DependencyTrack / DependencyTrack/dependency-track
publisher field length in DB causes a problem
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior:
DT stopped reading the bom because it couldn't put the publisher fieald value in the DB because of its length. as a consequence, DT stopped reading the bom and detected only 8 out of 275 components. it was also unable to detect vulnerabilities for the 8 components detected.
here is the component that caused the problem:
{
"type": "library",
"bom-ref": "pkg:nuget/Hangfire.PostgreSql@1.8.6",
"publisher": "Frank Hommers and others (Burhan Irmikci (barhun), Zachary Sims(zsims), kgamecarter, Stafford Williams (staff0rd), briangweber, Viktor Svyatokha (ahydrax), Christopher Dresel (Dresel), Vytautas Kasparavi\u010Dius (vytautask), Vincent Vrijburg, David Roth (davidroth).",
"name": "Hangfire.PostgreSql",
"version": "1.8.6",
"description": "PostgreSql storage implementation for Hangfire (background job system for ASP.NET and aspnet core applications).",
"scope": "required",
"hashes": [
{
"alg": "SHA-512",
"content": "5830F65FF7073A794CA1AEC26193CE6709FFD4340D6E2EDD77D3B4F1C8A96DD1799FCEDF101C4349C8D3016321ACE63DC2ED6ABA16559EDC0B937006C8DA0B02"
}
],
"licenses": [
{
"license": {
"url": "https://aka.ms/deprecateLicenseUrl"
}
}
],
"copyright": "Copyright \u00A9 2014-2021 Frank Hommers and others",
"purl": "pkg:nuget/Hangfire.PostgreSql@1.8.6",
"externalReferences": [
{
"url": "http://hmm.rs/Hangfire.PostgreSql",
"type": "website"
},
{
"url": "https://github.com/frankhommers/Hangfire.PostgreSql",
"type": "vcs"
}
]
},
### Steps to Reproduce:
produce and inject a bom for an application that uses the next component: pkg:nuget/Hangfire.PostgreSql@1.8.6
i was able to encounter this by reducind the publisher field value's length.
### Expected Behavior:
DT should try to populate the max of the field, not stop reading the BOM.
### Environment:
- Dependency-Track Version: 4.5.0
- Distribution: [ Docker | Executable WAR | Traditional WAR ] docker
- BOM Format & Version: CycloneDX 1.3
- Database Server: [ H2 | MSSQL | MySQL | PostgreSQL ] h2 & postgresql
- Browser: edge
### Additional Details:
(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)
Contributor guide
Assessment
This issue has not been assessed yet.