changed request size limit for multi delete objects

Issue : CLDSRV-699

Author: SylvainSenechal

constants.js

@@ -89,6 +89,10 @@ const constants = {
     // Maximum HTTP headers size allowed
     maxHttpHeadersSize: 14122,
 
+    // AWS sets the maximum number of objects deleted to 1000 for multiDeleteObjects
+    // https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteObjects.html
+    maximumBatchDeleteObjects: 1000,
+
     // hex digest of sha256 hash of empty string:
     emptyStringHash: crypto.createHash('sha256')
         .update('', 'binary').digest('hex'),

lib/api/api.js

@@ -219,8 +219,14 @@ const api = {
                 }
                 // issue 100 Continue to the client
                 writeContinue(request, response);
-                const MAX_POST_LENGTH = request.method === 'POST' ?
-                      1024 * 1024 : 1024 * 1024 / 2; // 1 MB or 512 KB
+                const postLengthLimits = {
+                    // Multi-Object Delete can be large : up to 1000 keys of 1024 bytes is
+                    // already 1mb, with the other fields it could reach 2mb
+                    'multiObjectDelete': 2 * 1024 * 1024,
+                };
+                const defaultMaxPostLength = request.method === 'POST' ?
+                      1024 * 1024 : 512 * 1024; // 1 MB or 512 KB
+                const MAX_POST_LENGTH = postLengthLimits[apiMethod] || defaultMaxPostLength;
                 const post = [];
                 let postLength = 0;
                 request.on('data', chunk => {
@@ -242,7 +248,8 @@ const api = {
                     if (postLength > MAX_POST_LENGTH) {
                         log.error('body length is too long for request type',
                                   { postLength });
-                        return next(errors.InvalidRequest);
+                        return next(errors.InvalidRequest.customizeDescription(
+                            `Maximum body length is ${MAX_POST_LENGTH} bytes, but received ${postLength}.`));
                     }
                     // Convert array of post buffers into one string
                     request.post = Buffer.concat(post, postLength).toString();

lib/api/multiObjectDelete.js

@@ -19,6 +19,7 @@ const createAndStoreObject = require('./apiUtils/object/createAndStoreObject');
 const monitoring = require('../utilities/monitoringHandler');
 const metadataUtils = require('../metadata/metadataUtils');
 const { config } = require('../Config');
+const constants = require('../../constants');
 const { isRequesterNonAccountUser } = require('./apiUtils/authorization/permissionChecks');
 const { hasGovernanceBypassHeader, checkUserGovernanceBypass, ObjectLockInfo }
     = require('./apiUtils/object/objectLockHelpers');
@@ -492,8 +493,11 @@ function multiObjectDelete(authInfo, request, log, callback) {
         function parseXML(next) {
             return _parseXml(request.post,
                 (err, quietSetting, objects) => {
-                    if (err || objects.length < 1 || objects.length > 1000) {
-                        return next(errors.MalformedXML);
+                    if (err || objects.length < 1 || objects.length > constants.maximumBatchDeleteObjects) {
+                        return next(errors.MalformedXML.customizeDescription(
+                            `The provided request tries to delete ${objects.length} objects, ` +
+                            `but AWS standard only allows ${constants.maximumBatchDeleteObjects} deletions per call. `
+                        ));
                     }
                     return next(null, quietSetting, objects);
                 });