DependencyTrack / DependencyTrack/dependency-track

Recognize NuGet `unlisted` packages and do not log 'error parsing upload time for NuGet component'

Open
#2,388 0 comments 6 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Using Dependency Track 4.7.0, warnings similar to those below are regularly observed in the logs:

```
2023-01-13 19:12:06,807 INFO [RepositoryMetaAnalyzerTask] Performing component repository metadata analysis against 58 components in project: 9731f6d0-12f0-4625-a688-fd8d0be204ea
2023-01-13 19:12:09,046 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00
2023-01-13 19:12:09,046 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00
2023-01-13 19:12:10,152 WARN [NugetMetaAnalyzer] An error occurred while parsing upload time for a NuGet component - Repo returned: 1900-01-01T00:00:00+00:00
```

This was reported in https://github.com/DependencyTrack/dependency-track/issues/537 but closed as an assumed defect with NuGet metadata.

The official NuGet docs describe at least one valid use case for the `1900-01-01` timestamp: unlisted packages, which are de-facto deprecated and should no longer be used.

One concrete example to illustrate this: https://www.nuget.org/packages/Unity/5.7.4 -- note the warning:

> The owner has unlisted this package. This could mean that the package is deprecated, has security vulnerabilities or shouldn't be used anymore.

Use the NuGet API to retrieve the package registration details (https://api.nuget.org/v3/registration5-semver1/unity/5.7.4.json) and note the `listed: false` and `published: "1900-01-01T00:00:00+00:00"` values in the response:

```json
{
"@id": "https://api.nuget.org/v3/registration5-semver1/unity/5.7.4.json",
"@type": [
"Package",
"http://schema.nuget.org/catalog#Permalink"
],
"catalogEntry": "https://api.nuget.org/v3/catalog0/data/2018.10.15.06.25.35/unity.5.7.4.json",
"listed": false,
"packageContent": "https://api.nuget.org/v3-flatcontainer/unity/5.7.4/unity.5.7.4.nupkg",
"published": "1900-01-01T00:00:00+00:00",
"registration": "https://api.nuget.org/v3/registration5-semver1/unity/index.json",
"@context": { /* elided for brevity */ }
}
```

The NuGet docs at https://learn.microsoft.com/en-us/nuget/api/registration-base-url-resource include an explicit note for this behavior:

> Note
>
> **On nuget.org, the published value is set to year 1900 when the package is unlisted.**

However, Dependency Track does not currently recognize this value and logs a warning.

### Proposed Behavior

Update `NugetMetaAnalyzer` to accept a NuGet API `published` value of `1900-01-01T00:00:00+00:00` as valid, and meant to represent *unlisted packages* whose use is discouraged.

https://github.com/DependencyTrack/dependency-track/blob/90437bdfee153ed6082e5dfc344a0bb7b5d2e515/src/main/java/org/dependencytrack/tasks/repositories/NugetMetaAnalyzer.java#L49-L52

Additionally, consider enhancing Dependency Track to flag use of unlisted NuGet packages with warnings, e.g. in its APIs or frontend UI.

It may be helpful to see in the UI, similar to the warning icons for packages which have a newer version available, that the package is unlisted / deprecated and should no longer be used.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.