From 01c159fd9fefd9863d2eed5a1f75f709595de294 Mon Sep 17 00:00:00 2001 From: Mathieu Duckerts-Antoine Date: Wed, 26 Dec 2018 16:01:18 +0000 Subject: [PATCH] [FIX] web: quotes and backslashes in search view The commit 6d3ada178f7caf6ea159b871648ca4c440c7845b aimed to solve problems occuring whith (single or double) quotes when creating new custom filters. Unfortunately, the point was missed and bugs were still present. The present commit solves the orginial problem satisfactorily. There was also a problem in the management of backslashes. Type '\\' in the search bar would lead to a domain like [('...', 'ilike', '\\\\\\\\\\\\\\\\')]. This has also been fixed. Note that it is necessary to input "\\" if one is looking for a backslash in db (as before). A remark on the _formatAST function (py_utils.js): We deescape only the chars `'`, `"`, and `\` because it does not seem possible to produce a string in the search view that would intend a search for a line return or a tab for example. A general remark: Domains should always be in normalized form. In that way they could be manipulated and combined together without a tokenization/parsing! closes odoo/odoo#29756 --- addons/web/static/lib/py.js/lib/py.js | 9 +-- addons/web/static/src/js/core/py_utils.js | 10 +++- .../views/control_panel/search/filter_menu.js | 2 - .../control_panel/search/search_filters.js | 9 --- .../tests/chrome/action_manager_tests.js | 2 +- .../web/static/tests/core/py_utils_tests.js | 35 +++++------- .../tests/views/search_filter_menu_tests.js | 56 ++++++++++++++++--- .../static/tests/views/search_view_tests.js | 10 ++-- .../static/tests/views/view_dialogs_tests.js | 2 +- 9 files changed, 78 insertions(+), 57 deletions(-) diff --git a/addons/web/static/lib/py.js/lib/py.js b/addons/web/static/lib/py.js/lib/py.js index bd794323995..60b80a7f439 100644 --- a/addons/web/static/lib/py.js/lib/py.js +++ b/addons/web/static/lib/py.js/lib/py.js @@ -273,8 +273,7 @@ var py = {}; var Special = '[:;.,`@]'; var Funny = group(Operator, Bracket, Special); - var ContStr = group("([uU])?'([^']*)'", '([uU])?"([^"]*)"'); - + var ContStr = group("([uU])?'([^\n'\\\\]*(?:\\\\.[^\n'\\\\]*)*)'", '([uU])?"([^\n"\\\\]*(?:\\\\.[^\n"\\\\]*)*)"'); var PseudoToken = Whitespace + group(Number, Funny, ContStr, Name); var number_pattern = new RegExp('^' + Number + '$'); @@ -282,9 +281,6 @@ var py = {}; var name_pattern = new RegExp('^' + Name + '$'); var strip = new RegExp('^' + Whitespace); return function tokenize(s) { - s = s - .replace(/\\\"/g, '\\u0022') // for double quote - .replace(/\\\'/g, '\\u0027'); // for single quote var max=s.length, tokens = [], start, end; // /g flag makes repeated exec() have memory var pseudoprog = new RegExp(PseudoToken, 'g'); @@ -313,9 +309,6 @@ var py = {}; } else if (string_pattern.test(token)) { var m = string_pattern.exec(token); var value = (m[3] !== undefined ? m[3] : m[5]); - value - .replace(/\\u0022/g, '"') - .replace(/\\u0027/g, "'"); tokens.push(create(symbols['(string)'], { unicode: !!(m[2] || m[4]), value: value diff --git a/addons/web/static/src/js/core/py_utils.js b/addons/web/static/src/js/core/py_utils.js index 9bcd66864e5..296ab5c3089 100644 --- a/addons/web/static/src/js/core/py_utils.js +++ b/addons/web/static/src/js/core/py_utils.js @@ -415,7 +415,15 @@ function _formatAST(ast, lbp) { case "(number)": return String(ast.value); case "(string)": - return "'" + ast.value + "'"; + // ast.value is a string that may contain a mix of single and double quotes. + // But we need to return a string that represents the string ast.value. + // We use for that JSON.stringify. It will return a string with quotes correctly + // escaped. For instance, for x = `""` JSON.stringify(x) is `"\"\""`. + // But this means that if we pass several times here, escapes will be + // done again and again, leading to a profusion of backslashes that we don't want. + // For fun consider