Fix: Do not leak codefix IDs in API

Signed-off-by: Shrish0098 <shrish409@gmail.com>

Author: Dedsec0098

vulnerabilities/api_v2.py

@@ -570,7 +570,7 @@ class CodeFixSerializer(serializers.ModelSerializer):
     class Meta:
         model = CodeFix
         fields = [
-            "id",
+            "uuid",
             "commits",
             "pulls",
             "downloads",
@@ -594,6 +594,8 @@ class CodeFixViewSet(viewsets.ReadOnlyModelViewSet):
 
     queryset = CodeFix.objects.all()
     serializer_class = CodeFixSerializer
+    lookup_field = 'uuid'
+    lookup_url_kwarg = 'uuid'
 
     def get_queryset(self):
         """

vulnerabilities/models.py

@@ -11,12 +11,14 @@
 import hashlib
 import json
 import logging
+import uuid
 import xml.etree.ElementTree as ET
 from contextlib import suppress
 from functools import cached_property
 from itertools import groupby
 from operator import attrgetter
 from typing import Union
+from django.db import models
 
 from cvss.exceptions import CVSS2MalformedError
 from cvss.exceptions import CVSS3MalformedError
@@ -1784,6 +1786,14 @@ class CodeFix(CodeChange):
     - optionally with a specific fixing package version when it is known
     """
 
+    uuid = models.UUIDField(
+        primary_key=True,
+        default=uuid.uuid4,
+        editable=False,
+        unique=True,
+        help_text="Unique identifier for this code fix"
+    )
+
     affected_package_vulnerability = models.ForeignKey(
         "AffectedByPackageRelatedVulnerability",
         on_delete=models.CASCADE,

vulnerablecode/urls.py

@@ -50,7 +50,7 @@ def __init__(self, *args, **kwargs):
 api_v2_router = OptionalSlashRouter()
 api_v2_router.register("packages", PackageV2ViewSet, basename="package-v2")
 api_v2_router.register("vulnerabilities", VulnerabilityV2ViewSet, basename="vulnerability-v2")
-api_v2_router.register("codefixes", CodeFixViewSet, basename="codefix")
+api_v2_router.register("codefixes", CodeFixViewSet, basename="codefix", lookup_field="uuid",)
 
 
 urlpatterns = [