DependencyTrack / DependencyTrack/dependency-track

Error when listing project vulnerabilities

Open
#2,845 7 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When requesting vuulnerabilities for an existing project, server responds with a 500 status code.
Internal logging indicates a posisble DAL issue:
Please note that this does not occur for all projects,

API Call url:

`/v1/vulnerability/project/{uuid}`

Error message:
```
...
Caused by: org.datanucleus.exceptions.NucleusDataStoreException: Cannot get Object result for param = 2 for column "COMPONENT.AUTHOR" : The conversion from varchar to CLOB is unsupported.
...
````

Full log:
```
2023-06-22T08:41:36.712164252Z javax.jdo.JDOUserException: Exception thrown while loading remaining rows of query
2023-06-22T08:41:36.712171053Z at org.datanucleus.api.jdo.JDOAdapter.getUserExceptionForException(JDOAdapter.java:507)
2023-06-22T08:41:36.712185655Z at org.datanucleus.store.rdbms.query.ForwardQueryResult.closingConnection(ForwardQueryResult.java:304)
2023-06-22T08:41:36.712190856Z at org.datanucleus.store.query.AbstractQueryResult.disconnect(AbstractQueryResult.java:106)
2023-06-22T08:41:36.712195657Z at org.datanucleus.store.rdbms.query.AbstractRDBMSQueryResult.disconnect(AbstractRDBMSQueryResult.java:283)
2023-06-22T08:41:36.712200357Z at org.datanucleus.store.rdbms.query.JDOQLQuery$1.managedConnectionPreClose(JDOQLQuery.java:746)
2023-06-22T08:41:36.712205058Z at org.datanucleus.store.rdbms.ConnectionFactoryImpl$ManagedConnectionImpl.close(ConnectionFactoryImpl.java:527)
2023-06-22T08:41:36.712209658Z at org.datanucleus.store.connection.AbstractManagedConnection.release(AbstractManagedConnection.java:92)
2023-06-22T08:41:36.712214559Z at org.datanucleus.store.rdbms.ConnectionFactoryImpl$ManagedConnectionImpl.release(ConnectionFactoryImpl.java:366)
2023-06-22T08:41:36.712219460Z at org.datanucleus.store.rdbms.query.JDOQLQuery.performExecute(JDOQLQuery.java:821)
2023-06-22T08:41:36.712224160Z at org.datanucleus.store.query.Query.executeQuery(Query.java:2004)
2023-06-22T08:41:36.712228761Z at org.datanucleus.store.query.Query.executeWithArray(Query.java:1893)
2023-06-22T08:41:36.712233662Z at org.datanucleus.api.jdo.JDOQuery.executeInternal(JDOQuery.java:433)
2023-06-22T08:41:36.712239662Z at org.datanucleus.api.jdo.JDOQuery.execute(JDOQuery.java:276)
2023-06-22T08:41:36.712244463Z at org.dependencytrack.persistence.ComponentQueryManager.getAllComponents(ComponentQueryManager.java:130)
2023-06-22T08:41:36.712249164Z at org.dependencytrack.persistence.QueryManager.getAllComponents(QueryManager.java:877)
2023-06-22T08:41:36.712253764Z at org.dependencytrack.persistence.VulnerabilityQueryManager.getVulnerabilities(VulnerabilityQueryManager.java:426)
2023-06-22T08:41:36.712258465Z at org.dependencytrack.persistence.QueryManager.getVulnerabilities(QueryManager.java:957)
2023-06-22T08:41:36.712263065Z at org.dependencytrack.resources.v1.VulnerabilityResource.getVulnerabilitiesByProject(VulnerabilityResource.java:128)
2023-06-22T08:41:36.712267766Z at jdk.internal.reflect.GeneratedMethodAccessor798.invoke(Unknown Source)
2023-06-22T08:41:36.712272367Z at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
2023-06-22T08:41:36.712278267Z at java.base/java.lang.reflect.Method.invoke(Unknown Source)
2023-06-22T08:41:36.712282968Z at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
2023-06-22T08:41:36.712287769Z at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:134)
2023-06-22T08:41:36.712292469Z at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:177)
2023-06-22T08:41:36.712301270Z at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)
2023-06-22T08:41:36.712306371Z at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:81)
2023-06-22T08:41:36.712311072Z at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478)
2023-06-22T08:41:36.712315672Z at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400)
2023-06-22T08:41:36.712320273Z at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81)
2023-06-22T08:41:36.712324874Z at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:256)
2023-06-22T08:41:36.712329474Z at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
2023-06-22T08:41:36.712334075Z at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
2023-06-22T08:41:36.712338675Z at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
2023-06-22T08:41:36.712343476Z at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
2023-06-22T08:41:36.712347977Z at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
2023-06-22T08:41:36.712352477Z at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265)
