DependencyTrack / DependencyTrack/dependency-track

Provide a way to make errors not fail the whole analysis

Open
#4,618 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

DependencyTrack fails with error when a malformed IRIs such as "http://pear.php.net/bugs/search.php?cmd=display&package_name[]=Console_Getopt" (which is indeed a perfectly working URI, found in externalReferences.2.url of PHP module console_getopt@1.4.3, see also #3831 and #3865) are found in bom.json; this makes a whole Jenkins pipeline fail for a problem which is not a security issue without providing alternatives to disabling the whole DependencyTrack analysis or ignoring its failures; this carries far greater risks than a malformed IRI.

### Proposed Behavior

Please provide a property to force DependencyTrack to ignore minor issues, i.e. not related with security (and an environment counterpart for DependencyTrack Docker image) so that they won't block the whole process.
The alternative would be a more lax check for IRIs, which don't represent a security issue, by resolving issues #3831 and #3865.

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.