DependencyTrack / DependencyTrack/dependency-track
Failed parsing of file should be flagged in the project
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When uploading a cyclonedx 1.5 format file, the file is seemingly received, but will silently fail in the background as it is parsed.
### Steps to Reproduce
1. Upgrade cdxgen to 9.1.1, which will create a cyclonedx 1.5 file
2. Upload file through /api/v1/bom . This returns 200 ok, just as the same configuration with cxdgen 8.6.1, which works, does
3. The file will be parsed asynchronously, and fail because the format is not supported.
4. The gui will stay stable, and the only hint that something is off is that the last uploaded field will not be updated
### Expected Behavior
when parsing of a file fails for whatever reason I would have expected
- a flag in the project gui saying that the last upload had problems, expanding to a description of the actual error if clicked. This is important because it will shorten the time the project team will spend trying to chase down something that doesn't work - or believing the old information in the gui, if the timestamp for the upload is not noticed.
- the ability to download the last uploaded sbom, to see whether an integration has mangled the file
- in the administration console, a log of asynchronous actions with an ok/error status, and the same information returned in the project gui. Parsing of the uploaded file is obviously an asynchronous operation. If it fails it would be good to see it somewhere else than the log.
### Dependency-Track Version
4.8.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
Mozilla Firefox
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.