fix(gitlab): sanitize ANSI escape sequences from MR webhook author email/name

[billyvg]

Summary

Fixes a production DataError: value too long for type character varying(200) crash in the GitLab webhook handler.

• Sentry issue: https://sentry.sentry.io/issues/SENTRY-5RKP
• Triage session: https://claude.ai/code/session_01Ma5RaV2qEq4QrWH3gakKs5

Root Cause

A GitLab MR webhook arrived with ANSI terminal escape sequences appended to the commit author email field in the last_commit.author.email payload key — e.g. user@example.com followed by 34 cursor-left (\x1b[d) and 33 cursor-right (\x1b[c) sequences, totalling ~170 extra bytes and pushing the value well past 200 characters.

MergeEventWebhook.__call__ extracted this value verbatim and passed it directly to CommitAuthor.objects.get_or_create(email=<malformed_value>, ...). PostgreSQL's varchar(200) constraint on the sentry_commitauthor.email column rejected the insert with StringDataRightTruncation, which Django surfaced as DataError. The entire webhook request failed with a 500.

What was ruled out

• Widening the DB column: wrong direction — the column is already generous at 200 chars; accommodating injected garbage is not the answer.
• Catching DataError silently: hides the bug, allows future similar injections to fail undetected, and does not store the author at all so the PR record ends up without an author.
• Truncating blindly without stripping: ANSI sequences like \x1b[d consist of a non-printable ESC byte (\x1b) followed by printable ASCII characters ([d). Stripping only non-printable bytes would leave [d[d[d… in the stored email, which is still wrong data.

Fix

Add _sanitize_author_field() in src/sentry/integrations/gitlab/webhooks.py and apply it when extracting author email and name from MR and push webhook payloads, before they reach any model layer.

The sanitizer uses a two-pass regex approach:

1. Strip complete ANSI/VT100 CSI sequences (\x1b[<params><letter>) and two-character escape sequences — these contain printable ASCII characters that the second pass would not catch.
2. Strip any remaining non-printable ASCII characters (lone ESC bytes, other control characters, non-ASCII code points).
3. Truncate to the column's max_length as a belt-and-suspenders guard.

Test plan

• New regression test test_merge_event_author_email_with_ansi_sequences_is_sanitized in tests/sentry/integrations/gitlab/test_webhook.py — injects a production-style malformed email (valid address + 67 ANSI escape sequences, length > 200) into the webhook payload, posts it through the full webhook handler, and asserts that the CommitAuthor is created with the clean email and name.
• Existing GitLab webhook tests continue to pass.

---

Generated by Claude Code

[billyvg]

this just affects a single user it looks like, not high priority