NULL not allowed for column "NAME"

Current Behavior

If I upload a CycloneDX SBOM with an invalid name (and/or?) purl DependencyTrack is unable to analyze the rest of the SBOM.

For example, I had an SBOM that included the component:

    {
      "type": "library",
      "bom-ref": "pkg:cran/",
      "name": "",
      "version": "",
      "licenses": [
        {
          "license": {
            "name": "NOASSERTION"
          }
        }
      ],
      "purl": "pkg:cran/"
    },

The UI couldn't see it at all and the API could see 12698 components but 0 vulnerabilities.

Removing this component allowed 1435 vulnerabilities to be identified.

The logs show

2023-06-01 10:35:17,253 WARN [ModelConverter] Unable to parse PackageURL: pkg:cran/
2023-06-01 10:35:39,877 WARN [Persist] Insert of object "org.dependencytrack.model.Component@7dd0659b" using statement "INSERT INTO COMPONENT (AUTHOR,BLAKE2B_256,BLAKE2B_384,BLAKE2B_512,BLAKE3,CLASSIFIER,COPYRIGHT,CPE,DESCRIPTION,DIRECT_DEPENDENCIES,EXTENSION,EXTERNAL_REFERENCES,FILENAME,"GROUP",INTERNAL,LAST_RISKSCORE,LICENSE,LICENSE_URL,MD5,"NAME",TEXT,PARENT_COMPONENT_ID,PROJECT_ID,PUBLISHER,PURL,PURLCOORDINATES,LICENSE_ID,SHA1,SHA_256,SHA_384,SHA3_256,SHA3_384,SHA3_512,SHA_512,SWIDTAGID,UUID,VERSION) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : NULL not allowed for column "NAME"; SQL statement:
...
    at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:605)
    at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:702)
    at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistent(JDOPersistenceManager.java:722)
    at alpine.persistence.AbstractAlpineQueryManager.persist(AbstractAlpineQueryManager.java:427)
    at org.dependencytrack.persistence.ComponentQueryManager.createComponent(ComponentQueryManager.java:306)

Steps to Reproduce

    {
      "type": "library",
      "bom-ref": "pkg:cran/",
      "name": "",
      "version": "",
      "licenses": [
        {
          "license": {
            "name": "NOASSERTION"
          }
        }
      ],
      "purl": "pkg:cran/"
    },

... to any SBOM with >0 vulnerabilities.

Expected Behavior

I'd like to see DependencyTrack complain about the invalid Component metadata but I am not sure where it should surface that complaint in the UI.

I'd like SBOM processing to continue when such a component is part of the SBOM

Dependency-Track Version

4.8.2

Dependency-Track Distribution

Container Image

Database Server

N/A

Database Server Version

No response

Browser

Google Chrome

Checklist

[X] I have read and understand the contributing guidelines
[X] I have checked the existing issues for whether this defect was already reported

DependencyTrack / dependency-track