Duplicate tag is created upon updating a project

[ifree92]

Bug with POST /v1/project endpoint.

Current Behavior:

Let's say you have already created a project with a specific tag mytag.
If you will update a project with no changes, e.g. just send back values that are equal to previous, then you will get duplicates.

Steps to Reproduce:

1. Create a project

curl -X PUT "https://dtrack-api.net/api/v1/project" \
  -H "accept: application/json" \
  -H "X-Api-Key: API_KEY" \
  -H "Content-Type: application/json" \
  -d "{ \"name\": \"my-project\", \"version\": \"1.3.5\", \"classifier\": \"APPLICATION\", \"tags\": [ { \"name\": \"mytag\" } ]}"

2. Update the project

curl -X POST "https://dtrack-api.net/api/v1/project" \
  -H "accept: application/json" \
  -H "X-Api-Key: API_KEY" \
  -H "Content-Type: application/json" \
  -d "{ \"name\": \"my-project\", \"version\": \"1.3.5\", \"classifier\": \"APPLICATION\", \"uuid\": \"6cb22bed-5f7b-4179-8510-1d7a98d87036\", \"tags\": [ { \"name\": \"mytag\" } ]}"

Response:

{
  "name": "my-project",
  "version": "1.3.5",
  "classifier": "APPLICATION",
  "uuid": "671ce55e-36fb-4a55-96bc-b83736658511",
  "properties": [],
  "tags": [{ "name": "mytag" }],
  "active": true
}

3. Send update requests one more time

curl -X POST "https://dtrack-api.net/api/v1/project" \
  -H "accept: application/json" \
  -H "X-Api-Key: API_KEY" \
  -H "Content-Type: application/json" \
  -d "{ \"name\": \"my-project\", \"version\": \"1.3.5\", \"classifier\": \"APPLICATION\", \"uuid\": \"6cb22bed-5f7b-4179-8510-1d7a98d87036\", \"tags\": [ { \"name\": \"mytag\" } ]}"

Response:

{
  "name": "my-project",
  "version": "1.3.5",
  "classifier": "APPLICATION",
  "uuid": "671ce55e-36fb-4a55-96bc-b83736658511",
  "properties": [],
  "tags": [{ "name": "mytag" }, { "name": "mytag" }],
  "active": true
}

By repeating (3) that will create tag duplicates. At the moment (after execution 3 commands above), you will get two double mytag tags on the same project.

The same behaviour could be reproduced via UI. Just create a project. Go to project edit, add tag and click on "Update". And then again go to project edit ("View details" button) and just click "Update".

Expected Behavior:

I'm expecting to do not have duplicates.

Environment:

• Dependency-Track Version: 4.3.2
• Distribution: Docker
• Database Server: PostgreSQL

[sephiroth-j]

Can be reproduced with the following test

package org.dependencytrack.resources.v1;
...
public class ProjectResourceTest extends ResourceTest {
...
	@Test
	public void updateProjectTagsTest()
	{
		var tags = Stream.of("tag1", "tag2").map(qm::createTag).collect(Collectors.toUnmodifiableList());
		var p1 = qm.createProject("ABC", "Test project", "1.0", tags, null, null, true, false);

		var jsonProject = new Project();
		jsonProject.setUuid(p1.getUuid());
		jsonProject.setName(p1.getName());
		jsonProject.setVersion(p1.getVersion());
		jsonProject.setTags(Stream.of("tag1", "tag2", "tag3").map(name ->
		{
			var t = new Tag();
			t.setName(name);
			return t;
		}).collect(Collectors.toUnmodifiableList()));

		// update the 1st time
		Response response = target(V1_PROJECT)
			.request()
			.header(X_API_KEY, apiKey)
			.post(Entity.entity(jsonProject, MediaType.APPLICATION_JSON));
		Assert.assertEquals(200, response.getStatus(), 0);
		JsonObject json = parseJsonObject(response);
		Assert.assertNotNull(json);
		Assert.assertEquals("ABC", json.getString("name"));
		Assert.assertEquals("1.0", json.getString("version"));
		Assert.assertFalse(json.containsKey("description"));
		var jsonTags = json.getJsonArray("tags");
		Assert.assertEquals(3, jsonTags.size());
		Assert.assertEquals("tag1", jsonTags.get(0).asJsonObject().getString("name"));
		Assert.assertEquals("tag2", jsonTags.get(1).asJsonObject().getString("name"));
		Assert.assertEquals("tag3", jsonTags.get(2).asJsonObject().getString("name"));

		// and repeat ... will fail. issue #1165
		response = target(V1_PROJECT)
			.request()
			.header(X_API_KEY, apiKey)
			.post(Entity.entity(jsonProject, MediaType.APPLICATION_JSON));
		json = parseJsonObject(response);
		jsonTags = json.getJsonArray("tags");
		Assert.assertEquals(3, jsonTags.size());
		Assert.assertEquals("tag1", jsonTags.get(0).asJsonObject().getString("name"));
		Assert.assertEquals("tag2", jsonTags.get(1).asJsonObject().getString("name"));
		Assert.assertEquals("tag3", jsonTags.get(2).asJsonObject().getString("name"));
	}
}

[sephiroth-j]

The issues seems to be this code here:

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Lines 628 to 631 in 1d6ce18

	project.setTags(tags);
	for (final Tag tag: tags) {
	tag.getProjects().add(project);
	}

The tags are already associated with the projects through

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Line 628 in 1d6ce18

project.setTags(tags);

Afterwards, the project is added to the (new) tags again.

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Lines 628 to 631 in 1d6ce18

	project.setTags(tags);
	for (final Tag tag: tags) {
	tag.getProjects().add(project);
	}

And after the commit

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Line 632 in 1d6ce18

pm.currentTransaction().commit();

the project has 6 tags instead of 3 with each tag twice.

Will provide a PR to fix this.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.