[discuss] Validation behavior during deserialization vs. serialization
See original GitHub issueIs it ok that required fields doesn’t work in load()
method?
From quickstart example:
class UserSchema(Schema):
name = fields.String(required=True)
email = fields.Email()
user = {'name': None, 'email': 'foo@bar.com'}
data, errors = UserSchema().dump(user)
errors # {'name': 'Missing data for required field.'}
user = {'name': None, 'email': 'foo@bar.com'}
data, errors = UserSchema().load(user)
errors # {}
I thought that load()
method is used for loading model objects from input data and SHOULD support required
fields. On the contrary, method dump()
is used to serialize inner data and not requires validation at all. Whether I understand everything correctly?
Issue Analytics
- State:
- Created 9 years ago
- Comments:16 (10 by maintainers)
Top Results From Across the Web
Serialization and deserialization in Java | Snyk Blog
A Java deserialize vulnerability is a security vulnerability that occurs when a malicious user tries to insert a modified serialized object into ...
Read more >Serialization and Deserialization: Languages they work with
During deserialization of data, vulnerability occurs when an attacker manipulates the data during serialization, which is then passed for ...
Read more >Serialization
Validation during deserialization ... If so desired, JSON can be validated by a JSON Schema before deserialization of client-defined types. The schema must...
Read more >Deserialization - OWASP Cheat Sheet Series
Serialization is the process of turning some object into a data format that can be restored later. People often serialize objects in order...
Read more >Serialization Validation in Java - Baeldung
2. Serialization and Deserialization ... Serialization is the process of converting the state of an object into a byte stream. Serialized objects ...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
As discussed in the above thread, defaults for deserialization can be defined in
make_object
or in apreprocessor
. For example, if you want the deserialization defaults to be the same as serialization defaults, you could do the following:In lieu of the
missing
parameter discussed in previous comments, you can take advantage of the fact that extrakwargs
passed to fields are stored in each field’smetadata
attribute. This would allow you to have different defaults between serialization/deserialization.Yes, I am aware that these workarounds are just that: hacky workarounds. I will open up an issue to reopen discussion of a built-in
missing
param.EDIT: Fix first example
Yeah, thanks, I’m afraid I hadn’t noticed that. #189 still is a problem, but I think that’s not by design so I’ll go back to that issue. I’ll open another issue regarding the docs.