Help with new serialization protections

Development

AI-generated summary

The user, pfaffman, is seeking help with a BlockedSerialization error when using render_json_dump with a ServerSerializer. The issue stems from the server model including the entire user record, which triggers the new serialization protections. pfaffman resolved the problem by limiting the fields included in the serializer, realizing that the user data wasn’t needed, and confirming that the protection mechanism is working as intended.

1

Should something like this work?

      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)

Here are all of my renders:

      # render json: servers, each_serializer: ServerIndexSerializer
      # render json: MultiJson.dump(server_serializer, group_serializer)
      # render json: servers, each_serializer: ServerIndexSerializer
      #render_json_dump(both) # FIX!!!! this is the thing we really want. . . 
      render json: servers, each_serializer: ServerIndexSerializer
      # render json: @server, serializer: ServerSerializer, scope: { is_admin => current_user.admin? }
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
        render plain: "ok"
        render plain: "updating API key failed"
      render plain: @server.ssh_key_public
          render json: success_json
          render json: failed_json, status: 500
        render json: failed_json, status: 500
        return render json: failed_json, status: 404 unless guardian.can_manage_server?(@server)
          render json: failed_json, status: 403
            render json: @server, serializer: ServerSerializer
            render json: failed_json, status: 500
        render json: failed_json, status: 500
      render plain: text
          render json: failed_json, status: 403
          render json: failed_json, status: 501
          return render json: failed_json, status: 403 unless guardian.can_install_server?(@server)
          render json: @server, serializer: ServerSerializer
        render json: failed_json, status: 501
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
      render_json_dump(ServerSerializer.new(@server, scope: guardian), is_index: false)
            # render_json_error(@server.errors.full_messages)
          render json: @server, serializer: ServerSerializer
          # render_json_error(@server.errors.full_messages)
          render_json_error(ServerSerializer.new(@server, scope: guardian).errors.full_messages)

This is, I think, what’s giving me the BlockedSerialization error:

    def index
      if params["group_name"]
        group = Group.find_by_name(params["group_name"])
        if (params["group_name"] == "everyone") && current_user.admin?
          # puts "Getting all servers!!!!!!!!!!!!!!!!!!!"
          servers = ::Pfaffmanager::Server.all.sort_by(&:updated_at).reverse
        else
          servers = ::Pfaffmanager::Server.where(group_id: group.id).sort_by(&:updated_at).reverse
        end
      elsif params["s"]
        s = params["s"]
        servers =
          ::Pfaffmanager::Server.where("hostname like '%#{s}%'").sort_by(&:updated_at).reverse
      else
        servers =
          ::Pfaffmanager::Server.where(user_id: current_user.id).sort_by(&:updated_at).reverse
      end
      # render json: servers, each_serializer: ServerIndexSerializer

      server_groups = Pfaffmanager::Server.where("group_id is not null").pluck(:group_id).uniq
      groups = Group.where(id: server_groups)

      my_groups = groups.select { |g| current_user.groups.pluck(:id).include? g.id }

      product_serializer = ActiveModel::ArraySerializer.new(Pfaffmanager::Server.product_hash)

      # add only: to serializer to limit fields

      server_serializer =
        ActiveModel::ArraySerializer.new(
          servers,
          each_serializer: ServerIndexSerializer,
          scope: guardian,
        )

      group_serializer =
        ActiveModel::ArraySerializer.new(
          my_groups,
          each_serializer: BasicGroupSerializer,
          scope: guardian,
        )
      both = {
        install_types: PfaffmanagerInstallType.install_types,
        product_hash: Pfaffmanager::Server.product_hash,
        servers: server_serializer,
        groups: group_serializer,
      }
      # render json: MultiJson.dump(server_serializer, group_serializer)
      # render json: servers, each_serializer: ServerIndexSerializer
      #render_json_dump(both) # FIX!!!! this is the thing we really want. . . 
      render json: servers, each_serializer: ServerIndexSerializer
      
    end
2

This problem ended up being that my server model included the whole user record and I needed to be calling some serializer or :only to keep from superflously including the entire record, and, it turns out, I didn’t need any of it, so I guess this protection nonsense is doing its job!