jsonapi_parameters 2.1.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 514048af1321f2eb0d1c17e260d8bfc0ce3dbf3b0d8c70fc91f42724fdc6a0c1
-  data.tar.gz: 46a52ac2fa28952b732d11479b9c1a2a3c2ff88bafd37816a920626b32ceda31
+  metadata.gz: 414c6d7e91cd71641096a2fc6dcb6d7055f9154cab1db06be6dbb188fddb3c6a
+  data.tar.gz: 483e0f4576c935632ca3cdbe48b10050d232dbb67e202a4db0fca2d4f0004721
 SHA512:
-  metadata.gz: 406ea510828fb14bb8b4ba1298ad4a7f1c68a93391b8dce48a0e9132d8b7e05343febc0da9fd8f2e7aa8b6bb81f1a48a5cc23c51f01164d8d13e572b4f2b1c1e
-  data.tar.gz: b455719c009aae879edf3e457f34222cee455a3583ae9c1c58348f4784efafe92c1b2407732500a35d8f5da026bdce9dff5624482c90950a0d3a8d4430c48d81
+  metadata.gz: 5a90b5d5a44fcbe5ee66e13308ab190e73a7a84409727c6c7530d66d5105baf4754987d634b71ebe4f7674d3b491e95a7ed8bb8e5fd399f4a638cb2bb272f087
+  data.tar.gz: 89d0c3dc2b6b100c53f1c446b80d9bd8acfc5e9db33587330c5fd57c362d9c92d8b9866f5c2afb95aa86233bb5c40ce72c61baac6cafa2b40d53df37d39dc47d

data/README.md

@@ -93,7 +93,51 @@ translator.jsonapify(params)
 
 As [stated in the JSON:API specification](https://jsonapi.org/#mime-types) correct mime type for JSON:API input should be [`application/vnd.api+json`](http://www.iana.org/assignments/media-types/application/vnd.api+json). 
 
-This gems intention is to make input consumption as easy as possible. Hence, it [registers this mime type for you](lib/jsonapi_parameters/core_ext/action_dispatch/http/mime_type.rb). 
+This gem's intention is to make input consumption as easy as possible. Hence, it [registers this mime type for you](lib/jsonapi_parameters/core_ext/action_dispatch/http/mime_type.rb).
+
+## Stack limit
+
+In theory, any payload may consist of infinite amount of relationships (and so each relationship may have its own, included, infinite amount of nested relationships).
+Because of that, it is a potential vector of attack. 
+
+For this reason we have introduced a default limit of stack levels that JsonApi::Parameters will go down through while parsing the payloads. 
+
+This default limit is 3, and can be overwritten by specifying the custom limit.
+
+#### Ruby
+```ruby
+class Translator
+    include JsonApi::Parameters
+end
+
+translator = Translator.new
+
+translator.jsonapify(custom_stack_limit: 4)
+
+# OR
+ 
+translator.stack_limit = 4
+translator.jsonapify.(...)
+``` 
+
+#### Rails
+```ruby
+def create_params
+    params.from_jsonapi(custom_stack_limit: 4).require(:user).permit(
+        entities_attributes: { subentities_attributes: { ... } }
+    )
+end
+
+# OR
+ 
+def create_params
+    params.stack_level = 4
+
+    params.from_jsonapi.require(:user).permit(entities_attributes: { subentities_attributes: { ... } })
+ensure
+    params.reset_stack_limit!
+end
+```
 
 ## Customization
 
@@ -101,5 +145,11 @@ If you need custom relationship handling (for instance, if you have a relationsh
 
 Read more at [Relationship Handlers](https://github.com/visualitypl/jsonapi_parameters/wiki/Relationship-handlers).
 
+## Team
+
+Project started by [Jasiek Matusz](https://github.com/Marahin).
+
+Currently, jsonapi_parameters is maintained by Visuality's [Open Source Commitee](https://www.visuality.pl/open-source).
+
 ## License
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/lib/jsonapi_parameters/core_ext/action_controller/parameters.rb

@@ -9,7 +9,7 @@ class ActionController::Parameters
     from_jsonapi(*args)
   end
 
