From 996cb85c2797ff119ac9072947376eb9dc78c956 Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Thu, 4 Mar 2021 14:16:40 +0000
Subject: [PATCH] [FIX] *: mass replace known t-raws by t-out

* QWeb bodies should be markup-safe so `0` should always be
  markup-safe.
* `head` is qweb-rendered so the same.
* The `json` pseudo-module in qweb templates is `json.scriptsafe`,
  which should be markup-safe.
---
 .../views/http_routing_template.xml           |  2 +-
 .../views/im_livechat_channel_templates.xml   |  2 +-
 addons/l10n_de/report/din5008_report.xml      |  2 +-
 .../views/mass_mailing_templates_portal.xml   |  2 +-
 addons/mass_mailing/views/snippets_themes.xml |  2 +-
 .../point_of_sale/views/pos_assets_index.xml  |  2 +-
 .../point_of_sale/views/pos_assets_qunit.xml  |  2 +-
 addons/portal/views/portal_templates.xml      | 10 ++++----
 addons/web/tests/test_js.py                   |  2 +-
 addons/web/views/report_templates.xml         | 24 +++++++++----------
 addons/web/views/webclient_templates.xml      | 14 +++++------
 .../views/snippets/s_dynamic_snippet.xml      |  2 +-
 .../snippets/s_dynamic_snippet_carousel.xml   |  2 +-
 addons/website/views/website_templates.xml    |  8 +++----
 .../views/website_blog_templates.xml          |  2 +-
 .../views/event_templates_page.xml            |  2 +-
 .../event_templates_page_registration.xml     |  2 +-
 .../views/event_templates_widgets.xml         |  2 +-
 .../views/event_templates.xml                 |  4 ++--
 addons/website_forum/views/ir_qweb.xml        |  2 +-
 addons/website_forum/views/website_forum.xml  |  4 ++--
 addons/website_sale/views/templates.xml       |  4 ++--
 odoo/addons/base/models/ir_qweb.py            |  1 -
 odoo/addons/base/tests/test_qweb.py           |  2 +-
 odoo/addons/base/views/onboarding_views.xml   |  2 +-
 25 files changed, 51 insertions(+), 52 deletions(-)

diff --git a/addons/http_routing/views/http_routing_template.xml b/addons/http_routing/views/http_routing_template.xml
index 0d2f30fc269..ce9f21c630c 100644
--- a/addons/http_routing/views/http_routing_template.xml
+++ b/addons/http_routing/views/http_routing_template.xml
@@ -103,7 +103,7 @@
     <template id="404" name="Page Not Found">
         <t t-call="web.frontend_layout">
             <div id="wrap">
-                <t t-raw="0"/>
+                <t t-out="0"/>
                 <div class="oe_structure oe_empty">
                     <section class="s_text_image pt104 pb104" data-snippet="s_image_text" data-name="Image - Text">
                         <div class="container">
diff --git a/addons/im_livechat/views/im_livechat_channel_templates.xml b/addons/im_livechat/views/im_livechat_channel_templates.xml
index 69ff1db20be..50667ae882d 100644
--- a/addons/im_livechat/views/im_livechat_channel_templates.xml
+++ b/addons/im_livechat/views/im_livechat_channel_templates.xml
@@ -106,7 +106,7 @@
                         var button = new im_livechat.LivechatButton(
                             rootWidget,
                             "<t t-esc="info['server_url']"/>",
-                            <t t-raw="json.dumps(info.get('options', {}))"/>
+                            <t t-out="json.dumps(info.get('options', {}))"/>
                         );
                         button.appendTo(document.body);
                         window.livechat_button = button;
diff --git a/addons/l10n_de/report/din5008_report.xml b/addons/l10n_de/report/din5008_report.xml
index d54be2d96d8..77c38842618 100644
--- a/addons/l10n_de/report/din5008_report.xml
+++ b/addons/l10n_de/report/din5008_report.xml
@@ -81,7 +81,7 @@
                             </t>
                         </div>
                     </div>
-                        <t t-raw="0" />
+                        <t t-out="0" />
                 </div>
 
