[FIX] web: quotes and backslashes in search view

The commit 6d3ada178f7caf6ea159b871648ca4c440c7845b
aimed to solve problems occuring whith (single or
double) quotes when creating new custom filters.
Unfortunately, the point was missed and bugs were
still present. The present commit solves the
orginial problem satisfactorily.
There was also a problem in the management of
backslashes. Type '\\' in the search bar would
lead to a domain like
[('...', 'ilike', '\\\\\\\\\\\\\\\\')].
This has also been fixed. Note that it is
necessary to input "\\" if one is looking for a
backslash in db (as before).

A remark on the _formatAST function (py_utils.js):

We deescape only the chars `'`, `"`, and `\`
because it does not seem possible to produce a
string in the search view that would intend a
search for a line return or a tab for example.

A general remark:

Domains should always be in normalized form.
In that way they could be manipulated and combined
together without a tokenization/parsing!

closes odoo/odoo#29756

5 files changed, 67 insertions, 36 deletions

diff --git a/addons/web/static/tests/chrome/action_manager_tests.js b/addons/web/static/tests/chrome/action_manager_tests.js
index 291084402a9..4b8a3a79751 100644
--- a/addons/web/static/tests/chrome/action_manager_tests.js
+++ b/addons/web/static/tests/chrome/action_manager_tests.js
@@ -3133,7 +3133,7 @@ QUnit.module('ActionManager', {
             intercepts: {
                 create_filter: function (event) {
                     var filter = event.data.filter;
-                    assert.deepEqual(filter.domain, "[('bar', '=', 1)]",
+                    assert.deepEqual(filter.domain, `[("bar", "=", 1)]`,
                         "should save the correct domain");
                     assert.deepEqual(filter.context, {shouldBeInFilterContext: true},
                         "should save the correct context");
diff --git a/addons/web/static/tests/core/py_utils_tests.js b/addons/web/static/tests/core/py_utils_tests.js
index be5760fc6c7..fba8017cf01 100644
--- a/addons/web/static/tests/core/py_utils_tests.js
+++ b/addons/web/static/tests/core/py_utils_tests.js
@@ -1149,7 +1149,7 @@ QUnit.module('core', function () {
         assert.checkAST("1.4", "float value");
         assert.checkAST("-12", "negative integer value");
         assert.checkAST("True", "boolean");
-        assert.checkAST("'some string'", "a string");
+        assert.checkAST(`"some string"`, "a string");
         assert.checkAST("None", "None");
     });
 
@@ -1157,8 +1157,8 @@ QUnit.module('core', function () {
         assert.expect(3);
 
         assert.checkAST("{}", "empty dictionary");
-        assert.checkAST("{'a': 1}", "dictionary with a single key");
-        assert.checkAST("d['a']", "get a value in a dictionary");
+        assert.checkAST(`{"a": 1}`, "dictionary with a single key");
+        assert.checkAST(`d["a"]`, "get a value in a dictionary");
     });
 
     QUnit.test("list", function (assert) {
@@ -1225,14 +1225,14 @@ QUnit.module('core', function () {
 
     QUnit.test("strftime", function (assert) {
         assert.expect(3);
-        assert.checkAST("time.strftime('%Y')", "strftime with year");
-        assert.checkAST("time.strftime('%Y') + '-01-30'", "strftime with year");
-        assert.checkAST("time.strftime('%Y-%m-%d %H:%M:%S')", "strftime with year");
+        assert.checkAST(`time.strftime("%Y")`, "strftime with year");
+        assert.checkAST(`time.strftime("%Y") + "-01-30"`, "strftime with year");
+        assert.checkAST(`time.strftime("%Y-%m-%d %H:%M:%S")`, "strftime with year");
     });
 
     QUnit.test("context_today", function (assert) {
         assert.expect(1);
-        assert.checkAST("context_today().strftime('%Y-%m-%d')", "context today call");
+        assert.checkAST(`context_today().strftime("%Y-%m-%d")`, "context today call");
     });
 
 
@@ -1250,17 +1250,10 @@ QUnit.module('core', function () {
         assert.checkAST('(a - b).days', "substraction and .days");
         assert.checkAST('a + day == date(2002, 3, 3)');
 
