From 02720af2a1df21fb05f6ef6a814534b2493b82dc Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Thu, 1 Oct 2026 17:16:10 +0530 Subject: [PATCH 1/2] fix: use X-User-Agent for Swagger API requests - fixes: https://github.com/aboutcode-org/vulnerablecode/issues/2456 Signed-off-by: Keshav Priyadarshi --- vulnerabilities/middleware/vcio_user_agent.py | 3 ++- vulnerabilities/templates/drf_spectacular/swagger_ui.html | 4 ++-- vulnerablecode/settings.py | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/vulnerabilities/middleware/vcio_user_agent.py b/vulnerabilities/middleware/vcio_user_agent.py index b5aba63ec..69cabc777 100644 --- a/vulnerabilities/middleware/vcio_user_agent.py +++ b/vulnerabilities/middleware/vcio_user_agent.py @@ -24,8 +24,9 @@ def __call__(self, request): ("/api/docs/", "/api/schema/") ): user_agent = request.headers.get("User-Agent", "") + x_user_agent = request.headers.get("X-User-Agent", "") docs_url = request.build_absolute_uri("/api/docs/") - if user_agent != settings.VCIO_USER_AGENT: + if settings.VCIO_USER_AGENT not in [user_agent, x_user_agent]: return JsonResponse( { "detail": ( diff --git a/vulnerabilities/templates/drf_spectacular/swagger_ui.html b/vulnerabilities/templates/drf_spectacular/swagger_ui.html index d90b38e35..d7c9d520c 100644 --- a/vulnerabilities/templates/drf_spectacular/swagger_ui.html +++ b/vulnerabilities/templates/drf_spectacular/swagger_ui.html @@ -33,8 +33,8 @@ swaggerSettings.dom_id = "#swagger-ui"; swaggerSettings.requestInterceptor = (request) => { - const userAgent = swaggerSettings.userAgent || "VCIO_API_AGENT"; - request.headers['User-Agent'] = userAgent; + const xUserAgent = swaggerSettings.xUserAgent || "VCIO_API_AGENT"; + request.headers['X-User-Agent'] = xUserAgent; return request; }; diff --git a/vulnerablecode/settings.py b/vulnerablecode/settings.py index 965b15af8..6bf4b1e46 100644 --- a/vulnerablecode/settings.py +++ b/vulnerablecode/settings.py @@ -339,7 +339,7 @@ "defaultModelsExpandDepth": 1, "displayRequestDuration": True, "docExpansion": "list", - "userAgent": VCIO_USER_AGENT, + "xUserAgent": VCIO_USER_AGENT, }, "AUTHENTICATION_WHITELIST": [ "rest_framework.authentication.TokenAuthentication", From f56a9f0666dc21e86b7341dbc7b994d1b2ac57b7 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Thu, 1 Oct 2026 17:27:16 +0530 Subject: [PATCH 2/2] fix: use proper response type in swagger schema Signed-off-by: Keshav Priyadarshi --- vulnerabilities/api_v3.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/vulnerabilities/api_v3.py b/vulnerabilities/api_v3.py index 71d41f5f9..6c39e8617 100644 --- a/vulnerabilities/api_v3.py +++ b/vulnerabilities/api_v3.py @@ -275,7 +275,11 @@ class PackageV3ViewSet(viewsets.GenericViewSet): filter_backends = [filters.DjangoFilterBackend] throttle_classes = [AnonRateThrottle, PermissionBasedUserRateThrottle] - @extend_schema(request=PackageQuerySerializer) + @extend_schema( + operation_id="v3_packages_retrieve", + request=PackageQuerySerializer, + responses={200: PackageV3Serializer(many=True)}, + ) def create(self, request, *args, **kwargs): serializer = PackageQuerySerializer(data=request.data) serializer.is_valid(raise_exception=True) @@ -411,7 +415,11 @@ class AdvisoryV3ViewSet(viewsets.GenericViewSet): filter_backends = [filters.DjangoFilterBackend] throttle_classes = [AnonRateThrottle, PermissionBasedUserRateThrottle] - @extend_schema(request=AdvisoryQuerySerializer) + @extend_schema( + operation_id="v3_advisories_retrieve", + request=AdvisoryQuerySerializer, + responses={200: AdvisoryV3Serializer(many=True)}, + ) def create(self, request, *args, **kwargs): serializer = AdvisoryQuerySerializer(data=request.data) serializer.is_valid(raise_exception=True)