feat: throw error on deeply nested selections

Author: maurei

src/JsonApiDotNetCore/QueryParameterServices/SparseFieldsService.cs

@@ -51,9 +51,11 @@ public virtual void Parse(KeyValuePair<string, StringValues> queryParameter)
 
             var keySplitted = queryParameter.Key.Split(QueryConstants.OPEN_BRACKET, QueryConstants.CLOSE_BRACKET);
 
-            if (keySplitted.Count() == 1) // input format: fields=prop1,prop2
+            if (keySplitted.Count() == 1)
+            {   // input format: fields=prop1,prop2
                 foreach (var field in fields)
                     RegisterRequestResourceField(field);
+            }
             else
             {  // input format: fields[articles]=prop1,prop2
                 string navigation = keySplitted[1];
@@ -65,6 +67,9 @@ public virtual void Parse(KeyValuePair<string, StringValues> queryParameter)
                         $" the square bracket navigations is now reserved " +
                         $"for relationships only. See https://github.com/json-api-dotnet/JsonApiDotNetCore/issues/555#issuecomment-543100865");
 
+                if (navigation.Contains(QueryConstants.DOT))
+                    throw new JsonApiException(400, $"fields[{navigation}] is not valid: deeply nested sparse field selection is not yet supported.");
+
                 var relationship = _requestResource.Relationships.SingleOrDefault(a => a.Is(navigation));
                 if (relationship == null)
                     throw new JsonApiException(400, $"\"{navigation}\" in \"fields[{navigation}]\" is not a valid relationship of {_requestResource.EntityName}");

test/UnitTests/QueryParameters/SparseFieldsServiceTests.cs

@@ -83,6 +83,32 @@ public void Parse_TypeNameAsNavigation_ThrowsJsonApiException()
             Assert.Contains("relationships only", ex.Message);
         }
 
+        [Fact]
+        public void Parse_DeeplyNestedSelection_ThrowsJsonApiException()
+        {
+            // arrange
+            const string type = "articles";
+            const string relationship = "author.employer";
+            const string attrName = "some-field";
+            const string internalAttrName = "SomeField";
+            var attribute = new AttrAttribute(attrName) { InternalAttributeName = internalAttrName };
+            var idAttribute = new AttrAttribute("id") { InternalAttributeName = "Id" };
+
+            var query = new KeyValuePair<string, StringValues>($"fields[{relationship}]", new StringValues(attrName));
+
+            var contextEntity = new ContextEntity
+            {
+                EntityName = type,
+                Attributes = new List<AttrAttribute> { attribute, idAttribute },
+                Relationships = new List<RelationshipAttribute>()
+            };
+            var service = GetService(contextEntity);
+
+            // act, assert
+            var ex = Assert.Throws<JsonApiException>(() => service.Parse(query));
+            Assert.Contains("deeply nested", ex.Message);
+        }
+
         [Fact]
         public void Parse_InvalidField_ThrowsJsonApiException()
         {