Lightrun
question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

4.0.0-beta.2: BOM upload fails with 'Cannot parse date' error

See original GitHub issue

Current Behavior:

Uploading a BOM produced by cyclonedx-node-module 2.0.2 to DependencyTrack 4.0.0-beta.2 fails with the following log:

org.cyclonedx.exception.ParseException: com.thoughtworks.xstream.converters.ConversionException: Cannot parse date 
INFO [BomUploadProcessingTask] Processing CycloneDX BOM uploaded to project: 4ba56406-e56a-491e-afdd-cb3da5996131
ERROR [BomUploadProcessingTask] Error while processing bom
org.cyclonedx.exception.ParseException: com.thoughtworks.xstream.converters.ConversionException: Cannot parse date
---- Debugging information ----
message             : Cannot parse date
date                : 2020-11-17T10:52:44.281Z
class               : java.util.Date
required-type       : java.util.Date
converter-type      : com.thoughtworks.xstream.converters.SingleValueConverterWrapper
wrapped-converter   : com.thoughtworks.xstream.converters.basic.DateConverter
Default date pattern: yyyy-MM-dd HH:mm:ss.S z
Default era date pattern: yyyy-MM-dd G HH:mm:ss.S z
Alternative date pattern: yyyy-MM-dd HH:mm:ss.S z
Alternative date pattern[1]: yyyy-MM-dd HH:mm:ss.S a
Alternative date pattern[2]: yyyy-MM-dd HH:mm:ssz
Alternative date pattern[3]: yyyy-MM-dd HH:mm:ss z
Alternative date pattern[4]: yyyy-MM-dd'T'HH:mm:ss.SX
Alternative date pattern[5]: yyyy-MM-dd'T'HH:mm:ssX
Alternative date pattern[6]: yyyy-MM-dd'T'HH:mmX
Alternative date pattern[7]: yyyy-MM-dd HH:mm:ssa
path                : /bom/metadata/timestamp
line number         : 4
class[1]            : org.cyclonedx.model.Metadata
required-type[1]    : org.cyclonedx.model.Metadata
converter-type[1]   : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
class[2]            : org.cyclonedx.model.Bom
required-type[2]    : org.cyclonedx.model.Bom
version             : not available
-------------------------------
        at org.cyclonedx.parsers.XmlParser.parse(XmlParser.java:109)
        at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:84)
        at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:99)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: com.thoughtworks.xstream.converters.ConversionException: Cannot parse date
---- Debugging information ----
message             : Cannot parse date
date                : 2020-11-17T10:52:44.281Z
class               : java.util.Date
required-type       : java.util.Date
converter-type      : com.thoughtworks.xstream.converters.SingleValueConverterWrapper
wrapped-converter   : com.thoughtworks.xstream.converters.basic.DateConverter
Default date pattern: yyyy-MM-dd HH:mm:ss.S z
Default era date pattern: yyyy-MM-dd G HH:mm:ss.S z
Alternative date pattern: yyyy-MM-dd HH:mm:ss.S z
Alternative date pattern[1]: yyyy-MM-dd HH:mm:ss.S a
Alternative date pattern[2]: yyyy-MM-dd HH:mm:ssz
Alternative date pattern[3]: yyyy-MM-dd HH:mm:ss z
Alternative date pattern[4]: yyyy-MM-dd'T'HH:mm:ss.SX
Alternative date pattern[5]: yyyy-MM-dd'T'HH:mm:ssX
Alternative date pattern[6]: yyyy-MM-dd'T'HH:mmX
Alternative date pattern[7]: yyyy-MM-dd HH:mm:ssa
path                : /bom/metadata/timestamp
line number         : 4
class[1]            : org.cyclonedx.model.Metadata
required-type[1]    : org.cyclonedx.model.Metadata
converter-type[1]   : com.thoughtworks.xstream.converters.reflection.ReflectionConverter
class[2]            : org.cyclonedx.model.Bom
required-type[2]    : org.cyclonedx.model.Bom
version             : not available
-------------------------------
        at com.thoughtworks.xstream.converters.basic.DateConverter.fromString(DateConverter.java:230)
        at com.thoughtworks.xstream.converters.SingleValueConverterWrapper.fromString(SingleValueConverterWrapper.java:41)
        at com.thoughtworks.xstream.converters.SingleValueConverterWrapper.unmarshal(SingleValueConverterWrapper.java:49)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshallField(AbstractReflectionConverter.java:499)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.doUnmarshal(AbstractReflectionConverter.java:425)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshal(AbstractReflectionConverter.java:277)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshallField(AbstractReflectionConverter.java:499)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.doUnmarshal(AbstractReflectionConverter.java:425)
        at com.thoughtworks.xstream.converters.reflection.AbstractReflectionConverter.unmarshal(AbstractReflectionConverter.java:277)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:134)
        at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
        at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1487)
        at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1467)
        at com.thoughtworks.xstream.XStream.fromXML(XStream.java:1347)
        at org.cyclonedx.parsers.XmlParser.parse(XmlParser.java:106)
        ... 5 common frames omitted

