[FIX] website: prevent animation of anchor links with invalid fragment

Also secure the anchor creation to only allow valid names, that is
letters, digits, underscores and hyphens.

task-1913458

closes odoo/odoo#30701

1 files changed, 13 insertions, 6 deletions

diff --git a/addons/website/static/src/js/content/snippets.animation.js b/addons/website/static/src/js/content/snippets.animation.js
index 587cbca61d4..d2a653b0837 100644
--- a/addons/website/static/src/js/content/snippets.animation.js
+++ b/addons/website/static/src/js/content/snippets.animation.js
@@ -1094,14 +1094,21 @@ registry.anchorSlide = Animation.extend({
      * @private
      */
     _onAnimateClick: function (ev) {
-        var hash = ev.currentTarget.hash;
+        if (this.$target[0].pathname !== window.location.pathname) {
+            return;
+        }
+        var hash = this.$target[0].hash;
+        if (!/^#[\w-]+$/.test(hash)) {
+            return;
+        }
         var $anchor = $(hash);
-        if ($anchor.length && $anchor.attr('data-anchor') && this.$target[0].pathname === window.location.pathname) {
-            ev.preventDefault();
-            $('html, body').animate({
-                scrollTop: $anchor.offset().top,
-            }, 500);
+        if (!$anchor.length || !$anchor.attr('data-anchor')) {
+            return;
         }
+        ev.preventDefault();
+        $('html, body').animate({
+            scrollTop: $anchor.offset().top,
+        }, 500);
     },
 });