Dependencies Pages and Dynamic Analysis Not Populating Data

[yasmin259]

Hi,

I am experiencing an issue where the Dependencies page consistently shows an empty view when selecting any dependency, as shown in the attached screenshot. I followed the manual instructions (Data collected by goals: steady:a2c, steady:t2c, and test), and all three commands ran successfully without any errors.

Could you please advise if there are any known issues or suggest possible solutions?

Thank you!

[serenaponta]

Hi @yasmin259 ,

thanks for trying Eclipse Steady!
Did you run the goal steady:app before any of the three you listed? The goal "app" must always be executed upfront as it's the one collecting the information of all dependencies (and their constructs).

[yasmin259]

Hi Serena,

Yes, I always run the steady:app goal as a first step before running the other goals I mentioned and it also runs without any issue.

One more thing please, I was referring to the Steady user manual for guidance, however, now I am getting a 404 File Not Found error. The page was previously accessible, but it seems to be missing now.

Could you let me know if the link has changed or if there’s an alternative way to access the content?
Thank you!

[serenaponta]

Hi @@yasmin259

could you please share the console log when running steady:app?
During the goal execution the client invokes the backend to check if libraries (by digest) are already known an uploads them (with all their constructs) if they are not yet known.

I will check what happened with the docs as soon as i can. In the meantime, most of the content comes from https://github.com/eclipse-steady/steady/tree/master/docs/public/content/user (the vulnerability db part is a sibling folder).

Thank you!

[yasmin259]

Hi Serena,

Thank you very much for the support, I am attaching the output of the steady:app goal for 2 different projects I was analyzing.

steady_app_output.txt

steady_app2_output.txt

[serenaponta]

The logs look good and, as you wrote, you already ran those, in fact the client checks whether the backend already knows the libraries and it does (backend returns 200 instead of 404):
HTTP GET [uri=http://localhost:8033/backend/libs/9420BA32C29217B54EEBD26FF7F9234D31C3FBB2, tenant=603EFBA1EA9B98ADB4B548682597E6D0]
HTTP GET completed with response code [200] in [00.022 ms] (proxy=false)

Part of the data the fills the table "Library size and application specific use" comes from the following endpoint /backend/apps////deps

Could you check the data coming from the backend to ensure that for a given dependency (by digest), it contains numbers greater than 0 for the field "constructTypeCounters"?

E.g.:
{"lib":
{"digest":"16CF5A6B78951F50713D29BFAE3230A611DC01F0",
...
"constructTypeCounters":{"ENUM":4,"INIT":18,"CONS":305,"METH":1165,"MODU":0,"countTotal":1720,"FUNC":0,"PACK":22,"CLASS":206,"countExecutable":1488}}

You can run something like :
curl -X GET "http://localhost:8033/backend/apps////deps" -H "X-Vulas-Space:"
replacing the application group artifact and version and providing the token you got when you created a workspace.
You can also use the swagger ui at /backend/swagger-ui.html

If the backend returns such data, could you inspect the frontend (F12 in chrome) and check whether some network calls are failing?

[yasmin259]

Hi Serena,

I ran the curl command you provided, and the output were non-zero for the "constructTypeCounters".

I also inspected the network tab in the browser, and all the requests returned a 200 OK status, indicating they were successful. I’m not entirely sure if there are specific details I should focus on in the network logs. So far, everything appears to be completing successfully.

Looking forward to your guidance. Thanks.

[serenaponta]

Hi @yasmin259

the data that populates the table named "Library size and application-specific use" comes from the API you just tested.
It seems that the backend is working fine and you have non-zero values from the API. Is some error logged in the console of the browser when you open the dependency details for a dependency?

Also note that the documentation is now available at https://eclipse-steady.github.io/steady/

[yasmin259]

Hi @serenaponta

Thank you for your response.

I checked the Response tab under the Network section in the browser’s and found the content in the attached file. I wanted to ask if this data is considered valid, as it doesn’t seem to be rendered in the frontend UI.

Response tab.txt

Also, I’m particularly interested in the table that shows the non-vulnerable library releases of the dependency. I couldn't find it in the API response I inspected, so I wanted to check if it's being fetched differently.

Thanks again for your support, and I appreciate the documentation link—it’s been really helpful!

[serenaponta]

Hi @yasmin259

yes, the data in the non-vulnerable library releases table is fetched in different APIs. The entry point is the API:

/backend/libids/g/a?latest=false&cache=true&greaterThanVersion=v&secureOnly=true

you should have a corresponding call in the Network tab. Does it return 200 with data in the response body?

Then the update metrics are retrieved with a call for each library in the table (each row) using

backend/apps/g/a/v/deps/sha1/updateMetrics

[yasmin259]

Hi @serenaponta

Thanks for the clarification. I checked the Network tab as you suggested:

I did not find any request matching /backend/libids/g/a?latest=false&cache=true&greaterThanVersion=v&secureOnly=true, even after filtering for /libids — nothing came up.

All other requests also returned 200, except for one 503 error (browser.json); I have attached a screenshot of that below in case it’s relevant.

Thanks again!

[serenaponta]

Hi @yasmin259 ,

i think I was able to reproduce the issue. The first request (the one used to populate the first table) didn't contain the field constructTypeCounters, it only contains reachableConstructTypeCounters and tracedConstructTypeCounters. As you are interested in the second table, as a temporary fix you can add the following if condition wrapping lines 108 to 118 in ArchiveDetail.controller.js as shown below, then the table with non-vulnerable versions will be populated.

In any case the API calls returning the data populating such table comes out of the following call

curl -X POST "http://localhost:8033/backend/apps/"g"/"a"/"v"/deps/"sha1"/updateMetrics" -H "X-Vulas-Space:TOKEN" -H "Content-Type: application/json" -d '{"group": "G-tocompare", "artifact": "A-tocompare", "version": "V-tocompare"}'

and the versions to compare to comes from

backend/libids/"g"/"a"?latest=false&cache=true&greaterThanVersion="v"&secureOnly=true

[yasmin259]

Thank you so much @serenaponta, I was able to get the data populated in the table.

I really appreciate your support.