Merge pull request #1228 from cmu-delphi/fix_dashboard_signals_parsing

Fix dashboard signals parsing for dashboard queries

Author: dmytrotsko

src/server/_limiter.py

@@ -7,10 +7,11 @@
 from ._common import app, get_real_ip_addr
 from ._config import RATE_LIMIT, RATELIMIT_STORAGE_URL, REDIS_HOST, REDIS_PASSWORD
 from ._exceptions import ValidationFailedException
-from ._params import extract_dates, extract_integers, extract_strings
+from ._params import extract_dates, extract_integers, extract_strings, parse_source_signal_sets
 from ._security import _is_public_route, current_user, resolve_auth_token, ERROR_MSG_RATE_LIMIT, ERROR_MSG_MULTIPLES
 
 
+
 def deduct_on_success(response: Response) -> bool:
     if response.status_code != 200:
         return False
@@ -52,8 +53,9 @@ def get_multiples_count(request):
     if "window" in request.args.keys():
         multiple_selection_allowed -= 1
     for k, v in request.args.items():
-        if v == "*":
+        if "*" in v:
             multiple_selection_allowed -= 1
+            continue
         try:
             vals = multiples.get(k)(k)
             if len(vals) >= 2:
@@ -70,16 +72,23 @@ def get_multiples_count(request):
 
 def check_signals_allowlist(request):
     signals_allowlist = {":".join(ss_pair) for ss_pair in DashboardSignals().srcsig_list()}
-    request_signals = []
-    if "signal" in request.args.keys():
-        request_signals += extract_strings("signal")
-    if "signals" in request.args.keys():
-        request_signals += extract_strings("signals")
-    if "data_source" in request.args:
-        request_signals = [f"{request.args['data_source']}:{request_signal}" for request_signal in request_signals]
+    request_signals = set()
+    try:
+        source_signal_sets = parse_source_signal_sets()
+    except ValidationFailedException:
+        return False
+    for source_signal in source_signal_sets:
+        # source_signal.signal is expected to be eiter list or bool:
+        # in case of bool, we have wildcard signal -> return False as there are no chances that
+        # all signals from given source will be whitelisted
+        # in case of list, we have list of signals
+        if isinstance(source_signal.signal, bool):
+            return False
+        for signal in source_signal.signal:
+            request_signals.add(f"{source_signal.source}:{signal}")
     if len(request_signals) == 0:
         return False
-    return all([signal in signals_allowlist for signal in request_signals])
+    return request_signals.issubset(signals_allowlist)
 
 
 def _resolve_tracking_key() -> str: