DependencyTrack / DependencyTrack/dependency-track
Inconsistent behavior with project properties in notifications
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
We are trying to use project properties with webhook notifications.
For some notifications (like `POLICY_VIOLATION`), `subject.project.properties` is populated as expected. But for other notifications (like `NEW_VULNERABLE_DEPENDENCY`), `subject.project.properties` is empty (no null).
Same thing when using `subject.component.project.properties` instead of `subject.project.properties`.
Is this the expected behavior? Or maybe there is a better or more consistent way to get project properties in notification templates?
### Steps to Reproduce
1.Add a new webhook notification with this template:
```
{
"notification": {
"level": "{{ notification.level | escape(strategy="json") }}",
"scope": "{{ notification.scope | escape(strategy="json") }}",
"group": "{{ notification.group | escape(strategy="json") }}",
"timestamp": "{{ notification.timestamp }}",
"title": "{{ notification.title | escape(strategy="json") }}",
"content": "{{ notification.content | escape(strategy="json") }}"
},
"subject.component.project.properties.toString" : "{{ subject.component.project.properties.toString | escape(strategy="json") }}",
"subject.component.project.properties": [
{% for p in subject.component.project.properties %}
{
"groupName": "{{ p.groupName.toString | escape(strategy="json") }}",
"propertyName": "{{ p.propertyName.toString | escape(strategy="json") }}",
"propertyValue": "{{ p.propertyValue.toString | escape(strategy="json") }}"
}
{% endfor %}
],
"subject.project.properties.toString" : "{{ subject.project.properties.toString | escape(strategy="json") }}",
"subject.project.properties": [
{% for p in subject.project.properties %}
{
"groupName": "{{ p.groupName.toString | escape(strategy="json") }}",
"propertyName": "{{ p.propertyName.toString | escape(strategy="json") }}",
"propertyValue": "{{ p.propertyValue.toString | escape(strategy="json") }}"
}
{% endfor %}
]
}
```
2. trigger POLICY_VIOLATION and NEW_VULNERABLE_DEPENDENCY notifications using this template
3. inspect the result JSON sent to the webhook URL
Results for a `POLICY_VIOLATION` notification:
```json
{
"notification": {
"level": "INFORMATIONAL",
"scope": "PORTFOLIO",
"group": "POLICY_VIOLATION",
"timestamp": "2024-11-07T14:42:22.965782190",
"title": "Policy Violation on Project: [test lme : 1.0]",
"content": "A security policy violation occurred"
},
"subject.component.project.properties.toString": "[org.dependencytrack.model.ProjectProperty@7872efd6]",
"subject.component.project.properties": [
{
"groupName": "my_group",
"propertyName": "my_property",
"propertyValue": "my_value"
}
],
"subject.project.properties.toString": "[org.dependencytrack.model.ProjectProperty@7872efd6]",
"subject.project.properties": [
{
"groupName": "my_group",
"propertyName": "my_property",
"propertyValue": "my_value"
}
]
}
```
Results for a `NEW_VULNERABLE_DEPENDENCY` notification (no properties in the result):
```json
{
"notification": {
"level": "INFORMATIONAL",
"scope": "PORTFOLIO",
"group": "NEW_VULNERABLE_DEPENDENCY",
"timestamp": "2024-11-07T14:42:22.961691586",
"title": "Vulnerable Dependency Introduced on Project: [test lme : 1.0]",
"content": "A dependency was introduced that contains 11 known vulnerabilities"
},
"subject.component.project.properties.toString": "",
"subject.component.project.properties": [
],
"subject.project.properties.toString": "",
"subject.project.properties": [
]
}
```
### Expected Behavior
The ability to have access to project properties consistently for all notification types.
### Dependency-Track Version
4.12.0
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
12
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.