-  def from_jsonapi(naming_convention = :snake)
-    @from_jsonapi ||= self.class.new jsonapify(self, naming_convention: naming_convention)
+  def from_jsonapi(naming_convention = :snake, custom_stack_limit: stack_limit)
+    @from_jsonapi ||= self.class.new jsonapify(self, naming_convention: naming_convention, custom_stack_limit: custom_stack_limit)
   end
 end

data/lib/jsonapi_parameters/default_handlers/nil_relation_handler.rb

@@ -1,3 +1,5 @@
+require 'active_support/inflector'
+
 require_relative './base_handler'
 
 module JsonApi

data/lib/jsonapi_parameters/default_handlers/to_many_relation_handler.rb

@@ -1,3 +1,5 @@
+require 'active_support/inflector'
+
 module JsonApi
   module Parameters
     module Handlers
@@ -34,8 +36,9 @@ module JsonApi
               @with_inclusion &= !included_object.empty?
 
               if with_inclusion
-                included_object.delete(:type)
-                included_object[:attributes].merge(id: related_id)
+                { **(included_object[:attributes] || {}), id: related_id }.tap do |body|
+                  body[:relationships] = included_object[:relationships] if included_object.key?(:relationships) # Pass nested relationships
+                end
               else
                 relationship.dig(:id)
               end

data/lib/jsonapi_parameters/default_handlers/to_one_relation_handler.rb

@@ -1,3 +1,5 @@
+require 'active_support/inflector'
+
 module JsonApi
   module Parameters
     module Handlers
@@ -15,8 +17,10 @@ module JsonApi
 
             return ["#{singularize(relationship_key)}_id".to_sym, related_id] if included_object.empty?
 
-            included_object.delete(:type)
-            included_object = included_object[:attributes].merge(id: related_id)
+            included_object = { **(included_object[:attributes] || {}), id: related_id }.tap do |body|
+              body[:relationships] = included_object[:relationships] if included_object.key?(:relationships) # Pass nested relationships
+            end
+
             ["#{singularize(relationship_key)}_attributes".to_sym, included_object]
           end
         end

data/lib/jsonapi_parameters/handlers.rb

@@ -29,7 +29,7 @@ module JsonApi
         resource_handlers[resource_key.to_sym] = handler_key.to_sym
       end
 
-      def reset_handlers!
+      def reset_handlers
         @handlers = DEFAULT_HANDLER_SET.dup
         @resource_handlers = {}
       end

data/lib/jsonapi_parameters/stack_limit.rb

@@ -0,0 +1,45 @@
+module JsonApi
+  module Parameters
+    LIMIT = 3
+
+    class StackLevelTooDeepError < StandardError
+    end
+
+    def stack_limit=(val)
+      @stack_limit = val
+    end
+
+    def stack_limit
+      @stack_limit || LIMIT
+    end
+
+    def reset_stack_limit
+      @stack_limit = LIMIT
+    end
+
+    private
+
+    def initialize_stack(custom_stack_limit)
+      @current_stack_level = 0
+      @stack_limit = custom_stack_limit
+    end
+
+    def increment_stack_level!
+      @current_stack_level += 1
+
+      raise StackLevelTooDeepError.new(stack_exception_message) if @current_stack_level > stack_limit
+    end
+
+    def decrement_stack_level
+      @current_stack_level -= 1
+    end
+
+    def reset_stack_level
+      @current_stack_level = 0
+    end
+
+    def stack_exception_message
+      "Stack level of nested payload is too deep: #{@current_stack_level}/#{stack_limit}. Please see the documentation on how to overwrite the limit."
+    end
+  end
+end

data/lib/jsonapi_parameters/translator.rb

@@ -3,7 +3,9 @@ require 'active_support/inflector'
 module JsonApi::Parameters
   include ActiveSupport::Inflector
 
-  def jsonapify(params, naming_convention: :snake)
+  def jsonapify(params, naming_convention: :snake, custom_stack_limit: stack_limit)
+    initialize_stack(custom_stack_limit)
+
     jsonapi_translate(params, naming_convention: naming_convention)
   end
 
@@ -38,27 +40,11 @@ module JsonApi::Parameters
   def jsonapi_main_body
     jsonapi_unsafe_params.tap do |param|
       jsonapi_relationships.each do |relationship_key, relationship_value|
-        relationship_value = relationship_value[:data]
-        handler_args = [relationship_key, relationship_value, jsonapi_included]
-        handler = if Handlers.resource_handlers.key?(relationship_key)
-                    Handlers.handlers[Handlers.resource_handlers[relationship_key]]
-                  else
-                    case relationship_value
-                    when Array
-                      Handlers.handlers[:to_many]
-                    when Hash
-                      Handlers.handlers[:to_one]
-                    when nil
-                      Handlers.handlers[:nil]
-                    else
-                      raise NotImplementedError.new('relationship resource linkage has to be a type of Array, Hash or nil')
-                    end
-                  end
-
-        key, val = handler.call(*handler_args)
-        param[key] = val
+        param = handle_relationships(param, relationship_key, relationship_value)
       end
     end
+  ensure
+    reset_stack_level
   end
 
   def jsonapi_unsafe_params
@@ -69,11 +55,63 @@ module JsonApi::Parameters
     end
   end
 
