Problem/Motivation

We want to enforce that custom added parameters (maybe through extensions) will conform to the specification names: http://jsonapi.org/format/upcoming/#document-member-names

Proposed resolution

Add a validation step in the JsonApiParamEnhancer to validate the parameter names. The official parameters needn't be validated.

Invalid parameter names will not trigger an error, but they will not be added to the _json_api_params. This is to allow external parameters like XDEBUG_SESSION_START.

Comments

e0ipso created an issue. See original summary.

e0ipso’s picture

Issue summary: View changes
dawehner’s picture

StatusFileSize
new1.99 KB

This is just a list of tests we should have. Whether this belongs onto the \Drupal\jsonapi\Routing\JsonApiParamEnhancer I'm not sure. We could have an access checker, which does that kind of validation. Seems to be a bit of a better semantic place to do so.

e0ipso’s picture

We could have an access checker, which does that kind of validation. Seems to be a bit of a better semantic place to do so.

+1

dawehner’s picture

Status: Active » Needs review
StatusFileSize
new6.05 KB
e0ipso’s picture

One step closer to full compliance with the standard! Thanks @dawehner. This is almost done. I added a couple of minor suggestions.

  1. +++ b/src/Access/CustomParameterNames.php
    @@ -0,0 +1,40 @@
    +  public function access(Request $request) {
    

    Let's have a docblock with {@inheritdoc}'s.

  2. +++ b/src/Access/CustomParameterNames.php
    @@ -0,0 +1,40 @@
    +  protected function validate(array $json_api_params) {
    

    Let's have a docblock with {@inheritdoc}'s.

  3. +++ b/tests/src/Unit/Access/CustomParameterNamesTest.php
    @@ -0,0 +1,90 @@
    +class CustomParameterNamesTest extends \PHPUnit_Framework_TestCase {
    

    Is there any reason not to use Drupal's base UnitTestCase?

  4. +++ b/tests/src/Unit/Access/CustomParameterNamesTest.php
    @@ -0,0 +1,90 @@
    +  public function testJsonApiParamsValidation($name, $valid) {
    

    Please add the @covers ::access annotation

  5. +++ b/tests/src/Unit/Access/CustomParameterNamesTest.php
    @@ -0,0 +1,90 @@
    +      '/',
    ...
    +      // @todo vertical line?
    

    Maybe |?

  6. +++ b/tests/src/Unit/Access/CustomParameterNamesTest.php
    @@ -0,0 +1,90 @@
    +      // @todo DELETE
    +      // @todo U+0000 to U+001F
    

    Not sure if you can check those into a text file in git. Let's leave them out.

e0ipso’s picture

Status: Needs review » Needs work
dawehner’s picture

Status: Needs work » Needs review
StatusFileSize
new6.4 KB
new2.23 KB

Status: Needs review » Needs work

The last submitted patch, 8: 2745537-8.patch, failed testing.

The last submitted patch, 8: 2745537-8.patch, failed testing.

e0ipso’s picture

This looks perfect to me. We just need a re-roll.

e0ipso’s picture

Status: Needs work » Needs review
StatusFileSize
new6.44 KB

Re-roll.

  • e0ipso committed e6cdfae on 8.x-1.x authored by dawehner
    Issue #2745537 by dawehner, e0ipso: [FEATURE] Validate that custom...
e0ipso’s picture

Fixed and merged.

e0ipso’s picture

Status: Needs review » Fixed
dawehner’s picture

Thank you @e0ipso!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.