Merge commit from fork

* Security: in summary serializer only allow access to metadata that is available in the catalog.

* add RESTAPI_EXTRA_NON_METADATA_ATTRIBUTES environment variable, a comma-separated list of extra attribute names appended to the summary serializer `non_metadata_attributes`

* add debug logging

* remove python-version added by mistake

* fix

---------

Co-authored-by: Mauro Amico <mauro.amico@gmail.com>

Author: mauritsvanrees

news/+6263b817.bugfix.md

@@ -0,0 +1 @@
+Security: in summary serializer only allow access to metadata that is available in the catalog.

news/+extra-non-metadata-attributes.feature.md

@@ -0,0 +1 @@
+Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`.

src/plone/restapi/serializer/summary.py

@@ -12,6 +12,19 @@
 from zope.interface import implementer
 from zope.interface import Interface
 
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+ADDITIONAL_NON_METADATA_ATTRIBUTES = {
+    attr.strip()
+    for attr in os.environ.get("RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES", "").split(
+        ","
+    )
+    if attr.strip()
+}
+
 
 @implementer(IJSONSummarySerializerMetadata)
 class JSONSummarySerializerMetadata:
@@ -30,7 +43,7 @@ def non_metadata_attributes(self):
         return {
             "getPath",
             "getURL",
-        }
+        } | ADDITIONAL_NON_METADATA_ATTRIBUTES
 
     def blocklisted_attributes(self):
         return {
@@ -112,14 +125,26 @@ def metadata_fields(self):
         if not isinstance(additional_metadata_fields, list):
             additional_metadata_fields = [additional_metadata_fields]
         additional_metadata_fields = set(additional_metadata_fields)
-
+        if not additional_metadata_fields:
+            return self.default_metadata_fields
+
+        fields_cache = self.request.get("_summary_fields_cache", None)
+        if fields_cache is None:
+            catalog = getToolByName(self.context, "portal_catalog")
+            fields_cache = set(catalog.schema()) | self.non_metadata_attributes
+            self.request.set("_summary_fields_cache", fields_cache)
         if "_all" in additional_metadata_fields:
-            fields_cache = self.request.get("_summary_fields_cache", None)
-            if fields_cache is None:
-                catalog = getToolByName(self.context, "portal_catalog")
-                fields_cache = set(catalog.schema()) | self.non_metadata_attributes
-                self.request.set("_summary_fields_cache", fields_cache)
             additional_metadata_fields = fields_cache
+        else:
+            rejected_metadata_fields = additional_metadata_fields - fields_cache
+            if rejected_metadata_fields:
+                logger.debug(
+                    "Rejected metadata_fields %s requested for %s: not available "
+                    "in the catalog schema or non_metadata_attributes.",
+                    sorted(rejected_metadata_fields),
+                    self.context,
+                )
+            additional_metadata_fields = additional_metadata_fields & fields_cache
 
         return self.default_metadata_fields | additional_metadata_fields
 

src/plone/restapi/tests/test_serializer_summary.py

@@ -9,6 +9,7 @@
 from plone.event.interfaces import IEvent
 from plone.event.interfaces import IEventRecurrence
 from plone.restapi.interfaces import ISerializeToJsonSummary
+from plone.restapi.serializer.summary import JSONSummarySerializerMetadata
 from plone.restapi.testing import PLONE_RESTAPI_DX_INTEGRATION_TESTING
 from plone.restapi.testing import register_static_uuid_utility
 from Products.CMFCore.utils import getToolByName
@@ -19,6 +20,7 @@
 import Missing
 import pytz
 import unittest
+import unittest.mock as mock
 
 try:
     from plone.app.event.adapters import OccurrenceContentListingObject
@@ -201,6 +203,19 @@ def test_brain_summary_includes_all_metadata_fields(self):
             summary.items(),
         )
 
+    def test_extra_non_metadata_attributes_env_var(self):
+        with mock.patch(
+            "plone.restapi.serializer.summary.ADDITIONAL_NON_METADATA_ATTRIBUTES",
+            {"customAttribute", "anotherCustomAttribute"},
+        ):
+            non_metadata_attributes = (
+                JSONSummarySerializerMetadata().non_metadata_attributes()
+            )
+        self.assertIn("customAttribute", non_metadata_attributes)
+        self.assertIn("anotherCustomAttribute", non_metadata_attributes)
+        self.assertIn("getPath", non_metadata_attributes)
+        self.assertIn("getURL", non_metadata_attributes)
+
     def test_dx_type_summary(self):
         summary = getMultiAdapter((self.doc1, self.request), ISerializeToJsonSummary)()