diff --git a/ModelDescriber/ObjectModelDescriber.php b/ModelDescriber/ObjectModelDescriber.php index d1a0646..fc86439 100644 --- a/ModelDescriber/ObjectModelDescriber.php +++ b/ModelDescriber/ObjectModelDescriber.php @@ -72,10 +72,15 @@ class ObjectModelDescriber implements ModelDescriberInterface, ModelRegistryAwar $annotationsReader->updateDefinition($reflClass, $schema); $propertyInfoProperties = $this->propertyInfo->getProperties($class, $context); + if (null === $propertyInfoProperties) { return; } + // Fix for https://github.com/nelmio/NelmioApiDocBundle/issues/1756 + // The SerializerExtractor does expose private/protected properties for some reason, so we eliminate them here + $propertyInfoProperties = array_intersect($propertyInfoProperties, $this->propertyInfo->getProperties($class, []) ?? []); + foreach ($propertyInfoProperties as $propertyName) { $serializedName = null !== $this->nameConverter ? $this->nameConverter->normalize($propertyName, $class, null, null !== $model->getGroups() ? ['groups' => $model->getGroups()] : []) : $propertyName; @@ -86,7 +91,7 @@ class ObjectModelDescriber implements ModelDescriberInterface, ModelRegistryAwar $serializedName = $annotationsReader->getPropertyName($reflection, $serializedName); } - $property = Util::getProperty($schema, $annotationsReader->getPropertyName($reflection, $serializedName)); + $property = Util::getProperty($schema, $serializedName); // Interpret additional options $groups = $model->getGroups(); diff --git a/Tests/Functional/Entity/PrivateProtectedExposure.php b/Tests/Functional/Entity/PrivateProtectedExposure.php new file mode 100644 index 0000000..f0b30fb --- /dev/null +++ b/Tests/Functional/Entity/PrivateProtectedExposure.php @@ -0,0 +1,30 @@ + + */ +class PrivateProtectedExposure +{ + private $privateField; + protected $protectedField; + + /** + * @var string + */ + public $publicField; + + protected function setProtected(string $thing) + { + } +} diff --git a/Tests/Functional/FunctionalTest.php b/Tests/Functional/FunctionalTest.php index bedf0b5..126fb91 100644 --- a/Tests/Functional/FunctionalTest.php +++ b/Tests/Functional/FunctionalTest.php @@ -471,4 +471,19 @@ class FunctionalTest extends WebTestCase $operation = $this->getOperation('/api/article/{id}', 'get'); $this->assertNull($operation->operationId); } + + /** + * Related to https://github.com/nelmio/NelmioApiDocBundle/issues/1756 + * Ensures private/protected properties are not exposed, just like the symfony serializer does. + */ + public function testPrivateProtectedExposure() + { + // Ensure that groups are supported + $model = $this->getModel('PrivateProtectedExposure'); + $this->assertCount(1, $model->properties); + $this->assertHasProperty('publicField', $model); + $this->assertNotHasProperty('privateField', $model); + $this->assertNotHasProperty('protectedField', $model); + $this->assertNotHasProperty('protected', $model); + } } diff --git a/Tests/Functional/SwaggerUiTest.php b/Tests/Functional/SwaggerUiTest.php index c19a0a6..38b5d38 100644 --- a/Tests/Functional/SwaggerUiTest.php +++ b/Tests/Functional/SwaggerUiTest.php @@ -53,6 +53,7 @@ class SwaggerUiTest extends WebTestCase $expected['servers'] = [ ['url' => 'http://api.example.com/app_dev.php'], ]; + $this->assertEquals($expected, json_decode($crawler->filterXPath('//script[@id="swagger-data"]')->text(), true)['spec']); } diff --git a/Tests/Functional/TestKernel.php b/Tests/Functional/TestKernel.php index f2d6d6b..66885bf 100644 --- a/Tests/Functional/TestKernel.php +++ b/Tests/Functional/TestKernel.php @@ -19,6 +19,7 @@ use JMS\SerializerBundle\JMSSerializerBundle; use Nelmio\ApiDocBundle\NelmioApiDocBundle; use Nelmio\ApiDocBundle\Tests\Functional\Entity\BazingaUser; use Nelmio\ApiDocBundle\Tests\Functional\Entity\NestedGroup\JMSPicture; +use Nelmio\ApiDocBundle\Tests\Functional\Entity\PrivateProtectedExposure; use Nelmio\ApiDocBundle\Tests\Functional\ModelDescriber\VirtualTypeClassDoesNotExistsHandlerDefinedDescriber; use Sensio\Bundle\FrameworkExtraBundle\SensioFrameworkExtraBundle; use Symfony\Bundle\FrameworkBundle\FrameworkBundle; @@ -232,6 +233,10 @@ class TestKernel extends Kernel ], 'models' => [ 'names' => [ + [ + 'alias' => 'PrivateProtectedExposure', + 'type' => PrivateProtectedExposure::class, + ], [ 'alias' => 'JMSPicture_mini', 'type' => JMSPicture::class, diff --git a/composer.json b/composer.json index 21753eb..c69465f 100644 --- a/composer.json +++ b/composer.json @@ -43,7 +43,7 @@ "doctrine/common": "^2.4", "api-platform/core": "^2.4", - "friendsofsymfony/rest-bundle": "^2.8|^3.0@dev", + "friendsofsymfony/rest-bundle": "^2.8|^3.0", "willdurand/hateoas-bundle": "^1.0|^2.0", "jms/serializer-bundle": "^2.3|^3.0", "jms/serializer": "^1.14|^3.0"