Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

JSON:API: request documents with no `data`, no `type` or a wrong `type` are accepted with 201

Abierto
  • ¿Algo no está bien?
#8,703 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php
Área
api

Línea de trabajo

Start in src/JsonApi/Serializer, where JsonApi\Serializer\ItemNormalizerTrait::denormalize() reads $data['data']['attributes'] ?? [] and $data['data']['relationships'] ?? [] without checking the document shape. Reproduce with the request bodies in the table (for example "Y", {"title":"A"} and a mismatched type) against a POST /novels operation. Done means malformed documents return 400 Bad Request, and a POST whose type does not match the endpoint returns 409 Conflict, with the existing JSON:API tests still passing.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

API Platform version(s) affected

4.4.4

Description

The JSON:API denormalizer does not check the structure of the request document. A body that is not a valid JSON:API document is accepted, and the resource is created with its default values.

The spec requires:

  • the top level of a request document is an object with a data member (document structure),
  • data is a resource object with a type member, and attributes is an object (resource objects),
  • "A server MUST return 409 Conflict when processing a POST request in which the resource object's type is not among the type(s) that constitute the collection represented by the endpoint" (creating resources).

JsonApi\Serializer\ItemNormalizerTrait::denormalize() reads $data['data']['attributes'] ?? [] and $data['data']['relationships'] ?? [], and it does not check the other members.

How to reproduce
#[ApiResource(operations: [
    new Get(provider: [self::class, 'provide']),
    new Post(processor: [self::class, 'process']),
])]
final class Novel
{
    public int $id = 1;
    public string $title = 'Dune';

    public static function provide(): self { return new self(); }
    public static function process(self $data, Operation $operation): self { return $data; }
}

Each of these POST /novels bodies answers 201 Created:

Body Problem
"Y" not an object
42 not an object
{"title":"A"} no data member
{"data":"x"} data is not a resource object
{"data":{"type":"Novel","attributes":["x"]}} attributes is not an object
{"data":{"attributes":{"title":"A"}}} no type member
{"data":{"type":"Author","attributes":{"title":"A"}}} type does not match the endpoint

Response for "Y":

{"data":{"id":"/novels/1","type":"Novel","attributes":{"_id":1,"title":"Dune"}}}

A validation constraint on a required property hides the problem in some cases, but a resource with optional properties or defaults is created from any body.

Expected:

  • A body that is not a JSON:API document, or has no data object, no type or a non-object attributes/relationships: 400 Bad Request.
  • A type that does not match the resource on POST: 409 Conflict.
Additional Context

Checked on api-platform/core v4.4.4, Symfony 7.4, PHP 8.5, in an empty Symfony app. The related code in src/JsonApi/Serializer is the same on main, except for the error status cast (#8366).

The app has only FrameworkBundle, TwigBundle and ApiPlatformBundle, with this config:

$c->extension('api_platform', [
    'mapping' => ['paths' => ['%kernel.project_dir%/src/ApiResource']],
    'formats' => ['jsonapi' => ['application/vnd.api+json']],
    'error_formats' => ['jsonapi' => ['application/vnd.api+json'], 'jsonproblem' => ['application/problem+json']],
    'doctrine' => ['enabled' => false],
]);

All requests send Accept: application/vnd.api+json and, when they have a body, Content-Type: application/vnd.api+json. The responses are from the prod environment.

Lenguaje dominante
PHP
Estrellas
2.6k
Forks
989
Merge medio
1 d 23 h
PR fusionados (30 d)
102

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de api-platform/core

Todos los issues de api-platform/core

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.