[FIX] qweb: renderToString should not escape twice text content

Since commit
https://github.com/odoo/owl/commit/b2f12a111524f37348b142ac248813f9cb25ca2e,
Owl escape text content twice. It seems that it was done to prevent
security issues, but without realizing that the standard t-esc method
already escapes.

closes #708
This commit is contained in:
Géry Debongnie
2021-12-14 15:16:53 +01:00
committed by aab-odoo
parent bc04f727ac
commit c06049076a
2 changed files with 4 additions and 13 deletions
+3 -12
View File
@@ -1,7 +1,7 @@
import { EventBus } from "../core/event_bus"; import { EventBus } from "../core/event_bus";
import { h, patch, VNode } from "../vdom/index"; import { h, patch, VNode } from "../vdom/index";
import { CompilationContext } from "./compilation_context"; import { CompilationContext } from "./compilation_context";
import { shallowEqual, escape } from "../utils"; import { shallowEqual } from "../utils";
import { addNS } from "../vdom/vdom"; import { addNS } from "../vdom/vdom";
/** /**
@@ -425,17 +425,8 @@ export class QWeb extends EventBus {
return vnode.text!; return vnode.text!;
} }
const node = document.createElement(vnode.sel); const node = document.createElement(vnode.sel);
const elem = patch(node, vnode).elm as HTMLElement; const result = patch(node, vnode);
function escapeTextNodes(node) { return (result.elm as HTMLElement).outerHTML;
if (node.nodeType === 3) {
node.textContent = escape(node.textContent);
}
for (let n of node.childNodes) {
escapeTextNodes(n);
}
}
escapeTextNodes(elem);
return elem.outerHTML;
} }
/** /**
+1 -1
View File
@@ -163,7 +163,7 @@ describe("t-esc", () => {
test("escaping", () => { test("escaping", () => {
qweb.addTemplate("test", `<span><t t-esc="var"/></span>`); qweb.addTemplate("test", `<span><t t-esc="var"/></span>`);
expect(renderToString(qweb, "test", { var: "<ok>abc</ok>" })).toBe( expect(renderToString(qweb, "test", { var: "<ok>abc</ok>" })).toBe(
"<span>&amp;lt;ok&amp;gt;abc&amp;lt;/ok&amp;gt;</span>" "<span>&lt;ok&gt;abc&lt;/ok&gt;</span>"
); );
}); });