Skip to content

Gemnasium-Maven dependency scanning fails on long log file entries

Gemnasium-maven-dependency_scanning with Gradle 8 can fail with this error:

[FATA] [gemnasium-maven] [2024-01-08T18:12:57Z] [/go/src/app/cmd/gemnasium-maven/main.go:64] ▶ bufio.Scanner: token too long

The root cause of error is here:
https://gitlab.com/gitlab-org/security-products/analyzers/gemnasium/-/blob/164d16fc7ec8770314bef874e460db30cb87ce7a/builder/exportpath/exportpath.go#L34-35

By default, bufio.NewScanner(reader) uses a buffer with the size 64 KB.
Dependency Scanning Analyzer runs Gradle and processes its output.
When it's processing line, which does not fit into the buffer, an error is returned.

Possible solution can be to use buffer with bigger size or not using bufio.Scanner.

Edited by Mathijs Rogiers