DependencyTrack / DependencyTrack/dependency-track

Conflicting success message with backend SBOM failure

Open
#1,421 3 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
When uploading a CycloneDX formatted SBOM with services ([used this example](https://github.com/CycloneDX/bom-examples/blob/master/SaaSBOM/apigateway-microservices-datastores/bom.json)), the DependencyTrack client is signaling a successful BOM upload. However, the debug terminal is process an error and then no actual BOM data is uploaded to the project.

### Steps to Reproduce:
- Use the SBOM linked above and load it to a new project
- You should see the client success message, like so:
![image](https://user-images.githubusercontent.com/96793624/156011893-15c829cc-37d9-47c1-bcd2-76e0901a5211.png)
- You should then also see a processing error like so:
![image](https://user-images.githubusercontent.com/96793624/156011988-e3e233a9-59dd-4a74-8793-332ed91c3178.png)

### Expected Behavior:
- If the BOM is actually failing on the back end, then the client side message shouldn't say the BOM was loaded successfully. The error should extend to the client side so the user knows there is an error and not to expect their data to load appropriately.

### Environment:

- Dependency-Track Version: 4.4.1 (frontend 4.4.0)
- Distribution: Docker
- BOM Format & Version: JSON 1.3 (see link above)
- Database Server: PostgreSQL
- Browser: Chrome

### Additional Details:
dtrack-apiserver_1 | 2022-02-28 15:38:28,728 INFO [BomUploadProcessingTask] Processing CycloneDX BOM uploaded to project: 7910308f-4591-418a-9883-465dbc02a671
dtrack-apiserver_1 | 2022-02-28 15:38:28,733 ERROR [BomUploadProcessingTask] Error while processing bom
dtrack-apiserver_1 | java.lang.NullPointerException: null
dtrack-apiserver_1 | at org.dependencytrack.parser.cyclonedx.util.ModelConverter.convertComponents(ModelConverter.java:75)
dtrack-apiserver_1 | at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:103)
dtrack-apiserver_1 | at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:99)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
dtrack-apiserver_1 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
dtrack-apiserver_1 | at java.base/java.lang.Thread.run(Unknown Source)

Contributor guide

Open the contributing guide

Research direction

Start with org.dependencytrack.parser.cyclonedx.util.ModelConverter.convertComponents at ModelConverter.java:75 and the upload flow in BomUploadProcessingTask.java:103. Reproduce the linked CycloneDX BOM, trace how the backend processing error is reported, and verify that a failed upload no longer produces a client-side success message.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.