DependencyTrack / DependencyTrack/dependency-track

Project creation form validation does not prevent empty mandatory fields

Open
#5,836 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

OWASP Dependency Track 4.13.6 allows to submit the "Create project" form without having filled in fields marked as mandatory with a red asterisk. It seems like a split second before submission one of the text boxes is marked red and an error is displayed but then the project is created anyway.

If a user forgets to set a team and portfolio access control is enabled, a project will be created that the user themselves cannot see or delete.

Image

### Steps to Reproduce

1. Go to the portfolio
2. Press the "Create Project" button
3. Leave inputs such as the team or application type empty
4. Press the "Create" button
5. Observe a project being created

### Expected Behavior

The expected behavior would be to stop the submission if mandatory fields are not properly populated, especially when portfolio access control is enabled.

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.