Tree fields returns writeOnly, property-restricted and encrypted values raw #4667

Found during a Strict review of #4580 (release development → beta). Present on development at 8e7bbd87; introduced in #4656.

Impact

GET …/tree?fields=a,b copies each named key straight from the raw object onto every node, with no property RBAC, writeOnly redaction or decryption.

The chain

GET /api/objects/{register}/{schema}/{id}/tree?fields=a,b copies each named key straight from $object->getObject() onto every node (node(), line 479), for the root and for every ancestor and descendant. Nothing on this path strips writeOnly properties, applies property-level authorization.read (PropertyRbacHandler::filterReadableProperties), or decrypts x-openregister-encrypted properties. Every other read path does: RenderObject::renderEntity, and the fast list paths in ObjectsController call RenderObject::redactWriteOnlyFromRows() for exactly this reason (comment at ObjectsController.php:1586: "without the redaction call below it returns every write-only field in cleartext… This is the exact path the OpenConnector Source leak used").

Impact: any user who may read an object of a hierarchy/party schema can read every writeOnly secret and every property they are denied by property-level RBAC on all readable nodes of the tree, by naming the property in fields. Encrypted properties come back as the envelope, not the value, so the endpoint is also wrong for a caller who may read them.

Suggested fix: build properties from the rendered/redacted data: run the loaded entities (root included) through RenderObject::redactWriteOnlyFromRows(rows: $objects, _rbac: true) (it applies writeOnly unconditionally, authorization.read and decryption) before node() reads them, or render each node with renderEntity. Keep fields as a projection of what that returns.

Done when:

• a new ObjectTreeServiceTest case with a schema property secret: {writeOnly: true} and a property with authorization.read the caller lacks: tree(..., fields: ['secret','restricted']) returns neither value on any node, and goes red with the redaction call removed
• grep -n 'redactWriteOnly\|filterReadableProperties\|renderEntity' lib/Service/Relation/ObjectTreeService.php is non-empty

Verified against 8e7bbd87eede51a19cd16b1eda5f1f9cbe21dfc0.

Reproduction

Verified by reading the code at 8e7bbd87; not executed.

Done when

• ObjectTreeServiceTest: writeOnly + authorization.read property named in fields is absent from every node; red when the redaction is removed
• grep -n 'redactWriteOnly|filterReadableProperties|renderEntity' lib/Service/Relation/ObjectTreeService.php returns a line

Review thread

#4580 (comment)