[FIX] web, *: review Bootstrap tooltip/popover sanitization

* website_sale_comparison

The Bootstrap sanitization introduced with BS 4.3.1 was disabled with
https://github.com/odoo/odoo/commit/36caf5fc16b5a95a0bf37f08f0caf974683b2df6
https://github.com/odoo/odoo/commit/ee94decd30c4514d5bc410b1652bc6464bb600aa

This commit re-enables it by default but extends it to accept more
common tag names like tables and buttons. If a specific tooltip or
popover must accept custom tags or attributes (such as data-* attributes
required by a related JS), they must be supplied through the whitelist
BS parameter explicitely (see example with website_sale_comparison in
this commit).

Note: data-oe-* attributes are also whiteListed by default.

We cannot disable sanitization because bootstrap uses tooltip/popover
DOM attributes in an "unsafe" way.

closes odoo/odoo#37631

Signed-off-by: Olivier Dony (odo) <odo@openerp.com>

1 files changed, 61 insertions, 4 deletions

diff --git a/addons/web/static/src/js/libs/bootstrap.js b/addons/web/static/src/js/libs/bootstrap.js
index b91728b22d1..8f200794fa8 100644
--- a/addons/web/static/src/js/libs/bootstrap.js
+++ b/addons/web/static/src/js/libs/bootstrap.js
@@ -6,11 +6,68 @@ odoo.define('web.bootstrap.extensions', function () {
  * patching in place.
  */
 
+/**
+ * Review Bootstrap Sanitization: leave it enabled by default but extend it to
+ * accept more common tag names like tables and buttons, and common attributes
+ * such as style or data-. If a specific tooltip or popover must accept custom
+ * tags or attributes, they must be supplied through the whitelist BS
+ * parameter explicitely.
+ *
+ * We cannot disable sanitization because bootstrap uses tooltip/popover
+ * DOM attributes in an "unsafe" way.
+ */
+var bsSanitizeWhiteList = $.fn.tooltip.Constructor.Default.whiteList;
+
+bsSanitizeWhiteList['*'].push('title', 'style', /^data-[\w-]+/);
+
+bsSanitizeWhiteList.header = [];
+bsSanitizeWhiteList.main = [];
+bsSanitizeWhiteList.footer = [];
+
+bsSanitizeWhiteList.caption = [];
+bsSanitizeWhiteList.col = ['span'];
+bsSanitizeWhiteList.colgroup = ['span'];
+bsSanitizeWhiteList.table = [];
+bsSanitizeWhiteList.thead = [];
+bsSanitizeWhiteList.tbody = [];
+bsSanitizeWhiteList.tfooter = [];
+bsSanitizeWhiteList.tr = [];
+bsSanitizeWhiteList.th = ['colspan', 'rowspan'];
+bsSanitizeWhiteList.td = ['colspan', 'rowspan'];
+
+bsSanitizeWhiteList.address = [];
+bsSanitizeWhiteList.article = [];
+bsSanitizeWhiteList.aside = [];
+bsSanitizeWhiteList.blockquote = [];
+bsSanitizeWhiteList.section = [];
+
+bsSanitizeWhiteList.button = ['type'];
+bsSanitizeWhiteList.del = [];
+
+/**
+ * Returns an extended version of bootstrap default whitelist for sanitization,
+ * i.e. a version where, for each key, the original value is concatened with the
+ * received version's value and where the received version's extra key/values
+ * are added.
+ *
+ * Note: the returned version
+ *
+ * @param {Object} extensions
+ * @returns {Object} /!\ the returned whitelist is made from a *shallow* copy of
+ *      the default whitelist, extended with given whitelist.
+ */
+function makeExtendedSanitizeWhiteList(extensions) {
+    var whiteList = _.clone($.fn.tooltip.Constructor.Default.whiteList);
+    Object.keys(extensions).forEach(key => {
+        whiteList[key] = (whiteList[key] || []).concat(extensions[key]);
+    });
+    return whiteList;
+}
+
 /* Bootstrap tooltip defaults overwrite */
 $.fn.tooltip.Constructor.Default.placement = 'auto';
 $.fn.tooltip.Constructor.Default.fallbackPlacement = ['bottom', 'right', 'left', 'top'];
 $.fn.tooltip.Constructor.Default.html = true;
-$.fn.tooltip.Constructor.Default.sanitize = false;
 $.fn.tooltip.Constructor.Default.trigger = 'hover';
 $.fn.tooltip.Constructor.Default.container = 'body';
 $.fn.tooltip.Constructor.Default.boundary = 'window';
@@ -25,7 +82,7 @@ $.fn.tooltip.Constructor.prototype.show = function () {
     return bootstrapShowFunction.call(this);
 };
 
-/* Bootstrap popover defaults overwrite */
-$.fn.popover.Constructor.Default.sanitize = false;
-
+return {
+    makeExtendedSanitizeWhiteList: makeExtendedSanitizeWhiteList,
+};
 });