From 9be3f0f4ffa1db943fceca9f426e89be0d0020f0 Mon Sep 17 00:00:00 2001
From: tsm-odoo <tsm@odoo.com>
Date: Thu, 15 Sep 2022 16:30:30 +0000
Subject: [PATCH] [FIX] bus: make subscribe method only accept strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before [1], only string channels were allowed for polling. This
ensured no one could send a server-side channel from the frontend,
this PR restores this behavior.

[1]: odoo/odoo@a5623d2

closes odoo/odoo#100309

Signed-off-by: Sébastien Theys (seb) <seb@odoo.com>
---
 addons/bus/controllers/websocket.py   |  2 ++
 addons/bus/models/ir_websocket.py     |  2 ++
 addons/bus/tests/__init__.py          |  1 +
 addons/bus/tests/test_ir_websocket.py | 13 +++++++++++++
 4 files changed, 18 insertions(+)
 create mode 100644 addons/bus/tests/test_ir_websocket.py

diff --git a/addons/bus/controllers/websocket.py b/addons/bus/controllers/websocket.py
index ed79c663517..5384c973915 100644
--- a/addons/bus/controllers/websocket.py
+++ b/addons/bus/controllers/websocket.py
@@ -33,6 +33,8 @@ class WebsocketController(Controller):
 
     @route('/websocket/peek_notifications', type='json', auth='public', cors='*')
     def peek_notifications(self, channels, last):
+        if not all(isinstance(c, str) for c in channels):
+            raise ValueError("bus.Bus only string channels are allowed.")
         channels = list(set(
             channel_with_db(request.db, c)
             for c in request.env['ir.websocket']._build_bus_channel_list(channels)
diff --git a/addons/bus/models/ir_websocket.py b/addons/bus/models/ir_websocket.py
index 054f358e2bd..b26df830625 100644
--- a/addons/bus/models/ir_websocket.py
+++ b/addons/bus/models/ir_websocket.py
@@ -20,6 +20,8 @@ class IrWebsocket(models.AbstractModel):
         return channels
 
     def _subscribe(self, data):
+        if not all(isinstance(c, str) for c in data['channels']):
+            raise ValueError("bus.Bus only string channels are allowed.")
         channels = set(self._build_bus_channel_list(data['channels']))
         dispatch.subscribe(channels, data['last'], self.env.registry.db_name, wsrequest.ws)
 
diff --git a/addons/bus/tests/__init__.py b/addons/bus/tests/__init__.py
index aff0b730980..bb3b9125cbb 100644
--- a/addons/bus/tests/__init__.py
+++ b/addons/bus/tests/__init__.py
@@ -1,5 +1,6 @@
 from . import common
 from . import test_assetsbundle
 from . import test_health
+from . import test_ir_websocket
 from . import test_websocket_caryall
 from . import test_websocket_rate_limiting
diff --git a/addons/bus/tests/test_ir_websocket.py b/addons/bus/tests/test_ir_websocket.py
new file mode 100644
index 00000000000..1a32e02c03c
--- /dev/null
+++ b/addons/bus/tests/test_ir_websocket.py
@@ -0,0 +1,13 @@
+# Part of Odoo. See LICENSE file for full copyright and licensing details.
+
+from odoo.tests import common
+
+
+class TestIrWebsocket(common.HttpCase):
+    def test_only_allow_string_channels_from_frontend(self):
+        with self.assertRaises(ValueError):
+            self.env['ir.websocket']._subscribe({
+                'inactivity_period': 1000,
+                'last': 0,
+                'channels': [('odoo', 'mail.channel', 5)],
+            })