Do not leak internal database ids in the API

[pombredanne]

In this we have URLs such as

• "url": "http://public.vulnerablecode.io/api/vulnerabilities/1265",
• "url": "http://public.vulnerablecode.io/api/packages/168702",
  that leak internal record ids/primary keys.
  We should provide either a GUID or a natural key instead.

[
  {
    "url": "http://public.vulnerablecode.io/api/packages/168702",
    "purl": "pkg:maven/junit/junit@4.12",
    "type": "maven",
    "namespace": "junit",
    "name": "junit",
    "version": "4.12",
    "qualifiers": {},
    "subpath": "",
    "affected_by_vulnerabilities": [
      {
        "url": "http://public.vulnerablecode.io/api/vulnerabilities/1265",
        "vulnerability_id": "VCID-e1bu-4uh4-aaac",
        "summary": "",
....

[uzaxirr]

Hey, I have a question.
what's the expected result you wanna have?
from what i've understood it's this

For example, instead of:
"http://public.vulnerablecode.io/api/vulnerabilities/1265"

It could be:
"http://public.vulnerablecode.io/api/vulnerabilities/abcdefg-1234-5678-90ab-cdefghijklmn"

Please correct me if i'm wrong

[uzaxirr]

@TG1999 @pombredanne ^^

[Hritik14]

How about VCID and purl in public urls ? This would make the URLs independent of database deletion/re-creation, if it so happens. Also, multiple instances will be very explicit about which vulnerability/package they're pointing at by just looking at the url.

EDIT: Just realized VCID is based on UUID so this might not be as good.

[pombredanne]

IMHO we should use the natural keys of each model: vcid and purl

[suraj-mandal]

As I can infer from the discussion, is it okay to reference the URLs via the natural key instead of UUID. This means that the natural key is a different entity other than the primary key right?

[Mohit-majumdar]

I checked, and this problem still exists. If you are willing to work on a solution, I would like to take up the case.

[TG1999]

@Mohit-majumdar sure, feel free to work on this issue

[Mohit-majumdar]

I have discovered the true cause of this primary key, which is that the HyperlinkModel Serializer is being used. The question at hand is: will we use the VCID field or something else in place of the PK field? @TG1999 or @Hritik14 can someone please help me with this?

[pombredanne]

@Mohit-majumdar we would want to use either a natural key (may be VCID or package_url) or a UUID

[saransh1307]

@pombredanne @TG1999 after reviewing the source code, it seems that replacing the Record IDs with UUIDs (generated using the UUID module, specifically UUID4) would be more efficient by Python scripting, rather than relying on a manual process. Would it be okay for me to start working on this issue?

[Dedsec0098]

Hey is the issue still there, I would like to work on this issue by replacing internal IDs with PURLs

[Mukund-Menon]

I've sent a PR for this- PTAL!

#1781