+  def jsonapi_relationships
+    @jsonapi_relationships ||= @jsonapi_unsafe_hash.dig(:data, :relationships) || []
+  end
+
   def jsonapi_included
     @jsonapi_included ||= @jsonapi_unsafe_hash[:included] || []
   end
 
-  def jsonapi_relationships
-    @jsonapi_relationships ||= @jsonapi_unsafe_hash.dig(:data, :relationships) || []
+  def handle_relationships(param, relationship_key, relationship_value)
+    increment_stack_level!
+
+    relationship_value = relationship_value[:data]
+    handler_args = [relationship_key, relationship_value, jsonapi_included]
+    handler = if Handlers.resource_handlers.key?(relationship_key)
+                Handlers.handlers[Handlers.resource_handlers[relationship_key]]
+              else
+                case relationship_value
+                when Array
+                  Handlers.handlers[:to_many]
+                when Hash
+                  Handlers.handlers[:to_one]
+                when nil
+                  Handlers.handlers[:nil]
+                else
+                  raise NotImplementedError.new('relationship resource linkage has to be a type of Array, Hash or nil')
+                end
+              end
+
+    key, val = handler.call(*handler_args)
+
+    param[key] = handle_nested_relationships(val)
+
+    param
+  ensure
+    decrement_stack_level
+  end
+
+  def handle_nested_relationships(val)
+    # We can only consider Hash relationships (which imply to-one relationship) and Array relationships (which imply to-many).
+    # Each type has a different handling method, though in both cases we end up passing the nested relationship recursively to handle_relationship
+    # (and yes, this may go on indefinitely, basically we're going by the relationship levels, deeper and deeper)
+    case val
+    when Array
+      relationships_with_nested_relationships = val.select { |rel| rel.is_a?(Hash) && rel.dig(:relationships) }
+      relationships_with_nested_relationships.each do |relationship_with_nested_relationship|
+        relationship_with_nested_relationship.delete(:relationships).each do |rel_key, rel_val|
+          relationship_with_nested_relationship = handle_relationships(relationship_with_nested_relationship, rel_key, rel_val)
+        end
+      end
+    when Hash
+      if val.key?(:relationships)
+        val.delete(:relationships).each do |rel_key, rel_val|
+          val = handle_relationships(val, rel_key, rel_val)
+        end
+      end
+    end
+
+    val
   end
 end

data/lib/jsonapi_parameters/version.rb

@@ -1,5 +1,5 @@
 module JsonApi
   module Parameters
-    VERSION = '2.1.0'.freeze
+    VERSION = '2.3.0'.freeze
   end
 end

data/lib/jsonapi_parameters.rb

@@ -2,6 +2,5 @@ require 'jsonapi_parameters/parameters'
 require 'jsonapi_parameters/handlers'
 require 'jsonapi_parameters/translator'
 require 'jsonapi_parameters/core_ext'
+require 'jsonapi_parameters/stack_limit'
 require 'jsonapi_parameters/version'
-
-require 'active_support/inflector'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jsonapi_parameters
 version: !ruby/object:Gem::Version
-  version: 2.1.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Visuality
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-30 00:00:00.000000000 Z
+date: 2021-01-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -45,14 +45,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.5
+        version: '1.11'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.5
+        version: '1.11'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -327,6 +327,7 @@ files:
 - lib/jsonapi_parameters/default_handlers/to_one_relation_handler.rb
 - lib/jsonapi_parameters/handlers.rb
 - lib/jsonapi_parameters/parameters.rb
+- lib/jsonapi_parameters/stack_limit.rb
 - lib/jsonapi_parameters/translator.rb
 - lib/jsonapi_parameters/version.rb
 homepage: https://github.com/visualitypl/jsonapi_parameters
@@ -341,14 +342,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.3.0
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Translator for JSON:API compliant parameters