This is related to https://www.drupal.org/node/2984964

I found that the fix was not sufficient for responses that use count queries.

The attached patch needs some additional tests to validate that the issue no longer occurs with count queries, but it's a start.

Comments

jludwig created an issue. See original summary.

jludwig’s picture

jludwig’s picture

Title: Edit JSON API + hook_node_grants() implementations: accessing a node listing with a count query as non-admin user results in a cacheability metadata leak » JSON API + hook_node_grants() implementations: accessing a node listing with a count query as non-admin user results in a cacheability metadata leak
wim leers’s picture

Title: JSON API + hook_node_grants() implementations: accessing a node listing with a count query as non-admin user results in a cacheability metadata leak » Follow-up for #2984964: JSON API + hook_node_grants() implementations: count queries still result in cacheability metadata leak
Assigned: jludwig » wim leers
Status: Active » Needs work
Related issues: +#2942426: [DISCUSSION] Remove query counting and collection counts?

D'oh! 😞

Makes sense. Good find. Thanks for the detailed report and patch! 👏

The patch does exactly what I would propose! I only have obscenely nitpicky nitpicks:

  1. +++ b/src/Controller/EntityResource.php
    @@ -396,10 +391,41 @@ class EntityResource {
    +   * Execute the query in a render context, to catch bubbled cacheability.
    

    Nit: s/Execute/Executes/

    (I know you c/p'ed this, but as soon as it's a method, Drupal CS mandate that this is a 3rd person singular verb.)

  2. +++ b/src/Controller/EntityResource.php
    @@ -396,10 +391,41 @@ class EntityResource {
    +   *   Returns an integer for count queries or an array of ids. The values of
    +   *   the array are always entity ids. The keys will be revision ids if the
    +   *   entity supports revision and entity ids if not.
    

    Nit: s/ids/IDs/

All this needs is:

  1. CS violation fixed
  2. Two nits above fixed.
  3. Test coverage

However, in this case, the test coverage would be for functionality that jsonapi_extras provides, not jsonapi. (That's a whole discussion too, see #2942426: [DISCUSSION] Remove query counting and collection counts?.) Given that, I think test coverage is not necessary. Even more so because it's just expanding/consistently applying a pre-existing pattern. So I think this can go in without test coverage.

That leaves only:

  1. CS violation fixed
  2. Two nits above fixed.

Looks like you're in the USA, so you must be sleeping right now. I'll get those small things done, so you wake up to a fixed issue 😃

wim leers’s picture

Assigned: wim leers » Unassigned
Status: Needs work » Needs review
StatusFileSize
new4.1 KB

Status: Needs review » Needs work

The last submitted patch, 5: 3005826-5.patch, failed testing. View results

wim leers’s picture

Status: Needs work » Needs review
StatusFileSize
new722 bytes
new4.05 KB

Looks like #2 did introduce a small bug. Easy fix :)

Status: Needs review » Needs work

The last submitted patch, 7: 3005826-7.patch, failed testing. View results

wim leers’s picture

Status: Needs work » Needs review
StatusFileSize
new786 bytes
new4.05 KB

And one more small mistake in #2.

wim leers’s picture

Status: Needs review » Reviewed & tested by the community

Green!

  • Wim Leers committed d39aa2a on 8.x-2.x authored by jludwig
    Issue #3005826 by jludwig, Wim Leers: Follow-up for #2984964: JSON API...
wim leers’s picture

Status: Reviewed & tested by the community » Fixed
e0ipso’s picture

👍🏽

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.