🔒 Ensure `skip_defaults` doesn't cause extra fields to be serialized (#485)

fastapi/routing.py

@@ -45,6 +45,8 @@ def serialize_response(
 ) -> Any:
     if field:
         errors = []
+        if skip_defaults and isinstance(response, BaseModel):
+            response = response.dict(skip_defaults=skip_defaults)
         value, errors_ = field.validate(response, {}, loc=("response",))
         if isinstance(errors_, ErrorWrapper):
             errors.append(errors_)
@@ -52,8 +54,6 @@ def serialize_response(
             errors.extend(errors_)
         if errors:
             raise ValidationError(errors)
-        if skip_defaults and isinstance(response, BaseModel):
-            value = response.dict(skip_defaults=skip_defaults)
         return jsonable_encoder(
             value,
             include=include,

tests/test_skip_defaults.py

@@ -16,9 +16,13 @@ class Model(BaseModel):
     sub: SubModel
 
 
+class ModelSubclass(Model):
+    y: int
+
+
 @app.get("/", response_model=Model, response_model_skip_defaults=True)
-def get() -> Model:
-    return Model(sub={})
+def get() -> ModelSubclass:
+    return ModelSubclass(sub={}, y=1)
 
 
 client = TestClient(app)