Validate comment length in vulnerability state transition mutations

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Problem

Vulnerabilities::StateTransition limits comment to 50,000 characters (validates :comment, length: { maximum: 50_000 }). Several GraphQL mutations document this limit on their comment argument but don't enforce it.

A longer comment reaches Vulnerabilities::StateTransition.create!, which raises ActiveRecord::RecordInvalid. Nothing rescues it, so the user gets a generic "Internal server error" instead of a useful GraphQL error.

The error is raised in:

  • Vulnerabilities::CreateService#create_state_transition_if_needed (new vulnerability)
  • Vulnerabilities::BaseStateTransitionService#execute (existing vulnerability)

Affected mutations

  • securityFindingConfirm and securityFindingResolve (added in !253678 (merged))
  • securityFindingDismiss
  • securityFindingRevertToDetected: also add "(maximum 50,000 characters)" to the comment description.
  • vulnerabilityConfirm, vulnerabilityResolve, vulnerabilityDismiss, vulnerabilityRevertToDetected (shared VulnerabilityStateTransitions concern)
  • vulnerabilitiesDismiss (bulk dismiss): documents the limit but doesn't enforce it. It uses StateTransition.insert_all!, which skips model validations, so an oversized comment only fails at the DB check constraint (char_length(comment) <= 50000).
  • Possibly other mutations that pass a comment to a state transition. Check during implementation.

Proposal

Add validates: { length: { maximum: 50_000 } } to the comment arguments, like app/graphql/mutations/achievements/award.rb does. This rejects the request before anything is written.

This is better than rescuing RecordInvalid in the services. A rescue would run after CreateService may already have saved the vulnerability.

Add a spec per mutation for a comment over 50,000 characters.

Changing the securityFindingRevertToDetected description changes the GraphQL docs, so regenerate doc/api/graphql/reference/_index.md.

References

Edited by 🤖 GitLab Bot 🤖