Skip to content

Safe exposure of Hash objects is failing #106

Closed
@croeck

Description

@croeck

When using :expose and specifying the exposure as safe: true, objects of the type Hash seem to never get exposed. It does not matter whether the Hash contains a key that matches the attribute.

If i mark the :exposewith safe: false, the response does show the value of the Hash, but of course only as long as the Hash has such a key.

A quick lookup in the source showed me the valid_exposure? method in the entity.rb (around line 570) to be the issue. This is the current check:

(nested_exposures.any? && nested_exposures.all? { |a, o| valid_exposure?(a, o) }) || \
      exposure_options.key?(:proc) || \
      !exposure_options[:safe] || \
      object.respond_to?(self.class.name_for(attribute))

What I don't understand (I'm quite new to ruby and especially grape) is the third line, which actually says that safe exposures are not valid, unless they have nested elements or have a :proc block.

Nevertheless, similar to the fourth line, which checks for a method matching the attribute's name, I would have added a fifth condition that checks if the object is a Hash and does have a key matching the attribute's name:

object.is_a?(Hash) && object.key?(self.class.name_for(attribute))

This would resolve my issue and be more in line with the implementation of the primary output of the serializable_hash method, which does resolve the values of Hash objects.

Can s.o. please verify my issue?
Thank you all!

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions