DGNum/demarches-normaliennes
14
1
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity

Merge pull request #11105 from demarches-simplifiees/filter_less_dumb

Browse source 
ETQ instructeur: les filtres textes marchent avec des accents en moins, des espaces en trop, et ignore la case.
This commit is contained in:
LeSim 2024-12-03 07:39:23 +00:00 committed by GitHub
commit 72ed54d104
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 28 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app/models/concerns/dossier_filtering_concern.rb
View file

@ -29,10 +29,10 @@ module DossierFilteringConcern
}
scope :filter_ilike, lambda { |table, column, search_terms|
safe_quoted_terms = search_terms.map { "%#{sanitize_sql_like(_1)}%" }
safe_quoted_terms = search_terms.map(&:strip).map { "%#{sanitize_sql_like(_1)}%" }
table_column = DossierFilterService.sanitized_column(table, column)
where("#{table_column} LIKE ANY (ARRAY[?])", safe_quoted_terms)
where("unaccent(#{table_column}) ILIKE ANY (ARRAY((SELECT unaccent(unnest(ARRAY[?])))))", safe_quoted_terms)
}
def sanitize_sql_like(q) = ActiveRecord::Base.sanitize_sql_like(q)

50
config/brakeman.ignore
View file

@ -15,7 +15,7 @@
"type": "controller",
"class": "Users::DossiersController",
"method": "merci",
"line": 323,
"line": 297,
"file": "app/controllers/users/dossiers_controller.rb",
"rendered": {
"name": "users/dossiers/merci",
@ -170,29 +170,6 @@
],
"note": ""
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "afd2a1a41bd87fa62e065671670bd9bd8cc503ca4cbd3cfdb74a38a794146926",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/concerns/dossier_filtering_concern.rb",
"line": 35,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "where(\"#{DossierFilterService.sanitized_column(table, column)} LIKE ANY (ARRAY[?])\", search_terms.map do\n \"%#{sanitize_sql_like(_1)}%\"\n end)",
"render_path": null,
"location": {
"type": "method",
"class": "DossierFilteringConcern",
"method": null
},
"user_input": "DossierFilterService.sanitized_column(table, column)",
"confidence": "Medium",
"cwe_id": [
89
],
"note": "The table and column are escaped, which should make this safe"
},
{
"warning_type": "Cross-Site Scripting",
"warning_code": 2,
@ -247,8 +224,31 @@
79
],
"note": "Current is not a model"
},
{
"warning_type": "SQL Injection",
"warning_code": 0,
"fingerprint": "fc12551e83eab01e5955c73470bb1fc30b6642bd39750ba4aa9f0fe6ef4d6522",
"check_name": "SQL",
"message": "Possible SQL injection",
"file": "app/models/concerns/dossier_filtering_concern.rb",
"line": 35,
"link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
"code": "where(\"unaccent(#{DossierFilterService.sanitized_column(table, column)}) ILIKE ANY (ARRAY((SELECT unaccent(unnest(ARRAY[?])))))\", search_terms.map(&:strip).map do\n \"%#{sanitize_sql_like(_1)}%\"\n end)",
"render_path": null,
"location": {
"type": "method",
"class": "DossierFilteringConcern",
"method": null
},
"user_input": "DossierFilterService.sanitized_column(table, column)",
"confidence": "Medium",
"cwe_id": [
89
],
"note": "The table and column are escaped, which should make this safe"
}
],
"updated": "2024-11-12 17:33:07 +0100",
"updated": "2024-12-02 21:04:14 +0100",
"brakeman_version": "6.1.2"
}

2
spec/services/dossier_filter_service_spec.rb
View file

@ -443,7 +443,7 @@ describe DossierFilterService do
end
context 'for type_de_champ table' do
let(:filter) { [type_de_champ.libelle, 'keep'] }
let(:filter) { [type_de_champ.libelle, ' Kéep '] } # add space / case / accent
let(:kept_dossier) { create(:dossier, procedure:) }
let(:discarded_dossier) { create(:dossier, procedure:) }