DependencyTrack / DependencyTrack/dependency-track
You can PUT a policy but you can't POST a policy without operator or violationState
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
You can PUT this policy json:
```
{
"name": "TestPolicy"
}
```
### Steps to Reproduce
If you POST a json of existing policy like:
```
{
"uuid": "",
"name": "TestPolicy",
"operator": "ANY"
}
```
you get an ISE 500
```
Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "VIOLATIONSTATE" of relation "POLICY" violates not-null constraint
Detail: Failing row contains (23, f, TestPolicy, f, ANY, 77d2381f-d6b9-46b3-bb7d-2000b578ebc6, null).
at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2733)
at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2420)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:372)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:517)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:434)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:465)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:415)
at org.datanucleus.store.rdbms.request.UpdateRequest.execute(UpdateRequest.java:512)
... 69 common frames omitted
```
If you POST a json of existing policy like:
```
{
"uuid": "",
"name": "TestPolicy",
"violationState": "FAIL"
}
```
You get an ISE 500
```
Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "OPERATOR" of relation "POLICY" violates not-null constraint
Detail: Failing row contains (12, f, TestPolicy, f, null, a6b18426-5da5-4bc4-82d2-522e9be4d43b, INFO).
at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2733)
at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2420)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:372)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:517)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:434)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:465)
at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:415)
at org.datanucleus.store.rdbms.request.UpdateRequest.execute(UpdateRequest.java:512)
... 69 common frames omitted
```
### Expected Behavior
Ideally there would be a PATCH endpoint.
At minimum the response is 400 status with a proper error message.
### Dependency-Track Version
4.13.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.