DependencyTrack / DependencyTrack/dependency-track
PURL NO_MATCH policy condition doesn't match by ?type
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Setup a policy with condition
```
{
"subject": "PACKAGE_URL",
"operator": "NO_MATCH",
"value": "pkg:maven/com.mysql/mysql-connector-j@8.0.33?type=jar"
}
```
Upload a BOM:
```
{
"bomFormat": "CycloneDX",
"specVersion": "1.5",
"version": 1,
"components": [
{
"type" : "library",
"group" : "com.mysql",
"name" : "mysql-connector-j",
"version" : "8.0.33",
"purl" : "pkg:maven/com.mysql/mysql-connector-j@8.0.33?type=jar"
}
]
}
```
Observe that the policy is triggered.
If you define a policy with condition (notice no ?type)
```
{
"subject": "PACKAGE_URL",
"operator": "NO_MATCH",
"value": "pkg:maven/com.mysql/mysql-connector-j@8.0.33"
}
```
Then the policy will not trigger for the above BOM
### Expected Behavior
PURL policy condition should match a component with exactly the same PURL
### Dependency-Track Version
4.13.2
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.