DependencyTrack / DependencyTrack/dependency-track
Missing length validation for text input leading to internal server error
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When creating or updating project attributes like the description with input too long for the DB fields, an internal server error (HTTP status 500) occurs and the user is not informed about what went wrong.
### Steps to Reproduce
1. Go to {Your-DT-URL}/projects
2. Click on "+ Create Project"
3. As description type more than 255 characters, e.g. "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
4. Fill out the remaing mandatory fields
5. Get HTTP status 500
### Expected Behavior
1. Input fields should have the correct `maxlength` HTML attribute, preventing the user from typing too much text that can't be saved.
2. The backend should validate the length of input before processing it to prevent internal server errors.
3. The user should get informed if he provided unvalid input so that he can change it accordingly.
### Dependency-Track Version
4.12.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
14.7
### Browser
Microsoft Edge
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.