From 343c1c05d3e9cf39a41dc259e8f1630fe3ecd9f2 Mon Sep 17 00:00:00 2001 From: Xavier Dubuc Date: Thu, 25 Jun 2020 12:58:05 +0000 Subject: [PATCH] [FIX] mail: replace
by space in thread preview MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit task-2284905 closes odoo/odoo#53718 X-original-commit: 80504fabd43832c5495ded3afc4b364c71d3df70 Signed-off-by: Alexandre Kühn (aku) --- .../messaging_menu/messaging_menu_tests.js | 127 ++++++++++++++++-- .../thread_needaction_preview.xml | 2 +- .../thread_preview/thread_preview.xml | 2 +- addons/mail/static/src/js/utils.js | 1 + 4 files changed, 122 insertions(+), 10 deletions(-) diff --git a/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js b/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js index abf13f541f4..359bbe52768 100644 --- a/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js +++ b/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js @@ -797,27 +797,26 @@ QUnit.test('no code injection in message body preview', async function (assert) Object.assign(this.data.initMessaging, { channel_slots: { channel_channel: [{ - channel_type: "channel", + channel_type: 'channel', id: 1, is_pinned: true, name: "General", }], }, }); - this.data['mail.channel'].records = [{ - id: 1, - name: "general", - channel_type: "channel", channel_message_ids: [1], + channel_type: 'channel', + id: 1, + is_pinned: true, + name: "General", }]; this.data['mail.message'].records = [{ - id: 1, - author_id: [1, 'Georges'], + author_id: [1, "Georges"], body: "

&shoulnotberaised

", channel_ids: [1], + id: 1, }]; - await this.start(); await afterNextRender(() => { @@ -851,6 +850,118 @@ QUnit.test('no code injection in message body preview', async function (assert) ); }); +QUnit.test('no code injection in message body preview from sanitized message', async function (assert) { + assert.expect(5); + + Object.assign(this.data.initMessaging, { + channel_slots: { + channel_channel: [{ + channel_type: 'channel', + id: 1, + is_pinned: true, + name: "General", + }], + }, + }); + this.data['mail.channel'].records = [{ + channel_message_ids: [1], + channel_type: 'channel', + id: 1, + is_pinned: true, + name: "General", + }]; + this.data['mail.message'].records = [{ + author_id: [1, "Georges"], + body: "

<em>&shoulnotberaised</em><script>throw new Error('CodeInjectionError');</script>

", + channel_ids: [1], + id: 1, + }]; + await this.start(); + + await afterNextRender(() => { + document.querySelector(`.o_MessagingMenu_toggler`).click(); + }); + assert.containsOnce( + document.body, + '.o_MessagingMenu_dropdownMenu .o_ThreadPreview', + "should display a preview", + ); + assert.containsOnce( + document.body, + '.o_ThreadPreview_core', + "preview should have core in content", + ); + assert.containsOnce( + document.body, + '.o_ThreadPreview_inlineText', + "preview should have inline text in core of content", + ); + assert.strictEqual( + document.querySelector('.o_ThreadPreview_inlineText') + .textContent.replace(/\s/g, ""), + "Georges:&shoulnotberaised", + "should display correct uninjected last message inline content" + ); + assert.containsNone( + document.querySelector('.o_ThreadPreview_inlineText'), + 'script', + "last message inline content should not have any code injection" + ); +}); + +QUnit.test('
tags in message body preview are transformed in spaces', async function (assert) { + assert.expect(4); + + Object.assign(this.data.initMessaging, { + channel_slots: { + channel_channel: [{ + channel_type: 'channel', + id: 1, + is_pinned: true, + name: "General", + }], + }, + }); + this.data['mail.channel'].records = [{ + channel_message_ids: [1], + channel_type: 'channel', + id: 1, + is_pinned: true, + name: "general", + }]; + this.data['mail.message'].records = [{ + author_id: [1, "Georges"], + body: "

a
b
c
d

", + channel_ids: [1], + id: 1, + }]; + await this.start(); + + await afterNextRender(() => { + document.querySelector(`.o_MessagingMenu_toggler`).click(); + }); + assert.containsOnce( + document.body, + '.o_MessagingMenu_dropdownMenu .o_ThreadPreview', + "should display a preview", + ); + assert.containsOnce( + document.body, + '.o_ThreadPreview_core', + "preview should have core in content", + ); + assert.containsOnce( + document.body, + '.o_ThreadPreview_inlineText', + "preview should have inline text in core of content", + ); + assert.strictEqual( + document.querySelector('.o_ThreadPreview_inlineText').textContent, + "Georges: a b c d", + "should display correct last message inline content with brs replaced by spaces" + ); +}); + }); }); }); diff --git a/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml b/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml index ebdab785bba..b6a5c896174 100644 --- a/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml +++ b/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml @@ -45,7 +45,7 @@ threadLocalId="thread.localId" /> - + diff --git a/addons/mail/static/src/components/thread_preview/thread_preview.xml b/addons/mail/static/src/components/thread_preview/thread_preview.xml index 8b067a5ae6f..da364d4f99d 100644 --- a/addons/mail/static/src/components/thread_preview/thread_preview.xml +++ b/addons/mail/static/src/components/thread_preview/thread_preview.xml @@ -48,7 +48,7 @@ threadLocalId="thread.localId" /> - + diff --git a/addons/mail/static/src/js/utils.js b/addons/mail/static/src/js/utils.js index d54f5932619..bbb9a535716 100644 --- a/addons/mail/static/src/js/utils.js +++ b/addons/mail/static/src/js/utils.js @@ -95,6 +95,7 @@ function htmlToTextContentInline(htmlString) { const fragment = document.createDocumentFragment(); const div = document.createElement('div'); fragment.appendChild(div); + htmlString = htmlString.replace(//gi,' '); try { div.innerHTML = htmlString; } catch (e) {