Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

API Tags: Add filter for AND expressions #11743

Merged
merged 4 commits into from
Feb 20, 2025
Merged

API Tags: Add filter for AND expressions #11743

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f3c204b
API Tags: Add filter for `AND` expressions
Maffooch Feb 5, 2025
46b1aac
Fix some ruff stuff
Maffooch Feb 5, 2025
6923824
Small corrections
Maffooch Feb 6, 2025
fd25e09
Update dojo/filters.py
Maffooch Feb 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 103 additions & 32 deletions dojo/filters.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
from django.apps import apps
from django.conf import settings
from django.contrib.contenttypes.models import ContentType
from django.db.models import JSONField, Q
from django.db.models import Count, JSONField, Q
from django.forms import HiddenInput
from django.utils import timezone
from django.utils.translation import gettext_lazy as _
Expand Down Expand Up @@ -135,6 +135,20 @@ def __init__(self, *args, **kwargs):
super(CharFilter, self).__init__(*args, **kwargs)


class CharFieldFilterANDExpression(CharFieldInFilter):
def filter(self, queryset, value):
# Catch the case where a value if not supplied
if not value:
return queryset
# Do the filtering
objects = set(value.split(","))
return (
queryset.filter(**{f"{self.field_name}__in": objects})
.annotate(object_count=Count(self.field_name))
.filter(object_count=len(objects))
)


class FindingStatusFilter(ChoiceFilter):
def any(self, qs, name):
return qs
Expand Down Expand Up @@ -1204,11 +1218,20 @@ class ProductEngagementFilterWithoutObjectLookups(ProductEngagementFilterHelper,
class ApiEngagementFilter(DojoFilter):
product__prod_type = NumberInFilter(field_name="product__prod_type", lookup_expr="in")
tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")
product__tags = CharFieldInFilter(field_name="product__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on product")
tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
product__tags = CharFieldInFilter(
field_name="product__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on product (uses OR for multiple values)")
product__tags__and = CharFieldFilterANDExpression(
field_name="product__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on product")

not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
Expand Down Expand Up @@ -1365,9 +1388,13 @@ class ApiProductFilter(DojoFilter):
regulations = NumberInFilter(field_name="regulations", lookup_expr="in")

tag = CharFilter(field_name="tags__name", lookup_expr="icontains", label="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")

tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags not present on product", exclude="True")
Expand Down Expand Up @@ -1511,16 +1538,34 @@ class ApiFindingFilter(DojoFilter):
risk_acceptance = extend_schema_field(OpenApiTypes.NUMBER)(ReportRiskAcceptanceFilter())

tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")
test__tags = CharFieldInFilter(field_name="test__tags__name", lookup_expr="in", help_text="Comma separated list of exact tags present on test")
test__engagement__tags = CharFieldInFilter(field_name="test__engagement__tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags present on engagement")
tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
test__tags = CharFieldInFilter(
field_name="test__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on test (uses OR for multiple values)")
test__tags__and = CharFieldFilterANDExpression(
field_name="test__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on test")
test__engagement__tags = CharFieldInFilter(
field_name="test__engagement__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on engagement (uses OR for multiple values)")
test__engagement__tags__and = CharFieldFilterANDExpression(
field_name="test__engagement__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on engagement")
test__engagement__product__tags = CharFieldInFilter(
field_name="test__engagement__product__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on product")

help_text="Comma separated list of exact tags present on product (uses OR for multiple values)")
test__engagement__product__tags__and = CharFieldFilterANDExpression(
field_name="test__engagement__product__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on product")
not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags not present on model", exclude="True")
Expand Down Expand Up @@ -2118,9 +2163,13 @@ def __init__(self, *args, **kwargs):

class ApiTemplateFindingFilter(DojoFilter):
tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")

tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags not present on model", exclude="True")
Expand Down Expand Up @@ -2695,9 +2744,13 @@ class Meta:

class ApiEndpointFilter(DojoFilter):
tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")

tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags not present on model", exclude="True")
Expand Down Expand Up @@ -2851,13 +2904,27 @@ def __init__(self, *args, **kwargs):

class ApiTestFilter(DojoFilter):
tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")
engagement__tags = CharFieldInFilter(field_name="engagement__tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags present on engagement")
engagement__product__tags = CharFieldInFilter(field_name="engagement__product__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on product")
tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
engagement__tags = CharFieldInFilter(
field_name="engagement__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on engagement (uses OR for multiple values)")
engagement__tags__and = CharFieldFilterANDExpression(
field_name="engagement__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on engagement")
engagement__product__tags = CharFieldInFilter(
field_name="engagement__product__tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags present on product (uses OR for multiple values)")
engagement__product__tags__and = CharFieldFilterANDExpression(
field_name="engagement__product__tags__name",
help_text="Comma separated list of exact tags to match with an AND expression present on product")

not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
Expand Down Expand Up @@ -2905,9 +2972,13 @@ class Meta:

class ApiAppAnalysisFilter(DojoFilter):
tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Tag name contains")
tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags")

tags = CharFieldInFilter(
field_name="tags__name",
lookup_expr="in",
help_text="Comma separated list of exact tags (uses OR for multiple values)")
tags__and = CharFieldFilterANDExpression(
field_name="tags__name",
help_text="Comma separated list of exact tags to match with an AND expression")
not_tag = CharFilter(field_name="tags__name", lookup_expr="icontains", help_text="Not Tag name contains", exclude="True")
not_tags = CharFieldInFilter(field_name="tags__name", lookup_expr="in",
help_text="Comma separated list of exact tags not present on model", exclude="True")
Expand Down
4 changes: 2 additions & 2 deletions unittests/dojo_test_case.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -716,8 +716,8 @@ def get_finding_tags_api(self, finding_id):
response = self.do_finding_tags_api(self.client.get, finding_id)
return response.data

def get_finding_api_filter_tags(self, tags):
response = self.client.get(reverse("finding-list") + f"?tags={tags}", format="json")
def get_finding_api_filter_tags(self, tags, parameter="tags"):
response = self.client.get(reverse("finding-list") + f"?{parameter}={tags}", format="json")
self.assertEqual(200, response.status_code, response.content[:1000])
return response.data

Expand Down
6 changes: 6 additions & 0 deletions unittests/test_tags.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,12 @@ def test_finding_filter_tags(self):

response = self.get_finding_api_filter_tags("tag4")
self.assertEqual(response["count"], 0)
# Test the tags__and filter for a case with no matches
response = self.get_finding_api_filter_tags("tag2,tag3", parameter="tags__and")
self.assertEqual(response["count"], 0)
# Test the tags__and filter for a case with one exact match
response = self.get_finding_api_filter_tags("tag1,tag2", parameter="tags__and")
self.assertEqual(response["count"], 1)

def test_finding_post_tags(self):
# create finding
Expand Down