From b8f2edd94c498c6b1d8d7606d268232b50cbe88d Mon Sep 17 00:00:00 2001 From: XavierDo Date: Mon, 4 Feb 2019 13:21:32 +0000 Subject: [PATCH] [FIX] core: remove email escape logic from html_sanitize. Related to #30326 Before #30326, when calling html_sanitize, some content may be escaped when it shouldn't. A simple example was images with cid links containing @. (a first fix for another use case was made in 8aff53733b6ca1dd6f8074834ada1baaab3910d5) We suspect that this escaping (added in 71a92f46e4e223a3bad0e27ececa2ece3c09f5d1) was made to avoid loosing email with format '' in html_sanitize to escape them if html_sanitize is called on plain text. Anyway, only html should be passed to html_sanitize, and therefore email of format should already be escaped. PR #30326 fixes the unwanted behaviour in 12.0 and this commit removes this logic in master. closes odoo/odoo#30815 --- odoo/addons/base/tests/test_mail.py | 10 ---------- odoo/tools/mail.py | 5 ----- 2 files changed, 15 deletions(-) diff --git a/odoo/addons/base/tests/test_mail.py b/odoo/addons/base/tests/test_mail.py index 297a32cf67e..0e4a8c262c4 100644 --- a/odoo/addons/base/tests/test_mail.py +++ b/odoo/addons/base/tests/test_mail.py @@ -92,16 +92,6 @@ class TestSanitizer(unittest.TestCase): for attr in ['javascript']: self.assertNotIn(attr, sanitized_html, 'html_sanitize did not remove enough unwanted attributes') - def test_sanitize_escape_emails(self): - emails = [ - "Charles ", - "Dupuis <'tr/-: ${dupuis#$'@truc.baz.fr>", - "Technical ", - "Div nico " - ] - for email in emails: - self.assertIn(misc.html_escape(email), html_sanitize(email), 'html_sanitize stripped emails of original html') - def test_sanitize_unescape_emails(self): not_emails = [ '
cat
', diff --git a/odoo/tools/mail.py b/odoo/tools/mail.py index d310220111d..40c9604157f 100644 --- a/odoo/tools/mail.py +++ b/odoo/tools/mail.py @@ -176,11 +176,6 @@ def html_sanitize(src, silent=True, sanitize_tags=True, sanitize_attributes=Fals logger = logging.getLogger(__name__ + '.html_sanitize') - # html encode email tags - part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL) - # remove results containing cite="mid:email_like@address" (ex: blockquote cite) - # cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE) - src = part.sub(lambda m: (u'cite=' not in m.group(1) and u'alt=' not in m.group(1) and u'src=' not in m.group(1)) and misc.html_escape(m.group(1)) or m.group(1), src) # html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner src = src.replace(u'<%', misc.html_escape(u'<%')) src = src.replace(u'%>', misc.html_escape(u'%>'))