2023-06-22T08:41:36.712357178Z at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:235)
2023-06-22T08:41:36.712361778Z at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:684)
2023-06-22T08:41:36.712366379Z at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:394)
2023-06-22T08:41:36.712371380Z at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:346)
2023-06-22T08:41:36.712375880Z at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:358)
2023-06-22T08:41:36.712380781Z at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:311)
2023-06-22T08:41:36.712385482Z at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
2023-06-22T08:41:36.712389982Z at org.eclipse.jetty.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1419)
2023-06-22T08:41:36.712394583Z at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)
2023-06-22T08:41:36.712399283Z at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)
2023-06-22T08:41:36.712403984Z at alpine.server.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:225)
2023-06-22T08:41:36.712408585Z at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
2023-06-22T08:41:36.713265697Z at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
2023-06-22T08:41:36.713283500Z at alpine.server.filters.ClickjackingFilter.doFilter(ClickjackingFilter.java:93)
2023-06-22T08:41:36.713295501Z at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
2023-06-22T08:41:36.713300602Z at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
2023-06-22T08:41:36.713305302Z at alpine.server.filters.WhitelistUrlFilter.doFilter(WhitelistUrlFilter.java:166)
2023-06-22T08:41:36.713310603Z at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:210)
2023-06-22T08:41:36.713315504Z at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
2023-06-22T08:41:36.713320104Z at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)
2023-06-22T08:41:36.713325005Z at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:131)
2023-06-22T08:41:36.713329606Z at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)
2023-06-22T08:41:36.713334206Z at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
2023-06-22T08:41:36.713338807Z at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:223)
2023-06-22T08:41:36.713343507Z at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1570)
2023-06-22T08:41:36.713348308Z at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
2023-06-22T08:41:36.713352909Z at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1385)
2023-06-22T08:41:36.713357609Z at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)
2023-06-22T08:41:36.713362310Z at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)
2023-06-22T08:41:36.713367011Z at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1543)
2023-06-22T08:41:36.713373111Z at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)
2023-06-22T08:41:36.713378012Z at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1307)
2023-06-22T08:41:36.713382713Z at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
2023-06-22T08:41:36.713387313Z at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
2023-06-22T08:41:36.713391914Z at org.eclipse.jetty.server.Server.handle(Server.java:563)
2023-06-22T08:41:36.713396614Z at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:505)
2023-06-22T08:41:36.713401215Z at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:762)
2023-06-22T08:41:36.713405816Z at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:497)
2023-06-22T08:41:36.713410416Z at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282)
2023-06-22T08:41:36.713415017Z at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
2023-06-22T08:41:36.713423818Z at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
2023-06-22T08:41:36.713428619Z at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
2023-06-22T08:41:36.713433519Z at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:416)
2023-06-22T08:41:36.713438320Z at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:385)
2023-06-22T08:41:36.713443221Z at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:272)
2023-06-22T08:41:36.713448021Z at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:140)
2023-06-22T08:41:36.713452722Z at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
2023-06-22T08:41:36.713457522Z at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:936)
2023-06-22T08:41:36.713462123Z at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1080)
2023-06-22T08:41:36.713466924Z at java.base/java.lang.Thread.run(Unknown Source)
2023-06-22T08:41:36.713471624Z Caused by: org.datanucleus.exceptions.NucleusDataStoreException: Cannot get Object result for param = 2 for column "COMPONENT.AUTHOR" : The conversion from varchar to CLOB is unsupported.
