From 5b41b5c563c75e18f4cf8d2f7dd66d5e273e4341 Mon Sep 17 00:00:00 2001
From: Gorash <chm@odoo.com>
Date: Tue, 4 Jun 2019 08:15:48 +0000
Subject: [PATCH] [FIX] web_editor: escape html tag when copy paste code and
 text content
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

closes odoo/odoo#33859

Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
---
 addons/web_editor/static/src/js/wysiwyg/plugin/text.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/addons/web_editor/static/src/js/wysiwyg/plugin/text.js b/addons/web_editor/static/src/js/wysiwyg/plugin/text.js
index f2834c531f7..9014b367fee 100644
--- a/addons/web_editor/static/src/js/wysiwyg/plugin/text.js
+++ b/addons/web_editor/static/src/js/wysiwyg/plugin/text.js
@@ -780,7 +780,10 @@ var TextPlugin = AbstractPlugin.extend({
             clipboardData = e.originalEvent.clipboardData.getData('text/plain');
             // get that text as an array of text nodes separated by <br> where needed
             var allNewlines = /\n/g;
-            clipboardData = $('<p>' + clipboardData.replace(allNewlines, '<br>') + '</p>').contents().toArray();
+            clipboardData = _.str.trim(clipboardData)
+                .replace(/</g, '&lt;').replace(/>/g, '&gt;')
+                .replace(allNewlines, '<br>');
+            clipboardData = $('<p>' + clipboardData + '</p>').contents().toArray();
         }
 
         // Delete selection