fix undertow throwing away request with no message by ExtReMLapin · Pull Request #3568 · ArcadeData/arcadedb

ExtReMLapin · 2026-03-03T16:33:16Z

New error :

--- ERROR DEBUG INFO ---
Status Code: 413
Response Text: '{"error":"Request body too large","detail":"Request body size (221937363 bytes) exceeds the maximum allowed size of 104857600 bytes. Configure 'arcadedb.server.httpBodyContentMaxSize' to increase the limit."}'

gemini-code-assist · 2026-03-03T16:33:31Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the HTTP server's handling of large request bodies to provide a more robust and informative error experience. Previously, oversized requests might have been silently dropped or resulted in unclear errors from the underlying Undertow server. The changes introduce a custom handler that explicitly validates request body size and returns a standardized 413 Request Entity Too Large response with a helpful JSON message, improving client-side error diagnosis and server stability.

Highlights

Undertow Configuration Update: Modified the Undertow server configuration to set MAX_ENTITY_SIZE to Long.MAX_VALUE, preventing Undertow from rejecting oversized requests prematurely without a proper error message.
Custom Body Size Handler: Implemented a new createBodySizeLimitHandler to explicitly check the request content length against the configured SERVER_HTTP_BODY_CONTENT_MAX_SIZE.
Improved Error Handling: Ensured that requests exceeding the maximum allowed body size now receive a 413 Request Entity Too Large status code with a detailed JSON error message, providing clear feedback to the client.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

server/src/main/java/com/arcadedb/server/http/HttpServer.java
- Added necessary Undertow imports for HTTP handler and exchange utilities.
- Modified buildUndertowServer to configure Undertow's MAX_ENTITY_SIZE to Long.MAX_VALUE and integrate a new custom body size limit handler.
- Introduced createBodySizeLimitHandler method to check request content length and send a 413 status code with a JSON error message for oversized requests.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request aims to provide a more informative JSON error response for HTTP requests that exceed the configured maximum body size. However, the current implementation introduces a significant Denial of Service (DoS) risk by disabling Undertow's built-in MAX_ENTITY_SIZE protection and only validating the Content-Length header, which allows chunked requests to bypass the size limit entirely. To create a robust solution, it's recommended to leverage Undertow's built-in size limiting capabilities by setting MAX_ENTITY_SIZE to the actual limit, combined with a custom exception handler to catch RequestEntityTooLargeException and produce the desired JSON response. This will ensure all request types are handled safely and correctly.

gemini-code-assist · 2026-03-03T16:40:19Z

server/src/main/java/com/arcadedb/server/http/HttpServer.java

-        .setServerOption(UndertowOptions.MAX_ENTITY_SIZE, maxEntitySize)
+        // Set to Long.MAX_VALUE so Undertow does not reject oversized requests before routing;
+        // the actual limit is enforced in the handler chain to return a proper 413 with JSON body
+        .setServerOption(UndertowOptions.MAX_ENTITY_SIZE, Long.MAX_VALUE)


The application disables Undertow's built-in request body size limit by setting UndertowOptions.MAX_ENTITY_SIZE to Long.MAX_VALUE. This creates a Denial of Service vulnerability as chunked requests can bypass the custom Content-Length check, potentially leading to memory exhaustion. To properly enforce request size limits, UndertowOptions.MAX_ENTITY_SIZE must be set to the actual configured limit, allowing Undertow to throw a RequestEntityTooLargeException when the limit is exceeded.

Suggested change

.setServerOption(UndertowOptions.MAX_ENTITY_SIZE, Long.MAX_VALUE)

.setServerOption(UndertowOptions.MAX_ENTITY_SIZE, maxEntitySize)

gemini-code-assist · 2026-03-03T16:40:20Z

server/src/main/java/com/arcadedb/server/http/HttpServer.java

+      final long contentLength = exchange.getRequestContentLength();
+      if (contentLength > maxEntitySize) {


The createBodySizeLimitHandler only checks the Content-Length header, which is insufficient. For chunked requests, exchange.getRequestContentLength() returns -1, bypassing the limit check. This, combined with MAX_ENTITY_SIZE being set to Long.MAX_VALUE, creates a Denial of Service vulnerability, potentially leading to OutOfMemoryError from excessively large chunked requests. A more robust approach is to let Undertow enforce the limit by setting UndertowOptions.MAX_ENTITY_SIZE and then provide a custom handler for the RequestEntityTooLargeException to return the desired JSON error message. This will handle all cases correctly.

If I understand correctly, this is only to get a proper error message, right? I'm afraid that disabling Undertow protection could be dangerous. I wouldn't set the limit to Long.MAX_VALUE, maybe a more conservative approach is to set maxEntitySize+1 and check if it's > maxEntitySize. @robfrank WDYT?

issue with maxEntitySize+1 is that it's not going to fix the problem, when undertow "catches" it, it returns NOTHING, so setting it to maxEntitySize+1 will only trigger the error message when size == maxEntitySize and above throw nothing

mergify · 2026-03-03T16:55:40Z

🧪 CI Insights

Here's what we observed from your CI run for b8869e0.

