Race Conditions in Marshmallow - Context Not thread safe?

[alnikolaj]

Hello everybody,

I am having a serious problem. We are serializing a list of objects up to 100 objects at a time/per request and we have some custom field methods.

In these field methods, we pass the user_id in the context and perform some queries specific to that user_id. Now... I have noticed that sometimes this extra object field is wrong and after much investigation I found out that in some cases (within the list of objects in the same request!) the user_id was wrong and suddenly changed. The user_id passed through the context changed mid serialization of these 100 objects... I checked this "wrong" user and saw that his/her last activity was the same as mine what leads me to the conclusion that for some reason Marshmallow is not thread-safe and there is a race condition? Here is an example of my code:

# Schema
class MySchema(SQLAlchemyAutoSchema):
    class Meta:
        model = Object

    extra = fields.Method('custom_field', dump_only=True)

    def custom_field(self, obj):
        user_id = self.context.get('user_id')

        # User Favorites
        favorited = False
        in_favorites = Favorite.query.filter_by(user_id = user_id).first()
        if in_favorites:
            favorited = True
        
        return {
            'user_id' : user_id, 
            'favorited' : favorited
        }

# API
objects = Object.query.all()
user = User.query.get(id=id)

many_schema = MySchema(many=True)
many_schema.context['user_id'] = user.id
return many_schema.dump(objects)

I am unsure how to proceed now. I would need to fix this as soon as possible.

Thanks in advance.

[lafrech]

I suspect the same schema instance is shared among all requests. This shouldn't happen if the view is passed a schema class and instantiates the schema on each request.

Please post a sample code to show the way you use the schema in the view function.

[alnikolaj]

Example:

#api.py
from flask_classful import FlaskView
from app.models import User, Object
from serializer.py import MySchema

schema = MySchema()

class ObjectListAPI(FlaskView):
    def get(self):
        # Query User
        user_id = request.args.get('user_id')
        user_obj = User.query.get(user_id)
        objects = Object.query.all()

        schema.context['user_id'] = user.id
        return schema.dump(objects)

I had the MySchema initialisation outside of the Get Function / FlaskView, which might have caused the problem?

[lafrech]

Exactly.

This is not exactly a marshmallow thread-safety issue. If a object instance is shared by multiple threads, setting an attribute in one thread modifies the object for the other threads as well.

(Things can get tricky with nested schemas, though: #1617.)