{"record":{"id":"e95813c79691b14d","repo":"iflytek/astron-agent","slug":"credential-file-is-too-large","errorCode":null,"errorMessage":"credential file is too large","messagePattern":"credential file is too large","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/tenant/config/bootstrap_credentials.go","lineNumber":123,"sourceCode":"\nfunc readCredentialFile(fileName string) (string, error) {\n\tfile, err := openCredentialFileNoFollow(fileName)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tdefer func() {\n\t\t_ = file.Close()\n\t}()\n\n\topenedInfo, err := file.Stat()\n\tif err != nil {\n\t\treturn \"\", errors.New(\"credential file cannot be inspected\")\n\t}\n\tif !openedInfo.Mode().IsRegular() {\n\t\treturn \"\", errors.New(\"credential file must be a regular non-symbolic-link file\")\n\t}\n\tif openedInfo.Size() > maxCredentialFileBytes {\n\t\treturn \"\", errors.New(\"credential file is too large\")\n\t}\n\n\tdata, err := io.ReadAll(io.LimitReader(file, maxCredentialFileBytes+1))\n\tif err != nil {\n\t\treturn \"\", errors.New(\"credential file cannot be read\")\n\t}\n\tif len(data) > maxCredentialFileBytes {\n\t\treturn \"\", errors.New(\"credential file is too large\")\n\t}\n\treturn strings.TrimSpace(string(data)), nil\n}\n\nfunc validateCredential(name, value string) error {\n\tlength := utf8.RuneCountInString(value)\n\tif !utf8.ValidString(value) || length < tenantCredentialMinLength || length > tenantCredentialMaxLength {\n\t\treturn fmt.Errorf(\"%s must contain 32-50 valid UTF-8 characters\", name)\n\t}\n\tfor _, character := range value {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/config/bootstrap_credentials.go#L105-L141","documentation":"Credential files may be at most maxCredentialFileBytes bytes. readCredentialFile checks Stat().Size() before reading and rejects oversized files, bounding memory use and defending against a maliciously huge file mounted at the credential path.","triggerScenarios":"credentialFromEnvironmentOrFile opens a *_FILE credential path whose size on disk exceeds maxCredentialFileBytes, so the pre-read size check fails.","commonSituations":"Operator pasted a multi-line certificate bundle or notes into the credential file instead of just the secret value, or accidentally mounted a large data file at the credential path.","solutions":["Trim the credential file to contain only the secret value (single line, within maxCredentialFileBytes)","Check the file size with `wc -c <path>` and compare against the limit","If the credential genuinely needs more bytes, verify the platform limit and use a shorter generated secret"],"exampleFix":"# before\n/creds/TENANT_KEY = 40-line annotated notes (12 KB)\n# after\nprintf '%s' \"$TENANT_KEY_VALUE\" > /creds/TENANT_KEY  # single short secret","handlingStrategy":"validation","validationCode":"info, err := os.Stat(path)\nif err != nil {\n    return err\n}\nif info.Size() > config.MaxCredentialFileBytes {\n    return fmt.Errorf(\"%s is %d bytes, limit is %d\", path, info.Size(), config.MaxCredentialFileBytes)\n}","typeGuard":null,"tryCatchPattern":"if _, err := config.LoadTenantBootstrapCredentials(ctx); err != nil {\n    if strings.Contains(err.Error(), \"too large\") {\n        logger.Fatal(\"credential file exceeds size limit; store only the secret value\")\n    }\n    return err\n}","preventionTips":["Credential files must contain only the secret value, one line","Check sizes with `wc -c` before deploying mounts","Never paste cert bundles or notes into credential files"],"tags":["filesystem","credentials","validation"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}