fix: Sanitize tags for filtering providers in projects

client/src/planwise/client/projects2/handlers.cljs

@@ -6,6 +6,8 @@
             [planwise.client.effects :as effects]
             [planwise.client.projects2.db :as db]
             [planwise.client.utils :as utils]
+            [planwise.common :as common]
+            [clojure.string :as string]
             [clojure.spec.alpha :as s]))
 
 
@@ -270,10 +272,12 @@
  :projects2/save-tag
  in-projects2
  (fn [{:keys [db]} [_ tag]]
-   (let [path [:current-project :config :providers :tags]
-         n (count (get-in db path))]
-     {:db       (update-in db path (comp vec conj) tag)
-      :dispatch [:projects2/persist-current-project]})))
+   (let [tag  (common/sanitize-tag tag)
+         path [:current-project :config :providers :tags]
+         n    (count (get-in db path))]
+     (when-not (string/blank? tag)
+       {:db       (update-in db path (comp vec conj) tag)
+        :dispatch [:projects2/persist-current-project]}))))
 
 (rf/reg-event-fx
  :projects2/delete-tag

common/src/planwise/common.cljc

@@ -1,5 +1,5 @@
 (ns planwise.common
-  (:require [clojure.string :refer [lower-case]]))
+  (:require [clojure.string :as string :refer [lower-case]]))
 
 (defn is-budget
   [analysis-type]
@@ -47,3 +47,10 @@
    (get-capacity-unit project true))
   ([project lowercase?]
    (get-project-unit project [:config :providers :capacity-unit] "units" lowercase?)))
+
+(defn sanitize-tag
+  [tag]
+  (-> tag
+      string/trim
+      (string/replace #"\s+" "-")
+      (string/replace #"[^a-zA-Z0-9.-]" "")))

src/planwise/component/providers_set.clj

@@ -10,6 +10,7 @@
             [clojure.edn :as edn]
             [planwise.util.files :as files]
             [planwise.util.collections :refer [csv-data->maps]]
+            [planwise.common :as common]
             [clojure.string :as str]
             [clojure.set :as set]))
 
@@ -104,8 +105,10 @@
                              :version         version
                              :region-id       (:region-id filter-options)}
         all-providers       (db-find-providers-in-region db-spec config)
+        filter-tags         (->> (:tags filter-options)
+                                 (map common/sanitize-tag))
         providers-partition (group-by
-                             #(provider-matches-tags? % (:tags filter-options))
+                             #(provider-matches-tags? % filter-tags)
                              all-providers)]
     {:providers          (or (get providers-partition true) [])
      :disabled-providers (or (get providers-partition false) [])}))
@@ -115,7 +118,9 @@
    (count-providers-filter-by-tags store provider-set-id region-id tags nil))
   ([store provider-set-id region-id tags version]
    (let [db-spec  (get-db store)
-         tags     (str/join " & " tags)
+         tags     (->> tags
+                       (map common/sanitize-tag)
+                       (str/join " & "))
          count-fn (fn [tags version]
                     (let [{:keys [last-version]} (get-provider-set store provider-set-id)]
                       (:count (db-count-providers-with-tags db-spec {:provider-set-id provider-set-id

test/planwise/component/providers_set_test.clj

@@ -5,6 +5,7 @@
             [planwise.component.providers-set :as providers-set]
             [planwise.boundary.projects2 :as projects2]
             [planwise.test-system :as test-system]
+            [planwise.common :as common]
             [clj-time.core :as time]
             [integrant.core :as ig])
   (:import [org.postgis PGgeometry]))
@@ -159,7 +160,7 @@
 
 (defn- validate-filter-count
   [store id tags number]
-  (is (= (:filtered (providers-set/count-providers-filter-by-tags store id 1 tags)) number)))
+  (is (= number (:filtered (providers-set/count-providers-filter-by-tags store id 1 tags)))))
 
 (deftest filtering-providers
   (test-system/with-system (test-config fixture-filtering-providers-tags)
@@ -170,7 +171,14 @@
       (validate-filter-count store 1 ["inexistent"] 0)
       (validate-filter-count store 1 ["private"] 2)
       (validate-filter-count store 2 ["private"] 0)
-      (validate-filter-count store 2 ["-"] 0))))
+      (validate-filter-count store 2 ["-"] 0)
+      ;; sanitizes input tags
+      (validate-filter-count store 1 ["pri&vate"] 2))))
+
+(deftest sanitize-tag
+  (is (= "" (common/sanitize-tag "&|")))
+  (is (= "general-medicine" (common/sanitize-tag "general medicine")))
+  (is (= "private" (common/sanitize-tag "pri&vate"))))
 
 ;; ----------------------------------------------------------------------
 ;; Testing deleting provider-set