[FIX] stock: remove eval from search method

Using a safe_eval is overkill and can nicely be replaced by operator

Closes #13138

addons/stock/models/product.py

@@ -4,9 +4,17 @@
 from odoo import api, fields, models, _
 from odoo.addons import decimal_precision as dp
 from odoo.exceptions import UserError
-from odoo.tools.safe_eval import safe_eval as eval
 from odoo.tools.float_utils import float_round
+import operator as py_operator
 
+OPERATORS = {
+    '<': py_operator.lt,
+    '>': py_operator.gt,
+    '<=': py_operator.le,
+    '>=': py_operator.ge,
+    '==': py_operator.eq,
+    '!=': py_operator.ne
+}
 
 class Product(models.Model):
     _inherit = "product.product"
@@ -238,7 +246,7 @@ class Product(models.Model):
         # TODO: Still optimization possible when searching virtual quantities
         ids = []
         for product in self.search([]):
-            if eval(str(product[field]) + operator + str(value)):
+            if OPERATORS[operator](product[field], value):
                 ids.append(product.id)
         return [('id', 'in', ids)]
 
@@ -261,7 +269,7 @@ class Product(models.Model):
             domain_quant.append(('package_id', '=', package_id))
         quants_groupby = self.env['stock.quant'].read_group(domain_quant, ['product_id', 'qty'], ['product_id'])
         for quant in quants_groupby:
-            if eval('%s %s %s' % (quant['qty'], operator, value)):
+            if OPERATORS[operator](quant['qty'], value):
                 product_ids.add(quant['product_id'][0])
         return list(product_ids)