From 4bcfcb9aa4c666e5bc133c25f9d881f335bdf1b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexandre=20K=C3=BChn?= <aku@odoo.com>
Date: Fri, 13 Jul 2018 17:42:49 +0200
Subject: [PATCH] [FIX] mail: unescape channel name in discuss sidebar

When the user creates a channel by providing a name, the name is escaped
in order to avoid XSS attacks. As a result, the logic make use of escaped
string, which may be different from the provided string by the user.

As a result, if we do not unescape the string when necessary, the user may
see the escaped version. For instance, if we creates a channel named 'R&D',
it may display 'R&amp;D' to the user.

This commit plays safe by still keeping the handling of channel names in
their escaped form, but unescape it just before displaying it on the sidebar
of the Discuss app to the user.
---
 .../src/js/models/threads/abstract_thread.js  |  3 +-
 addons/mail/static/src/xml/discuss.xml        |  2 +-
 addons/mail/static/tests/discuss_tests.js     | 40 +++++++++++++++++++
 3 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/addons/mail/static/src/js/models/threads/abstract_thread.js b/addons/mail/static/src/js/models/threads/abstract_thread.js
index fb31c5156c6..67929517ed4 100644
--- a/addons/mail/static/src/js/models/threads/abstract_thread.js
+++ b/addons/mail/static/src/js/models/threads/abstract_thread.js
@@ -51,7 +51,8 @@ var AbstractThread = Class.extend({
      */
     getMessages: function () {},
     /**
-     * Get the name of this thread
+     * Get the name of this thread. If the name of the thread has been created
+     * by the user from an input, it may be escaped.
      *
      * @returns {string}
      */
diff --git a/addons/mail/static/src/xml/discuss.xml b/addons/mail/static/src/xml/discuss.xml
index ab2e7255ba5..c56aa3dda8d 100644
--- a/addons/mail/static/src/xml/discuss.xml
+++ b/addons/mail/static/src/xml/discuss.xml
@@ -143,7 +143,7 @@
                         </t>
                     </span>
                     <span t-if="displayHash" class="o_mail_hash">#</span>
-                    <t t-esc="thread.getName()"/>
+                    <t t-esc="_.unescape(thread.getName())"/>
                     <i t-if="thread.isMassMailing()" class="fa fa-envelope-o" title="Sends messages by email" role="img" aria-label="Send by mail"/>
                 </span>
                 <span t-attf-class="fa fa-cog o_mail_channel_settings"
diff --git a/addons/mail/static/tests/discuss_tests.js b/addons/mail/static/tests/discuss_tests.js
index c3ee2442bf1..2c91db6ed81 100644
--- a/addons/mail/static/tests/discuss_tests.js
+++ b/addons/mail/static/tests/discuss_tests.js
@@ -102,6 +102,46 @@ QUnit.test('basic rendering', function (assert) {
     });
 });
 
+QUnit.test('unescape channel name in the sidebar', function (assert) {
+    // When the user creates a channel, the channel's name is escaped, this in
+    // order to prevent XSS attacks. However, the user should see visually the
+    // unescaped name of the channel. For instance, when the user creates a
+    // channel named  "R&D", he should see "R&D" and not "R&amp;D".
+    assert.expect(2);
+    var done = assert.async();
+
+    this.data.initMessaging = {
+        channel_slots: {
+            channel_channel: [{
+                id: 1,
+                channel_type: "channel",
+                name: "R&amp;D",
+            }],
+        },
+    };
+
+    createDiscuss({
+        id: 1,
+        context: {},
+        params: {},
+        data: this.data,
+        services: this.services,
+    })
+    .then(function (discuss) {
+        var $sidebar = discuss.$('.o_mail_discuss_sidebar');
+
+        var $channel = $sidebar.find('.o_mail_discuss_item[data-thread-id=1]');
+        assert.strictEqual($channel.length, 1,
+            "should have the channel item for channel 1 in the sidebar");
+        assert.strictEqual($channel.find('.o_thread_name').text().replace(/\s/g, ''),
+            "#R&D",
+            "should have unescaped channel name in the sidebar");
+
+        discuss.destroy();
+        done();
+    });
+});
+
 QUnit.test('@ mention in channel', function (assert) {
     assert.expect(34);
     var done = assert.async();