From f7b1d02c16683d062a8a1349eae2f4b8ffbc55ea Mon Sep 17 00:00:00 2001
From: Xavier Morel <xmo@odoo.com>
Date: Wed, 30 Jun 2021 13:46:19 +0000
Subject: [PATCH] [IMP] website_twitter: de-traw-ify

Not tested. I probably really need to add that replace() override
---
 .../static/src/js/website.twitter.animation.js      | 13 ++++---------
 .../static/src/xml/website.twitter.xml              |  2 +-
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/addons/website_twitter/static/src/js/website.twitter.animation.js b/addons/website_twitter/static/src/js/website.twitter.animation.js
index 295ae199868..f511e6a07eb 100644
--- a/addons/website_twitter/static/src/js/website.twitter.animation.js
+++ b/addons/website_twitter/static/src/js/website.twitter.animation.js
@@ -2,6 +2,7 @@ odoo.define('website_twitter.animation', function (require) {
 'use strict';
 
 var core = require('web.core');
+const {Markup} = require('web.utils');
 var publicWidget = require('web.public.widget');
 
 var qweb = core.qweb;
@@ -47,7 +48,7 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                 }
 
                 // Parse tweet text
-                tweet.text = tweet.text
+                tweet.text = Markup(_.escape(tweet.text)
                     .replace(
                         /[A-Za-z]+:\/\/[A-Za-z0-9-_]+\.[A-Za-z0-9-_:%&~\?\/.=]+/g,
                         function (url) {
@@ -65,18 +66,12 @@ publicWidget.registry.twitter = publicWidget.Widget.extend({
                         function (hashtag) {
                             return _makeLink('http://twitter.com/search?q='+hashtag.replace('#',''), hashtag);
                         }
-                    );
+                    ));
 
                 return qweb.render('website.Twitter.Tweet', {tweet: tweet});
 
                 function _makeLink(url, text) {
-                    var c = $('<a/>', {
-                        text: text,
-                        href: url,
-                        target: '_blank',
-                        rel: 'noreferrer noopener',
-                    });
-                    return c.prop('outerHTML');
+                    return Markup`<a href="${url}" target="_blank" rel="noreferrer noopener">${text}</a>`;
                 }
             });
 
diff --git a/addons/website_twitter/static/src/xml/website.twitter.xml b/addons/website_twitter/static/src/xml/website.twitter.xml
index e6ceb3ccb98..e4c96fdbaa9 100644
--- a/addons/website_twitter/static/src/xml/website.twitter.xml
+++ b/addons/website_twitter/static/src/xml/website.twitter.xml
@@ -16,7 +16,7 @@
                     <a class="date" target="_blank" t-attf-href="http://twitter.com/#{tweet.user.screen_name}/status/#{tweet.id_str}"><t t-esc="tweet.created_at"/></a>
                 </div>
                 <div class="bottom">
-                    <p><t t-raw="tweet.text"/></p>
+                    <p><t t-out="tweet.text"/></p>
                 </div>
             </div>
         </div>