                 <div class="footer o_background_footer din">
diff --git a/addons/mass_mailing/views/mass_mailing_templates_portal.xml b/addons/mass_mailing/views/mass_mailing_templates_portal.xml
index 52da35d41e1..48138246ca4 100644
--- a/addons/mass_mailing/views/mass_mailing_templates_portal.xml
+++ b/addons/mass_mailing/views/mass_mailing_templates_portal.xml
@@ -130,7 +130,7 @@
                 </header>
                 <div id="wrap" class="oe_structure oe_empty"/>
                 <main>
-                    <t t-raw="0"/>
+                    <t t-out="0"/>
                 </main>
             </body>
             <xpath expr="//footer" position="replace">
diff --git a/addons/mass_mailing/views/snippets_themes.xml b/addons/mass_mailing/views/snippets_themes.xml
index a542c037e95..7f114aaf555 100644
--- a/addons/mass_mailing/views/snippets_themes.xml
+++ b/addons/mass_mailing/views/snippets_themes.xml
@@ -829,7 +829,7 @@
 <!-- Snippet themes Options -->
 <template id="snippet_options">
     <t t-call="web_editor.snippet_options"/>
-    <t t-raw="0"/>
+    <t t-out="0"/>
 
     <div data-js="mass_mailing_sizing_x"
         data-selector="img, .mv, .col_mv, td, th"
diff --git a/addons/point_of_sale/views/pos_assets_index.xml b/addons/point_of_sale/views/pos_assets_index.xml
index 97ed1d4287b..c44ddbc2888 100644
--- a/addons/point_of_sale/views/pos_assets_index.xml
+++ b/addons/point_of_sale/views/pos_assets_index.xml
@@ -26,7 +26,7 @@
         <link rel="shortcut icon" href="/web/static/src/img/favicon.ico" type="image/x-icon"/>
 
         <script type="text/javascript">
-            var odoo = <t t-raw="json.dumps({
+            var odoo = <t t-out="json.dumps({
                 'csrf_token': request.csrf_token(None),
                 'session_info': session_info,
                 'login_number': login_number,
diff --git a/addons/point_of_sale/views/pos_assets_qunit.xml b/addons/point_of_sale/views/pos_assets_qunit.xml
index e58b3059460..d28669a3e7a 100644
--- a/addons/point_of_sale/views/pos_assets_qunit.xml
+++ b/addons/point_of_sale/views/pos_assets_qunit.xml
@@ -64,7 +64,7 @@
         <t t-set="head">
             <!-- we need session_info in order to properly instantiate PosModel -->
             <script type="text/javascript">
-                var odoo = <t t-raw="json.dumps({
+                var odoo = <t t-out="json.dumps({
                     'csrf_token': request.csrf_token(None),
                     'session_info': session_info,
                     'debug': debug,
diff --git a/addons/portal/views/portal_templates.xml b/addons/portal/views/portal_templates.xml
index 2a23cefcf39..fde28f3bb1c 100644
--- a/addons/portal/views/portal_templates.xml
+++ b/addons/portal/views/portal_templates.xml
@@ -26,7 +26,7 @@
                 </div>
             </nav>
         </xpath>
-        <xpath expr="//div[@id='wrapwrap']/main/t[@t-raw='0']" position="before">
+        <xpath expr="//div[@id='wrapwrap']/main/t[@t-out='0']" position="before">
             <div t-if="o_portal_fullwidth_alert" class="alert alert-info alert-dismissible rounded-0 fade show d-print-none css_editable_mode_hidden">
                 <div class="container">
                     <t t-raw="o_portal_fullwidth_alert"/>
@@ -120,7 +120,7 @@
                     <t t-if="my_details">
                         <div class="row justify-content-between mt-4">
                             <div t-attf-class="col-12 col-md col-lg-6">
-                                <t t-raw="0"/>
+                                <t t-out="0"/>
                             </div>
                             <div id="o_my_sidebar" class="pt-3 pt-lg-0 col-12 col-md col-lg-4 col-xl-3 o_my_sidebar">
                                 <div class="o_my_contact" t-if="sales_user">
@@ -140,7 +140,7 @@
                         </div>
                     </t>
                     <t t-else="">
-                        <t t-raw="0"/>
+                        <t t-out="0"/>
                     </t>
                 </div>
             </div>
@@ -187,7 +187,7 @@
     <template id="portal_table" name="My Portal Table">
         <div t-attf-class="table-responsive border rounded border-top-0 #{classes if classes else ''}">
             <table class="table rounded mb-0 bg-white o_portal_my_doc_table">
-                <t t-raw="0"/>
+                <t t-out="0"/>
             </table>
         </div>
         <div t-if="pager" class="o_portal_pager text-center">
@@ -294,7 +294,7 @@
                             </div>
                         </div>
                     </div>
-                    <t t-raw="0"/>
+                    <t t-out="0"/>
                 </div>
                 <form t-if="searchbar_inputs" class="form-inline o_portal_search_panel ml-lg-4 col-xl-4 col-md-5">
                     <div class="input-group input-group-sm w-100">
diff --git a/addons/web/tests/test_js.py b/addons/web/tests/test_js.py
index 1a3c1dcdb81..b52a16c52f2 100644
--- a/addons/web/tests/test_js.py
+++ b/addons/web/tests/test_js.py
@@ -22,7 +22,7 @@ class WebSuite(odoo.tests.HttpCase):
     def _check_only_call(self, suite):
         # As we currently aren't in a request context, we can't render `web.layout`.
         # redefinied it as a minimal proxy template.
-        self.env.ref('web.layout').write({'arch_db': '<t t-name="web.layout"><head><meta charset="utf-8"/><t t-raw="head"/></head></t>'})
+        self.env.ref('web.layout').write({'arch_db': '<t t-name="web.layout"><head><meta charset="utf-8"/><t t-esc="head"/></head></t>'})
 
