NPE on BomUploadProcessingTask at StateManagerImpl.transitionReadField

Current Behavior:

Once in while when a Jenkins uploads synchronously the generated BOM to dependency track we fail to get a response from Dependency-Track

On Dependency-Track we see a NullPointerException.

Steps to Reproduce:

Occurs randomly when uploading a BOM generated by @cyclonedx/bom by appending its results to the results generated by cyclonedx-gradle-plugin.

Environment:

• Dependency-Track Version: v3.5.1
• Distribution: Docker
• BOM Format & Version: CycloneDX BOM
• Database Server: PostgreSQL
• Browser: N/A

Additional Details:

Stack Trace:

09:53:56.922 INFO [MetricsUpdateTask] Executing metrics update on project: d90cf0bc-71ee-4140-8cbb-a542eafeda44
10:29:48.913 INFO [BomUploadProcessingTask] Processing CycloneDX BOM uploaded to project: fea6f545-c45c-43d1-a6df-a9821f544187
10:30:08.576 INFO [BomUploadProcessingTask] Processed 1215 components uploaded to project fea6f545-c45c-43d1-a6df-a9821f544187
10:30:08.580 ERROR [LoggableUncaughtExceptionHandler] An unknown error occurred in an asynchronous event or notification thread
java.lang.NullPointerException: null
        at org.datanucleus.state.StateManagerImpl.transitionReadField(StateManagerImpl.java:1047)
        at org.datanucleus.state.StateManagerImpl.isLoaded(StateManagerImpl.java:4091)
        at org.dependencytrack.model.Component.dnGetpurl(Component.java)
        at org.dependencytrack.model.Component.getPurl(Component.java:355)
        at org.dependencytrack.tasks.VulnerabilityAnalysisTask.inform(VulnerabilityAnalysisTask.java:61)
        at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:97)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)

[msymons]

I think that I have seen the error StateManagerImpl.transitionReadField for projects that do NOT have synchronous mode.

My DT is now tracking 177 projects.

• At least 120 use scripted pipelines based on name and version, with no synchronous mode (waiting for fix/enhancement in DT v3.6).
• About 12 projects use declarative pipelines with synchronous mode,
• The remaining projects are Maven/Freestyle and use synchronous mode.

If the exception log in my earlier message is linked to project 7b2edc73-9b4a-4a10-8178-24f6fa3cb5df then that project is one that is not using synchronous mode.

For this example…

2019-06-16 21:44:34,233 [] INFO [org.dependencytrack.tasks.MetricsUpdateTask] Executing metrics update on project: 46fcb625-2602-4996-aa06-b3c5774ab9f2
2019-06-16 21:44:37,652 [] INFO [org.dependencytrack.tasks.BomUploadProcessingTask] Processed 188 components uploaded to project 1908f306-2323-460e-8447-fd69f1b6c8d3
2019-06-16 21:44:37,659 [] ERROR [alpine.event.framework.LoggableUncaughtExceptionHandler] An unknown error occurred in an asynchronous event or notification thread
java.lang.NullPointerException: null
	at org.datanucleus.state.StateManagerImpl.transitionReadField(StateManagerImpl.java:1047)
	at org.datanucleus.state.StateManagerImpl.isLoaded(StateManagerImpl.java:4091)
	at org.dependencytrack.model.Component.dnGetpurl(Component.java)

…I would assume that the project of interest is 1908f306-2323-460e-8447-fd69f1b6c8d3. If so, that’s also not using synchronous mode.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.