🟢 All jobs passed!

But CI Insights is watching 👀

codecov · 2026-03-03T17:19:59Z

Codecov Report

❌ Patch coverage is 62.50000% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.51%. Comparing base (6dd0a35) to head (b8869e0).
⚠️ Report is 52 commits behind head on main.

Files with missing lines	Patch %	Lines
...main/java/com/arcadedb/server/http/HttpServer.java	53.84%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3568      +/-   ##
==========================================
+ Coverage   65.12%   65.51%   +0.39%     
==========================================
  Files        1506     1506              
  Lines      103053   103063      +10     
  Branches    21366    21368       +2     
==========================================
+ Hits        67109    67526     +417     
+ Misses      26751    26305     -446     
- Partials     9193     9232      +39

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ExtReMLapin · 2026-03-03T17:38:02Z

ContextConfiguration change fixes this issue :

java.lang.NumberFormatException: For input string: " -1"
        at java.base/java.lang.NumberFormatException.forInputString(NumberFormatException.java:67)
        at java.base/java.lang.Long.parseLong(Long.java:695)
        at java.base/java.lang.Long.parseLong(Long.java:832)
        at com.arcadedb.ContextConfiguration.getValueAsLong(ContextConfiguration.java:189)
        at com.arcadedb.server.http.HttpServer.lambda$createBodySizeLimitHandler$0(HttpServer.java:270)
        at io.undertow.server.protocol.http2.Http2UpgradeHandler.handleRequest(Http2UpgradeHandler.java:101)
        at io.undertow.server.handlers.HostHeaderHandler.handleRequest(HostHeaderHandler.java:277)
        at io.undertow.server.Connectors.executeRootHandler(Connectors.java:418)
        at io.undertow.server.protocol.http.HttpReadListener.handleEventWithNoRunningRequest(HttpReadListener.java:257)
        at io.undertow.server.protocol.http.HttpReadListener.handleEvent(HttpReadListener.java:137)
        at io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:162)
        at io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:100)
        at io.undertow.server.protocol.http.HttpOpenListener.handleEvent(HttpOpenListener.java:57)
        at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
        at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:291)
        at org.xnio.ChannelListeners$10.handleEvent(ChannelListeners.java:286)
        at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
        at org.xnio.nio.QueuedNioTcpServer2.acceptTask(QueuedNioTcpServer2.java:178)
        at org.xnio.nio.WorkerThread.safeRun(WorkerThread.java:624)
        at org.xnio.nio.WorkerThread.run(WorkerThread.java:491)

ExtReMLapin · 2026-03-04T07:20:32Z

Also , beside the empty message fix, it's a runtime fix for undertow because right now if you update the setting at runtime, it won't change anything

fix undertow throwing away request with no message

58f4fa2

gemini-code-assist bot reviewed Mar 3, 2026

View reviewed changes

CNE Pierre FICHEPOIL added 2 commits March 3, 2026 17:36

read runtime settings, instead of reading at boottime

4196ddb

add trim to read digits from config

b8869e0

lvca assigned robfrank Mar 3, 2026

lvca added the do not merge The PR is not ready label Mar 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix undertow throwing away request with no message#3568

fix undertow throwing away request with no message#3568
ExtReMLapin wants to merge 3 commits intoArcadeData:mainfrom
ExtReMLapin:fix_max_size_http_rest

ExtReMLapin commented Mar 3, 2026

Uh oh!

gemini-code-assist bot commented Mar 3, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Mar 3, 2026

Uh oh!

gemini-code-assist bot Mar 3, 2026

Uh oh!

lvca Mar 3, 2026

Uh oh!

ExtReMLapin Mar 3, 2026

Uh oh!

mergify bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

codecov bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

ExtReMLapin commented Mar 3, 2026

Uh oh!

ExtReMLapin commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	.setServerOption(UndertowOptions.MAX_ENTITY_SIZE, Long.MAX_VALUE)
	.setServerOption(UndertowOptions.MAX_ENTITY_SIZE, maxEntitySize)

		final long contentLength = exchange.getRequestContentLength();
		if (contentLength > maxEntitySize) {

Uh oh!

Conversation

ExtReMLapin commented Mar 3, 2026

Uh oh!

gemini-code-assist bot commented Mar 3, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

lvca Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

ExtReMLapin Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 CI Insights

🟢 All jobs passed!

Uh oh!

codecov bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ExtReMLapin commented Mar 3, 2026

Uh oh!

ExtReMLapin commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mergify bot commented Mar 3, 2026 •

edited

Loading

codecov bot commented Mar 3, 2026 •

edited

Loading