Current Behavior:
Analysis Fails because the Component only has a CPE in QueryManager.matchIdentity(). Operating Systems won't ever have a purl as far as I can tell.
Steps to Reproduce:
<component type="operating-system">
<name>kernel-4.19.78-yocto-standard</name>
<version>4.19.69</version>
<cpe>cpe:2.3:o:linux:linux_kernel:4.19.69:*:*:*:*:*:*:*</cpe>
</component> Expected Behavior:
in version 3.8.0 299 Vulnerabilities are associated
Environment:
- Dependency-Track Version: 4.0.0-SNAPSHOT
- Distribution: Docker
- BOM Format & Version: CycloneDX XML 1.2
- Database Server: H2
- Browser: Chrome
Additional Details:
java.lang.NullPointerException: null
at org.dependencytrack.persistence.QueryManager.matchIdentity(QueryManager.java:1706)
at org.dependencytrack.util.NotificationUtil.analyzeNotificationCriteria(NotificationUtil.java:51)
at org.dependencytrack.tasks.scanners.AbstractVulnerableSoftwareAnalysisTask.analyzeVersionRange(AbstractVulnerableSoftwareAnalysisTask.java:58)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.versionRangeAnalysis(InternalAnalysisTask.java:104)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.analyze(InternalAnalysisTask.java:86)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.inform(InternalAnalysisTask.java:59)
at org.dependencytrack.tasks.VulnerabilityAnalysisTask.performAnalysis(VulnerabilityAnalysisTask.java:148)
at org.dependencytrack.tasks.VulnerabilityAnalysisTask.inform(VulnerabilityAnalysisTask.java:103)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:99)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:834)
If I attempt to use a ternary query.executeWithArray(cid.getPurl() == null ? null : cid.getPurl().canonicalize(), to fix the purl NPE I get this instead which is way over my head.
org.datanucleus.exceptions.NucleusUserException: Object with id "3696" is managed by a different persistence manager
at org.datanucleus.ExecutionContextImpl.findObjectProvider(ExecutionContextImpl.java:1276)
at org.datanucleus.store.rdbms.scostore.ElementContainerStore.validateElementForWriting(ElementContainerStore.java:283)
at org.datanucleus.store.rdbms.scostore.JoinListStore.internalAdd(JoinListStore.java:200)
at org.datanucleus.store.rdbms.scostore.AbstractListStore.add(AbstractListStore.java:113)
at org.datanucleus.store.types.wrappers.backed.List.add(List.java:647)
at org.dependencytrack.model.Component.addVulnerability(Component.java:593)
at org.dependencytrack.persistence.QueryManager.addVulnerability(QueryManager.java:1402)
at org.dependencytrack.persistence.QueryManager.addVulnerability(QueryManager.java:1388)
at org.dependencytrack.tasks.scanners.AbstractVulnerableSoftwareAnalysisTask.analyzeVersionRange(AbstractVulnerableSoftwareAnalysisTask.java:59)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.versionRangeAnalysis(InternalAnalysisTask.java:104)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.analyze(InternalAnalysisTask.java:86)
at org.dependencytrack.tasks.scanners.InternalAnalysisTask.inform(InternalAnalysisTask.java:59)
at org.dependencytrack.tasks.VulnerabilityAnalysisTask.performAnalysis(VulnerabilityAnalysisTask.java:148)
at org.dependencytrack.tasks.VulnerabilityAnalysisTask.inform(VulnerabilityAnalysisTask.java:103)
at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:99)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:834)
Current Behavior:
Analysis Fails because the Component only has a CPE in QueryManager.matchIdentity(). Operating Systems won't ever have a purl as far as I can tell.
Steps to Reproduce:
Expected Behavior:
in version 3.8.0 299 Vulnerabilities are associated
Environment:
Additional Details:
If I attempt to use a ternary
query.executeWithArray(cid.getPurl() == null ? null : cid.getPurl().canonicalize(),to fix the purl NPE I get this instead which is way over my head.