In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema only option treats an empty list as implying no only option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the only option, and there is a user role that produces an empty value for only).
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Marshmallow | Marshmallow_project | * | 2.15.1 (excluding) |
| Python-marshmallow | Ubuntu | bionic | * |
| Python-marshmallow | Ubuntu | cosmic | * |
| Python-marshmallow | Ubuntu | upstream | * |
References
- https://github.com/marshmallow-code/marshmallow/issues/772
- https://github.com/marshmallow-code/marshmallow/pull/777
- https://github.com/marshmallow-code/marshmallow/pull/782
- https://github.com/marshmallow-code/marshmallow/issues/772
- https://github.com/marshmallow-code/marshmallow/pull/777
- https://github.com/marshmallow-code/marshmallow/pull/782