y = `\\` and y = JSON.stringify(y). + // This is why we first deescape particular characters in ast.value. + return JSON.stringify(ast.value.replace(/(\\(['"\\]))/g,"\$2")); case "(constant)": return ast.value; case "(name)": diff --git a/addons/web/static/src/js/views/control_panel/search/filter_menu.js b/addons/web/static/src/js/views/control_panel/search/filter_menu.js index 70a242dd0f8..04f333b37c4 100644 --- a/addons/web/static/src/js/views/control_panel/search/filter_menu.js +++ b/addons/web/static/src/js/views/control_panel/search/filter_menu.js @@ -89,8 +89,6 @@ var FilterMenu = DropdownMenu.extend({ domain: Domain.prototype.arrayToString(preFilter.attrs.domain), }; }); - // TO DO intercepts 'new_filters' and decide what to do whith filters - // rewrite web.search_filters? this.trigger_up('new_filters', {filters: filters}); _.invoke(this.propositions, 'destroy'); this.propositions = []; diff --git a/addons/web/static/src/js/views/control_panel/search/search_filters.js b/addons/web/static/src/js/views/control_panel/search/search_filters.js index 4703995ac7c..57aa34a84a7 100644 --- a/addons/web/static/src/js/views/control_panel/search/search_filters.js +++ b/addons/web/static/src/js/views/control_panel/search/search_filters.js @@ -171,15 +171,6 @@ var Char = Field.extend({ {value: "∃", text: _lt("is set")}, {value: "∄", text: _lt("is not set")} ], - get_domain: function (field, operator) { - switch (operator.value) { - case '∃': return [[field.name, '!=', false]]; - case '∄': return [[field.name, '=', false]]; - // does not work in all cases - // default: return "[('" + field.name + "', '" + operator.value + "', '" + this.get_value() + "')]"; - default: return [[field.name, operator.value, this.get_value()]]; - } - }, get_value: function () { return this.$el.val(); } diff --git a/addons/web/static/tests/chrome/action_manager_tests.js b/addons/web/static/tests/chrome/action_manager_tests.js index 291084402a9..4b8a3a79751 100644 --- a/addons/web/static/tests/chrome/action_manager_tests.js +++ b/addons/web/static/tests/chrome/action_manager_tests.js @@ -3133,7 +3133,7 @@ QUnit.module('ActionManager', { intercepts: { create_filter: function (event) { var filter = event.data.filter; - assert.deepEqual(filter.domain, "[('bar', '=', 1)]", + assert.deepEqual(filter.domain, `[("bar", "=", 1)]`, "should save the correct domain"); assert.deepEqual(filter.context, {shouldBeInFilterContext: true}, "should save the correct context"); diff --git a/addons/web/static/tests/core/py_utils_tests.js b/addons/web/static/tests/core/py_utils_tests.js index be5760fc6c7..fba8017cf01 100644 --- a/addons/web/static/tests/core/py_utils_tests.js +++ b/addons/web/static/tests/core/py_utils_tests.js @@ -1149,7 +1149,7 @@ QUnit.module('core', function () { assert.checkAST("1.4", "float value"); assert.checkAST("-12", "negative integer value"); assert.checkAST("True", "boolean"); - assert.checkAST("'some string'", "a string"); + assert.checkAST(`"some string"`, "a string"); assert.checkAST("None", "None"); }); @@ -1157,8 +1157,8 @@ QUnit.module('core', function () { assert.expect(3); assert.checkAST("{}", "empty dictionary"); - assert.checkAST("{'a': 1}", "dictionary with a single key"); - assert.checkAST("d['a']", "get a value in a dictionary"); + assert.checkAST(`{"a": 1}`, "dictionary with a single key"); + assert.checkAST(`d["a"]`, "get a value in a dictionary"); }); QUnit.test("list", function (assert) { @@ -1225,14 +1225,14 @@ QUnit.module('core', function () { QUnit.test("strftime", function (assert) { assert.expect(3); - assert.checkAST("time.strftime('%Y')", "strftime with year"); - assert.checkAST("time.strftime('%Y') + '-01-30'", "strftime with year"); - assert.checkAST("time.strftime('%Y-%m-%d %H:%M:%S')", "strftime with year"); + assert.checkAST(`time.strftime("%Y")`, "strftime with year"); + assert.checkAST(`time.strftime("%Y") + "-01-30"`, "strftime