DependencyTrack / DependencyTrack/dependency-track
Policy related Slack notifications do not populate any variables referencing "subject"
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
If a "PROJECT_AUDIT_CHANGE" (e.g. a suppression) is executed against a **vulnerability**, Slack notifications are received as expected.
If a "PROJECT_AUDIT_CHANGE" (e.g. a suppression) is executed against a **policy violation**, Slack notifications are not received as expected. Slack returns a 400 error, "invalid blocks"
The attached file shows the payload that is being sent to Slack from a policy violation suppression.
[invalid blocks.txt](https://github.com/user-attachments/files/17068019/invalid.blocks.txt)
**Note:**
- notification variables e.g. notification.level, notification.title are successfully populated
- subject variables e.g. subject.analysis.analysisState, subject.analysis.suppressed are left blank
- subject variables in for the same action against a **vulnerability** populates the subject variables as expected
The blank values are causing the "invalids blocks". I have confirmed this via Slack Block Kit Builder. Slack does not like blank values for plain text elements.
### Steps to Reproduce
1. Configure an alert on "PROJECT_AUDIT_CHANGE"
2. Configure the alert to use the Slack publisher
3. Open a policy violation
4. Suppress the violation
5. No message is received in Slack. Logs show a 400 error, which includes "invalid blocks"
### Expected Behavior
Any POLICY_VIOLATION action should successfully send a valid payload to Slack. Subject variables should all be populated correctly.
### Dependency-Track Version
4.11.7
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
16
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.