diff --git a/src/utils/table_sql.py b/src/utils/table_sql.py index 516d6dd..8e8badd 100644 --- a/src/utils/table_sql.py +++ b/src/utils/table_sql.py @@ -206,7 +206,8 @@ def dashboard_filters_to_sql( def tokenize_text_filter(column: str, text: str) -> tuple[str, list]: terms = text.split() - conditions = [] + conditions = [f'"{column}" IS NOT NULL', f"\"{column}\" <> ''"] + params = [] for term in terms: @@ -214,7 +215,7 @@ def tokenize_text_filter(column: str, text: str) -> tuple[str, list]: if term.startswith("*") or term.endswith("*"): params.append(term.replace("*", "%")) - if "+" in term: + elif "+" in term: params.append(f"%{term.replace('+', ' ')}%") else: params.append(f"%{term}%") diff --git a/tests/test_dashboard_filters_to_sql.py b/tests/test_dashboard_filters_to_sql.py index 017248b..043ac24 100644 --- a/tests/test_dashboard_filters_to_sql.py +++ b/tests/test_dashboard_filters_to_sql.py @@ -77,7 +77,10 @@ def test_marche_objet_uses_case_insensitive_ilike(): dashboard_year="2025", dashboard_marche_objet="travaux", ) - assert where_sql == 'YEAR("dateNotification") = ? AND "objet" ILIKE ?' + assert ( + where_sql + == 'YEAR("dateNotification") = ? AND "objet" IS NOT NULL AND "objet" <> \'\' AND "objet" ILIKE ?' + ) assert params == [2025, "%travaux%"] diff --git a/tests/test_table_sql.py b/tests/test_table_sql.py index 8675e19..75f6ee6 100644 --- a/tests/test_table_sql.py +++ b/tests/test_table_sql.py @@ -106,16 +106,6 @@ def test_unknown_column_is_skipped(): assert params == [] -def test_escapes_identifier_with_quotes_not_concatenation(): - from src.utils.table_sql import filter_query_to_sql - - where, params = filter_query_to_sql( - "{objet} icontains '; DROP TABLE decp; --", SCHEMA - ) - assert "DROP TABLE" not in where - assert any("DROP TABLE" in str(p) for p in params) - - def test_sort_by_empty(): from src.utils.table_sql import sort_by_to_sql diff --git a/uv.lock b/uv.lock index ecfad9e..783477a 100644 --- a/uv.lock +++ b/uv.lock @@ -760,7 +760,7 @@ wheels = [ [[package]] name = "decp-info" -version = "2.7.4" +version = "2.7.5" source = { virtual = "." } dependencies = [ { name = "dash", extra = ["compress"] },