DependencyTrack / DependencyTrack/dependency-track

OpenAPI PUT api/v1/component/project/{project_uuid} - Wrong Requestbody scheme

Open
#5,130 1 comment 0 reactions 0 assignees View on GitHub
api docs api-inconsistency
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

The requestBody scheme of `PUT /v1/component/project/{uuid}` equals to full component definition. This is wrong because of the following reasons:
- project and uuid are required properties in component, but this is not the case for calling via PUT
- there are a lot of optional fields in component-scheme which are located in different tables and which are ignored sending them to PUT endpoint (for example project, children, parent, vulnerabilities, directDependencies)

According to OpenApi the definition of `PUT /v1/component/project/{uuid}` is the following:
```yaml
put:
tags:
- component
summary: Creates a new component
description:

Requires permission PORTFOLIO_MANAGEMENT


operationId: createComponent
parameters:
- name: uuid
in: path
description: The UUID of the project to create a component for
required: true
schema:
type: string
format: uuid
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/Component"
responses:
"201":
description: The created component
content:
application/json:
schema:
$ref: "#/components/schemas/Component"
"401":
description: Unauthorized
"403":
description: Access to the specified project is forbidden
"404":
description: The project could not be found
security:
- ApiKeyAuth: []
- BearerAuth: []
```

Component definition in scheme:
```yaml
Component:
required:
- classifier
- project
- uuid
type: object
properties:
authors:
type: array
items:
$ref: "#/components/schemas/OrganizationalContact"
publisher:
maxLength: 255
minLength: 0
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
supplier:
$ref: "#/components/schemas/OrganizationalEntity"
group:
maxLength: 255
minLength: 0
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
name:
maxLength: 255
minLength: 1
pattern: "^[\\p{IsWhite_Space}\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}]*$"
type: string
...
```

### Steps to Reproduce

1. Retrieving OpenApi-Spec: `[server]/api/openapi.json`
2. Adding a component by name and classifier is possible: `PUT [server]/v1/component/project/{uuid}`
```json
{
"classifier": "LIBRARY",
"name": "Test-Component"
}
```
3. Adding a component without name is not possible

**So OpenApi-Spec does not match the required fields when using it via PUT.**

### Expected Behavior

Having a special requestBody scheme for `PUT /v1/component/project/{uuid}` which defines only supported properties in creation of component.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

16.4

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.