Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SCM URLs for git@server:repo (without an explicit schema like ssh://) do not render right #1007

Open
2 tasks done
jimklimov opened this issue Sep 17, 2024 · 2 comments
Open
2 tasks done
Labels
defect Something isn't working good first issue Good for newcomers hacktoberfest Issues eligible for Hacktoberfest contributions p3 Nice-to-have features size/S Small effort

Comments

@jimklimov
Copy link

Current Behavior

In my SBOM documents I have "components[] / externalReferences[]" as lists of objects like { "type": "vcs", "url": "scm:git:git@server:group/repo.git" } where the URL-ish part git@... does not have any schema like git+ssh:// or plain ssh:// (its just is as it comes from pom.xml files).

In Dependency-Track web-ui such links are rendered verbatim, e.g. scm:git:[email protected]:lukas-krecan/JsonUnit.git/json-unit-assertj so the browser leads nowhere - and there's even no schema prefix to register a handler for, I think (musing about scm:git:// prefix for users to somehow deal with if desired, or smart rewrite into the more standard git+ssh://[email protected]:lukas-krecan/JsonUnit.git/json-unit-assertj right away?)

Also note that URL entries mis-written as just git@... without an scm:git:... prefix are rendered as relative links under the Dependency-Track server root URL (e.g. http://localhost:8080/components/git@...), I suppose these links should always be absolute even if useless.

Steps to Reproduce

  1. Upload a BOM file with some non-HTTP VCS URLs for components
  2. Go to Component details in Web-UI
  3. On the right, open a drop-down for links; explore those marked VCS

Expected Behavior

  • VCS URLs are always emitted as absolute in HTML markup (VCS link strings relative to DT server are certainly useless)
  • If possible, ensure a standard schema prefix that applications/browsers could register OS handlers for, and open a suitable client application/IDE/...
  • Perhaps (have a toggle to) assume that git@... links without a prefix/schema mean git+ssh:// in fact

Dependency-Track Version

4.11.7

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

@jimklimov jimklimov added defect Something isn't working in triage labels Sep 17, 2024
@jimklimov jimklimov changed the title SCM URLs for git@server:repo (without an explicit schema like ssh:// do not render right SCM URLs for git@server:repo (without an explicit schema like ssh://) do not render right Sep 17, 2024
@nscuro nscuro transferred this issue from DependencyTrack/dependency-track Sep 17, 2024
@nscuro
Copy link
Member

nscuro commented Sep 17, 2024

For well-known patterns and hosts we can probably re-write those links before rendering (i.e. git+ssh://github.com -> https://github.com. However that will not always work, for example if the VCS host uses non-standard ports for HTTPS or SSH. Rewriting git+ssh://example.com:2222 to https://example.com:2222 might simply not be correct.

In cases where we don't recognize the protocol as "linkable", and we also cannot re-write it, we should probably render it as non-clickable string instead.

@nscuro nscuro added p3 Nice-to-have features good first issue Good for newcomers size/S Small effort and removed in triage labels Sep 17, 2024
@jimklimov
Copy link
Author

jimklimov commented Sep 17, 2024

I suppose different toggles can be made (or sed-like replacement regexes for users to edit), but I did not mean rewriting ssh git URLs into http(s) at unspecified ports - not out of the box.

Internally we use client certificate based auth for HTTPS GitLab, so checkouts over HTTP are a no-go with standard client; over SSH are easy however. So no schema replacement here.

What I meant was to add a schema prefix (maybe guess per ^git@.* match, or use the ^scm:SCHEMANAME: info from valid BOM entry contents) for VCS "URLs" that had no schema originally.

If the href is currently unclickable - so be it (that's something that URL handler registration in browser/OS can address independently of DT).

@leec94 leec94 added the hacktoberfest Issues eligible for Hacktoberfest contributions label Sep 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
defect Something isn't working good first issue Good for newcomers hacktoberfest Issues eligible for Hacktoberfest contributions p3 Nice-to-have features size/S Small effort
Projects
None yet
Development

No branches or pull requests

3 participants