         for asset in self.env['ir.qweb']._get_asset_content(suite, options={})[0]:
             filename = asset['filename']
diff --git a/addons/web/views/report_templates.xml b/addons/web/views/report_templates.xml
index 494ffacd6bc..8b25907506c 100644
--- a/addons/web/views/report_templates.xml
+++ b/addons/web/views/report_templates.xml
@@ -27,7 +27,7 @@
             <body t-att-class="'container' if not full_width else 'container-fluid'">
                 <div id="wrapwrap">
                     <main>
-                        <t t-raw="0"/>
+                        <t t-out="0"/>
                     </main>
                 </div>
             </body>
@@ -91,7 +91,7 @@
             </head>
             <body t-att-class="'container' if not full_width else 'container-fluid'">
                 <div id="wrapwrap">
-                        <t t-raw="0"/>
+                        <t t-out="0"/>
                 </div>
             </body>
         </html>
@@ -100,14 +100,14 @@
     <template id="html_container">
         <t t-set="body_classname" t-value="'container'"/>
         <t t-call="web.report_layout">
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </t>
     </template>
 
     <template id="html_preview_container">
         <t t-set="body_classname" t-value="'container'"/>
         <t t-call="web.report_preview_layout">
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </t>
     </template>
 
@@ -323,7 +323,7 @@
 
         <div t-attf-class="o_company_#{company.id}_layout article o_report_layout_background" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
             <t t-call="web.address_layout"/>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
 
         <div t-attf-class="o_company_#{company.id}_layout footer o_background_footer">
@@ -373,7 +373,7 @@
                 <!-- This div ensures that the address is not cropped by the header. -->
                 <t t-call="web.address_layout"/>
             </div>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
 
         <div t-attf-class="footer o_boxed_footer o_company_#{company.id}_layout">
@@ -422,7 +422,7 @@
 
         <div t-attf-class="article o_report_layout_clean o_company_#{company.id}_layout"  t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
             <t t-call="web.address_layout"/>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
 
         <div t-attf-class="footer o_clean_footer o_company_#{company.id}_layout">
@@ -473,7 +473,7 @@
                 <!-- This div ensures that the address is not cropped by the header. -->
                 <t t-call="web.address_layout"/>
             </div>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
 
         <div t-attf-class="footer o_standard_footer o_company_#{company.id}_layout">
@@ -520,8 +520,8 @@
             </t>
         </t>
 
