iflytek/astron-agent · error · RemoteResourcePolicyError

Remote resource size limit is invalid

Error message

Remote resource size limit is invalid

What it means

fetch_public_resource() validates its max_bytes download budget before connecting: if max_bytes <= 0 the download policy is considered invalid and RemoteResourcePolicyError is raised immediately. It protects SSRF-hardened downloads from unbounded or nonsensical size limits.

Solutions

1. Pass a positive max_bytes (e.g. DEFAULT_MAX_DOWNLOAD_BYTES)
2. Validate the size-limit config value at load time (must be > 0)
3. Fall back to the default when the configured limit is missing or invalid

Example fix

// before
await fetch_public_resource(url, max_bytes=int(os.getenv("MAX_DL", "")))  # '' -> ValueError/0
// after
max_bytes = int(os.getenv("MAX_DL") or DEFAULT_MAX_DOWNLOAD_BYTES)
if max_bytes <= 0: max_bytes = DEFAULT_MAX_DOWNLOAD_BYTES
await fetch_public_resource(url, max_bytes=max_bytes)

if not isinstance(max_bytes, int) or max_bytes <= 0:
    max_bytes = DEFAULT_MAX_DOWNLOAD_BYTES

def valid_download_limit(v) -> bool: return isinstance(v, int) and not isinstance(v, bool) and v > 0

try:
    data = await fetch_public_resource(url, max_bytes=limit)
except RemoteResourcePolicyError:
    data = await fetch_public_resource(url)  # fall back to default limit

When it happens

Trigger: Calling fetch_public_resource(url, max_bytes=0), a negative value, or a max_bytes computed from an unvalidated config that yields <= 0.

Common situations: Config parsing returning 0 for an unset limit, integer parsing of an empty string, or a caller dividing the default limit incorrectly.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• Only HTTP and HTTPS remote resources are allowed
• Path must stay inside the Skill workspace
• Remote resource URL must not include user information
• Resolved remote resource address is invalid
• Skill resource is unavailable

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/bca084a89a079ccf. Report an issue: GitHub.

Appendix: source

Thrown at core/plugin/aitools/common/clients/safe_download.py:90

            address,
            allow_private_storage=allow_private_storage,
        )
        return socket.socket(family=family, type=type_, proto=proto)

    return socket_factory


async def fetch_public_resource(
    url: str,
    span: Optional[SpanLike] = None,
    *,
    max_bytes: int = DEFAULT_MAX_DOWNLOAD_BYTES,
) -> bytes:
    """Download a public or exact trusted-storage resource with SSRF checks."""
    hostname = "invalid"
    try:
        if max_bytes <= 0:
            raise RemoteResourcePolicyError("Remote resource size limit is invalid")
        parsed, _ = _validate_resource_url(url)
        hostname = _normalize_hostname(parsed.hostname or "")
        connector = aiohttp.TCPConnector(
            use_dns_cache=False,
            socket_factory=create_public_socket_factory(url),
        )
        timeout = aiohttp.ClientTimeout(
            total=_positive_float_setting(AIOHTTP_CLIENT_TOTAL_TIMEOUT_KEY, 300.0),
            connect=_positive_float_setting(AIOHTTP_CLIENT_CONNECT_TIMEOUT_KEY, 10.0),
            sock_read=_positive_float_setting(AIOHTTP_CLIENT_READ_TIMEOUT_KEY, 60.0),
        )
        return await _download_resource(url, connector, timeout, max_bytes)
    except RemoteResourcePolicyError as exc:
        log.warning(
            "Remote resource download rejected, host={}, reason={}", hostname, exc
        )
        if span is not None:
            span.add_error_event("Remote resource download rejected")

View on GitHub (pinned to 5e758547a8)