# -*- coding: utf-8 -*- # Part of Odoo. See LICENSE file for full copyright and licensing details. import collections import json import os.path import re import markupsafe from lxml import etree, html from lxml.builder import E from copy import deepcopy from textwrap import dedent from odoo.tests.common import TransactionCase from odoo.addons.base.models.ir_qweb import QWebException, render from odoo.tools import misc, mute_logger from odoo.tools.json import scriptsafe as json_scriptsafe from odoo.exceptions import UserError, ValidationError, MissingError unsafe_eval = eval class TestQWebTField(TransactionCase): def setUp(self): super(TestQWebTField, self).setUp() self.env_branding = self.env(context={'inherit_branding': True}) self.engine = self.env_branding['ir.qweb'] def test_trivial(self): field = etree.Element('span', {'t-field': 'company.name'}) company = self.env['res.company'].create({'name': "My Test Company"}) result = self.engine._render(field, {'company': company}) self.assertEqual( etree.fromstring(result), etree.fromstring('%s' % ( company.id, "My Test Company", )), ) def test_i18n(self): field = etree.Element('span', {'t-field': 'company.name'}) s = "Testing «ταБЬℓσ»: 1<2 & 4+1>3, now 20% off!" company = self.env['res.company'].create({'name': s}) result = self.engine._render(field, {'company': company}) self.assertEqual( etree.fromstring(result), etree.fromstring('%s' % ( company.id, misc.html_escape(s), )), ) def test_reject_crummy_tags(self): field = etree.Element('td', {'t-field': 'company.name'}) with self.assertRaisesRegex(QWebException, r'QWeb widgets do not work correctly'): self.engine._render(field, {'company': None}) def test_reject_t_tag(self): field = etree.Element('t', {'t-field': 'company.name'}) with self.assertRaisesRegex(QWebException, r't-field can not be used on a t element'): self.engine._render(field, {'company': None}) def test_render_t_options(self): view1 = self.env['ir.ui.view'].create({ 'name': "dummy", 'type': 'qweb', 'arch': """ """ }) text = etree.fromstring(self.env['ir.qweb']._render(view1.id)).find('span').text self.assertEqual(text, '5.0000') def test_xss_breakout(self): view = self.env['ir.ui.view'].create({ 'name': 'dummy', 'type': 'qweb', 'arch': """ """ }) rendered = self.env['ir.qweb']._render(view.id, {'malicious': '1