DependencyTrack / DependencyTrack/dependency-track

Uploaded SBOM or VEX silently ignored if the first line is empty

Open
#4,983 7 comments 0 reactions 0 assignees View on GitHub
defect p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

It seems that if I upload a BOM json document with first line being empty the contents are ignored.

### Steps to Reproduce

1. Create a new project
2. Upload [bom.json](https://github.com/user-attachments/files/20394204/bom.json)
3. Observe that no components are added

### Expected Behavior

The contents are not ignored.

Ignoring the contents silently instead of returning an error makes this issue much worse. It's rather difficult to understand what happened if you don't know.

### Dependency-Track Version

4.13.1

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.