DependencyTrack / DependencyTrack/dependency-track

missing Index on VULNERABLESOFTWARE

Open
#5,925 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

-> Parallel Index Scan using "VULNERABLESOFTWARE_PURL_TYPE_NS_NAME_IDX" on "VULNERABLESOFTWARE" "A0" (cost=0.56..387323.80 rows=1 width=2410) (actual time=1134.942..1134.942 rows=0 loops=3)

### Steps to Reproduce

`explain SELECT
'org.dependencytrack.model.VulnerableSoftware' AS "DN_TYPE",
"A0"."CPE22",
"A0"."CPE23",
"A0"."EDITION",
"A0"."ID",
"A0"."LANGUAGE",
"A0"."OTHER",
"A0"."PART",
"A0"."PRODUCT",
"A0"."PURL",
"A0"."PURL_NAME",
"A0"."PURL_NAMESPACE",
"A0"."PURL_QUALIFIERS",
"A0"."PURL_SUBPATH",
"A0"."PURL_TYPE",
"A0"."PURL_VERSION",
"A0"."SWEDITION",
"A0"."TARGETHW",
"A0"."TARGETSW",
"A0"."UPDATE",
"A0"."UUID",
"A0"."VENDOR",
"A0"."VERSION",
"A0"."VERSIONENDEXCLUDING",
"A0"."VERSIONENDINCLUDING",
"A0"."VERSIONSTARTEXCLUDING",
"A0"."VERSIONSTARTINCLUDING",
"A0"."VULNERABLE"
FROM
"VULNERABLESOFTWARE" "A0"
WHERE
"A0"."PURL_TYPE" = 'foo'
AND "A0"."PURL_NAME" = 'bar'
AND "A0"."PURL_NAMESPACE" = 'ubuntu'
AND "A0"."VERSION" = 'baz'
AND "A0"."VERSIONENDEXCLUDING" = 'bla'
AND "A0"."VERSIONENDINCLUDING" IS NULL
AND "A0"."VERSIONSTARTEXCLUDING" IS NULL
AND "A0"."VERSIONSTARTINCLUDING" IS NULL FETCH NEXT ROW ONLY;`

### Expected Behavior

create index concurrently on "VULNERABLESOFTWARE" ("VERSION", "VERSIONENDEXCLUDING");

-> Index Scan using "VULNERABLESOFTWARE_VERSION_VERSIONENDEXCLUDING_idx" on "VULNERABLESOFTWARE" "A0" (cost=0.56..2.79 rows=1 width=2410) (actual time=1.005..1.005 rows=0 loops=1)

### Dependency-Track Version

4.7.x

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

15

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.