You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes#6136 (see the issue for usage details and reproduction).
Short version: SimpleBeanPropertyFilter.serializeAsProperty() runs include() against the name of the any-getter accessor rather than the names of the entries it emits, so an exclude filter (serializeAllExcept()) lets the writer straight through to getAndSerialize() and every entry goes out, including excluded ones. Only filterOutAllExcept reaches the per-entry getAndFilter(), since that call sits in the else branch. The fix routes AnyGetterWriter to getAndFilter() before the include() check, so inclusion is decided per entry.
A JsonNode-valued any-getter ([databind#3604]) leaks the same way under either filter style, because getAndFilter() short-circuits those to unfiltered entries; they now go through MapProperty the way map entries already do. Sending every any-getter down getAndFilter() also exposed its hardcoded null suppressable value, which dropped NON_EMPTY on the filtered path, so it now uses the one its MapSerializer was built with.
Makes sense. Filed #6136 with the specific usage and reproduction, and updated the PR title/body and test comments to reference it. Agreed on keeping this to 3.x, no backport.
Good call moving the unpacking into BeanSerializerBase. Handling it caller-side covers direct PropertyFilter implementations too, which my filter-side version missed. If it helps, feel free to post whatever else got flagged and I'm happy to work through the list.
Caught up on your commits. Moving the unpacking into BeanSerializerBase is better than what I had, since custom PropertyFilter implementations get per-entry decisions too, and the unwrapping serializer picks it up for free through _serializePropertiesFiltered. Pulled the branch and reran the full suite locally, 6187 tests green. Nothing outstanding from my side.
Updates AnyGetterWriter to route entries through getAndFilter() for proper per-entry JSON filter evaluation and resolves JsonNode-valued leakages. No issues found.
Options
Auto-apply is off → Gitar will not commit updates to this branch. Display: compact → Showing less information.
Comment with these commands to change the behavior for this request:
Auto-apply
Compact
gitar auto-apply:on
gitar display:verbose
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
aysha-afrah26
changed the title
Fixes #6136 (see the issue for usage details and reproduction).
Short version:
SimpleBeanPropertyFilter.serializeAsProperty()runsinclude()against the name of the any-getter accessor rather than the names of the entries it emits, so an exclude filter (serializeAllExcept()) lets the writer straight through togetAndSerialize()and every entry goes out, including excluded ones. OnlyfilterOutAllExceptreaches the per-entrygetAndFilter(), since that call sits in theelsebranch. The fix routesAnyGetterWritertogetAndFilter()before theinclude()check, so inclusion is decided per entry.A
JsonNode-valued any-getter ([databind#3604]) leaks the same way under either filter style, becausegetAndFilter()short-circuits those to unfiltered entries; they now go throughMapPropertythe way map entries already do. Sending every any-getter downgetAndFilter()also exposed its hardcodednullsuppressable value, which droppedNON_EMPTYon the filtered path, so it now uses the one itsMapSerializerwas built with.Targets
3.xonly, per discussion below.