Help with new serialization protections

dev
1

Should something like this work?

      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)

Here are all of my renders:

      # render json: servers, each_serializer: ServerIndexSerializer
      # render json: MultiJson.dump(server_serializer, group_serializer)
      # render json: servers, each_serializer: ServerIndexSerializer
      #render_json_dump(both) # FIX!!!! this is the thing we really want. . . 
      render json: servers, each_serializer: ServerIndexSerializer
      # render json: @server, serializer: ServerSerializer, scope: { is_admin => current_user.admin? }
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
        render plain: "ok"
        render plain: "updating API key failed"
      render plain: @server.ssh_key_public
          render json: success_json
          render json: failed_json, status: 500
        render json: failed_json, status: 500
        return render json: failed_json, status: 404 unless guardian.can_manage_server?(@server)
          render json: failed_json, status: 403
            render json: @server, serializer: ServerSerializer
            render json: failed_json, status: 500
        render json: failed_json, status: 500
      render plain: text
          render json: failed_json, status: 403
          render json: failed_json, status: 501
          return render json: failed_json, status: 403 unless guardian.can_install_server?(@server)
          render json: @server, serializer: ServerSerializer
        render json: failed_json, status: 501
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
            # render_json_error(@server.errors.full_messages)
          render json: @server, serializer: ServerSerializer
          # render_json_error(@server.errors.full_messages)
          render_json_error(ServerSerializer.new(@server, scope: guardian).errors.full_messages)

This is, I think, what’s giving me the BlockedSerialization error:

    def index
      if params["group_name"]
        group = Group.find_by_name(params["group_name"])
        if (params["group_name"] == "everyone") && current_user.admin?
          # puts "Getting all servers!!!!!!!!!!!!!!!!!!!"
          servers = ::Pfaffmanager::Server.all.sort_by(&:updated_at).reverse
        else
          servers = ::Pfaffmanager::Server.where(group_id: group.id).sort_by(&:updated_at).reverse
        end
      elsif params["s"]
        s = params["s"]
        servers =
          ::Pfaffmanager::Server.where("hostname like '%#{s}%'").sort_by(&:updated_at).reverse
      else
        servers =
          ::Pfaffmanager::Server.where(user_id: current_user.id).sort_by(&:updated_at).reverse
      end
      # render json: servers, each_serializer: ServerIndexSerializer

      server_groups = Pfaffmanager::Server.where("group_id is not null").pluck(:group_id).uniq
      groups = Group.where(id: server_groups)

      my_groups = groups.select { |g| current_user.groups.pluck(:id).include? g.id }

      product_serializer = ActiveModel::ArraySerializer.new(Pfaffmanager::Server.product_hash)

      # add only: to serializer to limit fields

      server_serializer =
        ActiveModel::ArraySerializer.new(
          servers,
          each_serializer: ServerIndexSerializer,
          scope: guardian,
        )

      group_serializer =
        ActiveModel::ArraySerializer.new(
          my_groups,
          each_serializer: BasicGroupSerializer,
          scope: guardian,
        )
      both = {
        install_types: PfaffmanagerInstallType.install_types,
        product_hash: Pfaffmanager::Server.product_hash,
        servers: server_serializer,
        groups: group_serializer,
      }
      # render json: MultiJson.dump(server_serializer, group_serializer)
      # render json: servers, each_serializer: ServerIndexSerializer
      #render_json_dump(both) # FIX!!!! this is the thing we really want. . . 
      render json: servers, each_serializer: ServerIndexSerializer
      
    end
1 Like
2

This problem ended up being that my server model included the whole user record and I needed to be calling some serializer or :only to keep from superflously including the entire record, and, it turns out, I didn’t need any of it, so I guess this protection nonsense is doing its job!

2 Likes
3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.