Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

JSON:API: request documents with no `data`, no `type` or a wrong `type` are accepted with 201

未关闭
  • 哪里不对？
#8,703 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
62/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
php
领域
api

调研方向

Start in src/JsonApi/Serializer, where JsonApi\Serializer\ItemNormalizerTrait::denormalize() reads $data['data']['attributes'] ?? [] and $data['data']['relationships'] ?? [] without checking the document shape. Reproduce with the request bodies in the table (for example "Y", {"title":"A"} and a mismatched type) against a POST /novels operation. Done means malformed documents return 400 Bad Request, and a POST whose type does not match the endpoint returns 409 Conflict, with the existing JSON:API tests still passing.

由索引模型根据 Issue 内容生成。

描述

API Platform version(s) affected

4.4.4

Description

The JSON:API denormalizer does not check the structure of the request document. A body that is not a valid JSON:API document is accepted, and the resource is created with its default values.

The spec requires:

  • the top level of a request document is an object with a data member (document structure),
  • data is a resource object with a type member, and attributes is an object (resource objects),
  • "A server MUST return 409 Conflict when processing a POST request in which the resource object's type is not among the type(s) that constitute the collection represented by the endpoint" (creating resources).

JsonApi\Serializer\ItemNormalizerTrait::denormalize() reads $data['data']['attributes'] ?? [] and $data['data']['relationships'] ?? [], and it does not check the other members.

How to reproduce
#[ApiResource(operations: [
    new Get(provider: [self::class, 'provide']),
    new Post(processor: [self::class, 'process']),
])]
final class Novel
{
    public int $id = 1;
    public string $title = 'Dune';

    public static function provide(): self { return new self(); }
    public static function process(self $data, Operation $operation): self { return $data; }
}

Each of these POST /novels bodies answers 201 Created:

Body Problem
"Y" not an object
42 not an object
{"title":"A"} no data member
{"data":"x"} data is not a resource object
{"data":{"type":"Novel","attributes":["x"]}} attributes is not an object
{"data":{"attributes":{"title":"A"}}} no type member
{"data":{"type":"Author","attributes":{"title":"A"}}} type does not match the endpoint

Response for "Y":

{"data":{"id":"/novels/1","type":"Novel","attributes":{"_id":1,"title":"Dune"}}}

A validation constraint on a required property hides the problem in some cases, but a resource with optional properties or defaults is created from any body.

Expected:

  • A body that is not a JSON:API document, or has no data object, no type or a non-object attributes/relationships: 400 Bad Request.
  • A type that does not match the resource on POST: 409 Conflict.
Additional Context

Checked on api-platform/core v4.4.4, Symfony 7.4, PHP 8.5, in an empty Symfony app. The related code in src/JsonApi/Serializer is the same on main, except for the error status cast (#8366).

The app has only FrameworkBundle, TwigBundle and ApiPlatformBundle, with this config:

$c->extension('api_platform', [
    'mapping' => ['paths' => ['%kernel.project_dir%/src/ApiResource']],
    'formats' => ['jsonapi' => ['application/vnd.api+json']],
    'error_formats' => ['jsonapi' => ['application/vnd.api+json'], 'jsonproblem' => ['application/problem+json']],
    'doctrine' => ['enabled' => false],
]);

All requests send Accept: application/vnd.api+json and, when they have a body, Content-Type: application/vnd.api+json. The responses are from the prod environment.

主要语言
PHP
星标
2.6k
派生
988
平均合并
1 天 19 小时
30 天内合并 PR
108

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

api-platform/core 的其他 Issue

查看 api-platform/core 的全部 Issue

相似的 Issue

更多 PHP Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。