with year"); + assert.checkAST(`time.strftime("%Y-%m-%d %H:%M:%S")`, "strftime with year"); }); QUnit.test("context_today", function (assert) { assert.expect(1); - assert.checkAST("context_today().strftime('%Y-%m-%d')", "context today call"); + assert.checkAST(`context_today().strftime("%Y-%m-%d")`, "context today call"); }); @@ -1250,17 +1250,10 @@ QUnit.module('core', function () { assert.checkAST('(a - b).days', "substraction and .days"); assert.checkAST('a + day == date(2002, 3, 3)'); - var expr = "[('type', '=', 'in'), ('day', '<=', time.strftime('%Y-%m-%d')), ('day', '>', (context_today() - datetime.timedelta(days = 15)).strftime('%Y-%m-%d'))]"; + var expr = `[("type", "=", "in"), ("day", "<=", time.strftime("%Y-%m-%d")), ("day", ">", (context_today() - datetime.timedelta(days = 15)).strftime("%Y-%m-%d"))]`; assert.checkAST(expr); }); - QUnit.test("parse escaped quoted strings", function (assert) { - assert.expect(2); - - assert.checkAST(`'\"'`, "a string containing \""); - assert.checkAST(`'\'`, "a string containing \'"); - }); - QUnit.module('pyutils (_normalizeDomain)'); QUnit.assert.checkNormalization = function (domain, normalizedDomain) { @@ -1278,23 +1271,23 @@ QUnit.module('core', function () { assert.expect(3); assert.checkNormalization("[]"); - assert.checkNormalization("[('a', '=', 1)]"); - assert.checkNormalization("['!', ('a', '=', 1)]"); + assert.checkNormalization(`[("a", "=", 1)]`); + assert.checkNormalization(`["!", ("a", "=", 1)]`); }); QUnit.test("properly add the & in a non normalized domain", function (assert) { assert.expect(1); assert.checkNormalization( - "[('a', '=', 1), ('b', '=', 2)]", - "['&', ('a', '=', 1), ('b', '=', 2)]" + `[("a", "=", 1), ("b", "=", 2)]`, + `["&", ("a", "=", 1), ("b", "=", 2)]` ); }); QUnit.test("normalize domain with ! operator", function (assert) { assert.expect(1); assert.checkNormalization( - "['!', ('a', '=', 1), ('b', '=', 2)]", - "['&', '!', ('a', '=', 1), ('b', '=', 2)]" + `["!", ("a", "=", 1), ("b", "=", 2)]`, + `["&", "!", ("a", "=", 1), ("b", "=", 2)]` ); }); diff --git a/addons/web/static/tests/views/search_filter_menu_tests.js b/addons/web/static/tests/views/search_filter_menu_tests.js index e907d70111e..92d49cc23ae 100644 --- a/addons/web/static/tests/views/search_filter_menu_tests.js +++ b/addons/web/static/tests/views/search_filter_menu_tests.js @@ -1,9 +1,10 @@ odoo.define('web.search_filters_menu_tests', function (require) { "use strict"; -var FilterMenu = require('web.FilterMenu'); -var testUtils = require('web.test_utils'); var Domain = require('web.Domain'); +var FilterMenu = require('web.FilterMenu'); +var pyUtils = require('web.py_utils'); +var testUtils = require('web.test_utils'); function createFilterMenu(filters, fields, params) { params = params || {}; @@ -134,33 +135,70 @@ QUnit.module('FilterMenu', { filterMenu.destroy(); }); - QUnit.skip('commit search with an extended proposition with field char does not cause a crash', function (assert) { - assert.expect(0); + QUnit.test('commit search with an extended proposition with field char does not cause a crash', function (assert) { + assert.expect(6); this.fields = {many2one_field: {string: "Trululu", type: "many2one", relation: 'partner', selectable: true, searchable: true}}; + var expectedDomains = [ + [['many2one_field','ilike', `a`]], + [['many2one_field','ilike', `"a"`]], + [['many2one_field','ilike', `'a'`]], + [['many2one_field','ilike', `'`]], + [['many2one_field','ilike', `"`]], + [['many2one_field','ilike', `\\`]], + ]; + var filterMenu = createFilterMenu([], this.fields, { intercepts: { new_filters: function (ev) { var filter = ev.data.filters[0]; - Domain.prototype.stringToArray(filter.domain); + // this step combine a tokenization/parsing followed by a string formatting + var domain = pyUtils.assembleDomains([filter.domain]); + domain = Domain.prototype.stringToArray(domain); + assert.deepEqual(domain, expectedDomains.shift()); }, } }); - // open menu dropdown and custom filter submenu, select trululu field and enter string "a", then click apply + // open menu dropdown and custom filter submenu, select trululu field and enter string `a`, then click apply testUtils.dom.click(filterMenu.