DependencyTrack / DependencyTrack/dependency-track

Issues with Email Alert Content

Open
#325 1 comment 0 reactions 0 assignees View on GitHub
defect p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Issue Type:
- [X] defect report
- [ ] enhancement request

### Current Behavior:

Dependency-Track v3.4.1 email alerts (which use Template Mimetype "text/plain") are not encoding/decoding correctly... when the advisory (as viewed in DT UI) displays a single quote, the email alert from DT has `'`. This makes emails rather hard to read, as can be seen here:

![email-content](https://user-images.githubusercontent.com/4938718/56578016-76a48680-65c4-11e9-9ff5-89f021078e82.png)

The screenshot does also illustrate a couple of other issues:
* Some content is not stripped out (marked as "Extraneous" in the image)
* Indenting is harder to read in email (perhaps use 4 space characters instead of 1?)
* Email alert does not include the original advisory's "Classification" or "Recommendation"

### Steps to Reproduce (if defect):
I have seen the `'` issue affecting alerts relating to multiple npm components. eg
```
pkg:npm/tunnel-agent@0.4.3
pkg:npm/lodash@4.17.10
pkg:npm/ws@1.1.2
```
I have not yet seen the issue for Maven components... but the explanation is because I've only just enabled both alerts **and** npm analysis (following upgrade to DT v3.4.1) and no maven alerts have yet been generated!

Anyway, for npm.

* Enable a PORTFOLIO email alert using Notify on NEW_VULNERABILITY.
* Create a new project in DT
* Upload a BOM to this new project, where the BOM contains the component:

```

tunnel-agent
0.4.3




6373db76909fe570e08d73583365ed828a74eeeb



Apache-2.0


pkg:npm/tunnel-agent@0.4.3
false

```

### Expected Behavior:
Email alerts should decode encoded characters correctly.

### Environment:

- Dependency-Track Version: v3.4.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.