[FIX] web: quotes and backslashes in search view

The commit 6d3ada1
aimed to solve problems occuring whith (single or
double) quotes when creating new custom filters.
Unfortunately, the point was missed and bugs were
still present. The present commit solves the
orginial problem satisfactorily.
There was also a problem in the management of
backslashes. Type '\\' in the search bar would
lead to a domain like
[('...', 'ilike', '\\\\\\\\\\\\\\\\')].
This has also been fixed. Note that it is
necessary to input "\\" if one is looking for a
backslash in db (as before).

A remark on the _formatAST function (py_utils.js):

We deescape only the chars `'`, `"`, and `\`
because it does not seem possible to produce a
string in the search view that would intend a
search for a line return or a tab for example.

A general remark:

Domains should always be in normalized form.
In that way they could be manipulated and combined
together without a tokenization/parsing!

closes odoo/odoo#31025

1 files changed, 9 insertions, 1 deletions

diff --git a/addons/web/static/src/js/core/py_utils.js b/addons/web/static/src/js/core/py_utils.js
index 9bcd66864e5..296ab5c3089 100644
--- a/addons/web/static/src/js/core/py_utils.js
+++ b/addons/web/static/src/js/core/py_utils.js
@@ -415,7 +415,15 @@ function _formatAST(ast, lbp) {
         case "(number)":
             return String(ast.value);
         case "(string)":
-            return "'" + ast.value + "'";
+            // ast.value is a string that may contain a mix of single and double quotes.
+            // But we need to return a string that represents the string ast.value.
+            // We use for that JSON.stringify. It will return a string with quotes correctly
+            // escaped. For instance, for x = `""` JSON.stringify(x) is `"\"\""`.
+            // But this means that if we pass several times here, escapes will be
+            // done again and again, leading to a profusion of backslashes that we don't want.
+            // For fun consider y = `\\` and y = JSON.stringify(y).
+            // This is why we first deescape particular characters in ast.value.
+            return JSON.stringify(ast.value.replace(/(\\(['"\\]))/g,"\$2"));
         case "(constant)":
             return ast.value;
         case "(name)":