Email Notification "PROJECT_AUDIT_CHANGE" - missing information

[JN-CSIRT]

Current Behavior

We've configured DT to send email alert "PROJECT_AUDIT_CHANGE" to specific email.
In received email we missin ALL needed information.
Here is the example of all received email alerts (depend on audit decision):

===========
Analysis Decision: Finding Resolved on Project: [PROJECT-NAME : PROJECT-NAME : PROJECT-VERSION]

---

Analysis Type: Project Analysis

Violation Analysis State:
Suppressed:
Policy:
Policy Violation State:
Policy Condition: subject == && value

Component:
Component URL: http://xxx.yyy.zzz:8080/component/?uuid=
Project:
Description:
Project URL: http://xxx.yyy.zzz:8080/projects/

---

An analysis decision was made to a finding affecting a project

---

2023-01-28T22:32:40.598317734

That it.

We used default Template:

{% elseif notification.group == "PROJECT_AUDIT_CHANGE" %}
Analysis Type: Project Analysis
{% if subject.analysis is null %}{% for comment in subject.violationAnalysis.analysisComments %} {% if loop.last and comment.commenter is not null %}
Commenter: {{ comment.commenter}}{% endif %}{% endfor %}
Violation Analysis State: {{ subject.violationAnalysis.analysisState }}
Suppressed: {{ subject.violationAnalysis.suppressed }}
Policy: {{ subject.policyViolation.policyCondition.Policy.name }}
Policy Violation State: {{ subject.policyViolation.policyCondition.Policy.violationState }}
Policy Condition: subject == {{ subject.policyViolation.policyCondition.subject }} && value {{ subject.policyViolation.policyCondition.operator }} {{ subject.policyViolation.policyCondition.value }}
{% else %}{% for comment in subject.analysis.analysisComments %} {% if loop.last and comment.commenter is not null %}
Commenter: {{ comment.commenter}}{% endif %}{% endfor %}
Analysis State: {{ subject.analysis.analysisState }}
Suppressed: {{ subject.analysis.suppressed }}
Vulnerability ID: {{ subject.vulnerability.vulnId }}
Vulnerability URL: {{ baseUrl }}/vulnerability/?source={{ subject.vulnerability.source }}&vulnId={{ subject.vulnerability.vulnId }}
Severity: {{ subject.vulnerability.severity }}
Source: {{ subject.vulnerability.source }}
{% endif %}
Component: {{ subject.component.toString }}
Component URL: {{ baseUrl }}/component/?uuid={{ subject.component.uuid }}
Project: {{ subject.component.project.toString }}
Description: {{ subject.component.project.description }}
Project URL: {{ baseUrl }}/projects/{{ subject.component.project.uuid }}
{% if notification.subject.affectedProjects|length > 1%}

Other affected projects:
{% for affectedProject in notification.subject.affectedProjects %}{% if not (affectedProject.uuid == subject.component.project.uuid) %}
Project: [{{ affectedProject.name }} : {{ affectedProject.version }}]
Project URL: {{ baseUrl }}/projects/{{ affectedProject.uuid }}
{% endif %}

==========

Emails with new found CVE with default template are received with all information defined in template. So it should work.

Steps to Reproduce

1. Configure to send email alert "PROJECT_AUDIT_CHANGE"
2. Perform any CVE audit
3. check received emails

Expected Behavior

The emailed Alert contains all configured and required project, components, analysis states and correct URL links

Dependency-Track Version

4.7.0

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

No response

Browser

Mozilla Firefox

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[JN-CSIRT]

Hello is there any progress?

[JN-CSIRT]

Hi,
as I see there no progress - is it overlooked? Should I create new Issue to get it checked?

[syalioune]

Hello @JN-CSIRT

I'm not able to reproduce your issue with v4.7.0 and default templates.

Could you please follow the steps below and share the results ?

• Share your notification publishers configuration

curl --location 'http://<DT_HOST>:<DT_PORT>/api/v1/notification/publisher' --header 'X-API-Key: <API_KEY>'

• Share your notification rules configuration

curl --location 'http://<DT_HOST>:<DT_PORT>/api/v1/notification/rule' --header 'X-API-Key: <API_KEY>'

• Upload attached SBOM sbom-issue-2420.cdx.txt
• Audit CVE-2019-15703 to resolved
• Share screenshot of audit part after GUI refresh (to make sure the audit is not transient)
• Share received mail

[JN-CSIRT]

Hello, thanks a lot for answer,
Here is requested information:

1. There I got an error:
   <noscript> <strong>We're sorry but this app doesn't work properly without JavaScript enabled. Please enable it to continue.</strong> </noscript>

Here is the Screenshot:

2. Same error
   <noscript> <strong>We're sorry but this app doesn't work properly without JavaScript enabled. Please enable it to continue.</strong> </noscript>

Screenshot:

3. SBOM uploaded:
   

4. Audit Part screenshot:
   

5. Email received:
   

6. New CVE Finding Alert per Email in other project is fully functional:

[JN-CSIRT]

Got the Notifications and Rules via Swagger Interface:
notification.rules.json.txt
notification.json.txt

[syalioune]

Thanks I'll look into it later in the day.

[syalioune]

I was able to reproduce the issue

It happens when notifications are restricted to specific projects and especially for PROJECT_AUDIT_CHANGE.
It's a little missed code impact from #975 due to a data model change. The default template is OK

[JN-CSIRT]

It's true - I've delete Project limitations than it works.
Now email is complete - we receive full information - project, component, audit change, etc.