cerebris / jsonapi-resources

A resource-focused Rails library for developing JSON:API compliant servers.
http://jsonapi-resources.com
MIT License
2.32k stars 532 forks source link

[v11] Sparse fieldsets allow for invalid types #1460

Open adamkiczula opened 1 week ago

adamkiczula commented 1 week ago

This issue is a (choose one):

Checklist before submitting:

Description

When specifying sparse fieldsets, if you specify the type as the singular version of the type (i.e. fields[user]=name instead of fields[users]=name, the request succeeds instead of returning a 400.

Bug reports:

On the v0-11-dev branch with Ruby 3.3.5. The root of the issue is that classify is used to look up the resource class, which works the same for user and users, they both become UserResource, but then parse_fields doesn't verify that the type matches after getting the resource class back.