Metadata component CPE not recognized in BOM upload

[eugenhoffmann]

Current Behavior

The CPE value defined in metadata component not being recognized when uploading a BOM file.
However, the defined PURL address is recognized and set correctly in the project

Steps to Reproduce

1. Upload the BOM file via "Upload BOM" button.
2. Click on "View Details"
3. Navigate to "Identity"

Expected Behavior

The CPE should be set in the project, just like the PURL address is correctly set when used in the metadata component

Dependency-Track Version

4.11.7

Dependency-Track Distribution

Container Image

Database Server

PostgreSQL

Database Server Version

15.5

Browser

Google Chrome

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported

[nscuro]

Good catch, CPE is not being set here:

dependency-track/src/main/java/org/dependencytrack/tasks/BomUploadProcessingTask.java

Lines 324 to 340 in 16ef236

	if (project != null) {
	persistentProject.setBomRef(project.getBomRef()); // Transient
	hasChanged |= applyIfChanged(persistentProject, project, Project::getAuthors, persistentProject::setAuthors);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getPublisher, persistentProject::setPublisher);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getManufacturer, persistentProject::setManufacturer);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getSupplier, persistentProject::setSupplier);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getClassifier, persistentProject::setClassifier);
	// TODO: Currently these properties are "decoupled" from the BOM and managed directly by DT users.
	// Perhaps there could be a flag for BOM uploads saying "use BOM properties" or something?
	// changed |= applyIfChanged(project, metadataComponent, Project::getGroup, project::setGroup);
	// changed |= applyIfChanged(project, metadataComponent, Project::getName, project::setName);
	// changed |= applyIfChanged(project, metadataComponent, Project::getVersion, project::setVersion);
	// changed |= applyIfChanged(project, metadataComponent, Project::getDescription, project::setDescription);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getExternalReferences, persistentProject::setExternalReferences);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getPurl, persistentProject::setPurl);
	hasChanged |= applyIfChanged(persistentProject, project, Project::getSwidTagId, persistentProject::setSwidTagId);
	}