feat: throw error on deeply nested selections

Author: maurei

src/JsonApiDotNetCore/QueryParameterServices/SparseFieldsService.cs

@@ -51,9 +51,11 @@ public virtual void Parse(KeyValuePair<string, StringValues> queryParameter)
 
  var keySplitted = queryParameter.Key.Split(QueryConstants.OPEN_BRACKET, QueryConstants.CLOSE_BRACKET);
 
- if (keySplitted.Count() == 1) // input format: fields=prop1,prop2
+ if (keySplitted.Count() == 1)
+ { // input format: fields=prop1,prop2
  foreach (var field in fields)
  RegisterRequestResourceField(field);
+ }
  else
  { // input format: fields[articles]=prop1,prop2
  string navigation = keySplitted[1];
@@ -65,6 +67,9 @@ public virtual void Parse(KeyValuePair<string, StringValues> queryParameter)
  $" the square bracket navigations is now reserved " +
  $"for relationships only. See https://github.com/json-api-dotnet/JsonApiDotNetCore/issues/555#issuecomment-543100865");
 
+ if (navigation.Contains(QueryConstants.DOT))
+ throw new JsonApiException(400, $"fields[{navigation}] is not valid: deeply nested sparse field selection is not yet supported.");
+
  var relationship = _requestResource.Relationships.SingleOrDefault(a => a.Is(navigation));
  if (relationship == null)
  throw new JsonApiException(400, $"\"{navigation}\" in \"fields[{navigation}]\" is not a valid relationship of {_requestResource.EntityName}");

test/UnitTests/QueryParameters/SparseFieldsServiceTests.cs

@@ -83,6 +83,32 @@ public void Parse_TypeNameAsNavigation_ThrowsJsonApiException()
  Assert.Contains("relationships only", ex.Message);
  }
 
+ [Fact]
+ public void Parse_DeeplyNestedSelection_ThrowsJsonApiException()
+ {
+ // arrange
+ const string type = "articles";
+ const string relationship = "author.employer";
+ const string attrName = "some-field";
+ const string internalAttrName = "SomeField";
+ var attribute = new AttrAttribute(attrName) { InternalAttributeName = internalAttrName };
+ var idAttribute = new AttrAttribute("id") { InternalAttributeName = "Id" };
+
+ var query = new KeyValuePair<string, StringValues>($"fields[{relationship}]", new StringValues(attrName));
+
+ var contextEntity = new ContextEntity
+ {
+ EntityName = type,
+ Attributes = new List<AttrAttribute> { attribute, idAttribute },
+ Relationships = new List<RelationshipAttribute>()
+ };
+ var service = GetService(contextEntity);
+
+ // act, assert
+ var ex = Assert.Throws<JsonApiException>(() => service.Parse(query));
+ Assert.Contains("deeply nested", ex.Message);
+ }
+
  [Fact]
  public void Parse_InvalidField_ThrowsJsonApiException()
  {