-        <t t-if="company.external_report_layout_id" t-call="{{company.external_report_layout_id.key}}"><t t-raw="0"/></t>
-        <t t-else="else" t-call="web.external_layout_standard"><t t-raw="0"/></t>
+        <t t-if="company.external_report_layout_id" t-call="{{company.external_report_layout_id.key}}"><t t-out="0"/></t>
+        <t t-else="else" t-call="web.external_layout_standard"><t t-out="0"/></t>
 
     </template>
 
@@ -559,7 +559,7 @@
             </div>
         </div>
         <div class="article" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
-          <t t-raw="0"/>
+          <t t-out="0"/>
         </div>
     </template>
 
@@ -567,7 +567,7 @@
         <t t-call="web.html_container">
             <t t-if="not o" t-set="o" t-value="doc"/>
             <div class="article" t-att-data-oe-model="o and o._name" t-att-data-oe-id="o and o.id" t-att-data-oe-lang="o and o.env.context.get('lang')">
-                <t t-raw="0"/>
+                <t t-out="0"/>
             </div>
         </t>
     </template>
diff --git a/addons/web/views/webclient_templates.xml b/addons/web/views/webclient_templates.xml
index 0c91694e2ec..d24491ce108 100644
--- a/addons/web/views/webclient_templates.xml
+++ b/addons/web/views/webclient_templates.xml
@@ -22,10 +22,10 @@
                     };
                 </script>
 
-                <t t-raw="head or ''"/>
+                <t t-out="head or ''"/>
             </head>
             <body t-att-class="body_classname">
-                <t t-raw="0"/>
+                <t t-out="0"/>
             </body>
         </html>
     </template>
@@ -41,7 +41,7 @@
         </xpath>
         <xpath expr="//head/script[@id='web.layout.odooscript']" position="after">
             <script type="text/javascript">
-                odoo.session_info = <t t-raw="json.dumps(request.env['ir.http'].get_frontend_session_info())"/>;
+                odoo.session_info = <t t-out="json.dumps(request.env['ir.http'].get_frontend_session_info())"/>;
                 if (!/(^|;\s)tz=/.test(document.cookie)) {
                     const userTZ = Intl.DateTimeFormat().resolvedOptions().timeZone;
                     document.cookie = `tz=${userTZ}; path=/`;
@@ -53,7 +53,7 @@
             <t t-call-assets="web.assets_common_lazy" t-css="false" lazy_load="True"/>
             <t t-call-assets="web.assets_frontend_lazy" t-css="false" lazy_load="True"/>
         </xpath>
-        <xpath expr="//t[@t-raw='0']" position="replace">
+        <xpath expr="//t[@t-out='0']" position="replace">
             <div id="wrapwrap" t-attf-class="#{pageName or ''}">
                 <header t-if="not no_header" id="top" data-anchor="true">
                     <img class="img-responsive d-block mx-auto"
@@ -61,7 +61,7 @@
                         alt="Logo"/>
                 </header>
                 <main>
-                    <t t-raw="0"/>
+                    <t t-out="0"/>
                 </main>
                 <footer t-if="not no_footer" id="bottom" data-anchor="true" t-attf-class="bg-light o_footer">
                     <div id="footer"/>
@@ -118,7 +118,7 @@
                         <div t-attf-class="text-center pb-3 border-bottom {{'mb-3' if form_small else 'mb-4'}}">
                             <img t-attf-src="/web/binary/company_logo{{ '?dbname='+db if db else '' }}" alt="Logo" style="max-height:120px; max-width: 100%; width:auto"/>
                         </div>
-                        <t t-raw="0"/>
+                        <t t-out="0"/>
                         <div class="text-center small mt-4 pt-3 border-top" t-if="not disable_footer">
                             <t t-if="not disable_database_manager">
                                 <a class="border-right pr-2 mr-1" href="/web/database/manager">Manage Databases</a>
@@ -286,7 +286,7 @@
         <t t-call="web.layout">
             <t t-set="head_web">
                 <script type="text/javascript">
-                    odoo.session_info = <t t-raw="json.dumps(session_info)"/>;
+                    odoo.session_info = <t t-out="json.dumps(session_info)"/>;
                     odoo.reloadMenus = () => fetch(`/web/webclient/load_menus/${odoo.session_info.cache_hashes.load_menus}`).then(res => res.json());
                     odoo.loadMenusPromise = odoo.reloadMenus();
                 </script>
diff --git a/addons/website/views/snippets/s_dynamic_snippet.xml b/addons/website/views/snippets/s_dynamic_snippet.xml
index bd7d45de56f..50049d96cdc 100644
--- a/addons/website/views/snippets/s_dynamic_snippet.xml
+++ b/addons/website/views/snippets/s_dynamic_snippet.xml
@@ -39,7 +39,7 @@
                 <we-button data-select-data-attribute="2">2</we-button>
                 <we-button data-select-data-attribute="3">3</we-button>
             </we-select>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
     </template>
     <template id="s_dynamic_snippet_options" inherit_id="website.snippet_options">
diff --git a/addons/website/views/snippets/s_dynamic_snippet_carousel.xml b/addons/website/views/snippets/s_dynamic_snippet_carousel.xml
index bd0950424a0..bff303ed37b 100644
--- a/addons/website/views/snippets/s_dynamic_snippet_carousel.xml
+++ b/addons/website/views/snippets/s_dynamic_snippet_carousel.xml
@@ -13,7 +13,7 @@
             <we-input string="Slider Speed"
                   data-select-data-attribute="1s" data-name="speed_opt" data-attribute-name="carouselInterval" data-no-preview="true"
                   data-unit="s" data-save-unit="ms" data-step="0.1"/>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </t>
     </template>
     <template id="s_dynamic_snippet_carousel_options" inherit_id="website.snippet_options">
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index 4386ad55837..b54eeb257fb 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -214,7 +214,7 @@
 <!-- Navbar Nav -->
 <template id="navbar_nav" name="Navbar Nav">
     <ul id="top_menu" t-attf-class="nav navbar-nav o_menu_loading #{_nav_class}">
-        <t t-raw="0"/>
+        <t t-out="0"/>
     </ul>
 </template>
 
