Aias00 opened a new issue, #6441:
URL: https://github.com/apache/shenyu/issues/6441
### Current Behavior
The config import unzip path enforces entry-count and size limits, but
throws `IllegalArgumentException` when those limits are exceeded:
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java:110`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java:121`
- `shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java:124`
```java
throw new IllegalArgumentException("entry count exceeds maximum of " +
maxEntryCount);
throw new IllegalArgumentException("entry size exceeds maximum allowed
value.");
throw new IllegalArgumentException("total size exceeds maximum allowed
value.");
```
The controller path only catches `IOException`:
-
`shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/ConfigsServiceImpl.java:409`
-
`shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java:137`
-
`shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/ConfigsExportImportController.java:144`
As a result, an oversized or over-entry ZIP submitted to `POST
/configs/import` can escape as an uncaught runtime exception and return HTTP
500, even though this is expected invalid user input.
### Expected Behavior
Config import limit violations should return a controlled admin error
response, ideally 400-style validation failure, without logging/returning an
internal server error.
### Steps To Reproduce
1. Configure or use the default config import size/count limits.
2. POST `/configs/import` with a ZIP that exceeds `maxEntryCount`,
`maxEntrySize`, or `maxTotalSize`.
3. `ZipUtil.unzip()` throws `IllegalArgumentException`; the controller does
not catch it because it only catches `IOException`.
### Suggested Fix
Either make `ZipUtil.unzip()` throw a checked/handled exception for
validation failures, or catch `IllegalArgumentException` in the
service/controller path and map it to a normal `ShenyuAdminResult.error(...)`
response.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
