DependencyTrack / DependencyTrack/dependency-track

Version Distance Policy Evaluation Cannot Deal With Letters

Open
#3,230 1 comment 2 reactions 0 assignees View on GitHub
defect
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

As a result of logging improvements introduced in v4.9.0 via Issue #2979, a Version Distance Policy that attempts to evaluate a component that contains a letter in the version (either existing version or latest version) will generate an informative WARN:

```
2023-11-22 02:27:01,522 INFO [OssIndexAnalysisTask] Sonatype OSS Index analysis complete
2023-11-22 02:27:01,526 INFO [PolicyEngine] Evaluating 362 component(s) against applicable policies
2023-11-22 02:27:02,397 WARN [VersionDistancePolicyEvaluator] Failed to compute version distance for component pkg:maven/com.google.code.findbugs/annotations@2.0.1?type=jar (UUID: 9d582ebf-b3b8-4ab1-bd90-e109f7fa5218), between component version 2.0.1 and latest version 3.0.1u2; Skipping
java.lang.NumberFormatException: For input string: "1u"
at java.base/java.lang.NumberFormatException.forInputString(Unknown Source)
at java.base/java.lang.Integer.parseInt(Unknown Source)
at java.base/java.lang.Integer.parseInt(Unknown Source)
at org.dependencytrack.util.VersionDistance.parseVersion(VersionDistance.java:156)
at org.dependencytrack.util.VersionDistance.getVersionDistance(VersionDistance.java:331)
at org.dependencytrack.policy.VersionDistancePolicyEvaluator.evaluate(VersionDistancePolicyEvaluator.java:93)
at org.dependencytrack.policy.PolicyEngine.evaluate(PolicyEngine.java:89)
at org.dependencytrack.policy.PolicyEngine.evaluate(PolicyEngine.java:71)
at org.dependencytrack.tasks.PolicyEvaluationTask.performPolicyEvaluation(PolicyEvaluationTask.java:55)
at org.dependencytrack.tasks.PolicyEvaluationTask.inform(PolicyEvaluationTask.java:44)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.base/java.lang.Thread.run(Unknown Source)
2023-11-22 02:27:02,580 WARN [VersionDistancePolicyEvaluator] Failed to compute version distance for component pkg:maven/org.apache-extras.beanshell/bsh@2.0b6?type=jar (UUID: c12140e6-4959-4f4b-9710-5f5235ceca09), between component version 2.0b6 and latest version 2.0b6; Skipping
java.lang.NumberFormatException: For input string: "0b"
at java.base/java.lang.NumberFormatException.forInputString(Unknown Source)
at java.base/java.lang.Integer.parseInt(Unknown Source)
...
2023-11-22 02:27:02,607 WARN [VersionDistancePolicyEvaluator] Failed to compute version distance for component pkg:maven/com.google.code.findbugs/annotations@3.0.1?type=jar (UUID: 4ff12922-f19b-413f-b776-b2cfbcd25f11), between component version 3.0.1 and latest version 3.0.1u2; Skipping
java.lang.NumberFormatException: For input string: "1u"
at java.base/java.lang.NumberFormatException.forInputString(Unknown Source)
at java.base/java.lang.Integer.parseInt(Unknown Source)
...
```

### Steps to Reproduce

1. Create version distance policy. This was the policy that gave rise to exceptions reported above but a better test would be to have version value as 1 rather than 2.

![version-policy](https://github.com/DependencyTrack/dependency-track/assets/4938718/5c2eb69e-a631-4617-9e4d-7448dcb12860)

2. Upload BOM containing following components....
`pkg:maven/jakarta.annotation/jakarta.annotation-api@1.3.5?type=jar`
`pkg:maven/org.apache-extras.beanshell/bsh@2.0b6?type=jar`

### Expected Behavior

1. No WARN exceptions logged per current behaviour.
2. Assuming policy distance is 1, a policy violation for `pkg:maven/com.google.code.findbugs/annotations@2.0.1?type=jar` as this is one major version behind latest version
3. Valid policy violations for any other component in project that is more than one version out of date. Currently I am not seeing any Version Distance policy violations for the project under test... but have not tested against a project that contain NO components that would give the WARN exception.

### Dependency-Track Version

4.10.0-SNAPSHOT

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.