Merge branch 'main' into dev

src/utils/table_sql.py

@@ -206,7 +206,8 @@ def dashboard_filters_to_sql(
 def tokenize_text_filter(column: str, text: str) -> tuple[str, list]:
     terms = text.split()
 
-    conditions = []
+    conditions = [f'"{column}" IS NOT NULL', f"\"{column}\" <> ''"]
+
     params = []
 
     for term in terms:
@@ -214,7 +215,7 @@ def tokenize_text_filter(column: str, text: str) -> tuple[str, list]:
 
         if term.startswith("*") or term.endswith("*"):
             params.append(term.replace("*", "%"))
-        if "+" in term:
+        elif "+" in term:
             params.append(f"%{term.replace('+', ' ')}%")
         else:
             params.append(f"%{term}%")

tests/test_dashboard_filters_to_sql.py

@@ -77,7 +77,10 @@ def test_marche_objet_uses_case_insensitive_ilike():
         dashboard_year="2025",
         dashboard_marche_objet="travaux",
     )
-    assert where_sql == 'YEAR("dateNotification") = ? AND "objet" ILIKE ?'
+    assert (
+        where_sql
+        == 'YEAR("dateNotification") = ? AND "objet" IS NOT NULL AND "objet" <> \'\' AND "objet" ILIKE ?'
+    )
     assert params == [2025, "%travaux%"]
 
 

tests/test_table_sql.py

@@ -106,16 +106,6 @@ def test_unknown_column_is_skipped():
     assert params == []
 
 
-def test_escapes_identifier_with_quotes_not_concatenation():
-    from src.utils.table_sql import filter_query_to_sql
-
-    where, params = filter_query_to_sql(
-        "{objet} icontains '; DROP TABLE decp; --", SCHEMA
-    )
-    assert "DROP TABLE" not in where
-    assert any("DROP TABLE" in str(p) for p in params)
-
-
 def test_sort_by_empty():
     from src.utils.table_sql import sort_by_to_sql
 

uv.lock

@@ -760,7 +760,7 @@ wheels = [
 
 [[package]]
 name = "decp-info"
-version = "2.7.4"
+version = "2.7.5"
 source = { virtual = "." }
 dependencies = [
     { name = "dash", extra = ["compress"] },