DependencyTrack / DependencyTrack/dependency-track

Missing project tags on NEW_VULNERABLE_DEPENDENCY notifications

Open
#6,556 0 comments 0 reactions 0 assignees View on GitHub
defect p2 size/S
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

On NEW_VULNERABLE_DEPENDENCY notifications, the `subject` field contains a serialized Project instance.

Looking at [NotificationUtil.java#L277](https://github.com/DependencyTrack/dependency-track/blob/c4a156726472cd529cc9fa8ed12e825cc000327d/src/main/java/org/dependencytrack/util/NotificationUtil.java#L277), it seems project tags should be included, but they are not in the resulting json.

I've done a bit of debugging, and it looks like the culprit is here: [NotificationUtil#L128](https://github.com/DependencyTrack/dependency-track/blob/c4a156726472cd529cc9fa8ed12e825cc000327d/src/main/java/org/dependencytrack/util/NotificationUtil.java#L128)

When the component is detached, its project "loses" the tags, for the lack of a better term. I'm not experienced at all in DataNucleus persistence, but I tried detaching the project as well and it seems to be working:
```
component = qm.detach(Component.class, component.getId());
component.setProject(qm.detach(Project.class, component.getProject().getId()));
```

Thanks!

### Steps to Reproduce

1. Create a project
2. Add a tag to the project
3. Trigger a NEW_VULNERABLE_DEPENDENCY notification
4. Verify `subject.project.tags` json field is missing in the notification

### Expected Behavior

Project tags should be available

### Dependency-Track Version

4.x

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start in src/main/java/org/dependencytrack/util/NotificationUtil.java, especially the detach logic around lines 128 and 277. Reproduce the notification after adding a project tag, then trace the detached component and project objects. Done means the NEW_VULNERABLE_DEPENDENCY notification includes the project's tags in subject.project.tags.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.