# -*- coding: utf-8 -*-
# Part of Odoo. See LICENSE file for full copyright and licensing details.
import collections
import json
import os.path
import re
from lxml import etree, html
from lxml.builder import E
from odoo.modules import get_module_resource
from odoo.tests.common import TransactionCase
from odoo.addons.base.models.qweb import QWebException
from odoo.tools import misc, mute_logger
class TestQWebTField(TransactionCase):
def setUp(self):
super(TestQWebTField, self).setUp()
self.env_branding = self.env(context={'inherit_branding': True})
self.engine = self.env_branding['ir.qweb']
def test_trivial(self):
field = etree.Element('span', {'t-field': u'company.name'})
company = self.env['res.company'].create({'name': "My Test Company"})
result = self.engine._render(field, {'company': company})
self.assertEqual(
etree.fromstring(result),
etree.fromstring(u'%s' % (
company.id,
u"My Test Company",
)),
)
def test_i18n(self):
field = etree.Element('span', {'t-field': u'company.name'})
s = u"Testing «ταБЬℓσ»: 1<2 & 4+1>3, now 20% off!"
company = self.env['res.company'].create({'name': s})
result = self.engine._render(field, {'company': company})
self.assertEqual(
etree.fromstring(result),
etree.fromstring(u'%s' % (
company.id,
misc.html_escape(s),
)),
)
def test_reject_crummy_tags(self):
field = etree.Element('td', {'t-field': u'company.name'})
with self.assertRaisesRegex(QWebException, r'^RTE widgets do not work correctly'):
self.engine._render(field, {'company': None})
def test_reject_t_tag(self):
field = etree.Element('t', {'t-field': u'company.name'})
with self.assertRaisesRegex(QWebException, r'^t-field can not be used on a t element'):
self.engine._render(field, {'company': None})
def test_render_t_options(self):
view1 = self.env['ir.ui.view'].create({
'name': "dummy",
'type': 'qweb',
'arch': u"""
"""
})
text = etree.fromstring(view1._render()).find('span').text
self.assertEqual(text, u'5.0000')
def test_xss_breakout(self):
view = self.env['ir.ui.view'].create({
'name': 'dummy', 'type': 'qweb',
'arch': u"""
"""
})
rendered = view._render({'malicious': '1