Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

All required properties should have "minLength": 1 #461

Open
Brcrwilliams opened this issue May 8, 2024 · 1 comment
Open

All required properties should have "minLength": 1 #461

Brcrwilliams opened this issue May 8, 2024 · 1 comment
Milestone

Comments

@Brcrwilliams
Copy link

If a property is required, it should also not be an empty string. There are many places in the BOM schema where we use "required": [...] but do not also verify that these properties have "minLength": 1.

An example is .components[].name:

It may be that optional properties should have this constraint as well. Consider the following example:

{
  "type": "library",
  "name": "whatever",
  "version": ""
}

If whatever does not have a version, it would be more clear if that key were to be omitted rather than provided as an empty string.

@stevespringett
Copy link
Member

Thanks @Brcrwilliams. We'll add this to the 2.0 backlog.

@stevespringett stevespringett added this to the 2.0 milestone May 13, 2024
nscuro added a commit to nscuro/dependency-track that referenced this issue Sep 13, 2024
`component.name` and `service.name` are required as per CycloneDX specification, but the schema doesn't sufficiently enforce this requirement (CycloneDX/specification#461).

Because DT trims names from the BOM during model conversion, empty or blank names end up becoming `null`. Since the respective database columns have a `NOT NULL` constraint on them, inserting or updating such components will always fail.

Usually we would not want to try to "repair" data, but the name being empty appears to be so common that there's no other sensible way for us to deal with it.

With this change, empty names will end up being saved as `-` instead, to signal the absence of a proper value.

Fixes DependencyTrack#2821

Signed-off-by: nscuro <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants