DependencyTrack / DependencyTrack/dependency-track

publisher field length in DB causes a problem

Open
#1,763 2 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
DT stopped reading the bom because it couldn't put the publisher fieald value in the DB because of its length. as a consequence, DT stopped reading the bom and detected only 8 out of 275 components. it was also unable to detect vulnerabilities for the 8 components detected.

here is the component that caused the problem:
{
"type": "library",
"bom-ref": "pkg:nuget/Hangfire.PostgreSql@1.8.6",
"publisher": "Frank Hommers and others (Burhan Irmikci (barhun), Zachary Sims(zsims), kgamecarter, Stafford Williams (staff0rd), briangweber, Viktor Svyatokha (ahydrax), Christopher Dresel (Dresel), Vytautas Kasparavi\u010Dius (vytautask), Vincent Vrijburg, David Roth (davidroth).",
"name": "Hangfire.PostgreSql",
"version": "1.8.6",
"description": "PostgreSql storage implementation for Hangfire (background job system for ASP.NET and aspnet core applications).",
"scope": "required",
"hashes": [
{
"alg": "SHA-512",
"content": "5830F65FF7073A794CA1AEC26193CE6709FFD4340D6E2EDD77D3B4F1C8A96DD1799FCEDF101C4349C8D3016321ACE63DC2ED6ABA16559EDC0B937006C8DA0B02"
}
],
"licenses": [
{
"license": {
"url": "https://aka.ms/deprecateLicenseUrl"
}
}
],
"copyright": "Copyright \u00A9 2014-2021 Frank Hommers and others",
"purl": "pkg:nuget/Hangfire.PostgreSql@1.8.6",
"externalReferences": [
{
"url": "http://hmm.rs/Hangfire.PostgreSql",
"type": "website"
},
{
"url": "https://github.com/frankhommers/Hangfire.PostgreSql",
"type": "vcs"
}
]
},

### Steps to Reproduce:

produce and inject a bom for an application that uses the next component: pkg:nuget/Hangfire.PostgreSql@1.8.6

i was able to encounter this by reducind the publisher field value's length.

### Expected Behavior:
DT should try to populate the max of the field, not stop reading the BOM.

### Environment:

- Dependency-Track Version: 4.5.0
- Distribution: [ Docker | Executable WAR | Traditional WAR ] docker
- BOM Format & Version: CycloneDX 1.3
- Database Server: [ H2 | MSSQL | MySQL | PostgreSQL ] h2 & postgresql
- Browser: edge

### Additional Details:

(e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. stackoverflow, gitter, etc)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.