@@ -1336,7 +1336,7 @@
 <template id="login_layout" inherit_id="web.login_layout" name="Website Login Layout" priority="20">
     <xpath expr="t" position="replace">
         <t t-call="website.layout">
-            <div class="oe_website_login_container" t-raw="0"/>
+            <div class="oe_website_login_container" t-out="0"/>
         </t>
     </xpath>
 </template>
@@ -1932,7 +1932,7 @@
          t-attf-class="o_record_cover_container d-flex flex-column h-100 o_colored_level o_cc #{_cp.get('background_color_class')} #{use_size and _cp.get('resize_class')} #{use_text_align and _cp.get('text_align_class')} #{additionnal_classes}">
         <div t-attf-class="o_record_cover_component o_record_cover_image #{snippet_autofocus and 'o_we_snippet_autofocus'}" t-attf-style="background-image: #{_bg};"/>
         <div t-if="use_filters" t-attf-class="o_record_cover_component o_record_cover_filter oe_black" t-attf-style="opacity: #{_cp.get('opacity', 0.0)};"/>
-        <t t-raw="0"/>
+        <t t-out="0"/>
     </div>
 </template>
 
@@ -1944,7 +1944,7 @@
             <button class="btn btn-success js_publish_btn">Published</button>
             <button type="button" t-attf-class="btn btn-default dropdown-toggle dropdown-toggle-split" t-att-id="'dopprod-%s' % object.id" data-toggle="dropdown"/>
             <div class="dropdown-menu" role="menu" t-att-aria-labelledby="'dopprod-%s' % object.id">
-                <t t-raw="0"/>
+                <t t-out="0"/>
                 <a role="menuitem" t-attf-href="/web#view_type=form&amp;model=#{object._name}&amp;id=#{object.id}&amp;action=#{action}&amp;menu_id=#{menu or object.env['ir.model.data'].xmlid_to_res_id('website.menu_website_configuration')}"
                     title='Edit in backend' class="dropdown-item" t-if="publish_edit">Edit</a>
             </div>
diff --git a/addons/website_blog/views/website_blog_templates.xml b/addons/website_blog/views/website_blog_templates.xml
index 95b4f4334ca..32cc797c8ce 100644
--- a/addons/website_blog/views/website_blog_templates.xml
+++ b/addons/website_blog/views/website_blog_templates.xml
@@ -6,7 +6,7 @@
 <template id="index" name="Blog Navigation">
     <t t-call="website.layout">
         <div id="wrap" class="js_blog website_blog">
-            <t t-raw="0"/>
+            <t t-out="0"/>
 
