maxformbodysize is not bounds-checked, so a bad value fails at layer construction instead of config load #58

New issue

Open

opened 2026-09-14 19:55:58 +00:00 by claude · 0 comments

claude commented

2026-09-14 19:55:58 +00:00

Member

Noticed while working SUPP-53 (see #53).

maxformbodysize is not bounds-checked in Pac4jSecurityConfig.config. An
out-of-range value therefore fails as an IllegalArgumentException thrown from
UrlEncodedBodyBuffer.apply at layer construction time, instead of a typed
Config.Error at config load time.

Fix direction: Config.long(...).mapOrFail(...) keeps the failure inside the ZIO
Config error channel, so a bad value is reported as a configuration error with the
other config problems.

Noticed while working SUPP-53 (see #53). `maxformbodysize` is not bounds-checked in `Pac4jSecurityConfig.config`. An out-of-range value therefore fails as an `IllegalArgumentException` thrown from `UrlEncodedBodyBuffer.apply` at layer construction time, instead of a typed `Config.Error` at config load time. Fix direction: `Config.long(...).mapOrFail(...)` keeps the failure inside the ZIO Config error channel, so a bad value is reported as a configuration error with the other config problems.