.../src/Plugin/rest/resource/EntityResourceValidationTrait.php | 6 ++++-- .../src/Functional/EntityResource/EntityResourceTestBase.php | 9 ++++++--- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/core/modules/rest/src/Plugin/rest/resource/EntityResourceValidationTrait.php b/core/modules/rest/src/Plugin/rest/resource/EntityResourceValidationTrait.php index 69f80d6..e24e757 100644 --- a/core/modules/rest/src/Plugin/rest/resource/EntityResourceValidationTrait.php +++ b/core/modules/rest/src/Plugin/rest/resource/EntityResourceValidationTrait.php @@ -21,8 +21,7 @@ * The entity to validate. * @param string[] $changed_fields * (optional) An array of field names. If specified, filters the violations - * list to include only this set of fields. Defaults to an empty array, - * which means that all violations will be reported. + * list to include only this set of fields. * * @throws \Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException * If validation errors are found. @@ -41,6 +40,9 @@ protected function validate(EntityInterface $entity, array $changed_fields = []) // Filter violations by the changed fields. New entities only have changed // fields. if (!$entity->isNew()) { + if (empty($changed_fields)) { + throw new \LogicException("Saving an entity without changing any fields does not make sense."); + } $violations->filterByFields(array_diff(array_keys($entity->getFieldDefinitions()), $changed_fields)); } diff --git a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php index f64fd70..e8a9c2a 100644 --- a/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php +++ b/core/modules/rest/tests/src/Functional/EntityResource/EntityResourceTestBase.php @@ -1155,8 +1155,7 @@ public function testPatch() { if ($this->entity instanceof FieldableEntityInterface) { // Change the rest_test_validation field to prove that then its validation - // does run. In subsequent test assertions, it will not be modified, and - // then should not trigger validation errors. + // does run. $override = [ 'rest_test_validation' => [ [ @@ -1175,12 +1174,16 @@ public function testPatch() { $this->entity->set('rest_test_validation', 'ALWAYS_FAIL'); $this->entity->save(); - // Information dislcosure prevented: when a malicious user correctly + // Information disclosure prevented: when a malicious user correctly // guesses the current invalid value of a field, ensure a 200 is not sent // because this would disclose to the attacker what the current value is. + // @see rest_test_entity_field_access() $response = $this->request('PATCH', $url, $request_options); $this->assertResourceErrorResponse(422, "Unprocessable Entity: validation failed.\nrest_test_validation: REST test validation failed\n", $response); + // All requests after the above one will not include this field (neither + // its current value nor any other), and therefore all subsequent test + // assertions should not trigger a validation error. } // 200 for well-formed PATCH request that sends all fields (even including