Unrecognized field "parentUuid" in Project

[sephiroth-j]

Current Behavior

The JSON representation of a project contains the field "parentUuid" which is not consumable by other operations that consume a project.

dependency-track/src/main/java/org/dependencytrack/model/Project.java

Lines 262 to 265 in 5e67e12

	@JsonProperty("parentUuid")
	private UUID getParentUuid() {
	return (this.getParent() == null) ? null : this.getParent().getUuid();
	}

If you send a request with that field to /api/v1/project, you will get the following response with code 400 (bad request).

Unrecognized field "parentUuid" (class org.dependencytrack.model.Project), not marked as ignorable (22 known properties: "classifier", "metrics", "lastBomImportFormat", "parent", "author", "lastBomImport", "directDependencies", "properties", "swidTagId", "version", "tags", "uuid", "publisher", "group", "active", "name", "externalReferences", "cpe", "description", "purl", "children", "lastInheritedRiskScore"]) at [Source: (org.glassfish.jersey.message.internal.ReaderInterceptorExecutor$UnCloseableInputStream); line: 1, column: 4480] (through reference chain: org.dependencytrack.model.Project["parentUuid"])

Steps to Reproduce

1. create two projects a and b
2. define project a to be the parent of b
3. retrieve project b using GET /api/v1/project/<uuid of b>
4. POST the response from step 1 back to /api/v1/project

Expected Behavior

The "parentUuid" field should not be part of the project model. It is not needed at all because it has the same value as "uuid" of the "parent" field. Either remove it completely or at least mark it as ignorable.

Dependency-Track Version

4.7.1

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[sephiroth-j]

p.s.
The removal of this field requires an update in the frontend as well.

https://github.com/DependencyTrack/frontend/blob/b30414d77eef7df5cd357ba54bc01e6f3ff0c307/src/views/portfolio/projects/ProjectList.vue#L127

[rbt-mm]

The parentUuid field cannot be removed, because it is necessary for displaying the parent-child relationships in the frontend project list.

The treegrid plugin, which is used for the hierarchical project view, needs an idField and a parentIdField to correctly display those relationships.
Unfortunately, neither of those fields can be a nested property (like parent.uuid), so during serialization it is necessary to add a field to a Project object that directly references its parent project (like parentUuid does) to avoid this limitation.

https://github.com/DependencyTrack/frontend/blob/b30414d77eef7df5cd357ba54bc01e6f3ff0c307/src/views/portfolio/projects/ProjectList.vue#L266-L267

I guess the best solution would be to somehow ignore this field during de-serialization, so that the project list in the frontend still displays the relationships correctly.

[sephiroth-j]

This is a pure frontend problem which should (and can) be solved there without changing the API. Instead, however, the model in the API was changed in a way that the API itself can't handle!

So, instead of this

project.pid = MurmurHash2(project.parentUuid).result()

Why not just this?

project.pid = MurmurHash2(project.parent?.uuid).result()

[rbt-mm]

So, instead of this
project.pid = MurmurHash2(project.parentUuid).result()
Why not just this?
project.pid = MurmurHash2(project.parent?.uuid).result()

Well, for some reason I didn't think about such a simple solution 😅.

Thanks for noticing, if you want I can create a PR for this fix tomorrow.

[sephiroth-j]

Please do so, because I won't have time to do so in the next few days.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.