# -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. import collections import json import os.path import re from lxml import etree, html from lxml.builder import E from odoo.modules import get_module_resource from odoo.tests.common import TransactionCase from odoo.addons.base.models.qweb import QWebException from odoo.tools import misc, mute_logger class TestQWebTField(TransactionCase): def setUp(self): super(TestQWebTField, self).setUp() self.env_branding = self.env(context={'inherit_branding': True}) self.engine = self.env_branding['ir.qweb'] def test_trivial(self): field = etree.Element('span', {'t-field': u'company.name'}) company = self.env['res.company'].create({'name': "My Test Company"}) result = self.engine._render(field, {'company': company}) self.assertEqual( etree.fromstring(result), etree.fromstring(u'%s' % ( company.id, u"My Test Company", )), ) def test_i18n(self): field = etree.Element('span', {'t-field': u'company.name'}) s = u"Testing «ταБЬℓσ»: 1<2 & 4+1>3, now 20% off!" company = self.env['res.company'].create({'name': s}) result = self.engine._render(field, {'company': company}) self.assertEqual( etree.fromstring(result), etree.fromstring(u'%s' % ( company.id, misc.html_escape(s), )), ) def test_reject_crummy_tags(self): field = etree.Element('td', {'t-field': u'company.name'}) with self.assertRaisesRegex(QWebException, r'^RTE widgets do not work correctly'): self.engine._render(field, {'company': None}) def test_reject_t_tag(self): field = etree.Element('t', {'t-field': u'company.name'}) with self.assertRaisesRegex(QWebException, r'^t-field can not be used on a t element'): self.engine._render(field, {'company': None}) def test_render_t_options(self): view1 = self.env['ir.ui.view'].create({ 'name': "dummy", 'type': 'qweb', 'arch': u""" """ }) text = etree.fromstring(view1._render()).find('span').text self.assertEqual(text, u'5.0000') def test_xss_breakout(self): view = self.env['ir.ui.view'].create({ 'name': 'dummy', 'type': 'qweb', 'arch': u""" """ }) rendered = view._render({'malicious': '1