DependencyTrack / DependencyTrack/dependency-track
OpenAPI PUT api/v1/component/project/{project_uuid} - Wrong Requestbody scheme
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
The requestBody scheme of `PUT /v1/component/project/{uuid}` equals to full component definition. This is wrong because of the following reasons:
- project and uuid are required properties in component, but this is not the case for calling via PUT
- there are a lot of optional fields in component-scheme which are located in different tables and which are ignored sending them to PUT endpoint (for example project, children, parent, vulnerabilities, directDependencies)
According to OpenApi the definition of `PUT /v1/component/project/{uuid}` is the following:
```yaml
put:
tags:
- component
summary: Creates a new component
description:
Requires permission PORTFOLIO_MANAGEMENT
operationId: createComponent
parameters:
- name: uuid
in: path
description: The UUID of the project to create a component for
required: true
schema:
type: string
format: uuid
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/Component"
responses:
"201":
description: The created component
content:
application/json:
schema:
$ref: "#/components/schemas/Component"
"401":
description: Unauthorized
"403":
description: Access to the specified project is forbidden
"404":
description: The project could not be found
security:
- ApiKeyAuth: []
- BearerAuth: []
```
Component definition in scheme:
```yaml
Component:
required:
- classifier
- project
- uuid
type: object
properties:
authors:
type: array
items:
$ref: "#/components/schemas/OrganizationalContact"
publisher:
maxLength: 255
minLength: 0
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
supplier:
$ref: "#/components/schemas/OrganizationalEntity"
group:
maxLength: 255
minLength: 0
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
name:
maxLength: 255
minLength: 1
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
...
```
### Steps to Reproduce
1. Retrieving OpenApi-Spec: `[server]/api/openapi.json`
2. Adding a component by name and classifier is possible: `PUT [server]/v1/component/project/{uuid}`
```json
{
"classifier": "LIBRARY",
"name": "Test-Component"
}
```
3. Adding a component without name is not possible
**So OpenApi-Spec does not match the required fields when using it via PUT.**
### Expected Behavior
Having a special requestBody scheme for `PUT /v1/component/project/{uuid}` which defines only supported properties in creation of component.
### Dependency-Track Version
4.13.2
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
16.4
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.