From e80164dd6bce2b82f2b3ed9f992cc2b7432d11dd Mon Sep 17 00:00:00 2001
From: Aaron Bohy <aab@odoo.com>
Date: Wed, 15 Jun 2022 09:28:02 +0000
Subject: [PATCH] [FIX] web: registry: getAll and getEntries return shallow
 copies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The getAll and getEntries functions have a cache, i.e. the array
they return is lazy evaluated once, and then kept until the next
update of the registry. Before this commit, those functions
returned their own version of those arrays, not a copy. As a
consequence, someone that would modify those arrays would actually
modify the arrays in the cache, and every subsequent calls to those
functions would return those modified arrays, which would not
correspond to the actual state of the registry.

closes odoo/odoo#93767

X-original-commit: c3d0449bb09a012d9ce97bfc6401476cf8a57c26
Signed-off-by: Géry Debongnie <ged@odoo.com>
Signed-off-by: Aaron Bohy (aab) <aab@odoo.com>
---
 addons/web/static/src/core/registry.js        |  4 ++--
 addons/web/static/tests/core/registry_test.js | 23 +++++++++++++++++++
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/addons/web/static/src/core/registry.js b/addons/web/static/src/core/registry.js
index 646ccf4a179..b71438cdf63 100644
--- a/addons/web/static/src/core/registry.js
+++ b/addons/web/static/src/core/registry.js
@@ -98,7 +98,7 @@ export class Registry extends EventBus {
             const content = Object.values(this.content).sort((el1, el2) => el1[0] - el2[0]);
             this.elements = content.map((elem) => elem[1]);
         }
-        return this.elements;
+        return this.elements.slice();
     }
 
     /**
@@ -111,7 +111,7 @@ export class Registry extends EventBus {
             const entries = Object.entries(this.content).sort((el1, el2) => el1[1][0] - el2[1][0]);
             this.entries = entries.map(([str, elem]) => [str, elem[1]]);
         }
-        return this.entries;
+        return this.entries.slice();
     }
 
     /**
diff --git a/addons/web/static/tests/core/registry_test.js b/addons/web/static/tests/core/registry_test.js
index 5b2e60ca02d..d5816af1152 100644
--- a/addons/web/static/tests/core/registry_test.js
+++ b/addons/web/static/tests/core/registry_test.js
@@ -100,6 +100,29 @@ QUnit.test("can get ordered list of entries", function (assert) {
     ]);
 });
 
+QUnit.test("getAll and getEntries returns shallow copies", function (assert) {
+    const registry = new Registry();
+
+    registry.add("foo1", "foo1");
+
+    const all = registry.getAll();
+    const entries = registry.getEntries();
+
+    assert.deepEqual(all, ["foo1"]);
+    assert.deepEqual(entries, [["foo1", "foo1"]]);
+
+    all.push("foo2");
+    entries.push(["foo2", "foo2"]);
+
+    assert.deepEqual(all, ["foo1", "foo2"]);
+    assert.deepEqual(entries, [
+        ["foo1", "foo1"],
+        ["foo2", "foo2"],
+    ]);
+    assert.deepEqual(registry.getAll(), ["foo1"]);
+    assert.deepEqual(registry.getEntries(), [["foo1", "foo1"]]);
+});
+
 QUnit.test("can override element with sequence", function (assert) {
     const registry = new Registry();