DependencyTrack / DependencyTrack/dependency-track

PURL NO_MATCH policy condition doesn't match by ?type

Open
#5,142 2 comments 1 reaction 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Setup a policy with condition
```
{
"subject": "PACKAGE_URL",
"operator": "NO_MATCH",
"value": "pkg:maven/com.mysql/mysql-connector-j@8.0.33?type=jar"
}
```

Upload a BOM:
```
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"version": 1,
"components": [
{
"type" : "library",
"group" : "com.mysql",
"name" : "mysql-connector-j",
"version" : "8.0.33",
"purl" : "pkg:maven/com.mysql/mysql-connector-j@8.0.33?type=jar"
}
]
}
```

Observe that the policy is triggered.

If you define a policy with condition (notice no ?type)
```
{
"subject": "PACKAGE_URL",
"operator": "NO_MATCH",
"value": "pkg:maven/com.mysql/mysql-connector-j@8.0.33"
}
```

Then the policy will not trigger for the above BOM

### Expected Behavior

PURL policy condition should match a component with exactly the same PURL

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.