[IMP] website_twitter: de-traw-ify

Not tested. I probably really need to add that replace() override

addons/website_twitter/static/src/js/website.twitter.animation.js

@@ -2,6 +2,7 @@ odoo.define('website_twitter.animation', function (require) {
 'use strict';
 
 var core = require('web.core');
+const {Markup} = require('web.utils');
 var publicWidget = require('web.public.widget');
 
 var qweb = core.qweb;
@@ -47,7 +48,7 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                 }
 
                 // Parse tweet text
-                tweet.text = tweet.text
+                tweet.text = Markup(_.escape(tweet.text)
                     .replace(
                         /[A-Za-z]+:\/\/[A-Za-z0-9-_]+\.[A-Za-z0-9-_:%&~\?\/.=]+/g,
                         function (url) {
@@ -65,18 +66,12 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                         function (hashtag) {
                             return _makeLink('http://twitter.com/search?q='+hashtag.replace('#',''), hashtag);
                         }
-                    );
+                    ));
 
                 return qweb.render('website.Twitter.Tweet', {tweet: tweet});
 
                 function _makeLink(url, text) {
-                    var c = $('<a/>', {
-                        text: text,
-                        href: url,
-                        target: '_blank',
-                        rel: 'noreferrer noopener',
-                    });
-                    return c.prop('outerHTML');
+                    return Markup`<a href="${url}" target="_blank" rel="noreferrer noopener">${text}</a>`;
                 }
             });
 

addons/website_twitter/static/src/xml/website.twitter.xml

@@ -16,7 +16,7 @@
                     <a class="date" target="_blank" t-attf-href="http://twitter.com/#{tweet.user.screen_name}/status/#{tweet.id_str}"><t t-esc="tweet.created_at"/></a>
                 </div>
                 <div class="bottom">
-                    <p><t t-raw="tweet.text"/></p>
+                    <p><t t-out="tweet.text"/></p>
                 </div>
             </div>
         </div>