Return 404 instead of 500 for unknown advisory pages

AdvisoryV2QuerySet.latest_for_avid() used .get() and raised an
unhandled DoesNotExist for an unknown avid, so advisory detail URLs
such as /advisories/pysec/PYSEC-3000-0 returned a server error. All
three detail views calling it already check for a None return and
raise Http404, so return None from the queryset method instead.

Closes #2396

Signed-off-by: Manoj Gowda <manojgowdabs18@gmail.com>

Author: MGpromax

vulnerabilities/models.py

@@ -2926,7 +2926,9 @@ def to_dict(self):
 
 class AdvisoryV2QuerySet(BaseQuerySet):
     def latest_for_avid(self, avid: str):
-        return self.get(avid=avid, is_latest=True)
+        # Return None when there is no advisory for this avid: the detail
+        # views rely on this to raise an Http404 instead of a server error.
+        return self.filter(avid=avid, is_latest=True).first()
 
     def latest_per_avid(self):
         return self.filter(is_latest=True)

vulnerabilities/tests/test_view.py

@@ -379,3 +379,22 @@ def test_throttle_after_15_requests(self):
             HTTP_USER_AGENT="test-agent",
         )
         assert response.status_code == 429
+
+
+class AdvisoryDetailNotFoundTestCase(TestCase):
+    def setUp(self):
+        # bypass the altcha bot protection middleware
+        import time
+
+        session = self.client.session
+        session["altcha_verified_at"] = time.time()
+        session.save()
+
+    def test_unknown_advisory_avid_returns_404_not_500(self):
+        # https://github.com/aboutcode-org/vulnerablecode/issues/2396
+        response = self.client.get("/advisories/pysec/PYSEC-3000-0")
+        self.assertEqual(404, response.status_code)
+
+    def test_unknown_advisory_packages_avid_returns_404_not_500(self):
+        response = self.client.get("/advisories/packages/pysec/PYSEC-3000-0")
+        self.assertEqual(404, response.status_code)