DependencyTrack / DependencyTrack/dependency-track

Can't import BOM that have license in evidence node

Open
#1,241 10 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

When creating reports using cyclonedx-gomod it puts licenses node inside evidence node causing Dependency-Track to fail parsing the BOM.

### Current Behavior:

Dependency-Tack fails to parse the BOM with the following error.

```
08:21:50.405 WARN [Persist] Insert of object "org.dependencytrack.model.Component@16f59b5a" using statement "INSERT INTO COMPONENT (AUTHOR,BLAKE2B_256,BLAKE2B_384,BLAKE2B_512,BLAKE3,CLASSIFIER,COPYRIGHT,CPE,DESCRIPTION,DIRECT_DEPENDENCIES,EXTENSION,FILENAME,"GROUP",INTERNAL,LAST_RISKSCORE,LICENSE,MD5,"NAME",TEXT,PARENT_COMPONENT_ID,PROJECT_ID,PUBLISHER,PURL,PURLCOORDINATES,LICENSE_ID,SHA1,SHA_256,SHA_384,SHA3_256,SHA3_384,SHA3_512,SHA_512,SWIDTAGID,UUID,VERSION) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : Cannot insert the value NULL into column 'NAME', table 'dtrack.dbo.COMPONENT'; column does not allow nulls. INSERT fails.
08:21:50.405 ERROR [BomUploadProcessingTask] Error while processing bom
javax.jdo.JDODataStoreException: Insert of object "org.dependencytrack.model.Component@16f59b5a" using statement "INSERT INTO COMPONENT (AUTHOR,BLAKE2B_256,BLAKE2B_384,BLAKE2B_512,BLAKE3,CLASSIFIER,COPYRIGHT,CPE,DESCRIPTION,DIRECT_DEPENDENCIES,EXTENSION,FILENAME,"GROUP",INTERNAL,LAST_RISKSCORE,LICENSE,MD5,"NAME",TEXT,PARENT_COMPONENT_ID,PROJECT_ID,PUBLISHER,PURL,PURLCOORDINATES,LICENSE_ID,SHA1,SHA_256,SHA_384,SHA3_256,SHA3_384,SHA3_512,SHA_512,SWIDTAGID,UUID,VERSION) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : Cannot insert the value NULL into column 'NAME', table 'dtrack.dbo.COMPONENT'; column does not allow nulls. INSERT fails.
at org.datanucleus.api.jdo.NucleusJDOHelper.getJDOExceptionForNucleusException(NucleusJDOHelper.java:542)
at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:720)
at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistent(JDOPersistenceManager.java:741)
at alpine.persistence.AbstractAlpineQueryManager.persist(AbstractAlpineQueryManager.java:398)
at org.dependencytrack.persistence.QueryManager.createComponent(QueryManager.java:781)
at org.dependencytrack.tasks.BomUploadProcessingTask.processComponent(BomUploadProcessingTask.java:170)
at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:124)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:99)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: Cannot insert the value NULL into column 'NAME', table 'dtrack.dbo.COMPONENT'; column does not allow nulls. INSERT fails.
at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:262)
at com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(SQLServerStatement.java:1632)
at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.doExecutePreparedStatement(SQLServerPreparedStatement.java:602)
at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement$PrepStmtExecCmd.doExecute(SQLServerPreparedStatement.java:524)
at com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:7375)
at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:3206)
at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(SQLServerStatement.java:247)
at com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(SQLServerStatement.java:222)
at com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.executeUpdate(SQLServerPreparedStatement.java:473)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.ParamLoggingPreparedStatement.executeUpdate(ParamLoggingPreparedStatement.java:393)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdate(SQLController.java:435)
at org.datanucleus.store.rdbms.request.InsertRequest.execute(InsertRequest.java:479)
at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObjectInTable(RDBMSPersistenceHandler.java:162)
at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObject(RDBMSPersistenceHandler.java:138)
at org.datanucleus.state.StateManagerImpl.internalMakePersistent(StateManagerImpl.java:4569)
at org.datanucleus.state.StateManagerImpl.makePersistent(StateManagerImpl.java:4546)
at org.datanucleus.ExecutionContextImpl.persistObjectInternal(ExecutionContextImpl.java:2026)
at org.datanucleus.ExecutionContextImpl.persistObjectWork(ExecutionContextImpl.java:1869)
at org.datanucleus.ExecutionContextImpl.persistObject(ExecutionContextImpl.java:1724)
at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:715)
... 9 common frames omitted
08:21:50.406 WARN [General] ExecutionContext closed with active transaction, so rolling back the active transaction
```

### Steps to Reproduce:

* Generate BOM.xml with [cyclonedx-gmod](https://github.com/CycloneDX/cyclonedx-gomod)
* Try to import it into Dependency-Track

### Expected Behavior:

CycloneDX spec seems to accept both places to have the license block, so it should parse the BOM without errors.

### Environment:

- Dependency-Track Version: 4.2.2
- Distribution: Docker
- BOM Format & Version: CycloneDX 1.3
- Database Server: MSSQL
- Browser: Microsoft Edge | 95.0.1020.30 (Official build) (64-bit)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.