view.get_queryset() is called if an array (instead of a dict) is passed to rest_framework.response.Response and rest_framework.exceptions are not being handled correctly.

[davemagro]

I find it pretty common to raise a rest_framework.exceptions.NotFound exception inside get_queryset() especially when using drf-nested-router.

When you pass a list to the Response() object (like return Response([])) in a viewset method defined by the rest_framework.decorators.action() without calling self.get_queryset() inside the said viewset method, then an HTTP status 500 will be returned to the user.

class Account(models.Model): 
  username = models.CharField(max_length=32)

class AccountAsset(models.Model): 
  symbol = models.CharField(max_length=32)
  account = models.ForeignKey(Account, on_delete=models.CASCADE)

class AccountAsset(viewsets.ModelViewSet): 

  queryset = models.AccountAsset.objects.all() 
  serializer = serializers.AccountAssetSerializer 

  def get_queryset(self): 
    account_id = self.kwargs.get("account_pk")
    try: 
      account = models.Account.objects.get(id=account_id)
    except models.Account.DoesNotExist:
      raise exceptions.NotFound("Invalid account!")
    return self.queryset.filter(account=account)

  @action(methods=['post'], detail=False)
  def increase(self, request, account_pk): 
    self.get_queryset()     # <- If called inside this method will cause the 
                            # exceptions.NotFound to be raised here and thus, 
                            # be handled correctly and HTTP 404 error is returned 
                            # and the faulty return statement 
                            # will no longer be invoked.

    return Response({})     # <- Doesn't cause HTTP 500 because 
                            # self.get_queryset() is never called. 
                             
    return Response([])     # <- Causes HTTP 500 because self.get_queryset() 
                            # is called and exceptions.NotFound is not handled. 

drf-nested-router is setup in such a way that the following paths are created:

/accounts/
/accounts/{pk}/
/accounts/{account_pk}/assets/
/accounts/{account_pk}/assets/{pk}/

accessing /accounts/{account_pk}/assets/ will cause the HTTP 500 error that I mentioned.

This is the code which is invoking the view.get_queryset() method when a list is passed to the Response object.

django-rest-framework/rest_framework/renderers.py

Line 626 in 0618fa8

queryset = view.get_queryset()