{"record":{"id":"e960adb7a0e2a4e6","repo":"theonedev/onedev","slug":"crate-archive-exceeds-maximum-size","errorCode":null,"errorMessage":"Crate archive exceeds maximum size: ","messagePattern":"Crate archive exceeds maximum size: ","errorType":"http","errorClass":"ClientException","httpStatus":406,"severity":"error","filePath":"server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java","lineNumber":322,"sourceCode":"\t\t\tdep.set(\"registry\", publishDep.path(\"registry\"));\n\t\t\tif (!explicitName.isMissingNode() && !explicitName.isNull())\n\t\t\t\tdep.put(\"package\", publishDep.path(\"name\").asText());\n\t\t\telse\n\t\t\t\tdep.putNull(\"package\");\n\t\t\tindexDeps.add(dep);\n\t\t}\n\t\treturn indexDeps;\n\t}\n\n\tprivate PublishBody readPublishBody(HttpServletRequest request) {\n\t\ttry (var is = request.getInputStream()) {\n\t\t\tvar metadataLength = readIntLE(is);\n\t\t\tif (metadataLength < 0 || metadataLength > MAX_METADATA_SIZE)\n\t\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package metadata exceeds maximum size: \" + MAX_METADATA_SIZE);\n\t\t\tvar metadata = readBytes(is, metadataLength);\n\t\t\tvar crateLength = readIntLE(is);\n\t\t\tif (crateLength < 0 || crateLength > MAX_CRATE_SIZE)\n\t\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Crate archive exceeds maximum size: \" + MAX_CRATE_SIZE);\n\t\t\tvar crateFile = readBytes(is, crateLength);\n\t\t\treturn new PublishBody(metadata, crateFile);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate int readIntLE(InputStream is) throws IOException {\n\t\tvar b1 = is.read();\n\t\tvar b2 = is.read();\n\t\tvar b3 = is.read();\n\t\tvar b4 = is.read();\n\t\tif ((b1 | b2 | b3 | b4) < 0)\n\t\t\tthrow new EOFException();\n\t\treturn b1 | b2 << 8 | b3 << 16 | b4 << 24;\n\t}\n\n\tprivate byte[] readBytes(InputStream is, int length) throws IOException {","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java#L304-L340","documentation":"Thrown by CargoPackHandler.readPublishBody when the crate archive (.crate) length read from the publish request body is negative or exceeds MAX_CRATE_SIZE. The server rejects the upload with HTTP 406 before buffering the archive. This prevents huge uploads from exhausting memory.","triggerScenarios":"`cargo publish` of a crate whose .crate tarball is larger than MAX_CRATE_SIZE, or a client sending a malformed length prefix so the read length is bogus.","commonSituations":"Crates bundling large assets in the package; accidental inclusion of build artifacts because `include`/`exclude` is not configured in Cargo.toml; reverse proxies with different body limits causing truncation.","solutions":["Shrink the crate: add exclude/include rules in Cargo.toml so assets aren't packaged","Raise MAX_CRATE_SIZE in CargoPackHandler if big crates are legitimate","Run `cargo package --list` to see what is being packaged and trim it","Verify no proxy is altering the request stream between cargo and the server"],"exampleFix":"// Cargo.toml\n// before\n[package]\n# no excludes\n// after\n[package]\nexclude = [\"assets/*\", \"tests/fixtures/*\"]","handlingStrategy":"validation","validationCode":"const size = require('fs').statSync('target/package/<crate>.crate').size;\nif (size > 512*1024*1024) throw new Error('crate too large for registry: ' + size);","typeGuard":null,"tryCatchPattern":"try { execSync('cargo publish'); } catch (e) { if (/Crate archive exceeds maximum size/.test(e.message)) { /* add excludes to Cargo.toml and retry */ } }","preventionTips":["Add exclude patterns for assets/tests in Cargo.toml","Run `cargo package --list` to audit contents","Check build artifacts aren't being packaged","Raise MAX_CRATE_SIZE only if legitimately needed"],"tags":["cargo","publish","payload-size","limit"],"backgroundTag":"payload-too-large","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}