DependencyTrack / DependencyTrack/dependency-track
Issues with Email Alert Content
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Issue Type:
- [X] defect report
- [ ] enhancement request
### Current Behavior:
Dependency-Track v3.4.1 email alerts (which use Template Mimetype "text/plain") are not encoding/decoding correctly... when the advisory (as viewed in DT UI) displays a single quote, the email alert from DT has `'`. This makes emails rather hard to read, as can be seen here:

The screenshot does also illustrate a couple of other issues:
* Some content is not stripped out (marked as "Extraneous" in the image)
* Indenting is harder to read in email (perhaps use 4 space characters instead of 1?)
* Email alert does not include the original advisory's "Classification" or "Recommendation"
### Steps to Reproduce (if defect):
I have seen the `'` issue affecting alerts relating to multiple npm components. eg
```
pkg:npm/tunnel-agent@0.4.3
pkg:npm/lodash@4.17.10
pkg:npm/ws@1.1.2
```
I have not yet seen the issue for Maven components... but the explanation is because I've only just enabled both alerts **and** npm analysis (following upgrade to DT v3.4.1) and no maven alerts have yet been generated!
Anyway, for npm.
* Enable a PORTFOLIO email alert using Notify on NEW_VULNERABILITY.
* Create a new project in DT
* Upload a BOM to this new project, where the BOM contains the component:
```
tunnel-agent
0.4.3
6373db76909fe570e08d73583365ed828a74eeeb
Apache-2.0
pkg:npm/tunnel-agent@0.4.3
false
```
### Expected Behavior:
Email alerts should decode encoded characters correctly.
### Environment:
- Dependency-Track Version: v3.4.1
Contributor guide
Assessment
This issue has not been assessed yet.