If translation.groups is defined as filter without a defined whitelist, it will allow to provide just any serialization group for the ?groups[]= parameter.
This might expose properties with serialization groups that are not defined in the normalizationContext of an API resource and shouldn't be exposed.
By configuring locastic_api_platform_translation.filter.translation_groups arguments with 'translations' defined in the $whitelist parameter, only the translations serialization group is allowed for the filter defined by this bundle.
Description
If
translation.groups
is defined as filter without a defined whitelist, it will allow to provide just any serialization group for the?groups[]=
parameter. This might expose properties with serialization groups that are not defined in thenormalizationContext
of an API resource and shouldn't be exposed.By configuring
locastic_api_platform_translation.filter.translation_groups
arguments with'translations'
defined in the$whitelist
parameter, only thetranslations
serialization group is allowed for the filter defined by this bundle.