DependencyTrack / DependencyTrack/dependency-track

Thoughts on reducing complexity of the code

Open
#3,302 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I'm the author of a tool called [atom](https://github.com/AppThreat/atom), which, among other things, can summarize applications and methods using data flows. Based on my analysis, the below method is the most complex of all in this repo.

https://github.com/DependencyTrack/dependency-track/blob/e827c0b2f4e775b0b77ec428e43fb616311e4c86/src/main/java/org/dependencytrack/parser/vulndb/VulnDbParser.java#L207

[parseVulnerabilities-2d728132005797e098b233f63f5d56bb.pdf](https://github.com/DependencyTrack/dependency-track/files/13671342/parseVulnerabilities-2d728132005797e098b233f63f5d56bb.pdf)

### Proposed Behavior

There are several for loops used, and in each loop, more library methods are invoked, seriously increasing the complexity. Such complex code are difficult to test thoroughly and could lead to both security and performance issues.

I'd like to know if such analyses are interesting for the maintainers so that I can improve this feature and share a PR to generate these reports.

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.