Permissions for "Download BOM"

[msymons]

Current Behavior:

Functionality for downloading a BOM via the Front-End was introduced in v4.4.0. Even though it is query-only in it's nature, it is controlled by the permission PORTFOLIO_MANAGEMENT. This is inappropriate because this permission is for the "the creation, modification, and deletion of data in the portfolio"

Steps to Reproduce:

Using a Managed User, it can be confirmed by adding/removing permissions that "Download BOM" (displayed as a button on the Components tab of a project page) is enabled via PORTFOLIO_MANAGEMENT

Expected Behavior:

The "Download BOM" button provides 3 options:

• Inventory: should be usable via VIEW_PORTFOLIO permission
• Inventory with Vulnerabilities: should be usable via VIEW_PORTFOLIO permission
• Vulnerability Exploitability Exchange (VEX): should be usable via VIEW_VULNERABILITY permission

Environment:

• Dependency-Track Version: 4.4.1
• Client Browser: Firefox
• Client O/S: Windows 10.

Additional Details:

I presume that a future version of DT will expand the download choices with a forth option to dowload CycloneDX 1.4 "Inventory with VEX". If so, I would expect that to be covered by VIEW_VULNERABILITY

[Robbilie]

the api server seems to already require the view_portfolio permission, just the frontend then?

https://github.com/DependencyTrack/dependency-track/blob/4.7.1/src/main/java/org/dependencytrack/resources/v1/BomResource.java#L95

ill create a PR for that…

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.