Skip to content

Limit the size of the summary field in the Security report

Cameron Swords requested to merge truncate-summary into master

What does this MR do?

Truncates the vulnerabilities[].evidence.summary field to a maximum of 20,000 characters. If the summary is greater than this length, the first 20k characters remain and the text ...[truncated] is appended to the end.

This protects DAST and Rails against vulnerability findings that include large amounts of JavaScript.

What are the relevant issue numbers?

gitlab-org/gitlab#259394 (closed)

Related to gitlab-org/gitlab#326786 (closed) as the test introduced for that issue has very large summaries.

Does this MR meet the acceptance criteria?

Edited by Cameron Swords

Merge request reports