DependencyTrack / DependencyTrack/dependency-track

Queue tokens for single component checks

Open
#1,543 4 comments 9 reactions 0 assignees View on GitHub
enhancement needs milestone p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
(1) PUT /v1/component/project/{uuid} method does not give you token to know if the component is being processed or not.
(2) GET /v1/vulnerability/component/{uuid} method returns code 200 + empty body for both cases:
a. component has no vulnerabilities
b. component is in the queue or being processed (and may have vulnerabilities when processing is finished)

### Proposed Behavior:
Either (1) should return token (similar to PUT /v1/bom) or (2) should return processing status in response body.

### Use case:
We would like to use Depedency Track for single component checks via API to implement our OSA Firewall functionality, but it is not possible now due to the lack of processing token. We cannot make sure that component has no vulnerabilities because it may be in the processing queue.

### Test:
To test this issue, try to upload some big SBOM like this https://github.com/CycloneDX/bom-examples/tree/master/SBOM/protonmail-webclient-v4-0912dff and send (1) and (2) queries immediately after that. Try (2) again later (in 30 seconds or so) and see that the response is different.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.