Jmsserializerbundle: If no group is defined on SerializationContext all fields with exposed true for groups are exposed

[mamartins]

Hello,

I was trying to have 2 expose methods for my user entity, one for the owner (with hashkey etc.) and other for "public" usage with only it's non sensitive info.

I've done that with groups, the problem is that if no group is set on the controller it exposes all methods even those that have the expose true only for a specific group.

eg:

AppBundle\Entity\User:
    exclusion_policy: ALL
    properties:
        referralCode:
            expose: true
        referrer:
            expose: true
        apikey:
            expose: true
            groups: [owner]

I expected that when no $context = SerializationContext::create()->setGroups(array("Default", "owner")); was set I got only the properties referralCode and referrer, but the apikey also cames along.

Having to set SerializationContext on all methods to hide the apikey can lead to potential security flaw if you miss to add it in some place. When no group is defined it should only expose the properties that don't have that restriction

[fliespl]

@mamartins have you found solution to this issue?

[fliespl]

Nevermind. Found out that setting below does the magic :)

fos_rest:
    serializer:
        groups: [Default]

[akomm]

Well yes, fos_rest has a solution for this, but this is jms_serializer. I'v ditched fos_rest for reasons.

This is a problem. It does not allow us to provide custom default SerializationContext.

An simple solution (not for this bundle) would be this:

parameters:
  jms_serializer.serializer.class: 'AppBundle\Serializer\CustomContextSerializer'

<?php

namespace AppBundle\Serializer;

use JMS\Serializer\SerializationContext;
use JMS\Serializer\Serializer;

/**
 * Class CustomContextSerializer
 * @package AppBundle\Serializer
 */
class CustomContextSerializer extends Serializer
{
    public function serialize($data, $format, SerializationContext $context = null)
    {
        if (null == $context) {
            $context = new SerializationContext();
            $context->setGroups(['Default']);
        }

        return parent::serialize($data, $format, $context);
    }
}

To make it configurable you would also need to extend the JMS Serializer and add a constructor configuration parameter, which is injected based on extension-configuration. Then override the serialize method and instantiate a context with the defaults provided via configuration.

[goetas]

With context factories https://github.com/schmittjoh/serializer/pull/645 added in jms serializer v1.4 and jms serializer bundle v1.2 , you can provide a factory for the context

[iisisrael]

When using this bundle, you now don't need to create your own context factory, as it can be done for you via configurations. Override the default behavior to exclude a property from the Default context if one or more groups is set on the property by using this configuration (available in versions ^1.4.0 with PR #556):

jms_serializer:
    default_context:
        serialization:
            groups: ['Default']

To then _include_ a property in the Default context as well as another group context (still excluding it from any other group context), add it explicitly to the property groups:

    exclusion_policy: ALL
    properties:
        someProperty:
            expose: true
            groups: [ 'mygroup', 'Default' ]

[lukepass]

@fliespl Thank you. Is this still the only solution?
@iisisrael I didn't catch your last comment. Is it a direct solution?