Merge pull request #10956 from demarches-simplifiees/fix_filter_on_enums

ETQ Instructeur, je peux à nouveau filtrer sur les types de champ choix multiple

app/components/instructeurs/column_filter_component/column_filter_component.html.haml

@@ -9,7 +9,7 @@
     %input.hidden{ type: 'submit', formaction: update_filter_instructeur_procedure_path(procedure), data: { autosubmit_target: 'submitter' } }
 
   = label_tag :value, t('.value'), for: 'value', class: 'fr-label'
-  - if column_type == :enum
+  - if column_type == :enum || column_type == :enums
     = select_tag :filter, options_for_select(options_for_select_of_column), id: 'value', name: "#{prefix}[filter]", class: 'fr-select', data: { no_autosubmit: true }
   - else
     %input#value.fr-input{ type: column_type, name: "#{prefix}[filter]", maxlength: FilteredColumn::FILTERS_VALUE_MAX_LENGTH, disabled: column.nil? ? true : false, data: { no_autosubmit: true } }

app/models/concerns/dossier_filtering_concern.rb

@@ -39,5 +39,11 @@ module DossierFilteringConcern
       q = Array.new(values.count, "(#{table_column} = ?)").join(' OR ')
       where(q, *(values))
     }
+
+    scope :filter_array_enum, lambda { |table, column, values|
+      table_column = DossierFilterService.sanitized_column(table, column)
+      q = Array.new(values.count, "(#{table_column} = ?)").join(' OR ')
+      where(q, *(values. map { |value| "[\"#{value}\"]" }))
+    }
   end
 end

app/models/type_de_champ.rb

@@ -532,7 +532,9 @@ class TypeDeChamp < ApplicationRecord
   end
 
   def self.filter_hash_type(type_champ)
-    if is_choice_type_from(type_champ)
+    if type_champ == 'multiple_drop_down_list'
+      :enums
+    elsif is_choice_type_from(type_champ)
       :enum
     else
       :text

app/services/dossier_filter_service.rb

@@ -92,6 +92,9 @@ class DossierFilterService
           if filtered_column.type == :enum
             dossiers.with_type_de_champ(column)
               .filter_enum(:champs, value_column, values)
+          elsif filtered_column.type == :enums
+            dossiers.with_type_de_champ(column)
+              .filter_array_enum(:champs, value_column, values)
           else
             dossiers.with_type_de_champ(column)
               .filter_ilike(:champs, value_column, values)

config/brakeman.ignore

@@ -44,6 +44,29 @@
       ],
       "note": ""
     },
+    {
+      "warning_type": "SQL Injection",
+      "warning_code": 0,
+      "fingerprint": "5092b33433aef8fe42b688a780325f3791a77b39e55131256c78cebc3c14c0a3",
+      "check_name": "SQL",
+      "message": "Possible SQL injection",
+      "file": "app/models/concerns/dossier_filtering_concern.rb",
+      "line": 46,
+      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
+      "code": "where(\"#{values.count} OR #{\"(#{DossierFilterService.sanitized_column(table, column)} = ?)\"}\", *values.map do\n \"[\\\"#{value}\\\"]\"\n end)",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "DossierFilteringConcern",
+        "method": null
+      },
+      "user_input": "values.count",
+      "confidence": "Medium",
+      "cwe_id": [
+        89
+      ],
+      "note": "filtered by rails query params where(something: ?, values)"
+    },
     {
       "warning_type": "SQL Injection",
       "warning_code": 0,
@@ -272,6 +295,6 @@
       "note": "Current is not a model"
     }
   ],
-  "updated": "2024-10-15 15:57:27 +0200",
+  "updated": "2024-10-16 18:07:17 +0200",
   "brakeman_version": "6.1.2"
 }

spec/services/dossier_filter_service_spec.rb

@@ -486,6 +486,23 @@ describe DossierFilterService do
 
         it { is_expected.to contain_exactly(kept_dossier.id) }
       end
+
+      context 'with enums type_de_champ' do
+        let(:filter) { [type_de_champ.libelle, 'Favorable'] }
+        let(:types_de_champ_public) { [{ type: :multiple_drop_down_list, options: ['Favorable', 'Defavorable'] }] }
+
+        before do
+          kept_champ = kept_dossier.champs.find_by(stable_id: type_de_champ.stable_id)
+          kept_champ.value = ['Favorable']
+          kept_champ.save!
+
+          discarded_champ = discarded_dossier.champs.find_by(stable_id: type_de_champ.stable_id)
+          discarded_champ.value = ['Defavorable']
+          discarded_champ.save!
+        end
+
+        it { is_expected.to contain_exactly(kept_dossier.id) }
+      end
     end
 
     context 'for type_de_champ_private table' do