DependencyTrack / DependencyTrack/dependency-track

"...project/{name}/{version}" API Fails to Retrieve Badge When Project Name Includes "/"

Open
#3,898 4 comments 0 reactions 0 assignees View on GitHub
defect documentation good first issue hacktoberfest size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When integrating DependencyTrack with GitLab CI, I encounter an issue with retrieving the vulnerability badge via API when the project name contains a slash ("/"). This problem does not occur when using UUID for the project.

I use the following curl command to post a BOM:
```
curl -X "POST" "${DEPENDENCY_TRACK_URL}" \
-H 'Content-Type: multipart/form-data' \
-H "X-Api-Key: ${DEPENDENCY_TRACK_API_KEY}" \
-F "projectName=${CI_PROJECT_NAMESPACE}/${CI_PROJECT_NAME}" \
-F "projectVersion=${CI_COMMIT_REF_NAME}" \
-F "autoCreate=true" \
-F "bom=@bom.json"
```
Where:
`${CI_PROJECT_NAMESPACE}` is the GitLab group path (e.g., "it/iot").
`${CI_PROJECT_NAME}` is the GitLab project name (e.g., "any-test").
`${CI_COMMIT_REF_NAME}` is the branch name (e.g., "develop").

After posting the BOM, the DependencyTrack project name appears as "it/iot/any-test" with version "develop".

The badge retrieval API URL:
[https://{DEPENDENCY_TRACK_URL}/api/v1/badge/vulns/project/it/iot/any-test/develop](https://dependency-track.hdrenewables.com/api/v1/badge/vulns/project/it/iot/any-test/develop)
responds with a 404 error, indicating that it cannot handle project names with slashes.

However, using the UUID version of the URL works as expected:
[https://{DEPENDENCY_TRACK_URL}/api/v1/badge/vulns/project/91c63ff0-0ff2-493b-8d9f-4abb5c6caf14](https://dependency-track.hdrenewables.com/api/v1/badge/vulns/project/91c63ff0-0ff2-493b-8d9f-4abb5c6caf14)

Error Logs

The following errors are logged when attempting to retrieve the badge:

- 2024-07-01 02:20:04,559 ERROR [WriterInterceptorExecutor] MessageBodyWriter not found for media type=image/svg+xml, type=class java.util.ArrayList, genericType=class java.util.ArrayList.
- 2024-07-01 02:20:04,561 ERROR [ServerRuntime$Responder] Error occurred when processing a response created from an already mapped exception.

### Steps to Reproduce

1. put ${DEPENDENCY_TRACK_URL}、${DEPENDENCY_TRACK_API_KEY} , then use any BOM to post
```
curl -X "POST" "${DEPENDENCY_TRACK_URL}" \
-H 'Content-Type: multipart/form-data' \
-H "X-Api-Key: ${DEPENDENCY_TRACK_API_KEY}" \
-F "projectName=it/iot/any-test" \
-F "projectVersion=develop" \
-F "autoCreate=true" \
-F "bom=@bom.json"
```
2. try get this url
https://{DEPENDENCY_TRACK_URL}/api/v1/badge/vulns/project/it/iot/any-test/develop

3. fail, 404

### Expected Behavior

ues [https://{DEPENDENCY_TRACK_URL}/api/v1/badge/vulns/project/it/iot/any-test/develop](https://{DEPENDENCY_TRACK_URL}/api/v1/badge/vulns/project/it/iot/any-test/develop) can return badge

### Dependency-Track Version

4.11.3

### Dependency-Track Distribution

Container Image, Executable WAR

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.