Merge commit from fork

* Security: in summary serializer only allow access to metadata that is available in the catalog.

* add RESTAPI_EXTRA_NON_METADATA_ATTRIBUTES environment

---------

Co-authored-by: Mauro Amico <mauro.amico@gmail.com>

Author: mauritsvanrees

news/+6263b817.bugfix.md

@@ -0,0 +1 @@
+Security: in summary serializer only allow access to metadata that is available in the catalog.

news/+extra-non-metadata-attributes.feature.md

@@ -0,0 +1 @@
+Add support for the `RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES` environment variable, a comma-separated list of extra attribute names appended to the summary serializer's `non_metadata_attributes`.

src/plone/restapi/serializer/summary.py

@@ -12,6 +12,20 @@
 from zope.interface import implementer
 from zope.interface import Interface
 
+import logging
+import os
+
+
+logger = logging.getLogger(__name__)
+
+ADDITIONAL_NON_METADATA_ATTRIBUTES = {
+    attr.strip()
+    for attr in os.environ.get("RESTAPI_ADDITIONAL_NON_METADATA_ATTRIBUTES", "").split(
+        ","
+    )
+    if attr.strip()
+}
+
 
 @implementer(IJSONSummarySerializerMetadata)
 class JSONSummarySerializerMetadata:
@@ -30,7 +44,7 @@ def non_metadata_attributes(self):
         return {
             "getPath",
             "getURL",
-        }
+        } | ADDITIONAL_NON_METADATA_ATTRIBUTES
 
     def blocklisted_attributes(self):
         return {
@@ -112,14 +126,26 @@ def metadata_fields(self):
         if not isinstance(additional_metadata_fields, list):
             additional_metadata_fields = [additional_metadata_fields]
         additional_metadata_fields = set(additional_metadata_fields)
-
+        if not additional_metadata_fields:
+            return self.default_metadata_fields
+
+        fields_cache = self.request.get("_summary_fields_cache", None)
+        if fields_cache is None:
+            catalog = getToolByName(self.context, "portal_catalog")
+            fields_cache = set(catalog.schema()) | self.non_metadata_attributes
+            self.request.set("_summary_fields_cache", fields_cache)
         if "_all" in additional_metadata_fields:
-            fields_cache = self.request.get("_summary_fields_cache", None)
-            if fields_cache is None:
-                catalog = getToolByName(self.context, "portal_catalog")
-                fields_cache = set(catalog.schema()) | self.non_metadata_attributes
-                self.request.set("_summary_fields_cache", fields_cache)
             additional_metadata_fields = fields_cache
+        else:
+            rejected_metadata_fields = additional_metadata_fields - fields_cache
+            if rejected_metadata_fields:
+                logger.debug(
+                    "Rejected metadata_fields %s requested for %s: not available "
+                    "in the catalog schema or non_metadata_attributes.",
+                    sorted(rejected_metadata_fields),
+                    self.context,
+                )
+            additional_metadata_fields = additional_metadata_fields & fields_cache
 
         return self.default_metadata_fields | additional_metadata_fields