DependencyTrack / DependencyTrack/dependency-track

Missing length validation for text input leading to internal server error

Open
#4,432 3 comments 1 reaction 0 assignees View on GitHub
defect p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When creating or updating project attributes like the description with input too long for the DB fields, an internal server error (HTTP status 500) occurs and the user is not informed about what went wrong.

### Steps to Reproduce

1. Go to {Your-DT-URL}/projects
2. Click on "+ Create Project"
3. As description type more than 255 characters, e.g. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
4. Fill out the remaing mandatory fields
5. Get HTTP status 500

### Expected Behavior

1. Input fields should have the correct `maxlength` HTML attribute, preventing the user from typing too much text that can't be saved.
2. The backend should validate the length of input before processing it to prevent internal server errors.
3. The user should get informed if he provided unvalid input so that he can change it accordingly.

### Dependency-Track Version

4.12.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

14.7

### Browser

Microsoft Edge

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.