Return 404 instead of 500 for unknown advisory pages - #2424
Open
MGpromax wants to merge 1 commit into
Open
Conversation
AdvisoryV2QuerySet.latest_for_avid() used .get() and raised an unhandled DoesNotExist for an unknown avid, so advisory detail URLs such as /advisories/pysec/PYSEC-3000-0 returned a server error. All three detail views calling it already check for a None return and raise Http404, so return None from the queryset method instead. Closes aboutcode-org#2396 Signed-off-by: Manoj Gowda <manojgowdabs18@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2396
AdvisoryV2QuerySet.latest_for_avid()used.get(), which raises an unhandledAdvisoryV2.DoesNotExistfor an unknown avid -- so/advisories/pysec/PYSEC-3000-0returned a 500. All three detail views that call it (AdvisoryDetails,AdvisoryPackagesDetails,AdvisoryPackageCommitPatchDetails) already doif not advisory: raise Http404(...), i.e. they were written against a returns-None contract the queryset method didn't honor. The fix makes it returnNonevia.filter(...).first().Added regression tests asserting 404 for unknown avids on the advisory detail and advisory packages pages (with the altcha bot-protection middleware bypassed via the session, following the middleware's own logic).
Tests: the new tests plus
test_same_avid_different_content_id.py(which exerciseslatest_for_avidfor existing avids) all pass against postgres locally -- 8 passed.