Prefetching multiple endpoints should return all prefetch models

[hblankenship]

When attempting a prefetch with multiple parameters, the response would only return one of the prefetch parameters.

[sc-6144]

[dryrunsecurity]

DryRun Security Summary

The pull request improves the handling of the prefetch parameter in the PrefetchListMixin and PrefetchRetrieveMixin classes by implementing a more robust method for processing the parameter while maintaining security and following Django REST Framework standards.

Expand for full summary

Summary:

The code changes in this pull request are focused on improving the handling of the prefetch parameter in the PrefetchListMixin and PrefetchRetrieveMixin classes of the dojo/api_v2/prefetch/mixins.py file. The main changes include a more robust way of handling the prefetch parameter, as well as applying the same operations as the standard list method defined in the Django REST Framework.

From an application security perspective, the changes made in this pull request do not seem to introduce any obvious security concerns. The code is handling user input (the prefetch parameter) in a reasonable way, and it is not performing any direct database queries or other operations that could lead to security vulnerabilities like SQL injection or cross-site scripting (XSS). However, it's important to consider the overall application context and the way this code is used within the larger system when evaluating the security implications, as the prefetch parameter could potentially be used to load sensitive data or perform privileged actions.

Files Changed:

• dojo/api_v2/prefetch/mixins.py: The changes in this file are focused on improving the handling of the prefetch parameter in the PrefetchListMixin and PrefetchRetrieveMixin classes. Specifically, the code now checks if the prefetch parameter contains commas, and if not, it uses the getlist method to handle multiple instances of the prefetch parameter. Additionally, the list method of the PrefetchListMixin now applies the same operations as the standard list method defined in the Django REST Framework, such as filtering and pagination.

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[hblankenship]

Apparently an interesting case where the code actually works but the unittests fail....

[Maffooch]

Moving out of draft to have tests run

[mtesauro]

Approved