[FIX] web_editor: escape html tag when copy paste code and text content

closes odoo/odoo#33859 Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
2019-06-04 08:15:48 +00:00
parent b2b639b693
commit 5b41b5c563
1 changed files with 4 additions and 1 deletions
@@ -780,7 +780,10 @@ var TextPlugin = AbstractPlugin.extend({
            clipboardData = e.originalEvent.clipboardData.getData('text/plain');
            // get that text as an array of text nodes separated by <br> where needed
            var allNewlines = /\n/g;
-            clipboardData = $('<p>' + clipboardData.replace(allNewlines, '<br>') + '</p>').contents().toArray();
+            clipboardData = _.str.trim(clipboardData)
+                .replace(/</g, '&lt;').replace(/>/g, '&gt;')
+                .replace(allNewlines, '<br>');
+            clipboardData = $('<p>' + clipboardData + '</p>').contents().toArray();
        }

        // Delete selection