Skip to content

JsonApi\ItemNormalizer::denormalize() is called twice resulting in nulled input properties #7794

@daFish

Description

@daFish

API Platform version(s) affected: 4.2.17

Description
After PR #7779, AbstractItemNormalizer::supportsDenormalization() returns true for input DTOs during serializer re-entry (via the api_platform_input flag).
For JSON:API, this causes JsonApi\ItemNormalizer to claim the DTO and attempt to extract data.attributes from already-flat data, yielding an empty array.

The flow:

  1. JsonApi\ItemNormalizer::denormalize() unwraps data.attributes → flat array
  2. AbstractItemNormalizer detects input DTO → re-enters serializer with flat data
  3. JsonApi\ItemNormalizer::supportsDenormalization() now returns true (new flag)
  4. JsonApi\ItemNormalizer::denormalize() runs again on flat data → $data['data']['attributes'] is null → empty
  5. Input DTO properties are all null

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions