DependencyTrack / DependencyTrack/dependency-track

Failed parsing of file should be flagged in the project

Open
#2,890 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When uploading a cyclonedx 1.5 format file, the file is seemingly received, but will silently fail in the background as it is parsed.

### Steps to Reproduce

1. Upgrade cdxgen to 9.1.1, which will create a cyclonedx 1.5 file
2. Upload file through /api/v1/bom . This returns 200 ok, just as the same configuration with cxdgen 8.6.1, which works, does
3. The file will be parsed asynchronously, and fail because the format is not supported.
4. The gui will stay stable, and the only hint that something is off is that the last uploaded field will not be updated

### Expected Behavior

when parsing of a file fails for whatever reason I would have expected
- a flag in the project gui saying that the last upload had problems, expanding to a description of the actual error if clicked. This is important because it will shorten the time the project team will spend trying to chase down something that doesn't work - or believing the old information in the gui, if the timestamp for the upload is not noticed.
- the ability to download the last uploaded sbom, to see whether an integration has mangled the file
- in the administration console, a log of asynchronous actions with an ok/error status, and the same information returned in the project gui. Parsing of the uploaded file is obviously an asynchronous operation. If it fails it would be good to see it somewhere else than the log.

### Dependency-Track Version

4.8.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.