DependencyTrack / DependencyTrack/dependency-track
Provide a way to make errors not fail the whole analysis
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
DependencyTrack fails with error when a malformed IRIs such as "http://pear.php.net/bugs/search.php?cmd=display&package_name[]=Console_Getopt" (which is indeed a perfectly working URI, found in externalReferences.2.url of PHP module console_getopt@1.4.3, see also #3831 and #3865) are found in bom.json; this makes a whole Jenkins pipeline fail for a problem which is not a security issue without providing alternatives to disabling the whole DependencyTrack analysis or ignoring its failures; this carries far greater risks than a malformed IRI.
### Proposed Behavior
Please provide a property to force DependencyTrack to ignore minor issues, i.e. not related with security (and an environment counterpart for DependencyTrack Docker image) so that they won't block the whole process.
The alternative would be a more lax check for IRIs, which don't represent a security issue, by resolving issues #3831 and #3865.
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.