DependencyTrack / DependencyTrack/dependency-track
Paging of Vulnerabilites for a component returns more entries than expected
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When accessing the vulnerabilities of a components currently the API returns every vulnerability the component contains regardless of the page Size that was used.
### Steps to Reproduce
1.Add a component with alot of vulnerabilities
2. Request the vulnerabilities for that component (This was done through the frontend version 5.1:
3. The API then returns every vulnerability of the component:
### Expected Behavior
I would expect, that the API only return PageSize amount of entries. This was also the behaviour in 4.14.
When this is expected the frontend should be changed because this currently breaks the fronted (every vulnerability is shown there despite that only 10 where selected to be shown)
### Dependency-Track Version
5.x
### Browser
Other
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Reproduce the request described in the issue against a component with many vulnerabilities, using a page size of 10, and inspect the API response. Compare the behavior with version 4.14 and check how frontend version 5.1 requests and displays the results. Done means the API returns only the requested page size and the frontend no longer shows every vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100