BOM downloads default to "SNAPSHOT" version when project version is unassigned

[lukas-braune]

Current Behavior

When downloading BOMs via Dependency-Track's frontend (Components > Download BOM) and no version is assigned to the project (Project Details > Version), the generated CycloneDX document defaults to the version SNAPSHOT in metadata.component.version, e.g.:

{
  "bomFormat" : "CycloneDX",
  "specVersion" : "1.5",
  "serialNumber" : "urn:uuid:c60df495-ab6a-4677-b825-5940811a7c3b",
  "version" : 1,
  "metadata" : {
    "timestamp" : "2024-09-02T08:10:01Z",
    "tools" : [
      {
        "vendor" : "OWASP",
        "name" : "Dependency-Track",
        "version" : "4.11.7"
      }
    ],
    "component" : {
      "type" : "application",
      "bom-ref" : "f6b74dfe-e8aa-41c9-ab8b-03e285165273",
      "name" : "Test BOM",
      "version" : "SNAPSHOT"
    }
  },

Steps to Reproduce

1. Create a new project and leave the version field blank.
2. In the newly created project, go to Components tab, click on Download BOM, and select one of the available options.
3. Check the generated BOM for metadata.component.version to confirm that the version is set to SNAPSHOT.

Expected Behavior

If no version is assigned to a project in Dependency-Track, the metadata.component.version field in the downloaded BOMs should be left empty. This field is optional in the CycloneDX specification.

Dependency-Track Version

4.11.7

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15.8

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

The version is set here:

dependency-track/src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

Lines 710 to 714 in e672e6b

	if (StringUtils.trimToNull(project.getVersion()) == null) {
	cycloneComponent.setVersion("SNAPSHOT"); // Version is required per CycloneDX spec
	} else {
	cycloneComponent.setVersion(StringUtils.trimToNull(project.getVersion()));
	}

It seems like component.version was a required field in earlier versions of the CycloneDX spec.

component.version is a required field in CycloneDX v1.3 and earlier: https://cyclonedx.org/docs/1.3/json/#components_items_version

[nscuro]

We could technically exploit an oversight in the spec by setting it to an empty string instead: CycloneDX/specification#461

[Gepardgame]

@nscuro I added a fix for that #4142

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.