jdx/mise · error

plaintext exceeds the size limit

Error message

plaintext exceeds the size limit

What it means

encrypt_bytes enforces MAX_PLAINTEXT_BYTES on the input before compressing. Plaintext larger than this limit is refused because the encrypted output (and any protocol framing) is designed around bounded payload sizes.

Solutions

  1. Split the data into chunks below MAX_PLAINTEXT_BYTES and encrypt each chunk
  2. Compress or trim the payload before encryption (large env dumps often contain redundant data)
  3. Store large data out-of-band and encrypt only a key/reference to it
  4. Check the caller for a bug that is accumulating plaintext without bound

Example fix

// before
let ct = encrypt_bytes(&entire_archive, &recipients)?; // too large
// after
for chunk in split_chunks(&entire_archive, MAX_PLAINTEXT_BYTES) {
    let ct = encrypt_bytes(chunk, &recipients)?;
    write_chunk(ct);
}
Defensive patterns

Strategy: validation

Validate before calling

// Rust (caller-side check)
const MAX_PLAINTEXT_BYTES: u64 = /* crate limit */;
anyhow::ensure!(plaintext.len() as u64 <= MAX_PLAINTEXT_BYTES, "payload too large to encrypt");

Type guard

fn within_plaintext_limit(plaintext: &[u8], max: u64) -> bool {
    (plaintext.len() as u64) <= max
}

Try / catch

match encrypt_bytes(&plaintext, &recipients) {
    Err(e) if e.to_string().contains("plaintext exceeds") => {
        eprintln!("split the payload or store it out-of-band");
    }
    other => other,
}

Prevention

When it happens

Trigger: Calling encrypt_bytes with plaintext.len() > MAX_PLAINTEXT_BYTES — e.g. encrypting a huge file, a large environment snapshot, or unbounded accumulated secrets buffers.

Common situations: Trying to encrypt a multi-gigabyte artifact, plugin protocol payloads that grew due to a bug, accidentally passing an entire directory archive instead of the intended small secret blob.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/d8650cc4cee01bd5. Report an issue: GitHub.

Appendix: source

Thrown at src/agecrypt.rs:157

    reader.take(limit + 1).read_to_end(&mut bytes)?;
    if bytes.len() as u64 > limit {
        return Err(std::io::Error::other(
            "encrypted content exceeds the size limit",
        ));
    }
    Ok(bytes)
}

/// zstd-compressed, then age-encrypted for `recipients`.
pub(crate) fn encrypt_bytes(
    plaintext: &[u8],
    recipients: &[Box<dyn Recipient + Send>],
) -> Result<Vec<u8>> {
    if recipients.is_empty() {
        bail!("no age recipients to encrypt for");
    }
    if plaintext.len() as u64 > MAX_PLAINTEXT_BYTES {
        bail!("plaintext exceeds the size limit");
    }
    let compressed = zstd::encode_all(plaintext, ZSTD_COMPRESSION_LEVEL)?;
    if compressed.len() as u64 > MAX_ENCRYPTED_BYTES {
        bail!("compressed payload exceeds the size limit");
    }
    let encryptor =
        Encryptor::with_recipients(recipients.iter().map(|r| r.as_ref() as &dyn Recipient))
            .map_err(|e| eyre!("creating the age encryptor: {e}"))?;
    let mut out = Vec::new();
    let mut writer = encryptor.wrap_output(&mut out)?;
    writer.write_all(&compressed)?;
    writer.finish()?;
    if out.len() as u64 > MAX_ENCRYPTED_BYTES {
        bail!("encrypted payload exceeds the size limit");
    }
    Ok(out)
}

View on GitHub (pinned to 533346cc37)