From 68f2c987d0dea96f4bdfafa1c4f952c91a2af429 Mon Sep 17 00:00:00 2001
From: Valentin Deniaud <vdeniaud@entrouvert.com>
Date: Mon, 8 Mar 2021 17:18:01 +0100
Subject: [PATCH] dataviz: do not accept nested lists as valid data (#51680)

---
 combo/apps/dataviz/models.py |  2 +-
 tests/test_dataviz.py        | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/combo/apps/dataviz/models.py b/combo/apps/dataviz/models.py
index f75e26d7..3ea30eb9 100644
--- a/combo/apps/dataviz/models.py
+++ b/combo/apps/dataviz/models.py
@@ -378,7 +378,7 @@ class ChartNgCell(CellBase):
         x_labels = response['axis'].get('x_labels') or []
         y_labels = response['axis'].get('y_labels') or []
         if loop_labels:
-            if x_labels and y_labels:
+            if 'x_labels' in response['axis'] and 'y_labels' in response['axis']:
                 # no support for three dimensions
                 raise UnsupportedDataSet()
             if not y_labels:
diff --git a/tests/test_dataviz.py b/tests/test_dataviz.py
index 5453bdd5..28fec523 100644
--- a/tests/test_dataviz.py
+++ b/tests/test_dataviz.py
@@ -126,6 +126,12 @@ VISUALIZATION_JSON = [
         'name': 'twelth visualization (all null)',
         'slug': 'twelth',
     },
+    {
+        'data-url': 'https://bijoe.example.com/visualization/13/json/',
+        'path': 'https://bijoe.example.com/visualization/13/iframe/?signature=123',
+        'name': 'thirteenth visualization (loop with empty x_labels)',
+        'slug': 'thirteenth',
+    },
 ]
 
 
@@ -257,6 +263,17 @@ def bijoe_mock(url, request):
             'measure': 'integer',
         }
         return {'content': json.dumps(response), 'request': request, 'status_code': 200}
+    if url.path == '/visualization/13/json/':
+        response = {
+            'format': '1',
+            'data': [[[], []], [[], []], [[], []]],
+            'axis': {
+                'x_labels': [],
+                'y_labels': ['web', 'mail'],
+                'loop': ['a', 'b', 'c'],
+            },
+        }
+        return {'content': json.dumps(response), 'request': request, 'status_code': 200}
 
 
 STATISTICS_LIST = {
@@ -477,6 +494,12 @@ def test_chartng_cell(app, statistics):
     with pytest.raises(HTTPError):
         chart = cell.get_chart()
 
+    # loop and empty x_labels
+    cell.statistic = Statistic.objects.get(slug='thirteenth')
+    cell.save()
+    with pytest.raises(UnsupportedDataSet):
+        chart = cell.get_chart()
+
 
 @with_httmock(new_api_mock)
 def test_chartng_cell_new_api(app, new_api_statistics):
-- 
2.20.1