Add recursion protection to EntityReferenceItem normalizers

Created on 1 July 2016, over 8 years ago
Updated 28 June 2023, over 1 year ago

Problem/Motivation

The HAL module's EntityReferenceItemNormalizer identifies the target_id and invokes the serializer to embed the referenced object in the HAL structures _links and _embedded properties. To minimize the amount of data embedded, the EntityReferenceItemNormalizer tweaks the $context parameter so only the uuid property is included on the embedded node. This has the secondary effect of preventing referencing fields out of that embedded object so they are not processed.

However, if you customize EntityReferenceItemNormalizer or ContentEntityNormalizer to include more of the "embedded" entity, you will include entity reference fields. Without the hard stop on recursing, any self-references or cycles will result in an uncontrolled recursion.

If you do override HAL to embed more data, you end up running entity loading in the serializer, with no clear way to add its now-significant cache metadata. Immediately referenced items by the loaded entity are not included, it appears referenced metadata is added in the rendering process which is not triggered for REST resources.

The goal as outlined is in making the HAL serializer more friendly to extension and customization, not to add new capabilities in what the HAL or REST modules offer by way of a more versatile API.

Proposed resolution

  1. If a self-reference is detected in EntityReferenceItemNormalizer, treat that field as a "regular" field where the value will be in-lined, instead of recursing to embed the field's referenced entity.
  2. Add a parameter to $context to indicate recursion is happening to provide less invasive or indirect means of identifying what the serializer is doing. For example, add a recursing element with a counter.
  3. Document if it exists, or add support if it does not, a means to addCacheableDependency() from inside the serialization process.

Remaining tasks

Add tests for point 1, implement functionality and tests for point 2 and 3.

User interface changes

None.

API changes

* Additional metadata for serializer that can be ignored.
* Changes that may impact custom or contrib recursion protection implementations.

Data model changes

None.

πŸ“Œ Task
Status

Needs work

Version

2.0

Component

Code

Created by

πŸ‡ΊπŸ‡ΈUnited States Grayside

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024