DependencyTrack / DependencyTrack/dependency-track
Uploaded SBOM or VEX silently ignored if the first line is empty
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
It seems that if I upload a BOM json document with first line being empty the contents are ignored.
### Steps to Reproduce
1. Create a new project
2. Upload [bom.json](https://github.com/user-attachments/files/20394204/bom.json)
3. Observe that no components are added
### Expected Behavior
The contents are not ignored.
Ignoring the contents silently instead of returning an error makes this issue much worse. It's rather difficult to understand what happened if you don't know.
### Dependency-Track Version
4.13.1
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.