Internal server error on GET /api/v1/project when portfolio ACL is enabled and excludeInactive parameter is omitted or false

[nscuro]

Current Behavior

Requesting the /api/v1/project endpoint without any query parameters, or with their respective values being false, while portfolio access control is enabled, causes internal server errors. Inspecting the logs reveals:

javax.jdo.JDOUserException: Method/Identifier expected at character 1 in "&& ( accessTeams.contains(:team0) )"
	at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:698)
	at org.datanucleus.api.jdo.JDOQuery.executeInternal(JDOQuery.java:456)
	at org.datanucleus.api.jdo.JDOQuery.executeWithMap(JDOQuery.java:331)
	at alpine.persistence.AbstractAlpineQueryManager.getCount(AbstractAlpineQueryManager.java:397)
	at alpine.persistence.AbstractAlpineQueryManager.execute(AbstractAlpineQueryManager.java:238)
	at org.dependencytrack.persistence.ProjectQueryManager.getProjects(ProjectQueryManager.java:119)
	at org.dependencytrack.persistence.QueryManager.getProjects(QueryManager.java:338)
	at org.dependencytrack.resources.v1.ProjectResource.getProjects(ProjectResource.java:95)
	...

The issue appears to be a missing non-empty check in the preprocessACLs method:

dependency-track/src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Lines 854 to 858 in 93321f8

	if (inputFilter != null) {
	query.setFilter(inputFilter + " && (" + sb.toString() + ")");
	} else {
	query.setFilter(sb.toString());
	}

This issue mostly affects API clients, as the frontend always sets request query parameters, and excludeInactive and onlyRoot default to true for it.

Steps to Reproduce

1. Enable Portfolio Access Control in the settings
2. Get an API key
3. Request the /api/v1/project endpoint without any parameters

curl -v -H 'X-Api-Key: <API_KEY>' 'http://localhost:8080/api/v1/project'

Expected Behavior

Querying projects should not fail when no request query parameters are set.

Dependency-Track Version

4.8.0-SNAPSHOT

Dependency-Track Distribution

Container Image, Executable WAR

Database Server

N/A

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[tomkuipers]

Any updates about an upcoming release containing this specific fix? Our pipelines fail because of this issue when using mvn plugin https://github.com/pmckeown/dependency-track-maven-plugin

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.