AIKIDO-2026-10459

TL;DR

AbstractItemNormalizer short-circuited security handling when resource_class was not considered a resource class: canAccessAttribute() returned true without evaluating ApiProperty security / policy, and the post-denormalize path returned early before reverting disallowed attributes for those types. Input DTOs legitimately use non-resource classes, so ApiProperty security expressions on input DTO properties were skipped. The fix removes those isResourceClass guards where they blocked required checks, evaluates property metadata (with PropertyNotFoundException ignored for attributes absent from the resource metadata chain), and keeps post-denormalize enforcement aligned with input DTOs.