DependencyTrack / DependencyTrack/dependency-track

Offer a query language to perform searches

Open
#2,919 3 comments 7 reactions 0 assignees View on GitHub
enhancement spike / research
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

The Dependency-Track UI has multiple views where users can filter displayed items through a search field.

For the *Vulnerabilities* view, here's what the search looks like:

![image](https://github.com/DependencyTrack/dependency-track/assets/5693141/f008e131-1c7d-4803-a2ca-2905b22b785b)

It works fine if the user knows roughly what they are looking for (i.e., they know the vulnerability ID), but for any other query, the search is not really useful. Some example queries that users may be interested in doing:

* Vulnerabilities that where published in 2021 with severity CRITICAL
* Vulnerabilities with CVSSv3 score higher than 7, that affect 5 projects or more
* Vulnerabilities associated with CWEs 123, 456, or 789

A fuzzy search across all properties of a vulnerability is not helpful, as it will always return too much data, and makes "drilling down" very hard or even impossible.

On the technical side, text entered in the search field is sent to the API server via `searchText` query parameter.

Behind the scenes, `searchText` is [made available as `filter`](https://github.com/stevespringett/Alpine/blob/cd6aa7ed05376935ab32bc43819eba0e3a525b7f/alpine-server/src/main/java/alpine/server/filters/ApiFilter.java#L49) variable to the context of incoming requests. It is then up to individual query methods as to what to do with that `filter` value. For the *Vulnerabilities* example above, it will be used to construct a match ("contains") query on vulnerability IDs:

https://github.com/DependencyTrack/dependency-track/blob/924a007cd6a37d75a2c4a8ea048814975fb85fcd/src/main/java/org/dependencytrack/persistence/VulnerabilityQueryManager.java#L297-L300

The *Components* search is a bit more sophisticated, as it allows for filtering based on different criteria:

![image](https://github.com/DependencyTrack/dependency-track/assets/5693141/730f8985-5816-4732-8a9d-b953b682d840)

However, it lacks support for multiple criteria. For example, it *is* possible to search for:

* Components with PURL `pkg:maven/foo/bar@1.2.3`
* Components with MD5 hash `3858f62230ac3c915f300c664312c63f`

But it is *not* possible to search for:

* Components with PURL `pkg:maven/foo/bar@1.2.3` *and* MD5 hash not matching `3858f62230ac3c915f300c664312c63f`

Additionally, the current search logic primarily treats inputs with "contains" semantics. There is no way for users to decide when something should be an exact match, or a fuzzy match.

### Proposed Behavior

This is similar to https://github.com/DependencyTrack/dependency-track/issues/2673.

I do not believe in adding input fields for all the various types of properties and comparison operators. It will clutter the UI, and will be hard to test.

What I'd like to see instead is support for a query language similar to Jira's JQL (as mentioned in https://github.com/DependencyTrack/dependency-track/issues/2673#issuecomment-1636459224).

It should be possible for users to search for, say, vulnerabilities using expressions like this:

```py
published.year == 2021 && severity == CRITICAL

cvssv3 >= 7.0 && affectedProjects >= 5
```

It may be possible to leverage [CEL](https://github.com/google/cel-spec). As long as the CEL library exposes the AST to us, we can "transpile" CEL expressions to JDOQL or SQL filter expressions. There is a project in Go that transpiles CEL to BigQuery filters: https://github.com/cockscomb/cel2sql

If CEL transpiling turns out to not be an option, we could investigate writing our own DSL with [ANTLR4](https://github.com/antlr/antlr4).

For a better UX, input fields for search expressions should offer autocomplete. There should be a mechanism that allows users to discover available fields (e.g. a dropdown next to the search bar).

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.