PURL condition in Policy Management does not work

[kpe09]

Current Behavior

I was trying to create a policy using the "All" operator, which informs me if a component does not have an allowed license. When trying to exclude a component by its PURL, I'm still being notified, as if the policy is still violated. The violation can also be found in Policy Violation Audit.

Steps to Reproduce

1. Create a policy with the "All" operator that is violated if a component doesn't have an allowed license. (License group => is not => Allowed Licenses)
2. Add an exception for a component that violates this policy, by matching the PURL. (Packacke URL (PURL) => does not match => {PURL})

Expected Behavior

The policy should not be violated if the specified PURL matches with the component's PURL.

Dependency-Track Version

4.12.2

Dependency-Track Distribution

Container Image

Database Server

N/A

Database Server Version

No response

Browser

N/A

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this defect was already reported