search

ozontech / dtrack-audit

OWASP Dependency Track API client for intergration into CI/CD pipeline
GNU General Public License v3.0
51 stars 16 forks source link

Project auto creation fails for PROJECT_CREATION_UPLOAD permission #15

Open matts-au opened 2 years ago

matts-au commented 2 years ago

Dependency Track v3.2.0 introduced the PROJECT_CREATION_UPLOAD permission that reduced the access that PORTFOLIO_MANAGEMENT gave. I get the following error upon upload of a BOM for a non-existing project:

$ dtrack-audit -a -n $PROJECT_NAME -k $DTRACK_KEY -u $DTRACK_URL -i bom.xml
[Dtrack Audit Error]: Permission error. Check that you have all required permissions

I am using dtrack-audit v1.0.0 and Dependency Track v4.3.4.

It looks like dtrack-audit is querying for a project, then trying to create a new one if it doesn't exist. This will fail if the key only had PROJECT_CREATION_UPLOAD permission.