Return error response in submitBom

When an error occurs, there is no possibility for the calling code to know the details.

In my case, I'd like to be able to log error response body, in particular to be able to know which validation is KO when uploading a SBOM to DependencyTrack (that recently enabled JsonSchema validation on upload).

Signed-off-by: Maxime Robert <[email protected]>
Signed-off-by: Maxime Robert <[email protected]>

Author: marob

bin/cdxgen.js

@@ -676,7 +676,9 @@ const checkPermissions = (filePath) => {
   if (options.serverUrl && options.serverUrl != true && options.apiKey) {
     try {
       const dbody = await submitBom(options, bomNSData.bomJson);
-      console.log("Response from server", dbody);
+      if (!dbody?.body?.errors) {
+        console.log("Response from server", dbody);
+      }
     } catch (err) {
       console.log(err);
     }

index.js

@@ -6194,6 +6194,7 @@ export async function createBom(path, options) {
  *
  * @param {Object} args CLI args
  * @param {Object} bomContents BOM Json
+ * @return {Promise<{ token: string } | { body: { errors: string[] } } | undefined>} a promise with a token (if request was successful), a body with errors (if request failed) or undefined (in case of invalid arguments)
  */
 export async function submitBom(args, bomContents) {
   const serverUrl = `${args.serverUrl.replace(/\/$/, "")}/api/v1/bom`;
@@ -6277,11 +6278,11 @@ export async function submitBom(args, bomContents) {
         console.log(
           "Unable to submit the SBOM to the Dependency-Track server using POST method",
         );
-        console.log(error);
       }
     } else {
       console.log("Unable to submit the SBOM to the Dependency-Track server");
-      console.log(error);
     }
+    console.log(error.response?.body);
+    return error.response;
   }
 }

server.js

@@ -131,10 +131,12 @@ const start = (options) => {
     if (!filePath) {
       res.writeHead(500, { "Content-Type": "application/json" });
       return res.end(
-        "{'error': 'true', 'message': 'path or url is required.'}\n",
+        JSON.stringify({
+          error: true,
+          message: "path or url is required.",
+        }),
       );
     }
-    res.writeHead(200, { "Content-Type": "application/json" });
     let srcDir = filePath;
     if (filePath.startsWith("http") || filePath.startsWith("git")) {
       srcDir = gitClone(filePath, reqOptions.gitBranch);
@@ -145,6 +147,22 @@ const start = (options) => {
     if (reqOptions.requiredOnly || reqOptions["filter"] || reqOptions["only"]) {
       bomNSData = postProcess(bomNSData, reqOptions);
     }
+    if (reqOptions.serverUrl && reqOptions.apiKey) {
+      console.log("Publishing SBOM to Dependency Track");
+      const response = await submitBom(reqOptions, bomNSData.bomJson);
+      const errorMessages = response?.body?.errors;
+      if (errorMessages) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+        return res.end(
+          JSON.stringify({
+            error: true,
+            message: "Unable to submit the SBOM to the Dependency-Track server",
+            detail: errorMessages,
+          }),
+        );
+      }
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
     if (bomNSData.bomJson) {
       if (
         typeof bomNSData.bomJson === "string" ||
@@ -155,10 +173,6 @@ const start = (options) => {
         res.write(JSON.stringify(bomNSData.bomJson, null, null));
       }
     }
-    if (reqOptions.serverUrl && reqOptions.apiKey) {
-      console.log("Publishing SBOM to Dependency Track");
-      submitBom(reqOptions, bomNSData.bomJson);
-    }
     res.end("\n");
     if (cleanup && srcDir && srcDir.startsWith(os.tmpdir()) && fs.rmSync) {
       console.log(`Cleaning up ${srcDir}`);

types/index.d.ts

@@ -260,6 +260,13 @@ export function createBom(path: string, options: any): any;
  *
  * @param {Object} args CLI args
  * @param {Object} bomContents BOM Json
+ * @return {Promise<{ token: string } | { body: { errors: string[] } } | undefined>} a promise with a token (if request was successful), a body with errors (if request failed) or undefined (in case of invalid arguments)
  */
-export function submitBom(args: any, bomContents: any): Promise<any>;
+export function submitBom(args: any, bomContents: any): Promise<{
+    token: string;
+} | {
+    body: {
+        errors: string[];
+    };
+} | undefined>;
 //# sourceMappingURL=index.d.ts.map