DependencyTrack / DependencyTrack/dependency-track

Deleting teams uses DELETE with a body

Open
#4,977 0 comments 0 reactions 0 assignees View on GitHub
api docs api-inconsistency
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

![Image](https://github.com/user-attachments/assets/0b18ea4e-cd80-44b9-8e94-2a96a7e9cc41)

### Expected Behavior

As clarified by [RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html#name-delete) using method body in DELETE requests is not interoperable.

> Although request message framing is independent of the method used, content received in a DELETE request has no generally defined semantics, cannot alter the meaning or target of the request, and might lead some implementations to reject the request and close the connection because of its potential as a request smuggling attack

Deleting a team should be done by specifying the UUID as url parameter.

### Dependency-Track Version

4.13.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.