Fix DictField HTML input returning empty dict for missing fields (#9891)

* Fix DictField returning empty dict instead of empty for missing HTML input (#6234)

When using DictField with HTML form (multipart/form-data) input,
parse_html_dict always returned an empty MultiValueDict when no
matching keys were found. This made it impossible to distinguish
between an unspecified field and an empty input, causing issues
with required/default field handling.

This aligns parse_html_dict with parse_html_list by adding a
default parameter that is returned when no matching keys are found.

* Address review feedback: add regression test, improve assertions

- Add regression test for nested serializer with QueryDict to cover
  the serializers.py get_value change (test_nested_serializer_not_required_with_querydict)
- Use `assert serializer.is_valid(), serializer.errors` for better
  test output on failures
- Keep `default=data` in to_internal_value as `default={}` would
  discard already-parsed MultiValueDict keys from get_value

* Use empty dict as default in DictField.to_internal_value()

Change default from data to {} in parse_html_dict call within
DictField.to_internal_value(), falling back to a dict conversion
of the MultiValueDict when no dot-separated keys are found. This
is cleaner than using the input data as its own default.

* Add support for clearing a dict field with form data

* Update rest_framework/fields.py

* Update rest_framework/utils/html.py

---------
Co-authored-by: Asif Saif Uddin {"Auvi":"অভি"} <auvipy@gmail.com>
Co-authored-by: Bruno Alla <browniebroke@users.noreply.github.com>

Author: 3 people

rest_framework/fields.py

@@ -1750,15 +1750,28 @@ def get_value(self, dictionary):
         # We override the default field access in order to support
         # dictionaries in HTML forms.
         if html.is_html_input(dictionary):
-            return html.parse_html_dict(dictionary, prefix=self.field_name)
+            result = html.parse_html_dict(dictionary, prefix=self.field_name, default=empty)
+            if result is not empty:
+                return result
+            # If the field name itself is present in the input,
+            # treat it as an explicit empty dict (e.g. clearing the field).
+            if self.field_name in dictionary:
+                return {}
+            return empty
         return dictionary.get(self.field_name, empty)
 
     def to_internal_value(self, data):
         """
         Dicts of native values <- Dicts of primitive datatypes.
         """
         if html.is_html_input(data):
-            data = html.parse_html_dict(data)
+            # Coerce HTML form inputs (e.g. QueryDict/MultiValueDict) to a plain dict.
+            # Use `.dict()` when available to preserve existing behavior of taking
+            # the first value for each key, otherwise fall back to `dict()`.
+            if hasattr(data, 'dict'):
+                data = data.dict()
+            else:
+                data = dict(data)
         if not isinstance(data, dict):
             self.fail('not_a_dict', input_type=type(data).__name__)
         if not self.allow_empty and len(data) == 0:

rest_framework/serializers.py

@@ -438,7 +438,7 @@ def get_value(self, dictionary):
         # We override the default field access in order to support
         # nested HTML forms.
         if html.is_html_input(dictionary):
-            return html.parse_html_dict(dictionary, prefix=self.field_name) or empty
+            return html.parse_html_dict(dictionary, prefix=self.field_name, default=empty)
         return dictionary.get(self.field_name, empty)
 
     def run_validation(self, data=empty):

rest_framework/utils/html.py

@@ -66,7 +66,10 @@ def parse_html_list(dictionary, prefix='', default=None):
     return [ret[item] for item in sorted(ret)] if ret else default
 
 
-def parse_html_dict(dictionary, prefix=''):
+NOT_PROVIDED = object()
+
+
+def parse_html_dict(dictionary, prefix='', default=NOT_PROVIDED):
     """
     Used to support dictionary values in HTML forms.
 
