Partial update of component field results in invalid data

[goodhoko]

Bug report

Required System information

• Node.js version: 16.16.0
• Yarn version: 1.22.19
• Strapi version: 4.3.9
• Database: Postgres:12.0
• Operating system: node:16 Docker image.

Describe the bug

Partial update of a "single" component field results in invalid data.

Steps to reproduce the behavior

1. Create a component with two required fields of any type.

   // /src/components/category/component.json
   {
     "collectionName": "components_category_my-component",
     "info": {
       "displayName": "My Component",
     },
     "options": {},
     "attributes": {
       "field_1": {
         "type": "string",
         "required": true
       },
       "field_2": {
         "type": "string",
         "required": true,
       }
     }
   }

2. Create a content-type with a non-repeatable component field that uses the component:

   // /src/api/my-type/contnent-types/my-type/shema.json
   {
     "kind": "collectionType",
     "collectionName": "my-type",
     "info": {
       "singularName": "my-type",
       "pluralName": "my-types",
       "displayName": "My Type"
     },
     "options": {
       "draftAndPublish": false
     },
     "pluginOptions": {},
     "attributes": {
       "component_field": {
         "type": "component",
         "repeatable": false,
         "component": "category.my-component",
         "required": true
       }
     }
   }

3. Allow public role to crate and update the content type:
   
4. Create an entry of the content type:

   POST /api/my-types
   {
     data: {
       component_field: {
         field_1: "value",
         field_2: "value"
       }
     }
   }
   

5. Update one of the fields of the component using the REST API:
    ```
    PUT /api/my-types/1?populate=*
    {
      data: {
        component_field: {
          field_1: "new value",
        }
      }
    }

6. Observe that field_2 gets nulled resulting in invalid entry:

   {
     data: {
       id: 1,
       attributes: {
         component_field: {
           field_1: "new value",
           field_2: null
         }
       },
       meta: {}
     },
     meta: {}
   }
   

Expected behavior

Only field_1 is updated to "new value" and field_2 keeps its value or HTTP 400 is returned stating that field_2 cannot be null.

Additional context

I posted about this on the Strapi forum: https://forum.strapi.io/t/partial-update-of-single-component-field-results-in-invalid-data/23195

[derrickmehaffy]

I believe you forgot to send the id of the component (you don't need this obviously when you create, but you do need it when you update)

It's certainly not an intuitive user experience I'll grant you that but it's reusing our logic for repeatable components. For now I'll mark this bug as closed but if you want to open a feature request on our board here: https://feedback.strapi.io to remove the requirement of having to send the ID please feel free.

[goodhoko]

@derrickmehaffy

I believe you forgot to send the id of the component

Aha! Didn't know this is needed. It would help if docs mentioned this. Do they or am I just blind? Because I didn't notice any info on updating components via the REST api.

It's certainly not an intuitive user experience I'll grant you that but it's reusing our logic for repeatable components

Agree, but I think this is fine. What is not fine though is that requests not specifying the ID get through and can results in invalid data. If this is not handled it's not safe to make the API public (even for authorized users) because it can't hold the invariants of our data model and that open doors to many kinds of malicious intents and/or undefined behaviour. Could we reopen this issue and fix this bug?

I'd be glad to submit a PR to fix this. Could you maybe just point me to where such a validation could be put?

[strapi-bot]

This issue has been mentioned on Strapi Community Forum. There might be relevant details there:

https://forum.strapi.io/t/partial-update-of-single-component-field-results-in-invalid-data/23195/2

[derrickmehaffy]

@derrickmehaffy

I believe you forgot to send the id of the component

Aha! Didn't know this is needed. It would help if docs mentioned this. Do they or am I just blind? Because I didn't notice any info on updating components via the REST api.

It's certainly not an intuitive user experience I'll grant you that but it's reusing our logic for repeatable components

Agree, but I think this is fine. What is not fine though is that requests not specifying the ID get through and can results in invalid data. If this is not handled it's not safe to make the API public (even for authorized users) because it can't hold the invariants of our data model and that open doors to many kinds of malicious intents and/or undefined behaviour. Could we reopen this issue and fix this bug?

I'd be glad to submit a PR to fix this. Could you maybe just point me to where such a validation could be put?

Hmmm yeah that is a good point, I'll reopen this under and exclusion and mark it as a discussion for now. I need @alexandrebodin or @Convly to comment on the intended actions to know if we classify this as a bug.

[ahmedsaed]

This has caused me some painful issues to deal with. Why such dangerous behavior is not at least documented?

The CMS can't just delete content because an ID is missing on a PUT request.