DependencyTrack / DependencyTrack/dependency-track
Missing project tags on NEW_VULNERABLE_DEPENDENCY notifications
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
On NEW_VULNERABLE_DEPENDENCY notifications, the `subject` field contains a serialized Project instance.
Looking at [NotificationUtil.java#L277](https://github.com/DependencyTrack/dependency-track/blob/c4a156726472cd529cc9fa8ed12e825cc000327d/src/main/java/org/dependencytrack/util/NotificationUtil.java#L277), it seems project tags should be included, but they are not in the resulting json.
I've done a bit of debugging, and it looks like the culprit is here: [NotificationUtil#L128](https://github.com/DependencyTrack/dependency-track/blob/c4a156726472cd529cc9fa8ed12e825cc000327d/src/main/java/org/dependencytrack/util/NotificationUtil.java#L128)
When the component is detached, its project "loses" the tags, for the lack of a better term. I'm not experienced at all in DataNucleus persistence, but I tried detaching the project as well and it seems to be working:
```
component = qm.detach(Component.class, component.getId());
component.setProject(qm.detach(Project.class, component.getProject().getId()));
```
Thanks!
### Steps to Reproduce
1. Create a project
2. Add a tag to the project
3. Trigger a NEW_VULNERABLE_DEPENDENCY notification
4. Verify `subject.project.tags` json field is missing in the notification
### Expected Behavior
Project tags should be available
### Dependency-Track Version
4.x
### Browser
Mozilla Firefox
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start in src/main/java/org/dependencytrack/util/NotificationUtil.java, especially the detach logic around lines 128 and 277. Reproduce the notification after adding a project tag, then trace the detached component and project objects. Done means the NEW_VULNERABLE_DEPENDENCY notification includes the project's tags in subject.project.tags.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100