From c94e7e9d8b39093c0918c993af54fec11eb6b76c Mon Sep 17 00:00:00 2001
From: Tushar Goel <34160672+TG1999@users.noreply.github.com>
Date: Thu, 23 Nov 2023 08:23:06 +0530
Subject: [PATCH 1/3] Fix search encoding issue (#1343)

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Reference: https://github.com/nexB/vulnerablecode/issues/1336
---
 vulnerabilities/templates/includes/pagination.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/vulnerabilities/templates/includes/pagination.html b/vulnerabilities/templates/includes/pagination.html
index 85020e4d6..0d6dad430 100644
--- a/vulnerabilities/templates/includes/pagination.html
+++ b/vulnerabilities/templates/includes/pagination.html
@@ -1,12 +1,12 @@
 <nav class="pagination is-centered is-small" aria-label="pagination">
   {% if page_obj.has_previous %}
-    <a href="?page={{ page_obj.previous_page_number }}&search={{ search }}" class="pagination-previous">Previous</a>
+  <a href="?page={{ page_obj.previous_page_number }}&search={{ search|urlencode }}" class="pagination-previous">Previous</a>
   {% else %}
     <a class="pagination-previous" disabled>Previous</a>
   {% endif %}
 
   {% if page_obj.has_next %}
-    <a href="?page={{ page_obj.next_page_number }}&search={{ search }}" class="pagination-next">Next</a>
+    <a href="?page={{ page_obj.next_page_number }}&search={{ search|urlencode }}" class="pagination-next">Next</a>
   {% else %}
     <a class="pagination-next" disabled>Next</a>
   {% endif %}
@@ -14,7 +14,7 @@
   <ul class="pagination-list">
     {% if page_obj.number != 1%}
       <li>
-        <a href="?page=1&search={{ search }}" class="pagination-link" aria-label="Goto page 1">1</a>
+        <a href="?page=1&search={{ search|urlencode }}" class="pagination-link" aria-label="Goto page 1">1</a>
       </li>
       {% if page_obj.number > 2 %}
         <li>
@@ -32,7 +32,7 @@
         </li>
       {% endif %}
       <li>
-        <a href="?page={{ page_obj.paginator.num_pages }}&search={{ search }}" class="pagination-link" aria-label="Goto page {{ page_obj.paginator.num_pages }}">{{ page_obj.paginator.num_pages }}</a>
+        <a href="?page={{ page_obj.paginator.num_pages }}&search={{ search|urlencode }}" class="pagination-link" aria-label="Goto page {{ page_obj.paginator.num_pages }}">{{ page_obj.paginator.num_pages }}</a>
       </li>
     {% endif %}
   </ul>

From fca8815876d9d6f8bd5eab8ee9bdf281bde896ed Mon Sep 17 00:00:00 2001
From: Tushar Goel <34160672+TG1999@users.noreply.github.com>
Date: Mon, 27 Nov 2023 12:20:09 +0530
Subject: [PATCH 2/3] Add middleware to ban bytedance user agent (#1347)

* Add middleware to ban bytedance user agent

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

* Change response type

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

---------

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
---
 vulnerabilities/middleware/ban_user_agent.py | 18 ++++++++++++++++++
 vulnerabilities/tests/test_api.py            |  6 ++++++
 vulnerablecode/settings.py                   |  1 +
 3 files changed, 25 insertions(+)
 create mode 100644 vulnerabilities/middleware/ban_user_agent.py

