Return 404 when the null version is provided to the license endpoint (#…

…9297) Address #9295
NuGet · Nov 3, 2022 · 4a96d3c · 4a96d3c
1 parent 6ce4702
commit 4a96d3c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/src/NuGetGallery/Controllers/PackagesController.cs b/src/NuGetGallery/Controllers/PackagesController.cs
@@ -1174,6 +1174,11 @@ public virtual ActionResult AtomFeed(string id, bool prerel = true)
         [HttpGet]
         public virtual async Task<ActionResult> License(string id, string version)
         {
+            if (version == null)
+            {
+                return HttpNotFound();
+            }
+
             var package = _packageService.FindPackageByIdAndVersionStrict(id, version);
             if (package == null || package.PackageStatusKey == PackageStatus.Deleted)
             {

diff --git a/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs b/tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs
@@ -10071,6 +10071,21 @@ public async Task GivenInvalidPackageReturns404()
                 Assert.IsType<HttpNotFoundResult>(result);
             }
 
+            [Fact]
+            public async Task GivenNullVersionReturns404()
+            {
+                // arrange
+                var controller = CreateController(
+                    GetConfigurationService(),
+                    packageService: _packageService);
+
+                // act
+                var result = await controller.License(_packageId, version: null);
+
+                // assert
+                Assert.IsType<HttpNotFoundResult>(result);
+            }
+
             [Fact]
             public async Task GivenDeletedPackageReturns404()
             {