Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify: There is a 500kb max size for SBOM #85

Open
patriksvensson opened this issue Jul 31, 2022 · 2 comments
Open

Verify: There is a 500kb max size for SBOM #85

patriksvensson opened this issue Jul 31, 2022 · 2 comments

Comments

@patriksvensson
Copy link

It seems like all SBOMs over 500kb cannot be verified.

@zdtsw
Copy link
Contributor

zdtsw commented Jul 31, 2022

isn't that because the limitation of upload file size?
OpenReadStream enforces a maximum size in bytes of its Stream.Reading one file or multiple files larger than 512,000 bytes (500 KB) results in an exception. This limit prevents developers from accidentally reading large files into memory. The maxAllowedSize parameter ofOpenReadStream can be used to specify a larger size if required up to a maximum supported size of 2 GB (2,147,483,648 bytes).

which looks like apply to all three actions: validate, merge and convert
https://github.com/CycloneDX/cyclonedx-web-tool/blob/master/src/CycloneDX.WebTool/Pages/Convert.razor#L92
https://github.com/CycloneDX/cyclonedx-web-tool/blob/master/src/CycloneDX.WebTool/Pages/Merge.razor#L93
https://github.com/CycloneDX/cyclonedx-web-tool/blob/master/src/CycloneDX.WebTool/Pages/Validate.razor#L77

@coderpatros
Copy link
Member

I've increased the limit to 100Mb. I should probably make this configurable or just use the maximum allowed size. The file handling is all done client side. So you can only DOS yourself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants