mirror of
https://github.com/odoo/owl.git
synced 2025-10-06 19:59:41 +07:00
[FIX] qweb: renderToString should not escape twice text content
Since commit https://github.com/odoo/owl/commit/b2f12a111524f37348b142ac248813f9cb25ca2e, Owl escape text content twice. It seems that it was done to prevent security issues, but without realizing that the standard t-esc method already escapes. closes #708
This commit is contained in:
+3
-12
@@ -1,7 +1,7 @@
|
|||||||
import { EventBus } from "../core/event_bus";
|
import { EventBus } from "../core/event_bus";
|
||||||
import { h, patch, VNode } from "../vdom/index";
|
import { h, patch, VNode } from "../vdom/index";
|
||||||
import { CompilationContext } from "./compilation_context";
|
import { CompilationContext } from "./compilation_context";
|
||||||
import { shallowEqual, escape } from "../utils";
|
import { shallowEqual } from "../utils";
|
||||||
import { addNS } from "../vdom/vdom";
|
import { addNS } from "../vdom/vdom";
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -425,17 +425,8 @@ export class QWeb extends EventBus {
|
|||||||
return vnode.text!;
|
return vnode.text!;
|
||||||
}
|
}
|
||||||
const node = document.createElement(vnode.sel);
|
const node = document.createElement(vnode.sel);
|
||||||
const elem = patch(node, vnode).elm as HTMLElement;
|
const result = patch(node, vnode);
|
||||||
function escapeTextNodes(node) {
|
return (result.elm as HTMLElement).outerHTML;
|
||||||
if (node.nodeType === 3) {
|
|
||||||
node.textContent = escape(node.textContent);
|
|
||||||
}
|
|
||||||
for (let n of node.childNodes) {
|
|
||||||
escapeTextNodes(n);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
escapeTextNodes(elem);
|
|
||||||
return elem.outerHTML;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
@@ -163,7 +163,7 @@ describe("t-esc", () => {
|
|||||||
test("escaping", () => {
|
test("escaping", () => {
|
||||||
qweb.addTemplate("test", `<span><t t-esc="var"/></span>`);
|
qweb.addTemplate("test", `<span><t t-esc="var"/></span>`);
|
||||||
expect(renderToString(qweb, "test", { var: "<ok>abc</ok>" })).toBe(
|
expect(renderToString(qweb, "test", { var: "<ok>abc</ok>" })).toBe(
|
||||||
"<span>&lt;ok&gt;abc&lt;/ok&gt;</span>"
|
"<span><ok>abc</ok></span>"
|
||||||
);
|
);
|
||||||
});
|
});
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user