2023-06-22T08:41:36.714075304Z at org.datanucleus.store.rdbms.mapping.column.ClobColumnMapping.getObject(ClobColumnMapping.java:147)
2023-06-22T08:41:36.714086005Z at org.datanucleus.store.rdbms.mapping.column.ClobColumnMapping.getString(ClobColumnMapping.java:107)
2023-06-22T08:41:36.714091106Z at org.datanucleus.store.rdbms.mapping.java.SingleFieldMapping.getString(SingleFieldMapping.java:208)
2023-06-22T08:41:36.714095806Z at org.datanucleus.store.rdbms.fieldmanager.ResultSetGetter.fetchStringField(ResultSetGetter.java:133)
2023-06-22T08:41:36.714101007Z at org.datanucleus.state.StateManagerImpl.replacingStringField(StateManagerImpl.java:2030)
2023-06-22T08:41:36.714106008Z at org.dependencytrack.model.Component.dnReplaceField(Component.java)
2023-06-22T08:41:36.714111308Z at org.dependencytrack.model.Component.dnReplaceFields(Component.java)
2023-06-22T08:41:36.714116309Z at org.datanucleus.state.StateManagerImpl.replaceNonLoadedFields(StateManagerImpl.java:4393)
2023-06-22T08:41:36.714121410Z at org.datanucleus.store.rdbms.query.PersistentClassROF$1.fetchNonLoadedFields(PersistentClassROF.java:601)
2023-06-22T08:41:36.714126410Z at org.datanucleus.ExecutionContextImpl.findObject(ExecutionContextImpl.java:3106)
2023-06-22T08:41:36.714131311Z at org.datanucleus.store.rdbms.query.PersistentClassROF.findObjectWithIdAndLoadFields(PersistentClassROF.java:521)
2023-06-22T08:41:36.714136212Z at org.datanucleus.store.rdbms.query.PersistentClassROF.getObject(PersistentClassROF.java:425)
2023-06-22T08:41:36.714146913Z at org.datanucleus.store.rdbms.query.ForwardQueryResult.nextResultSetElement(ForwardQueryResult.java:181)
2023-06-22T08:41:36.714168916Z at org.datanucleus.store.rdbms.query.ForwardQueryResult$QueryResultIterator.next(ForwardQueryResult.java:410)
2023-06-22T08:41:36.714174017Z at org.datanucleus.store.rdbms.query.ForwardQueryResult.processNumberOfResults(ForwardQueryResult.java:137)
2023-06-22T08:41:36.714179017Z at org.datanucleus.store.rdbms.query.ForwardQueryResult.advanceToEndOfResultSet(ForwardQueryResult.java:165)
2023-06-22T08:41:36.714184318Z at org.datanucleus.store.rdbms.query.ForwardQueryResult.closingConnection(ForwardQueryResult.java:292)
2023-06-22T08:41:36.714194019Z ... 84 common frames omitted
2023-06-22T08:41:36.714198920Z Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The conversion from varchar to CLOB is unsupported.
2023-06-22T08:41:36.714204021Z at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDriverError(SQLServerException.java:237)
2023-06-22T08:41:36.714208921Z at com.microsoft.sqlserver.jdbc.DataTypes.throwConversionError(DataTypes.java:1112)
2023-06-22T08:41:36.714214022Z at com.microsoft.sqlserver.jdbc.ServerDTVImpl.getValue(dtv.java:3706)
2023-06-22T08:41:36.714218923Z at com.microsoft.sqlserver.jdbc.DTV.getValue(dtv.java:247)
2023-06-22T08:41:36.714224623Z at com.microsoft.sqlserver.jdbc.Column.getValue(Column.java:190)
2023-06-22T08:41:36.714229724Z at com.microsoft.sqlserver.jdbc.SQLServerResultSet.getValue(SQLServerResultSet.java:2085)
2023-06-22T08:41:36.714234725Z at com.microsoft.sqlserver.jdbc.SQLServerResultSet.getValue(SQLServerResultSet.java:2071)
2023-06-22T08:41:36.714240125Z at com.microsoft.sqlserver.jdbc.SQLServerResultSet.getClob(SQLServerResultSet.java:2847)
2023-06-22T08:41:36.714245226Z at com.zaxxer.hikari.pool.HikariProxyResultSet.getClob(HikariProxyResultSet.java)
2023-06-22T08:41:36.714250127Z at org.datanucleus.store.rdbms.mapping.column.ClobColumnMapping.getObject(ClobColumnMapping.java:121)
2023-06-22T08:41:36.714255127Z ... 100 common frames omitted
```

When looking at the code, I see a generic call to obtain all components based on model Component.java. In the model the attribute 'Author' is annotated with the [RegexSequence > PRINTABLE_CHARS](https://github.com/stevespringett/Alpine/blob/master/alpine-common/src/main/java/alpine/common/validation/RegexSequence.java#L66) validation attribute, could this cause trouble? I do not understand the character classes yet, see also https://regex101.com/r/rPR9yM/1

The longest value in my database is 63 characters. Some have characters like `@`,`-`,`,`,`.`.

### Steps to Reproduce

1. Call url above.
As this appears to be a data/mappingproblems, I do not know the true cause yet.

### Expected Behavior

Returns list of vulnerabilites

### Dependency-Track Version

4.8.2

### Dependency-Track Distribution

Container Image

### Database Server

Microsoft SQL Server

### Database Server Version

12

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.