From e1f3929f3059f2951aa4a2bda97c9ef4f79bb61f Mon Sep 17 00:00:00 2001
From: Oliver Sauder <os@esite.ch>
Date: Thu, 15 Oct 2020 16:37:44 +0200
Subject: [PATCH] Stopped SparseFieldsetsMixin interpretting invalid fields
 parameter

---
 CHANGELOG.md                                  |  3 ++
 .../integration/test_sparse_fieldsets.py      | 34 ++++++++++++++++---
 rest_framework_json_api/serializers.py        |  2 +-
 3 files changed, 33 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b8a3e77..fc54b1bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,9 @@ This release is not backwards compatible. For easy migration best upgrade first
 * Removed obsolete `source` argument of `SerializerMethodResourceRelatedField`
 * Removed obsolete setting `JSON_API_SERIALIZE_NESTED_SERIALIZERS_AS_ATTRIBUTE` to render nested serializers as relationships. Default is as attribute now.
 
+### Fixed
+
+* Stopped `SparseFieldsetsMixin` interpretting invalid fields query parameter (e.g. invalidfields[entries]=blog,headline)
 
 ## [3.2.0] - 2020-08-26
 
diff --git a/example/tests/integration/test_sparse_fieldsets.py b/example/tests/integration/test_sparse_fieldsets.py
index c76f1efd..83b8560a 100644
--- a/example/tests/integration/test_sparse_fieldsets.py
+++ b/example/tests/integration/test_sparse_fieldsets.py
@@ -1,12 +1,36 @@
 import pytest
 from django.urls import reverse
+from rest_framework import status
 
 pytestmark = pytest.mark.django_db
 
 
-def test_sparse_fieldset_ordered_dict_error(multiple_entries, client):
+def test_sparse_fieldset_valid_fields(client, entry):
     base_url = reverse('entry-list')
-    querystring = '?fields[entries]=blog,headline'
-    # RuntimeError: OrderedDict mutated during iteration
-    response = client.get(base_url + querystring)
-    assert response.status_code == 200  # succeed if we didn't fail due to the above RuntimeError
+    response = client.get(base_url, data={'fields[entries]': 'blog,headline'})
+    assert response.status_code == status.HTTP_200_OK
+    data = response.json()['data']
+
+    assert len(data) == 1
+    entry = data[0]
+    assert entry['attributes'].keys() == {'headline'}
+    assert entry['relationships'].keys() == {'blog'}
+
+
+@pytest.mark.parametrize("fields_param", ['invalidfields[entries]', 'fieldsinvalid[entries'])
+def test_sparse_fieldset_invalid_fields_parameter(client, entry, fields_param):
+    """
+    Test that invalid fields query parameter is not processed by sparse fieldset.
+
+    rest_framework_json_api.filters.QueryParameterValidationFilter takes care of error
+    handling in such a case.
+    """
+    base_url = reverse('entry-list')
+    response = client.get(base_url, data={'invalidfields[entries]': 'blog,headline'})
+    assert response.status_code == status.HTTP_200_OK
+    data = response.json()['data']
+
+    assert len(data) == 1
+    entry = data[0]
+    assert entry['attributes'].keys() != {'headline'}
+    assert entry['relationships'].keys() != {'blog'}
diff --git a/rest_framework_json_api/serializers.py b/rest_framework_json_api/serializers.py
index f7d884ec..31f2a86b 100644
--- a/rest_framework_json_api/serializers.py
+++ b/rest_framework_json_api/serializers.py
@@ -71,7 +71,7 @@ def __init__(self, *args, **kwargs):
             )
             try:
                 param_name = next(
-                    key for key in request.query_params if sparse_fieldset_query_param in key
+                    key for key in request.query_params if sparse_fieldset_query_param == key
                 )
             except StopIteration:
                 pass