DependencyTrack / DependencyTrack/dependency-track

Policy related Slack notifications do not populate any variables referencing "subject"

Open
#4,161 0 comments 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

If a "PROJECT_AUDIT_CHANGE" (e.g. a suppression) is executed against a **vulnerability**, Slack notifications are received as expected.

If a "PROJECT_AUDIT_CHANGE" (e.g. a suppression) is executed against a **policy violation**, Slack notifications are not received as expected. Slack returns a 400 error, "invalid blocks"

The attached file shows the payload that is being sent to Slack from a policy violation suppression.

[invalid blocks.txt](https://github.com/user-attachments/files/17068019/invalid.blocks.txt)

**Note:**

- notification variables e.g. notification.level, notification.title are successfully populated
- subject variables e.g. subject.analysis.analysisState, subject.analysis.suppressed are left blank
- subject variables in for the same action against a **vulnerability** populates the subject variables as expected

The blank values are causing the "invalids blocks". I have confirmed this via Slack Block Kit Builder. Slack does not like blank values for plain text elements.

### Steps to Reproduce

1. Configure an alert on "PROJECT_AUDIT_CHANGE"
2. Configure the alert to use the Slack publisher
3. Open a policy violation
4. Suppress the violation
5. No message is received in Slack. Logs show a 400 error, which includes "invalid blocks"

### Expected Behavior

Any POLICY_VIOLATION action should successfully send a valid payload to Slack. Subject variables should all be populated correctly.

### Dependency-Track Version

4.11.7

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.