{"record":{"id":"dd66d846ae0904d4","repo":"Hmbown/CodeWhale","slug":"remote-bundle-exceeds-the-max-bundle-bytes-byte-limit","errorCode":null,"errorMessage":"remote bundle exceeds the {MAX_BUNDLE_BYTES} byte limit; refused","messagePattern":"remote bundle exceeds the (.+?) byte limit; refused","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/config_bundles.rs","lineNumber":809,"sourceCode":"        redirects += 1;\n    };\n\n    if !response.status().is_success() {\n        bail!(\n            \"bundle fetch failed with HTTP status {}\",\n            response.status().as_u16()\n        );\n    }\n\n    // Read at most MAX_BUNDLE_BYTES + 1 so an oversize body is detected\n    // rather than silently truncated.\n    let mut buffer = Vec::new();\n    let body = response;\n    body.take(MAX_BUNDLE_BYTES + 1)\n        .read_to_end(&mut buffer)\n        .map_err(|_| anyhow!(\"reading remote bundle failed\"))?;\n    if buffer.len() as u64 > MAX_BUNDLE_BYTES {\n        bail!(\"remote bundle exceeds the {MAX_BUNDLE_BYTES} byte limit; refused\");\n    }\n    Ok(buffer)\n}\n\nfn validate_bundle_url(url: &reqwest::Url) -> Result<()> {\n    if !matches!(url.scheme(), \"http\" | \"https\") {\n        bail!(\"unsupported bundle URL scheme; use https\");\n    }\n    if !url.username().is_empty() || url.password().is_some() {\n        bail!(\"bundle URLs may not include credentials\");\n    }\n    let host = url.host_str().context(\"bundle URL must include a host\")?;\n    match url.scheme() {\n        \"https\" => Ok(()),\n        \"http\" if is_loopback_bundle_host(host) => Ok(()),\n        \"http\" => bail!(\"plain http is only allowed for loopback hosts; use https\"),\n        _ => unreachable!(\"scheme was validated above\"),\n    }","sourceCodeStart":791,"sourceCodeEnd":827,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/cli/src/config_bundles.rs#L791-L827","documentation":"The remote bundle body is larger than `MAX_BUNDLE_BYTES`, so `fetch_bundle` refuses it. The body is read with `take(MAX_BUNDLE_BYTES + 1)` so an oversize download is detected after one extra byte instead of exhausting memory. This caps the cost of fetching untrusted URLs.","triggerScenarios":"Importing a bundle from a URL whose response body exceeds the configured byte limit (one byte past the limit is enough to trigger).","commonSituations":"Pointing the import at the wrong URL (a large archive or a page, not a bundle); a compromised or hostile mirror serving an enormous body; exporting very large configs that outgrew the limit.","solutions":["Verify the URL actually serves the intended (small) bundle file.","If the bundle is legitimately large, reduce its contents or export/import it locally as a file instead of over HTTP.","Serve the bundle from a source whose response is within the limit; trim attachments from the bundle export."],"exampleFix":"// before: URL returns a 200 MB archive\ncodewhale config bundle import https://example.com/huge-archive.zip\n// after: use the trimmed bundle endpoint or local file\ncodewhale config bundle import https://example.com/bundles/config-small.zip","handlingStrategy":"validation","validationCode":"let resp = reqwest::get(url)?;\nif let Some(len) = resp.content_length() {\n    if len as u64 > MAX_BUNDLE_BYTES {\n        return Err(format!(\"remote bundle is {len} bytes; over the {MAX_BUNDLE_BYTES} limit\"));\n    }\n}","typeGuard":"fn declares_acceptable_size(resp: &reqwest::Response, max: u64) -> bool {\n    resp.content_length().map_or(true, |l| l as u64 <= max)\n}","tryCatchPattern":"match fetch_bundle(url) {\n    Err(e) if e.to_string().contains(\"byte limit\") => {\n        eprintln!(\"remote bundle too large; fetch the trimmed bundle or import from a local file\");\n    }\n    Err(e) => return Err(e),\n    Ok(bytes) => apply(bytes),\n}","preventionTips":["Check Content-Length of the bundle URL before importing in scripts.","Keep exported bundles small; strip bulky sections before publishing.","Serve bundles from dedicated endpoints, not generic file servers, so the URL is unambiguous."],"tags":["bundle-fetch","size-limit","http"],"backgroundTag":"payload-too-large","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-22T21:17:16.096Z"}