VEX export returns invalid cyclonedx

[muellerst-hg]

Current Behavior

Given a project with two components which have the same vulnerability
When I click "Export VEX"
Then a VEX file is delivered which contains duplicate items in vulnerabilities section
But according to cyclonedx 1.5 schema this is invalid

Tested with 4.11.3 and 4.12-snapshot from 2024/06/11

Steps to Reproduce

1. Create a new project and upload the following BOM file:
   bom-express.json
2. Wait for analysis to be finished
3. Go to "Audit Vulerabilties" tab and click "Download VEX" (which returns the following VEX file:
   vex-express.json
   )
4. Enable "BOM Validation" in "Configuration/Bom Format" settings
5. Click "Apply VEX" and try to upload the above VEX file
6. Upload fails with > The uploaded BOM is invalid. Schema validation failed

The same duplicates can be found when exporting the BOM using "Download BOM -> Inventory with Vulnerabilities"

Expected Behavior

I expect valid cyclonedx bom returned by "Export VEX".

Dependency-Track Version

4.11.3

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

14

Browser

Mozilla Firefox

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[SaberStrat]

I decided to have a go at this one. Fixed it locally, not sure if it's the prettiest solution, but I'd dare a PR with it.

[SaberStrat]

Thinking about the deduplications on vulnerabilities I'm trying to implement, and am not sure if I'm understanding @muellerst-hg remark correctly:

The same duplicates can be found when exporting the BOM using "Download BOM -> Inventory with Vulnerabilities"

DT doesn't seem to be doing a validation check when importing a BOM with vulns so I'm not getting an error with the exported BOM from the example, but as per CycloneDX Schema, the whole Vulnerability object needs to be unique, including the Affects. The vulns in the exported BOM of OP's example are the ones that are duplicated in a VEX, but the difference in the BOM is that the Affects are the different Components, whereas in the VEX it is the (same) project-component in both vulnerability objects.

So I'm not sure if the exported BOM with Vulnerabilities is problematic as well or it's fine, and this is really only about the exported VEX.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.