Steps to Reproduce:

Create a BOM using cyclonedx-node-module@2.0.2, and upload it to DT 4.0-beta.2.

Expected Behavior:

The uploaded BOM is processed successfully.

Environment:

  • Dependency-Track Version: 4.0.0-beta.2
  • Distribution: Executable WAR
  • BOM Format & Version: XML, v1.2
  • Database Server: MSSQL
  • Browser: N/A

Additional Details:

The BOM I got which consistently reproduces this issue looks like this:

<?xml version="1.0" encoding="utf-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.2" version="1">
    <metadata>
        <timestamp>2020-11-17T10:52:44.281Z</timestamp>
        <tools>
            <tool>
                <vendor>CycloneDX</vendor>
                <name>Node.js module</name>
                <version>2.0.2</version>
            </tool>
        </tools>
        <component type="library">
            <name>irrelevant</name>
        </component>
    </metadata>
    <components>
      <!-- irrelevant, redacted -->
    </components>
</bom>

The value under bom/metadata/timestamp seems to trigger this issue.

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Comments:5 (2 by maintainers)

github_iconTop GitHub Comments

1reaction
nil4commented, Nov 20, 2020

Confirmed fixed in 4.0.0-beta.3 – thank you @stevespringett

1reaction
msymonscommented, Nov 17, 2020

I reported this in proj-dependency-track-beta Slack a couple of weeks ago and @stevespringett posted this:

The most recent version of CycloneDX Core Java module, used in 4.0.0.beta.2, has a defect affecting ISO 8601 date formats. This may prevent CycloneDX v1.2 SBOMs from being processed correctly. This has been corrected and a fix will be included in beta.3.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Firebase Android SDK Release Notes
Note that when using the Firebase Android BoM, you don't specify individual library ... Fixed a parsing error in MultiFactorInfo. ... to this...
Read more >
Unity 2022.1.0b3
Fixed in 2022.1.0b4. Bugreporter: Bug reporter upload of report fails consistently with non actionable error message (1358568). Editor: Fixed ...
Read more >
BigQuery fails on parsing dates in M/D/YYYY format from CSV ...
I'm attempting to create a BigQuery table from a CSV file in Google Cloud Storage. I'm explicitly defining the schema for the load...
Read more >
Error 'failed to parse date' for Date Time Field with Data Loader
Updates to Domain Traffic Infrastructure on December 2, 2022 Read More ... Error converting value to correct data type: Failed to parse date: ......
Read more >
Dataloader error : Error converting value to correct data type
You should check your csv carefully. It seems that there's YES value instead of date value. Also be sure that your date format...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found
Previous page

Uploading a CycloneDX bom with an extension at the end fails with a stacktrace

Next page

Add Packagist security advisories parser