chg: [API] the endpoint to create new security advisory is now using a raw dict for the Swagger documentation since we have laxed the JSON checks.

website/web/api/v1/base.py

@@ -8,7 +8,9 @@ import orjson
 from flask_login import current_user  # type: ignore[import-untyped]
 from flask import request
 from flask_restx import abort  # type: ignore[import-untyped]
+from flask_restx import fields
 from flask_restx import Namespace
+from flask_restx import reqparse
 from flask_restx import Resource
 from redis import Redis
 
@@ -34,6 +36,15 @@ storage = Redis(
     port=get_config("generic", "storage_db_port"),
 )
 
+# Argument Parsing
+vulnerability_query_parser = reqparse.RequestParser()
+vulnerability_query_parser.add_argument(
+    "data",
+    type=dict,
+    location="json",
+    help="The JSON data (CVE version 5 format) of the security advisory.",
+)
+
 
 @api_ns.route("/cve/<string:vulnerability_id>")
 @default_ns.route("vulnerability/<string:vulnerability_id>")
@@ -88,6 +99,16 @@ class VulnerabilitiesList(Resource):  # type: ignore[misc]
             422: "Not possible to edit a vulnerability from the requested source.",
         }
     )  # type: ignore[misc]
+    @default_ns.doc(
+        responses={
+            200: "Success.",
+            400: "JSON validation failed.",
+            403: "Reporter permission required.",
+            422: "Not possible to edit a vulnerability from the requested source.",
+        }
+    )  # type: ignore[misc]
+    @api_ns.expect(vulnerability_query_parser)  # type: ignore[misc]
+    @default_ns.expect(vulnerability_query_parser)  # type: ignore[misc]
     @reporter_permission.require(http_exception=403)  # type: ignore[misc]
     @auth_func
     def post(self) -> Tuple[Dict[Any, Any], int]:
@@ -139,7 +160,10 @@ class VulnerabilitiesList(Resource):  # type: ignore[misc]
         vuln["cveMetadata"]["dateUpdated"] = now.strftime("%Y-%m-%dT%H:%M:%S.%fZ")
 
         # Add information about the updater in the cveMetadata field
-        if "vulnerabilitylookup_history" not in vuln["cveMetadata"]:
+        if (
+            "vulnerabilitylookup_history" not in vuln["cveMetadata"]
+            or not vuln["cveMetadata"]["vulnerabilitylookup_history"]
+        ):
             vuln["cveMetadata"]["vulnerabilitylookup_history"] = [
                 (current_user.email, now.strftime("%Y-%m-%dT%H:%M:%S.%fZ"))
             ]