DependencyTrack / DependencyTrack/frontend

SCM URLs for `git@server:repo` (without an explicit schema like `ssh://`) do not render right

Open
#1,007 2 comments 0 reactions 0 assignees View on GitHub
defect good first issue hacktoberfest p3 size/S
Dominant language
Vue
Stars
171
Forks
250
Avg merge
11h 12m
Merged PRs (30d)
82

Description

### Current Behavior

In my SBOM documents I have "components[] / externalReferences[]" as lists of objects like `{ "type": "vcs", "url": "scm:git:git@server:group/repo.git" }` where the URL-ish part `git@...` does not have any schema like `git+ssh://` or plain `ssh://` (its just is as it comes from `pom.xml` files).

In Dependency-Track web-ui such links are rendered verbatim, e.g. `scm:git:git@github.com:lukas-krecan/JsonUnit.git/json-unit-assertj` so the browser leads nowhere - and there's even no schema prefix to register a handler for, I think (musing about `scm:git://` prefix for users to somehow deal with if desired, or smart rewrite into the more standard `git+ssh://git@github.com:lukas-krecan/JsonUnit.git/json-unit-assertj` right away?)

Also note that URL entries mis-written as just `git@...` without an `scm:git:...` prefix are rendered as relative links under the Dependency-Track server root URL (e.g. `http://localhost:8080/components/git@...`), I suppose these links should always be absolute even if useless.

### Steps to Reproduce

1. Upload a BOM file with some non-HTTP VCS URLs for components
2. Go to Component details in Web-UI
3. On the right, open a drop-down for links; explore those marked VCS

### Expected Behavior

* VCS URLs are always emitted as absolute in HTML markup (VCS link strings relative to DT server are certainly useless)
* If possible, ensure a standard schema prefix that applications/browsers could register OS handlers for, and open a suitable client application/IDE/...
* Perhaps (have a toggle to) assume that `git@...` links without a prefix/schema mean `git+ssh://` in fact

### Dependency-Track Version

4.11.7

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.