Repository: DependencyTrack/dependency-track (java)

Issue:
Uncaught internal server error java.lang.NumberFormatException: For input string: ""
### Current Behavior:

I get this error in the Docker Log Terminal:

    2022-10-11 10:34:46,950 ERROR [GlobalExceptionHandler] Uncaught internal server error
    java.lang.NumberFormatException: For input string: ""
           at java.base/java.lang.NumberFormatException.forInputString(Unknown Source)
           at java.base/java.lang.Integer.parseInt(Unknown Source)
           at java.base/java.lang.Integer.valueOf(Unknown Source)
           at org.dependencytrack.model.Finding.getCwes(Finding.java:169)
(see attachement for complete stack trace).

And now the vulnerabilities list of the test project I added is not shown any more (0 entries, before were about 40).

### Steps to Reproduce:

I changed some components, added internal vulnerabilities and added a CPE to the project...

### Expected Behavior:

Do not produce uncaught internal server errors

### Environment:
  
  - Dependency-Track Version: 4.5.0
  - Distribution: Docker
  - BOM Format & Version: CycloneDX 
  - Database Server: Docker
  - Browser: Firefox

[Stacktrace.txt](https://github.com/DependencyTrack/dependency-track/files/9754273/Stacktrace.txt)


Pull request:
Fix NumberFormatException when assembling CWE list for findings
Fixes #2029

Signed-off-by: nscuro <nscuro@protonmail.com>

Patch:
diff --git a/docs/_posts/2022-xx-xx-v4.6.0.md b/docs/_posts/2022-xx-xx-v4.6.0.md
index f28e4f61d..13055f550 100644
--- a/docs/_posts/2022-xx-xx-v4.6.0.md
+++ b/docs/_posts/2022-xx-xx-v4.6.0.md
@@ -48,6 +48,7 @@ type: major
 * Resolved defect that caused horizontal scroll bars to be displayed unnecessarily in the UI - [#248]
 * Resolved defect that made it impossible to provide component hashes in uppercase - [#1174]
 * Resolved defect that prevented vulnerabilities in PHP components to be identified based on GitHub Advisories data - [#1998]
+* Resolved defect that caused a `NumberFormatException` to be thrown when resolving CWEs for findings - [#2029]
 * Resolved projects search filter not working when viewing projects by tag - [#405]
 * Resolved notifications with group `NEW_VULNERABLE_DEPENDENCY` not working at all - [#1611]
 * Resolved multiple minor UI defects related to API key management - [#240]
@@ -155,6 +156,7 @@ For a complete list of changes, refer to the respective GitHub milestones:
 [#1948]: https://github.com/DependencyTrack/dependency-track/issues/1948
 [#1998]: https://github.com/DependencyTrack/dependency-track/issues/1998
 [#2005]: https://github.com/DependencyTrack/dependency-track/issues/2005
+[#2029]: https://github.com/DependencyTrack/dependency-track/issues/2029
 
 [containers]: {{ site.baseurl }}{% link _docs/getting-started/deploy-docker.md %}
 [executable WAR]: {{ site.baseurl }}{% link _docs/getting-started/deploy-exewar.md %}
diff --git a/src/main/java/org/dependencytrack/model/Finding.java b/src/main/java/org/dependencytrack/model/Finding.java
index 85e756616..fb22d3897 100644
--- a/src/main/java/org/dependencytrack/model/Finding.java
+++ b/src/main/java/org/dependencytrack/model/Finding.java
@@ -162,19 +162,23 @@ public class Finding implements Serializable {
         }
     }
 
-    private List<Cwe> getCwes(final Object value) {
-        if (value instanceof String) {
-            final String cweIds = (String)value;
+    static List<Cwe> getCwes(final Object value) {
+        if (value instanceof final String cweIds) {
             if (StringUtils.isBlank(cweIds)) {
                 return null;
             }
             final List<Cwe> cwes = new ArrayList<>();
             for (final String s : cweIds.split(",")) {
-                final Cwe cwe = CweResolver.getInstance().lookup(Integer.valueOf(s));
-                if (cwe != null) {
-                    cwes.add(cwe);
+                if (StringUtils.isNumeric(s)) {
+                    final Cwe cwe = CweResolver.getInstance().lookup(Integer.valueOf(s));
+                    if (cwe != null) {
+                        cwes.add(cwe);
+                    }
                 }
             }
+            if (cwes.isEmpty()) {
+                return null;
+            }
             return cwes;
         } else {
             return null;


Test patch:
diff --git a/src/test/java/org/dependencytrack/model/FindingTest.java b/src/test/java/org/dependencytrack/model/FindingTest.java
index 195710914..01ff76f86 100644
--- a/src/test/java/org/dependencytrack/model/FindingTest.java
+++ b/src/test/java/org/dependencytrack/model/FindingTest.java
@@ -19,13 +19,18 @@
 package org.dependencytrack.model;
 
 import org.dependencytrack.PersistenceCapableTest;
+import org.dependencytrack.persistence.CweImporter;
 import org.dependencytrack.tasks.scanners.AnalyzerIdentity;
 import org.junit.Assert;
+import org.junit.Before;
 import org.junit.Test;
+
 import java.util.Date;
 import java.util.Map;
 import java.util.UUID;
 
+import static org.assertj.core.api.Assertions.assertThat;
+
 public class FindingTest extends PersistenceCapableTest {
 
     private UUID projectUuid = UUID.randomUUID();
@@ -35,6 +40,12 @@ public class FindingTest extends PersistenceCapableTest {
             "vuln-subtitle", "vuln-description", "vuln-recommendation", Severity.HIGH, "7.2", "8.4",
             "0.5", "0.9", null, AnalyzerIdentity.INTERNAL_ANALYZER, attributedOn, null, null, AnalysisState.NOT_AFFECTED, true);
 
+
+    @Before
+    public void setUp() throws Exception {
+        new CweImporter().processCweDefinitions();
+    }
+
     @Test
     public void testComponent() {
         Map map = finding.getComponent();
@@ -70,4 +81,27 @@ public class FindingTest extends PersistenceCapableTest {
     public void testMatrix() {
         Assert.assertEquals(projectUuid + ":component-uuid" + ":vuln-uuid", finding.getMatrix());
     }
+
+    @Test
+    public void testGetCwes() {
+        assertThat(Finding.getCwes("787,79,,89,"))
+                .hasSize(3)
+                .satisfiesExactly(
+                        cwe -> assertThat(cwe.getCweId()).isEqualTo(787),
+                        cwe -> assertThat(cwe.getCweId()).isEqualTo(79),
+                        cwe -> assertThat(cwe.getCweId()).isEqualTo(89)
+                );
+    }
+
+    @Test
+    public void testGetCwesWhenInputIsEmpty() {
+        assertThat(Finding.getCwes("")).isNull();
+        assertThat(Finding.getCwes(",")).isNull();
+    }
+
+    @Test
+    public void testGetCwesWhenInputIsNull() {
+        assertThat(Finding.getCwes(null)).isNull();
+    }
+
 }