DependencyTrack / DependencyTrack/dependency-track
GitHubAdvisoryMirrorTaskTest fails due to not accounting for local time vs UTC
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When running tests:
```
[ERROR] Tests run: 17, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 8.000 s <<< FAILURE! -- in org.dependencytrack.tasks.GitHubAdvisoryMirrorTaskTest
[ERROR] org.dependencytrack.tasks.GitHubAdvisoryMirrorTaskTest.testProcessAdvisory -- Time elapsed: 0.234 s <<< FAILURE!
java.lang.AssertionError:
Expecting actual:
2022-03-11T16:00:00.000 (org.datanucleus.store.types.wrappers.Date)
to have same year, month and day as:
2022-03-12T00:00:00.000 (java.util.Date)
but had not.
at org.dependencytrack.tasks.GitHubAdvisoryMirrorTaskTest.testProcessAdvisory(GitHubAdvisoryMirrorTaskTest.java:129)
```
This appears to be a UTC vs Local time difference.
I think the issue is when we do this:
```
if (StringUtils.isNotBlank(publishedDateString)) {
vulnerability.setPublished(Date.from(OffsetDateTime.parse(publishedDateString).toInstant()));
}
```
we land on midnight UTC...which then becomes the previous day when adjusted for my local time (-8).
One option might be to trim off the time:
```
if (StringUtils.isNotBlank(publishedDateString)) {
OffsetDateTime odt = OffsetDateTime.parse(publishedDateString);
LocalDate localDate = odt.toLocalDate();
vulnerability.setPublished(java.sql.Date.valueOf(localDate));
}
```
### Steps to Reproduce
1. Live in a TZ behind UTC.
2. Run tests.
### Expected Behavior
Test either accounts for timezone or we drop the time component.
### Dependency-Track Version
4.13.x
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.