             <!-- Droppable-area shared across all blog's pages -->
             <t t-set="oe_structure_blog_footer_description">Visible in all blogs' pages</t>
diff --git a/addons/website_event/views/event_templates_page.xml b/addons/website_event/views/event_templates_page.xml
index 17b0fe42ebd..c16acb942a2 100644
--- a/addons/website_event/views/event_templates_page.xml
+++ b/addons/website_event/views/event_templates_page.xml
@@ -62,7 +62,7 @@
                     </div>
                 </nav>
             </t>
-            <t t-raw="0"/>
+            <t t-out="0"/>
             <t t-set="editor_sub_message">Following content will appear on all events.</t>
             <div class="oe_structure oe_empty" id="oe_structure_website_event_layout_1" t-att-data-editor-sub-message="editor_sub_message"/>
         </div>
diff --git a/addons/website_event/views/event_templates_page_registration.xml b/addons/website_event/views/event_templates_page_registration.xml
index ef7f5b8e8fe..ee8fc9103a8 100644
--- a/addons/website_event/views/event_templates_page_registration.xml
+++ b/addons/website_event/views/event_templates_page_registration.xml
@@ -22,7 +22,7 @@
                     <t t-call="website_event.registration_template"/>
                 </div>
             </t>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </div>
     </t>
 </template>
diff --git a/addons/website_event/views/event_templates_widgets.xml b/addons/website_event/views/event_templates_widgets.xml
index f367aa8b370..d01d5134e42 100644
--- a/addons/website_event/views/event_templates_widgets.xml
+++ b/addons/website_event/views/event_templates_widgets.xml
@@ -13,7 +13,7 @@
                 <input t-if="search != 'search' and search_value != 'all'" type="hidden"
                     t-att-name="search" t-att-value="search_value"/>
             </t>
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </form>
     </xpath>
 </template>
diff --git a/addons/website_event_track/views/event_templates.xml b/addons/website_event_track/views/event_templates.xml
index cf7b49775e8..6f4546608c9 100644
--- a/addons/website_event_track/views/event_templates.xml
+++ b/addons/website_event_track/views/event_templates.xml
@@ -19,7 +19,7 @@
     <xpath expr='//t[@t-call="website.layout"]' position="inside">
         <t t-set="pageName" t-value="'event'"/>
         <t t-set="head">
-            <t t-raw="head"/>
+            <t t-out="head"/>
             <t t-call="website_event_track.pwa_manifest"/>
         </t>
     </xpath>
@@ -29,7 +29,7 @@
     <xpath expr='//t[@t-call="website.layout"]' position="inside">
         <t t-set="pageName" t-value="'event'"/>
         <t t-set="head">
-            <t t-raw="head"/>
+            <t t-out="head"/>
             <t t-call="website_event_track.pwa_manifest"/>
         </t>
     </xpath>
diff --git a/addons/website_forum/views/ir_qweb.xml b/addons/website_forum/views/ir_qweb.xml
index 4fdefff0a7f..56241969352 100644
--- a/addons/website_forum/views/ir_qweb.xml
+++ b/addons/website_forum/views/ir_qweb.xml
@@ -21,7 +21,7 @@
                     <span class="fa fa-trophy badge-bronze ml-2" role="img" aria-label="Bronze badge" title="Bronze badge"/>
                     <t t-esc="object.bronze_badge"/>
                 </div>
-                <t t-raw="0"/>
+                <t t-out="0"/>
                 <div t-if="options.get('UserBio')" class="mt-2">
                     <div class="o_forum_tooltip_line" t-if="object.partner_id.country_id or object.partner_id.city">
                         <span t-field="object.partner_id.city"/><span t-if="object.partner_id.city and object.partner_id.country_id">, </span><span t-field="object.partner_id.country_id"/>
diff --git a/addons/website_forum/views/website_forum.xml b/addons/website_forum/views/website_forum.xml
index 40115cc7ebd..75c9af58423 100644
--- a/addons/website_forum/views/website_forum.xml
+++ b/addons/website_forum/views/website_forum.xml
@@ -90,7 +90,7 @@
                                     <li t-elif="tags" class="breadcrumb-item">All Tags</li>
                                 </ol>
                             </nav>
-                            <t t-raw="0"/>
+                            <t t-out="0"/>
                         </div>
                         <aside t-if="uid" class="d-none d-lg-flex justify-content-end col-auto">
                             <t t-call="website_forum.user_sidebar"/>
@@ -1021,7 +1021,7 @@
             t-att-data-karma="forum.karma_downvote"
             t-att-data-can-downvote="can_downvote"
             aria-label="Negative vote" title="Negative vote"/>
-        <t t-raw="0"/>
+        <t t-out="0"/>
     </div>
 </template>
 
