marshmallow-code / marshmallow-code/marshmallow
Are nested options applied correctly?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 738
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 7
Description
Experimenting with `only`, I noticed it is possible to assign an invalid value to a Field's `only` attribute.
Looking at the code in the `__apply_nested_option` method of the `schema.Schema` class, there is no validation done when propagating the `only` value to a field.
```python
from marshmallow import fields, Schema
class S(Schema):
f = fields.Str()
S(only=['f.a.b'])
# actual output.
ValueError: Option: 'only' with value: 'a.b' is not valid for Field: 'f'. # expected output.
```
All comments are welcome.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the __apply_nested_option method of the schema.Schema class and reproduce the issue using the S schema shown in the report. Check how the nested only value is propagated to the f field. Done means S(only=['f.a.b']) rejects the invalid nested option with the expected ValueError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100