DependencyTrack / DependencyTrack/dependency-track

You can PUT a policy but you can't POST a policy without operator or violationState

Open
#4,976 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

You can PUT this policy json:
```
{
"name": "TestPolicy"
}
```

### Steps to Reproduce

If you POST a json of existing policy like:
```
{
"uuid": "",
"name": "TestPolicy",
"operator": "ANY"
}

```

you get an ISE 500
```
Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "VIOLATIONSTATE" of relation "POLICY" violates not-null constraint
Detail: Failing row contains (23, f, TestPolicy, f, ANY, 77d2381f-d6b9-46b3-bb7d-2000b578ebc6, null).
at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2733)
at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2420)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:372)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:517)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:434)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:465)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:415)
at org.datanucleus.store.rdbms.request.UpdateRequest.execute(UpdateRequest.java:512)
... 69 common frames omitted
```

If you POST a json of existing policy like:
```
{
"uuid": "",
"name": "TestPolicy",
"violationState": "FAIL"
}

```
You get an ISE 500
```
Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "OPERATOR" of relation "POLICY" violates not-null constraint
Detail: Failing row contains (12, f, TestPolicy, f, null, a6b18426-5da5-4bc4-82d2-522e9be4d43b, INFO).
at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2733)
at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2420)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:372)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:517)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:434)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:465)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:415)
at org.datanucleus.store.rdbms.request.UpdateRequest.execute(UpdateRequest.java:512)
... 69 common frames omitted
```

### Expected Behavior

Ideally there would be a PATCH endpoint.

At minimum the response is 400 status with a proper error message.

### Dependency-Track Version

4.13.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.