diff --git a/addons/website_sale/views/templates.xml b/addons/website_sale/views/templates.xml
index 1c3eb1bd95a..b9cc4e8f676 100644
--- a/addons/website_sale/views/templates.xml
+++ b/addons/website_sale/views/templates.xml
@@ -155,7 +155,7 @@
             <form t-attf-class="o_wsale_products_searchbar_form o_wait_lazy_js #{_classes}" t-att-action="action if action else '/shop'" method="get" t-att-data-snippet="_snippet">
                 <t>$0</t>
                 <input name="order" type="hidden" class="o_wsale_search_order_by" value=""/>
-                <t t-raw="0"/>
+                <t t-out="0"/>
             </form>
         </xpath>
     </template>
@@ -934,7 +934,7 @@
     <!-- We use this template where we want to give the user a link to the product of a sale order line. -->
     <template id="cart_line_product_link" name="Shopping Cart Line Product Link">
         <a t-att-href="line.product_id.website_url">
-            <t t-raw="0"/>
+            <t t-out="0"/>
         </a>
     </template>
 
diff --git a/odoo/addons/base/models/ir_qweb.py b/odoo/addons/base/models/ir_qweb.py
index bf00dea5ff1..d6a23b871fe 100644
--- a/odoo/addons/base/models/ir_qweb.py
+++ b/odoo/addons/base/models/ir_qweb.py
@@ -2,7 +2,6 @@
 from __future__ import print_function
 import ast
 import copy
-import json
 import logging
 from collections import OrderedDict
 from time import time
diff --git a/odoo/addons/base/tests/test_qweb.py b/odoo/addons/base/tests/test_qweb.py
index 9c41c1d74ad..ddfe1c609d1 100644
--- a/odoo/addons/base/tests/test_qweb.py
+++ b/odoo/addons/base/tests/test_qweb.py
@@ -82,7 +82,7 @@ class TestQWebTField(TransactionCase):
                 <t t-name="base.dummy">
                     <root>
                         <script type="application/javascript">
-                            var s = <t t-raw="json.dumps({'key': malicious})"/>;
+                            var s = <t t-esc="json.dumps({'key': malicious})"/>;
                         </script>
                     </root>
                 </t>
diff --git a/odoo/addons/base/views/onboarding_views.xml b/odoo/addons/base/views/onboarding_views.xml
index 1085151a72f..a5b1c079338 100644
--- a/odoo/addons/base/views/onboarding_views.xml
+++ b/odoo/addons/base/views/onboarding_views.xml
@@ -33,7 +33,7 @@
                         <i class="fa fa-times" title="Close the onboarding panel" />
                     </a>
                     <div class="o_onboarding_steps">
-                        <t t-raw="0" />
+                        <t t-out="0" />
                     </div>
                     <div t-att-class="'o_onboarding_completed_message text-center' + (' o_onboarding_steps_done' if state.get('onboarding_state') in ('done', 'just_done') else '') + (' o_onboarding_steps_just_done' if state.get('onboarding_state') == 'just_done' else '')">
                         <i class="fa fa-check text-success mr8" />