Stowage/dependency-track
2
0
Fork 0
mirror of https://github.com/DependencyTrack/dependency-track.git synced 2025-10-19 16:03:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix NPE when cloning projects with broken dependency graph

Browse source 
Fixes #4413

Signed-off-by: nscuro <nscuro@protonmail.com>
This commit is contained in:
nscuro 2024-11-27 19:51:50 +01:00
parent 193d0f9c93
commit 297b192f91
No known key found for this signature in database
2 changed files with 68 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java
View file

@ -711,7 +711,19 @@ final class ProjectQueryManager extends QueryManager implements IQueryManager {
String directDependencies = project.getDirectDependencies();
for (final UUID sourceComponentUuid : projectDirectDepsSourceComponentUuids) {
final UUID clonedComponentUuid = clonedComponentUuidBySourceComponentUuid.get(sourceComponentUuid);
directDependencies = directDependencies.replace(sourceComponentUuid.toString(), clonedComponentUuid.toString());
if (clonedComponentUuid != null) {
directDependencies = directDependencies.replace(
sourceComponentUuid.toString(), clonedComponentUuid.toString());
} else {
// NB: This may happen when the source project itself is a clone,
// and it was cloned before DT v4.12.0.
// https://github.com/DependencyTrack/dependency-track/pull/4171
LOGGER.warn("""
The source project's directDependencies refer to a component with UUID \
%s, which does not exist in the project. The cloned project's dependency graph \
may be broken as a result. A BOM upload will resolve the issue.\
""".formatted(sourceComponentUuid));
}
}
project.setDirectDependencies(directDependencies);
@ -724,7 +736,16 @@ final class ProjectQueryManager extends QueryManager implements IQueryManager {
String directDependencies = component.getDirectDependencies();
for (final UUID sourceComponentUuid : sourceComponentUuids) {
final UUID clonedComponentUuid = clonedComponentUuidBySourceComponentUuid.get(sourceComponentUuid);
directDependencies = directDependencies.replace(sourceComponentUuid.toString(), clonedComponentUuid.toString());
if (clonedComponentUuid != null) {
directDependencies = directDependencies.replace(
sourceComponentUuid.toString(), clonedComponentUuid.toString());
} else {
LOGGER.warn("""
The directDependencies of component %s refer to a component with UUID \
%s, which does not exist in the source project. The cloned project's dependency graph \
may be broken as a result. A BOM upload will resolve the issue.\
""".formatted(component, sourceComponentUuid));
}
}
component.setDirectDependencies(directDependencies);