diff --git a/vulnerabilities/middleware/ban_user_agent.py b/vulnerabilities/middleware/ban_user_agent.py
new file mode 100644
index 000000000..6aafc490c
--- /dev/null
+++ b/vulnerabilities/middleware/ban_user_agent.py
@@ -0,0 +1,18 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/nexB/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+from django.http import HttpResponseNotFound
+from django.utils.deprecation import MiddlewareMixin
+
+
+class BanUserAgent(MiddlewareMixin):
+    def process_request(self, request):
+        user_agent = request.META.get("HTTP_USER_AGENT", None)
+        if user_agent and "bytedance" in user_agent:
+            return HttpResponseNotFound(404)
diff --git a/vulnerabilities/tests/test_api.py b/vulnerabilities/tests/test_api.py
index 5ead38a2d..5dd9a2319 100644
--- a/vulnerabilities/tests/test_api.py
+++ b/vulnerabilities/tests/test_api.py
@@ -650,3 +650,9 @@ def test_with_invalid_cpes(self):
             content_type="application/json",
         ).json()
         assert response == {"Error": "Invalid CPE: CVE-2022-2022"}
+
+
+class TesBanUserAgent(TestCase):
+    def test_ban_request_with_bytedance_user_agent(self):
+        response = self.client.get(f"/api/packages", format="json", HTTP_USER_AGENT="bytedance")
+        assert 404 == response.status_code
diff --git a/vulnerablecode/settings.py b/vulnerablecode/settings.py
index 525127915..48c849225 100644
--- a/vulnerablecode/settings.py
+++ b/vulnerablecode/settings.py
@@ -89,6 +89,7 @@
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "vulnerabilities.middleware.ban_user_agent.BanUserAgent",
 )
 
 ROOT_URLCONF = "vulnerablecode.urls"

From d3f314dce082e1b70350019137687a1d214b19f2 Mon Sep 17 00:00:00 2001
From: Tushar Goel <34160672+TG1999@users.noreply.github.com>
Date: Mon, 27 Nov 2023 12:46:04 +0530
Subject: [PATCH 3/3] Prepare for release v33.6.3 (#1348)

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>
---
 CHANGELOG.rst                         | 10 ++++++++++
 setup.cfg                             |  2 +-
 vulnerabilities/improvers/__init__.py |  5 +++--
 vulnerablecode/__init__.py            |  2 +-
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 5f684c91f..275c0b804 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,6 +2,16 @@ Release notes
 =============
 
 
+Version v33.6.3
+----------------
+
+- We updated RTD build configuration.
+- We added importer for OSS-Fuzz.
+- We removed vulnerabilities with empty aliases.
+- We fixed search encoding issue https://github.com/nexB/vulnerablecode/issues/1336.
+- We added middleware to ban "bytedance" user-agent.
+
+
 Version v33.6.2
 ----------------
 
diff --git a/setup.cfg b/setup.cfg
index abea64a2f..f1019f1dc 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = vulnerablecode
-version = 33.6.2
+version = 33.6.3
 license = Apache-2.0 AND CC-BY-SA-4.0
 
 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390
diff --git a/vulnerabilities/improvers/__init__.py b/vulnerabilities/improvers/__init__.py
index 9880bf9ee..35aef82b4 100644
--- a/vulnerabilities/improvers/__init__.py
+++ b/vulnerabilities/improvers/__init__.py
@@ -8,7 +8,8 @@
 #
 
 from vulnerabilities.improvers import valid_versions
-from vulnerabilities.improvers import vulnerability_status
+
+# from vulnerabilities.improvers import vulnerability_status
 
 IMPROVERS_REGISTRY = [
     valid_versions.GitHubBasicImprover,
@@ -24,7 +25,7 @@
     valid_versions.DebianOvalImprover,
     valid_versions.UbuntuOvalImprover,
     valid_versions.OSSFuzzImprover,
-    vulnerability_status.VulnerabilityStatusImprover,
+    # vulnerability_status.VulnerabilityStatusImprover,
 ]
 
 IMPROVERS_REGISTRY = {x.qualified_name: x for x in IMPROVERS_REGISTRY}
diff --git a/vulnerablecode/__init__.py b/vulnerablecode/__init__.py
index 7d0d72d9f..56e7550a1 100644
--- a/vulnerablecode/__init__.py
+++ b/vulnerablecode/__init__.py
@@ -12,7 +12,7 @@
 import warnings
 from pathlib import Path
 
-__version__ = "33.6.2"
+__version__ = "33.6.3"
 
 
 def command_line():