diff --git a/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java b/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java index f81bd6eba8..be76f59b7d 100644 --- a/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java +++ b/src/main/java/org/dependencytrack/parser/snyk/SnykParser.java @@ -59,8 +59,14 @@ public Vulnerability parse(JSONArray data, QueryManager qm, String purl, int cou if (vulnAttributes != null && vulnAttributes.optString("type").equalsIgnoreCase("package_vulnerability")) { // get the references of the data record (vulnerability) final JSONObject slots = vulnAttributes.optJSONObject("slots"); - if (slots != null && slots.optJSONArray("references") != null) { - vulnerability.setReferences(addReferences(slots)); + if (slots != null) { + var publishedTime = jsonStringToTimestamp(slots.optString("publication_time")); + if (publishedTime != null) { + vulnerability.setPublished(Date.from(publishedTime.toInstant())); + } + if (slots.optJSONArray("references") != null) { + vulnerability.setReferences(addReferences(slots)); + } } vulnerability.setTitle(vulnAttributes.optString("title", null)); vulnerability.setDescription(vulnAttributes.optString("description", null)); diff --git a/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java b/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java index f42d67b94a..8551ff1e15 100644 --- a/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java +++ b/src/test/java/org/dependencytrack/tasks/scanners/SnykAnalysisTaskTest.java @@ -302,6 +302,7 @@ public void testAnalyzeWithRateLimiting() { assertThat(vulnerability.getSeverity()).isEqualTo(Severity.HIGH); assertThat(vulnerability.getCreated()).isInSameDayAs("2022-10-31"); assertThat(vulnerability.getUpdated()).isInSameDayAs("2022-11-26"); + assertThat(vulnerability.getPublished()).isInSameDayAs("2022-10-31"); assertThat(vulnerability.getRecommendation()).contains("Upgrade the package version to 5.0.4,6.0.4 to fix this vulnerability"); assertThat(vulnerability.getAliases()).satisfiesExactly( alias -> {