{"record":{"id":"ed47791cce6f5db8","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-xai-oauth-file-exceeds-the-b","errorCode":null,"errorMessage":"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit","messagePattern":"Codewhale-owned xAI OAuth file (.+?) exceeds the (.+?) byte limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/config/src/xai_credentials.rs","lineNumber":230,"sourceCode":"\n    #[must_use]\n    pub fn directory(&self) -> &Path {\n        &self.directory\n    }\n\n    pub fn path_for(&self, name: &str) -> Result<PathBuf> {\n        validate_owned_auth_name(name)?;\n        Ok(self.directory.join(name))\n    }\n\n    pub fn read_to_string(&self, name: &str) -> Result<Option<String>> {\n        validate_owned_auth_name(name)?;\n        let Some(mut file) = self.open_owned_file_for_read(name)? else {\n            return Ok(None);\n        };\n        let metadata = validate_owned_file_handle(&file, &self.directory.join(name))?;\n        if metadata.len() > XAI_OAUTH_FILE_LIMIT {\n            bail!(\n                \"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit\",\n                crate::quote_os_path(&self.directory.join(name)),\n                XAI_OAUTH_FILE_LIMIT\n            );\n        }\n        let mut bytes = Vec::with_capacity(metadata.len() as usize);\n        (&mut file)\n            .take(XAI_OAUTH_FILE_LIMIT + 1)\n            .read_to_end(&mut bytes)\n            .with_context(|| {\n                format!(\n                    \"reading Codewhale-owned xAI OAuth file {}\",\n                    crate::quote_os_path(&self.directory.join(name))\n                )\n            })?;\n        if bytes.len() as u64 > XAI_OAUTH_FILE_LIMIT {\n            bail!(\n                \"Codewhale-owned xAI OAuth file {} exceeds the {} byte limit\",","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/config/src/xai_credentials.rs#L212-L248","documentation":"read_to_string reads a Codewhale-owned xAI OAuth file after stat-ing it; it enforces XAI_OAUTH_FILE_LIMIT so a huge or unexpected file is never read into memory. The pre-read size check bails when the file's metadata length exceeds the limit.","triggerScenarios":"Calling read_to_string on an owned auth file whose on-disk size (from file metadata) exceeds XAI_OAUTH_FILE_LIMIT.","commonSituations":"Corrupted or attacker-planted credential file; a user replaced the OAuth JSON with a large blob; a log or backup file accidentally written under the credentials name.","solutions":["Inspect the file and remove or shrink it to a valid small OAuth JSON payload","Re-authenticate (logout/login) so Codewhale rewrites a fresh, valid credential file","Verify no other process is writing oversized data into the credentials directory"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"let md = std::fs::metadata(path)?;\nassert!(md.len() <= 64 * 1024, \"credential file suspiciously large: {}\", md.len());","typeGuard":null,"tryCatchPattern":"match store.read_to_string(name) {\n    Ok(Some(contents)) => { /* use contents */ }\n    Ok(None) => { /* not logged in */ }\n    Err(e) if e.to_string().contains(\"byte limit\") => {\n        // file is corrupt/oversized: force re-login\n        store.logout_cleanup()?;\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Treat credential files as library-owned; never write your own data there","Re-authenticate rather than hand-editing credential files","Watch the credentials dir for unexpected writers"],"tags":["file","validation","oauth"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}