From 5f1f21d7aabda74f127a6322ca56308c8d1c69e8 Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Mon, 8 Mar 2021 17:18:01 +0100
Subject: [PATCH] dataviz: do not accept nested lists as valid data (#51680)

---
 combo/apps/dataviz/models.py |  3 +++
 tests/test_dataviz.py        | 23 +++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/combo/apps/dataviz/models.py b/combo/apps/dataviz/models.py
index f75e26d7..76604832 100644
--- a/combo/apps/dataviz/models.py
+++ b/combo/apps/dataviz/models.py
@@ -377,6 +377,9 @@ class ChartNgCell(CellBase):
         loop_labels = response['axis'].get('loop') or []
         x_labels = response['axis'].get('x_labels') or []
         y_labels = response['axis'].get('y_labels') or []
+        if isinstance(data, list) and isinstance(data[0], list) and isinstance(data[0][0], list):
+            # no support for three dimensions
+            raise UnsupportedDataSet()
         if loop_labels:
             if x_labels and y_labels:
                 # no support for three dimensions
diff --git a/tests/test_dataviz.py b/tests/test_dataviz.py
index 5453bdd5..66fc0df9 100644
--- a/tests/test_dataviz.py
+++ b/tests/test_dataviz.py
@@ -126,6 +126,12 @@ VISUALIZATION_JSON = [
         'name': 'twelth visualization (all null)',
         'slug': 'twelth',
     },
+    {
+        'data-url': 'https://bijoe.example.com/visualization/13/json/',
+        'path': 'https://bijoe.example.com/visualization/13/iframe/?signature=123',
+        'name': 'thirteenth visualization (empty with loop)',
+        'slug': 'thirteenth',
+    },
 ]
 
 
@@ -257,6 +263,17 @@ def bijoe_mock(url, request):
             'measure': 'integer',
         }
         return {'content': json.dumps(response), 'request': request, 'status_code': 200}
+    if url.path == '/visualization/13/json/':
+        response = {
+            'format': '1',
+            'data': [[[], []], [[], []], [[], []]],
+            'axis': {
+                'x_labels': [],
+                'y_labels': ['web', 'mail'],
+                'loop': ['a', 'b', 'c'],
+            },
+        }
+        return {'content': json.dumps(response), 'request': request, 'status_code': 200}
 
 
 STATISTICS_LIST = {
@@ -477,6 +494,12 @@ def test_chartng_cell(app, statistics):
     with pytest.raises(HTTPError):
         chart = cell.get_chart()
 
+    # empty with loop
+    cell.statistic = Statistic.objects.get(slug='thirteenth')
+    cell.save()
+    with pytest.raises(UnsupportedDataSet):
+        chart = cell.get_chart()
+
 
 @with_httmock(new_api_mock)
 def test_chartng_cell_new_api(app, new_api_statistics):
-- 
2.20.1