[FIX] tools: mail: email address escaping

This commit protects tags having an alt attribute containing an @. Like
cite on blockquote, alt on image for example could contain an @. Do not
escape it as it could break images.

openerp/addons/base/tests/test_mail.py

@@ -104,16 +104,15 @@ class TestSanitizer(unittest.TestCase):
         for email in emails:
             self.assertIn(cgi.escape(email), html_sanitize(email), 'html_sanitize stripped emails of original html')
 
-    def test_sanitize_escape_emails_cite(self):
+    def test_sanitize_unescape_emails(self):
         not_emails = [
-            '<blockquote cite="mid:CAEJSRZvWvud8c6Qp=wfNG6O1+wK3i_jb33qVrF7XyrgPNjnyUA@mail.gmail.com" type="cite">cat</blockquote>']
+            '<blockquote cite="mid:CAEJSRZvWvud8c6Qp=wfNG6O1+wK3i_jb33qVrF7XyrgPNjnyUA@mail.gmail.com" type="cite">cat</blockquote>',
+            '<img alt="@github-login" class="avatar" src="/web/image/pi" height="36" width="36">']
         for email in not_emails:
             sanitized = html_sanitize(email)
+            left_part = email.split('>')[0]  # take only left part, as the sanitizer could add data information on node
             self.assertNotIn(cgi.escape(email), sanitized, 'html_sanitize stripped emails of original html')
-            self.assertIn(
-                '<blockquote cite="mid:CAEJSRZvWvud8c6Qp=wfNG6O1+wK3i_jb33qVrF7XyrgPNjnyUA@mail.gmail.com"',
-                sanitized,
-                'html_sanitize escaped valid address-like')
+            self.assertIn(left_part, sanitized)
 
     def test_style_parsing(self):
         test_data = [

openerp/tools/mail.py

@@ -157,7 +157,7 @@ def html_sanitize(src, silent=True, strict=False, strip_style=False, strip_class
     part = re.compile(r"(<(([^a<>]|a[^<>\s])[^<>]*)@[^<>]+>)", re.IGNORECASE | re.DOTALL)
     # remove results containing cite="mid:email_like@address" (ex: blockquote cite)
     # cite_except = re.compile(r"^((?!cite[\s]*=['\"]).)*$", re.IGNORECASE)
-    src = part.sub(lambda m: 'cite=' not in m.group(1) and cgi.escape(m.group(1)) or m.group(1), src)
+    src = part.sub(lambda m: ('cite=' not in m.group(1) and 'alt=' not in m.group(1)) and cgi.escape(m.group(1)) or m.group(1), src)
     # html encode mako tags <% ... %> to decode them later and keep them alive, otherwise they are stripped by the cleaner
     src = src.replace('<%', cgi.escape('<%'))
     src = src.replace('%>', cgi.escape('%>'))