[FIX] website: prevent animation of anchor links with invalid fragment

Also secure the anchor creation to only allow valid names, that is
letters, digits, underscores and hyphens.

task-1913458

closes odoo/odoo#30701

1 files changed, 7 insertions, 3 deletions

diff --git a/addons/website/static/src/js/editor/snippets.options.js b/addons/website/static/src/js/editor/snippets.options.js
index 9f25a4d15b9..f51dda964db 100644
--- a/addons/website/static/src/js/editor/snippets.options.js
+++ b/addons/website/static/src/js/editor/snippets.options.js
@@ -1502,9 +1502,13 @@ options.registry.anchorName = options.Class.extend({
                     click: function () {
                         var $input = this.$('.o_input_anchor_name');
                         var anchorName = $input.val().trim().replace(/\s/g, '_');
-                        var alreadyExists = $('#' + anchorName).length > 0;
-                        $input.toggleClass('is-invalid', alreadyExists);
-                        if (!alreadyExists) {
+                        var isValid = /^[\w-]+$/.test(anchorName);
+                        var alreadyExists = isValid && $('#' + anchorName).length > 0;
+                        var anchorOK = isValid && !alreadyExists;
+                        this.$('.o_anchor_not_valid').toggleClass('d-none', isValid);
+                        this.$('.o_anchor_already_exists').toggleClass('d-none', !alreadyExists);
+                        $input.toggleClass('is-invalid', !anchorOK);
+                        if (anchorOK) {
                             self._setAnchorName(anchorName);
                             this.close();
                         }