Do not break path2uid with strange links (#1428)

* handle edge-case in path2uid

* handle edge-case in path2uid

* add changelog

Author: cekk

news/1428.bugfix

@@ -0,0 +1,2 @@
+Do not break path2uid with some edge-cases.
+[cekk]

src/plone/restapi/deserializer/utils.py

@@ -30,9 +30,11 @@ def path2uid(context, link):
     suffix = ""
     while not IUUIDAware.providedBy(obj):
         obj = aq_parent(obj)
+        if obj is None:
+            break
         suffix += "/" + segments.pop()
     # check if obj is wrong because of acquisition
-    if "/".join(obj.getPhysicalPath()) != "/".join(segments):
+    if not obj or "/".join(obj.getPhysicalPath()) != "/".join(segments):
         return link
     href = relative_up * "../" + "resolveuid/" + IUUID(obj)
     if suffix:

src/plone/restapi/tests/test_blocks_deserializer.py

@@ -417,3 +417,23 @@ def test_aquisition_messing_with_link_deserializer(self):
             self.portal.doc1.blocks["123"]["href"][0]["@id"],
             f"../resolveuid/{wrong_uid}",
         )
+
+        # another use-case: pass "../.." as link. Do not change the link.
+        self.deserialize(
+            blocks={
+                "123": {
+                    "@type": "foo",
+                    "href": [
+                        {
+                            # Pointing to a not created yet object, but matches because acquisition
+                            # with another existing parent content with alike-ish path structure
+                            "@id": "../.."
+                        }
+                    ],
+                }
+            }
+        )
+        self.assertEqual(
+            self.portal.doc1.blocks["123"]["href"][0]["@id"],
+            "../..",
+        )