-        var expr = "[('type', '=', 'in'), ('day', '<=', time.strftime('%Y-%m-%d')), ('day', '>', (context_today() - datetime.timedelta(days = 15)).strftime('%Y-%m-%d'))]";
+        var expr = `[("type", "=", "in"), ("day", "<=", time.strftime("%Y-%m-%d")), ("day", ">", (context_today() - datetime.timedelta(days = 15)).strftime("%Y-%m-%d"))]`;
         assert.checkAST(expr);
     });
 
-    QUnit.test("parse escaped quoted strings", function (assert) {
-        assert.expect(2);
-
-        assert.checkAST(`'\"'`, "a string containing \"");
-        assert.checkAST(`'\'`, "a string containing \'");
-    });
-
     QUnit.module('pyutils (_normalizeDomain)');
 
     QUnit.assert.checkNormalization = function (domain, normalizedDomain) {
@@ -1278,23 +1271,23 @@ QUnit.module('core', function () {
         assert.expect(3);
 
         assert.checkNormalization("[]");
-        assert.checkNormalization("[('a', '=', 1)]");
-        assert.checkNormalization("['!', ('a', '=', 1)]");
+        assert.checkNormalization(`[("a", "=", 1)]`);
+        assert.checkNormalization(`["!", ("a", "=", 1)]`);
     });
 
     QUnit.test("properly add the & in a non normalized domain", function (assert) {
         assert.expect(1);
         assert.checkNormalization(
-            "[('a', '=', 1), ('b', '=', 2)]",
-            "['&', ('a', '=', 1), ('b', '=', 2)]"
+            `[("a", "=", 1), ("b", "=", 2)]`,
+            `["&", ("a", "=", 1), ("b", "=", 2)]`
         );
     });
 
     QUnit.test("normalize domain with ! operator", function (assert) {
         assert.expect(1);
         assert.checkNormalization(
-            "['!', ('a', '=', 1), ('b', '=', 2)]",
-            "['&', '!', ('a', '=', 1), ('b', '=', 2)]"
+            `["!", ("a", "=", 1), ("b", "=", 2)]`,
+            `["&", "!", ("a", "=", 1), ("b", "=", 2)]`
         );
     });
 
diff --git a/addons/web/static/tests/views/search_filter_menu_tests.js b/addons/web/static/tests/views/search_filter_menu_tests.js
index e907d70111e..92d49cc23ae 100644
--- a/addons/web/static/tests/views/search_filter_menu_tests.js
+++ b/addons/web/static/tests/views/search_filter_menu_tests.js
@@ -1,9 +1,10 @@
 odoo.define('web.search_filters_menu_tests', function (require) {
 "use strict";
 
+var Domain = require('web.Domain');
 var FilterMenu = require('web.FilterMenu');
+var pyUtils = require('web.py_utils');
 var testUtils = require('web.test_utils');
-var Domain = require('web.Domain');
 
 function createFilterMenu(filters, fields, params) {
     params = params || {};
@@ -134,33 +135,70 @@ QUnit.module('FilterMenu', {
         filterMenu.destroy();
     });
 
-    QUnit.skip('commit search with an extended proposition with field char does not cause a crash', function (assert) {
-        assert.expect(0);
+    QUnit.test('commit search with an extended proposition with field char does not cause a crash', function (assert) {
+        assert.expect(6);
 
         this.fields = {many2one_field: {string: "Trululu", type: "many2one", relation: 'partner', selectable: true, searchable: true}};
 
+        var expectedDomains = [
+            [['many2one_field','ilike', `a`]],
+            [['many2one_field','ilike', `"a"`]],
+            [['many2one_field','ilike', `'a'`]],
+            [['many2one_field','ilike', `'`]],
+            [['many2one_field','ilike', `"`]],
+            [['many2one_field','ilike', `\\`]],
+        ];
+
         var filterMenu = createFilterMenu([], this.fields, {
             intercepts: {
                 new_filters: function (ev) {
                     var filter = ev.data.filters[0];
-                    Domain.prototype.stringToArray(filter.domain);
+                    // this step combine a tokenization/parsing followed by a string formatting
+                    var domain = pyUtils.assembleDomains([filter.domain]);
+                    domain = Domain.prototype.stringToArray(domain);
+                    assert.deepEqual(domain, expectedDomains.shift());
                 },
             }
         });
 
