Incidents with large attachments fail to display match highlights in Enforce

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

When attempting to view incidents that have large attachments (hundreds of MB or above 1 GB), the incident is rendered in the Enforce console without the match highlights. You will see the following text colored in red instead of the match highlights:

There was an error highlighting the violating text for this incident. Check the Enforce logs for more details.

Another symptom of this problem is if you try to execute a GET /incidents/{id}/components/matches API call for the same incidents. Instead of the expected HTTP 200 (call successful) response, you will get a HTTP 500 response with the response message being:

Unexpected server error occurred. Please refer to log for details.

Environment

DLP 16.x

Cause

In the localhost logs, the below entries are present at the same timestamps as the attempts to open the affected incidents in the Enforce UI or to run the GET API call to retrieve the affected incident matches:

WARNING [com.symantec.dlp.incidentwebapi.IncidentApiRestErrorHandler] Handler dispatch failed; nested exception is java.lang.OutOfMemoryError: Requested array size exceeds VM limit|org.springframework.web.util.NestedServletException: Handler dispatch failed; nested exception is java.lang.OutOfMemoryError: Requested array size exceeds VM limit
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1087)
    at com.vontu.manager.spring.web.rbac.UseSubjectPermissionsDispatcherServlet.access$001(UseSubjectPermissionsDispatcherServlet.java:47)
    at com.vontu.manager.spring.web.rbac.UseSubjectPermissionsDispatcherServlet$1.run(UseSubjectPermissionsDispatcherServlet.java:90)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
    at com.vontu.manager.spring.web.rbac.UseSubjectPermissionsDispatcherServlet.doDispatch(UseSubjectPermissionsDispatcherServlet.java:85)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:965)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
(...)
Caused by: java.lang.OutOfMemoryError: Requested array size exceeds VM limit

Resolution

This was confirmed to be a defect in DLP. A permanent fix is scheduled for inclusion in DLP version 26.1.