Return 404 when the null version is provided to the license endpoint (#9297)

Address #9295

Author: joelverhagen

src/NuGetGallery/Controllers/PackagesController.cs

@@ -1174,6 +1174,11 @@ public virtual ActionResult AtomFeed(string id, bool prerel = true)
         [HttpGet]
         public virtual async Task<ActionResult> License(string id, string version)
         {
+            if (version == null)
+            {
+                return HttpNotFound();
+            }
+
             var package = _packageService.FindPackageByIdAndVersionStrict(id, version);
             if (package == null || package.PackageStatusKey == PackageStatus.Deleted)
             {

tests/NuGetGallery.Facts/Controllers/PackagesControllerFacts.cs

@@ -10071,6 +10071,21 @@ public async Task GivenInvalidPackageReturns404()
                 Assert.IsType<HttpNotFoundResult>(result);
             }
 
+            [Fact]
+            public async Task GivenNullVersionReturns404()
+            {
+                // arrange
+                var controller = CreateController(
+                    GetConfigurationService(),
+                    packageService: _packageService);
+
+                // act
+                var result = await controller.License(_packageId, version: null);
+
+                // assert
+                Assert.IsType<HttpNotFoundResult>(result);
+            }
+
             [Fact]
             public async Task GivenDeletedPackageReturns404()
             {