BOM upload fails when BOM XML contains multiple namespace declarations

[philippn]

Current Behavior

Hi there,

first if all, thanks for this great tool.

We are using it with merged SBOMs (the merging is done using the CycloneDX CLI). There we noticed that the BOMs couln't be imported. There error you get is: "Unable to determine schema version from XML namespaces: "

Steps to Reproduce

1. Try to upload a BOM with the following root element

<?xml version="1.0" encoding="utf-8"?>
<bom xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" serialNumber="urn:uuid:bf4ea1d0-53d4-4f6c-9b97-b111fb89024a" version="1" xmlns="http://cyclonedx.org/schema/bom/1.5">
  <metadata>
    ...

Expected Behavior

The import works

Dependency-Track Version

4.11.5

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Google Chrome

Checklist

• [X] I have read and understand the contributing guidelines
• [X] I have checked the existing issues for whether this defect was already reported

[philippn]

The reason is in https://github.com/DependencyTrack/dependency-track/blob/ccacd1da754ab74cc94ea79bc8e39e1c74a54f50/src/main/java/org/dependencytrack/parser/cyclonedx/CycloneDxValidator.java#L184 the for loop should probably break once the first hit was found.

I could provide a pull-request, I'm not sure how this sign-off stuff works though.

Thanks in advance for looking into it!

[nscuro]

Good catch @philippn!

I could provide a pull-request, I'm not sure how this sign-off stuff works though.

That would be great, and I'd like you to get the appropriate credit for finding and fixing this! The DCO sign-off is just a git flag, really. There is a good guide here: https://cert-manager.io/docs/contributing/sign-off/

Just pay attention that the username and email of your commit matches their counterparts on GitHub, see https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address

[philippn]

Thanks for your feedback. I have created a PR, including a test case. Hope that helps!

[github-actions[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.