Backport pr 2060 to 9.x.x branch

Author: ichim-david

CONTRIBUTORS.md

@@ -44,3 +44,4 @@ this file, one to a line, like so:
 - Jon Pentland
 - Leonardo J. Caballero G.
 - Steve Piercy
+- Marcel Liebischer

news/2060.bugfix

@@ -0,0 +1 @@
+Fix two cases where REST API search and summary serialization could return HTTP 500 (`TypeError`) based on request parameters: a form or query string parameter named `summary_serializer_metadata`, and a `portal_type` value containing the substring "query" when `use_site_search_settings` is used. Also make the summary serializer's per-request metadata cache effective; it was recomputed for every item. @mliebischer

src/plone/restapi/search/handler.py

@@ -116,7 +116,7 @@ def filter_query(self, query):
         search_settings = registry.forInterface(ISearchSchema, prefix="plone")
 
         types = query.get("portal_type", [])
-        if "query" in types:
+        if isinstance(types, dict) and "query" in types:
             types = types["query"]
         query["portal_type"] = self.filter_types(types)
 

src/plone/restapi/serializer/summary.py

@@ -85,9 +85,10 @@ class DefaultJSONSummarySerializer:
     def __init__(self, context, request):
         self.context = context
         self.request = request
-        # Cache summary_serializer_metadata on request
-        metadata = self.request.form.get("summary_serializer_metadata", None)
-        if not metadata:
+        # Cache on the request: read via request.get() so the value stored by
+        # request.set() is reused; isinstance() ignores a same-named parameter.
+        metadata = self.request.get("summary_serializer_metadata", None)
+        if not isinstance(metadata, dict):
             metadata = merge_serializer_metadata_utilities_data()
             self.request.set("summary_serializer_metadata", metadata)
 

src/plone/restapi/tests/test_search.py

@@ -718,6 +718,17 @@ def test_respect_access_inactive_permission(self):
         ).json()
         self.assertEqual(response["items_total"], 1)
 
+    def test_search_use_site_search_settings_with_portal_type_containing_query(self):
+        # A portal_type string that happens to contain the substring "query"
+        # must not be mistaken for a {"query": ...} dict, which raised a
+        # TypeError (HTTP 500) in filter_query.
+        response = self.api_session.get(
+            "/@search",
+            params={"use_site_search_settings": 1, "portal_type": "Subquery"},
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json()["items_total"], 0)
+
     def test_search_use_site_search_settings_for_types(self):
         response = self.api_session.get(
             "/@search", params={"use_site_search_settings": 1}

src/plone/restapi/tests/test_serializer_summary.py

@@ -19,6 +19,7 @@
 import Missing
 import pytz
 import unittest
+from unittest import mock
 
 
 try:
@@ -202,6 +203,36 @@ def test_brain_summary_includes_all_metadata_fields(self):
             summary.items(),
         )
 
+    def test_request_metadata_cache_is_reused(self):
+        # The per-request metadata cache must take effect, so the metadata is
+        # only computed once even when many items are serialized in the same
+        # request (e.g. a search result or folder listing with many items).
+        from plone.restapi.serializer import summary as summary_module
+
+        self.request.other.pop("summary_serializer_metadata", None)
+
+        with mock.patch.object(
+            summary_module,
+            "merge_serializer_metadata_utilities_data",
+            wraps=summary_module.merge_serializer_metadata_utilities_data,
+        ) as merge_mock:
+            getMultiAdapter((self.doc1, self.request), ISerializeToJsonSummary)()
+            getMultiAdapter((self.doc1, self.request), ISerializeToJsonSummary)()
+
+        self.assertEqual(merge_mock.call_count, 1)
+
+    def test_request_parameter_does_not_break_serialization(self):
+        self.request.other.pop("summary_serializer_metadata", None)
+        self.request.form["summary_serializer_metadata"] = "injected"
+        try:
+            summary = getMultiAdapter(
+                (self.doc1, self.request), ISerializeToJsonSummary
+            )()
+        finally:
+            del self.request.form["summary_serializer_metadata"]
+
+        self.assertEqual(summary["@type"], "DXTestDocument")
+
     def test_dx_type_summary(self):
         summary = getMultiAdapter((self.doc1, self.request), ISerializeToJsonSummary)()