[FIX] mail: escape canned responses

Create a canned response containing the character "<". It is
automatically converted into "&lt;".

The substitution field is systematically escaped, for security reason.
This causes the substitution observed. However, the canned responses are
only used in text-only messages. The escaping is therefore not
necessary, since the HTML is not interpreted.

opw-693970

addons/mail/models/mail_shortcode.py

@@ -1,10 +1,7 @@
 # -*- coding: utf-8 -*-
 # Part of Odoo. See LICENSE file for full copyright and licensing details.
 
-import cgi
-import re
-
-from odoo import api, fields, models
+from odoo import fields, models
 
 
 class MailShortcode(models.Model):
@@ -23,25 +20,3 @@ class MailShortcode(models.Model):
     shortcode_type = fields.Selection([('image', 'Smiley'), ('text', 'Canned Response')], required=True, default='text',
         help="* Smiley are only used for HTML code to display an image "\
              "* Text (default value) is used to substitute text with another text")
-
-    @api.model
-    def create(self, values):
-        if values.get('substitution'):
-            values['substitution'] = self._sanitize_shorcode(values['substitution'])
-        return super(MailShortcode, self).create(values)
-
-    @api.multi
-    def write(self, values):
-        if values.get('substitution'):
-            values['substitution'] = self._sanitize_shorcode(values['substitution'])
-        return super(MailShortcode, self).write(values)
-
-    def _sanitize_shorcode(self, substitution):
-        """ Sanitize the shortcode substitution :
-                - HTML substitution : only allow the img tag (emoji)
-                - escape other substitutions to avoid XSS
-        """
-        is_img_tag = re.match(r'''^<img\s+src=('|")([^'"]*)\1\s*/?>$''', substitution, re.M | re.I)
-        if is_img_tag:
-            return substitution
-        return cgi.escape(substitution)