$('span.fa-filter')); testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); - testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), "a"); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `a`); testUtils.dom.click(filterMenu.$('.o_apply_filter')); - // open custom filter submenu, select trululu field and enter string "'a'", then click apply + // open custom filter submenu, select trululu field and enter string `"a"`, then click apply testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); - testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), '"a"'); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"a"`); testUtils.dom.click(filterMenu.$('.o_apply_filter')); + + // open custom filter submenu, select trululu field and enter string `'a'`, then click apply + testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); + testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'a'`); + testUtils.dom.click(filterMenu.$('.o_apply_filter')); + + // open custom filter submenu, select trululu field and enter string `'`, then click apply + testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); + testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'`); + testUtils.dom.click(filterMenu.$('.o_apply_filter')); + + // open custom filter submenu, select trululu field and enter string `"`, then click apply + testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); + testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"`); + testUtils.dom.click(filterMenu.$('.o_apply_filter')); + + // open custom filter submenu, select trululu field and enter string `\`, then click apply + testUtils.dom.click(filterMenu.$('.o_add_custom_filter')); + testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field'); + testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `\\`); + testUtils.dom.click(filterMenu.$('.o_apply_filter')); + filterMenu.destroy(); }); }); diff --git a/addons/web/static/tests/views/search_view_tests.js b/addons/web/static/tests/views/search_view_tests.js index 53f02f9e6cc..aafe0cbe89d 100644 --- a/addons/web/static/tests/views/search_view_tests.js +++ b/addons/web/static/tests/views/search_view_tests.js @@ -747,10 +747,10 @@ QUnit.module('Search View', { create_filter: function (ev) { assert.equal( ev.data.filter.domain, - "['&', " + - "('date_field', '>=', (context_today() + relativedelta()).strftime('%Y-%m-%d')), " + - "('date_field', '<', (context_today() + relativedelta(days = 1)).strftime('%Y-%m-%d'))"+ - "]"); + `["&", ` + + `("date_field", ">=", (context_today() + relativedelta()).strftime("%Y-%m-%d")), ` + + `("date_field", "<", (context_today() + relativedelta(days = 1)).strftime("%Y-%m-%d"))`+ + `]`); }, }, }); @@ -838,7 +838,7 @@ QUnit.module('Search View', { data: this.data, intercepts: { create_filter: function (ev) { - assert.ok(ev.data.filter.domain === "[['foo', 'ilike', 'a']]"); + assert.ok(ev.data.filter.domain === `[["foo", "ilike", "a"]]`); }, }, }); diff --git a/addons/web/static/tests/views/view_dialogs_tests.js b/addons/web/static/tests/views/view_dialogs_tests.js index 1df70b03acc..27275e7fd80 100644 --- a/addons/web/static/tests/views/view_dialogs_tests.js +++ b/addons/web/static/tests/views/view_dialogs_tests.js @@ -443,7 +443,7 @@ QUnit.module('Views', { intercepts: { create_filter: function (event) { var filter = event.data.filter; - assert.deepEqual(filter.domain, "[('bar', '=', True)]", + assert.deepEqual(filter.domain, `[("bar", "=", True)]`, "should save the correct domain"); assert.deepEqual(filter.context, {shouldBeInFilterContext: true}, "should save the correct context");