@@ -81,6 +84,9 @@ def parse_html_dict(dictionary, prefix=''):
             'email': 'example@example.com'
         }
     }
+
+    :returns a MultiValueDict of the parsed data, or the value specified in
+        ``default`` if the dict field was not present in the input
     """
     ret = MultiValueDict()
     regex = re.compile(r'^%s\.(.+)$' % re.escape(prefix))
@@ -92,4 +98,8 @@ def parse_html_dict(dictionary, prefix=''):
         value = dictionary.getlist(field)
         ret.setlist(key, value)
 
-    return ret
+    # Left for backwards compatibility in case of external caller
+    if default is NOT_PROVIDED:
+        return ret
+
+    return ret if ret else default

tests/test_fields.py

@@ -2558,6 +2558,74 @@ def test_allow_empty_disallowed(self):
 
         assert exc_info.value.detail == ['This dictionary may not be empty.']
 
+    def test_query_dict_input_with_dot_separated_keys(self):
+        """
+        DictField should correctly parse HTML form (QueryDict) input
+        with dot-separated keys.
+        """
+        class TestSerializer(serializers.Serializer):
+            data = serializers.DictField(child=serializers.CharField())
+
+        serializer = TestSerializer(data=QueryDict('data.a=1&data.b=2'))
+        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data == {'data': {'a': '1', 'b': '2'}}
+
+    def test_query_dict_input_no_values_uses_default(self):
+        """
+        When no matching keys are present in the QueryDict and a default
+        is set, the field should return the default value.
+        """
+        class TestSerializer(serializers.Serializer):
+            a = serializers.IntegerField(required=True)
+            data = serializers.DictField(default=lambda: {'x': 'y'})
+
+        serializer = TestSerializer(data=QueryDict('a=1'))
+        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data == {'a': 1, 'data': {'x': 'y'}}
+
+    def test_query_dict_input_no_values_no_default_and_not_required(self):
+        """
+        When no matching keys are present in the QueryDict, there is no
+        default, and the field is not required, the field should be
+        skipped entirely from validated_data.
+        """
+        class TestSerializer(serializers.Serializer):
+            data = serializers.DictField(required=False)
+
+        serializer = TestSerializer(data=QueryDict(''))
+        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data == {}
+
+    def test_query_dict_input_no_values_required(self):
+        """
+        When no matching keys are present in the QueryDict and the field
+        is required, validation should fail.
+        """
+        class TestSerializer(serializers.Serializer):
+            data = serializers.DictField(required=True)
+
+        serializer = TestSerializer(data=QueryDict(''))
+        assert not serializer.is_valid()
+        assert 'data' in serializer.errors
+
+    def test_partial_update_can_clear_html_dict_field(self):
+        """
+        Test that a partial update can clear a DictField when provided with an
+        empty string value through a QueryDict.
+        """
+        class TestSerializer(serializers.Serializer):
+            field_name = serializers.DictField(required=False)
+            other_field = serializers.CharField(required=False)
+
+        serializer = TestSerializer(
+            data=QueryDict('field_name='),
+            partial=True,
+        )
+        assert serializer.is_valid()
+        assert 'field_name' in serializer.validated_data
+        assert serializer.validated_data['field_name'] == {}
+        assert 'other_field' not in serializer.validated_data
+
 
 class TestNestedDictField(FieldValues):
     """

tests/test_serializer.py

@@ -552,6 +552,26 @@ class Serializer(serializers.Serializer):
         assert Serializer({'nested': {'a': '3', 'b': {}}}).data == {'nested': {'a': '3', 'c': '2'}}
         assert Serializer({'nested': {'a': '3', 'b': {'c': '4'}}}).data == {'nested': {'a': '3', 'c': '4'}}
 
+    def test_nested_serializer_not_required_with_querydict(self):
+        """
+        When a nested serializer is not required and the QueryDict does
+        not contain any matching prefixed keys, the nested serializer
+        should be omitted from validated_data. Regression test for #6234.
+        """
+        from django.http import QueryDict
+
+        class NestedSerializer(serializers.Serializer):
+            x = serializers.CharField()
+
+        class ParentSerializer(serializers.Serializer):
+            name = serializers.CharField()
+            nested = NestedSerializer(required=False)
+
+        serializer = ParentSerializer(data=QueryDict("name=test"))
+        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data == {"name": "test"}
+        assert "nested" not in serializer.validated_data
+
     def test_default_for_allow_null(self):
         """
         Without an explicit default, allow_null implies default=None when serializing. #5518 #5708