-        // open menu dropdown and custom filter submenu, select trululu field and enter string "a", then click apply
+        // open menu dropdown and custom filter submenu, select trululu field and enter string `a`, then click apply
         testUtils.dom.click(filterMenu.$('span.fa-filter'));
         testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
         testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
-        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), "a");
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `a`);
+        testUtils.dom.click(filterMenu.$('.o_apply_filter'));
+
+
+        // open custom filter submenu, select trululu field and enter string `"a"`, then click apply
+        testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
+        testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"a"`);
+        testUtils.dom.click(filterMenu.$('.o_apply_filter'));
+
+        // open custom filter submenu, select trululu field and enter string `'a'`, then click apply
+        testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
+        testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'a'`);
         testUtils.dom.click(filterMenu.$('.o_apply_filter'));
 
+        // open custom filter submenu, select trululu field and enter string `'`, then click apply
+        testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
+        testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `'`);
+        testUtils.dom.click(filterMenu.$('.o_apply_filter'));
 
-        // open custom filter submenu, select trululu field and enter string "'a'", then click apply
+        // open custom filter submenu, select trululu field and enter string `"`, then click apply
         testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
         testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
-        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), '"a"');
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `"`);
         testUtils.dom.click(filterMenu.$('.o_apply_filter'));
+
+        // open custom filter submenu, select trululu field and enter string `\`, then click apply
+        testUtils.dom.click(filterMenu.$('.o_add_custom_filter'));
+        testUtils.fields.editSelect(filterMenu.$('.o_filter_condition select.o_input.o_searchview_extended_prop_field'), 'many2one_field');
+        testUtils.fields.editInput(filterMenu.$('.o_filter_condition .o_searchview_extended_prop_value input'), `\\`);
+        testUtils.dom.click(filterMenu.$('.o_apply_filter'));
+
         filterMenu.destroy();
     });
 });
diff --git a/addons/web/static/tests/views/search_view_tests.js b/addons/web/static/tests/views/search_view_tests.js
index 53f02f9e6cc..aafe0cbe89d 100644
--- a/addons/web/static/tests/views/search_view_tests.js
+++ b/addons/web/static/tests/views/search_view_tests.js
@@ -747,10 +747,10 @@ QUnit.module('Search View', {
                 create_filter: function (ev) {
                     assert.equal(
                         ev.data.filter.domain,
-                        "['&', " +
-                        "('date_field', '>=', (context_today() + relativedelta()).strftime('%Y-%m-%d')), " +
-                        "('date_field', '<', (context_today() + relativedelta(days = 1)).strftime('%Y-%m-%d'))"+
-                        "]");
+                        `["&", ` +
+                        `("date_field", ">=", (context_today() + relativedelta()).strftime("%Y-%m-%d")), ` +
+                        `("date_field", "<", (context_today() + relativedelta(days = 1)).strftime("%Y-%m-%d"))`+
+                        `]`);
                 },
             },
         });
@@ -838,7 +838,7 @@ QUnit.module('Search View', {
             data: this.data,
             intercepts: {
                 create_filter: function (ev) {
-                    assert.ok(ev.data.filter.domain === "[['foo', 'ilike', 'a']]");
+                    assert.ok(ev.data.filter.domain === `[["foo", "ilike", "a"]]`);
                 },
             },
         });
diff --git a/addons/web/static/tests/views/view_dialogs_tests.js b/addons/web/static/tests/views/view_dialogs_tests.js
index 1df70b03acc..27275e7fd80 100644
--- a/addons/web/static/tests/views/view_dialogs_tests.js
+++ b/addons/web/static/tests/views/view_dialogs_tests.js
@@ -443,7 +443,7 @@ QUnit.module('Views', {
             intercepts: {
                 create_filter: function (event) {
                     var filter = event.data.filter;
-                    assert.deepEqual(filter.domain, "[('bar', '=', True)]",
+                    assert.deepEqual(filter.domain, `[("bar", "=", True)]`,
                         "should save the correct domain");
                     assert.deepEqual(filter.context, {shouldBeInFilterContext: true},
                         "should save the correct context");