Merge 3.4

Author: soyuka

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v3.3.9
+
+### Bug fixes
+
+* [84df46786](https://github.com/api-platform/core/commit/84df4678618869f439a7995a2534440c031e10f3) fix(jsonld): remove request uri variables when denormalizing output (#6467)
+* [ffb4ad31f](https://github.com/api-platform/core/commit/ffb4ad31f30b531a5102da8cd92235e070f43b86) fix(jsonld): mitigate #6465 (#6469)
+
 ## v3.3.8
 
 ### Bug fixes

src/Serializer/AbstractItemNormalizer.php

@@ -139,9 +139,7 @@ public function normalize(mixed $object, ?string $format = null, array $context
         // Never remove this, with `application/json` we don't use our AbstractCollectionNormalizer and we need
         // to remove the collection operation from our context or we'll introduce security issues
         if (isset($context['operation']) && $context['operation'] instanceof CollectionOperationInterface) {
-            unset($context['operation_name']);
-            unset($context['operation']);
-            unset($context['iri']);
+            unset($context['operation_name'], $context['operation'], $context['iri']);
         }
 
         if ($this->resourceClassResolver->isResourceClass($resourceClass)) {
@@ -174,8 +172,7 @@ public function normalize(mixed $object, ?string $format = null, array $context
         $data = parent::normalize($object, $format, $context);
 
         $context['data'] = $data;
-        unset($context['property_metadata']);
-        unset($context['api_attribute']);
+        unset($context['property_metadata'], $context['api_attribute']);
 
         if ($emptyResourceAsIri && \is_array($data) && 0 === \count($data)) {
             $context['data'] = $iri;
@@ -758,6 +755,7 @@ protected function getAttributeValue(object $object, string $attribute, ?string
             unset(
                 $context['resource_class'],
                 $context['force_resource_class'],
+                $context['uri_variables'],
             );
 
             // Anonymous resources
@@ -788,8 +786,11 @@ protected function getAttributeValue(object $object, string $attribute, ?string
             throw new LogicException(sprintf('The injected serializer must be an instance of "%s".', NormalizerInterface::class));
         }
 
-        unset($context['resource_class']);
-        unset($context['force_resource_class']);
+        unset(
+            $context['resource_class'],
+            $context['force_resource_class'],
+            $context['uri_variables']
+        );
 
         $attributeValue = $this->propertyAccessor->getValue($object, $attribute);
 
@@ -847,8 +848,7 @@ protected function normalizeRelation(ApiProperty $propertyMetadata, ?object $rel
         $context['iri'] = $iri = $this->iriConverter->getIriFromResource(resource: $relatedObject, context: $context);
         $context['data'] = $iri;
         $context['object'] = $relatedObject;
-        unset($context['property_metadata']);
-        unset($context['api_attribute']);
+        unset($context['property_metadata'], $context['api_attribute']);
 
         if ($this->tagCollector) {
             $this->tagCollector->collect($context);
@@ -906,6 +906,7 @@ private function createAndValidateAttributeValue(string $attribute, mixed $value
             ) {
                 $resourceClass = $this->resourceClassResolver->getResourceClass(null, $className);
                 $context['resource_class'] = $resourceClass;
+                unset($context['uri_variables']);
 
                 return $this->denormalizeCollection($attribute, $propertyMetadata, $type, $resourceClass, $value, $format, $context);
             }
@@ -930,7 +931,7 @@ private function createAndValidateAttributeValue(string $attribute, mixed $value
                     throw new LogicException(sprintf('The injected serializer must be an instance of "%s".', DenormalizerInterface::class));
                 }
 
-                unset($context['resource_class']);
+                unset($context['resource_class'], $context['uri_variables']);
 
                 return $this->serializer->denormalize($value, $className.'[]', $format, $context);
             }
@@ -940,7 +941,7 @@ private function createAndValidateAttributeValue(string $attribute, mixed $value
                     throw new LogicException(sprintf('The injected serializer must be an instance of "%s".', DenormalizerInterface::class));
                 }
 
-                unset($context['resource_class']);
+                unset($context['resource_class'], $context['uri_variables']);
 
                 return $this->serializer->denormalize($value, $className, $format, $context);
             }

tests/Fixtures/app/AppKernel.php

@@ -274,7 +274,7 @@ class_exists(NativePasswordHasher::class) ? 'password_hashers' : 'encoders' => [
             $c->prependExtensionConfig('doctrine', [
                 'orm' => [
                     'report_fields_where_declared' => true,
-                    'controller_resolver' => ['auto_mapping' => true],
+                    'controller_resolver' => ['auto_mapping' => false],
                     'enable_lazy_ghost_objects' => true,
                 ],
             ]);