pengyuthon/odoo_source
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[FIX] web, *: review Bootstrap tooltip/popover sanitization

Browse Source 
* website_sale_comparison

The Bootstrap sanitization introduced with BS 4.3.1 was disabled with
https://github.com/odoo/odoo/commit/36caf5fc16b5a95a0bf37f08f0caf974683b2df6
https://github.com/odoo/odoo/commit/ee94decd30c4514d5bc410b1652bc6464bb600aa

This commit re-enables it by default but extends it to accept more
common tag names like tables and buttons. If a specific tooltip or
popover must accept custom tags or attributes (such as data-* attributes
required by a related JS), they must be supplied through the whitelist
BS parameter explicitely (see example with website_sale_comparison in
this commit).

Note: data-oe-* attributes are also whiteListed by default.

We cannot disable sanitization because bootstrap uses tooltip/popover
DOM attributes in an "unsafe" way.

closes odoo/odoo#37631

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>
This commit is contained in:
qsm-odoo
2019-10-01 15:33:28 +00:00
parent 28931034c0
commit 6991f300cd
1 changed files with 61 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
addons/web/static/src/js/libs/bootstrap.js
Vendored
+61 -4
View File
@@ -6,11 +6,68 @@ odoo.define('web.bootstrap.extensions', function () {
* patching in place.
*/
/**
* Review Bootstrap Sanitization: leave it enabled by default but extend it to
* accept more common tag names like tables and buttons, and common attributes
* such as style or data-. If a specific tooltip or popover must accept custom
* tags or attributes, they must be supplied through the whitelist BS
* parameter explicitely.
*
* We cannot disable sanitization because bootstrap uses tooltip/popover
* DOM attributes in an "unsafe" way.
*/
var bsSanitizeWhiteList = $.fn.tooltip.Constructor.Default.whiteList;
bsSanitizeWhiteList['*'].push('title', 'style', /^data-[\w-]+/);
bsSanitizeWhiteList.header = [];
bsSanitizeWhiteList.main = [];
bsSanitizeWhiteList.footer = [];
bsSanitizeWhiteList.caption = [];
bsSanitizeWhiteList.col = ['span'];
bsSanitizeWhiteList.colgroup = ['span'];
bsSanitizeWhiteList.table = [];
bsSanitizeWhiteList.thead = [];
bsSanitizeWhiteList.tbody = [];
bsSanitizeWhiteList.tfooter = [];
bsSanitizeWhiteList.tr = [];
bsSanitizeWhiteList.th = ['colspan', 'rowspan'];
bsSanitizeWhiteList.td = ['colspan', 'rowspan'];
bsSanitizeWhiteList.address = [];
bsSanitizeWhiteList.article = [];
bsSanitizeWhiteList.aside = [];
bsSanitizeWhiteList.blockquote = [];
bsSanitizeWhiteList.section = [];
bsSanitizeWhiteList.button = ['type'];
bsSanitizeWhiteList.del = [];
/**
* Returns an extended version of bootstrap default whitelist for sanitization,
* i.e. a version where, for each key, the original value is concatened with the
* received version's value and where the received version's extra key/values
* are added.
*
* Note: the returned version
*
* @param {Object} extensions
* @returns {Object} /!\ the returned whitelist is made from a *shallow* copy of
* the default whitelist, extended with given whitelist.
*/
function makeExtendedSanitizeWhiteList(extensions) {
var whiteList = _.clone($.fn.tooltip.Constructor.Default.whiteList);
Object.keys(extensions).forEach(key => {
whiteList[key] = (whiteList[key] || []).concat(extensions[key]);
});
return whiteList;
}
/* Bootstrap tooltip defaults overwrite */
$.fn.tooltip.Constructor.Default.placement = 'auto';
$.fn.tooltip.Constructor.Default.fallbackPlacement = ['bottom', 'right', 'left', 'top'];
$.fn.tooltip.Constructor.Default.html = true;
$.fn.tooltip.Constructor.Default.sanitize = false;
$.fn.tooltip.Constructor.Default.trigger = 'hover';
$.fn.tooltip.Constructor.Default.container = 'body';
$.fn.tooltip.Constructor.Default.boundary = 'window';
@@ -25,7 +82,7 @@ $.fn.tooltip.Constructor.prototype.show = function () {
return bootstrapShowFunction.call(this);
};
/* Bootstrap popover defaults overwrite */
$.fn.popover.Constructor.Default.sanitize = false;
return {
makeExtendedSanitizeWhiteList: makeExtendedSanitizeWhiteList,
};
});