Question on Missing Component Information in Black Duck Hub Scan Processing

[KK7NZY]

Hello,

I recently uploaded a Black Duck Hub Scan and observed missing component information. Upon inspecting the code, I found that the component information does exist but is not being referenced when the BlackDuckFinding is created in the _process_project_findings method of BlackduckImporter.

I made a modification to the original code on lines 43 and 44 to read:

security_issue_dict.get("Component name") or security_issue_dict.get("Project name"),
security_issue_dict.get("Component version name") or security_issue_dict.get("Version"),

I'm unsure if this is a bug or if I might be misunderstanding the intended functionality. With that change I am now able to reference the component name and version fields.

Best,
KK7NZY

[kiblik]

I see that there are different formats of Blackduck reports (e.g. many_vulns.csv and many_vulns_new_format.csv).
I suppose somebody just wrote it for the old format and it is a good idea to add it as you proposed.
If you already found the related line, can you change it and offer PR? Plus add some test.

[manuel-sommer]

I can help you with a PR @KK7NZY

[KK7NZY]

@manuel-sommer, I've prepared a draft PR available here. Any assistance in getting this PR merged would be greatly appreciated.

[manuel-sommer]

Hi @KK7NZY I have already finished the PR. See linked PR above: #9148

[KK7NZY]

Hey @manuel-sommer! That's awesome. Thank you! I'll go ahead and close out the other ticket. 😊👍

[manuel-sommer]

This can be closed @mtesauro and @KK7NZY