[FIX] mail: replace <br/> by space in thread preview

task-2284905

closes odoo/odoo#53718

X-original-commit: 80504fabd43832c5495ded3afc4b364c71d3df70
Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>

4 files changed, 122 insertions, 10 deletions

diff --git a/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js b/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js
index abf13f541f4..359bbe52768 100644
--- a/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js
+++ b/addons/mail/static/src/components/messaging_menu/messaging_menu_tests.js
@@ -797,27 +797,26 @@ QUnit.test('no code injection in message body preview', async function (assert)
     Object.assign(this.data.initMessaging, {
         channel_slots: {
             channel_channel: [{
-                channel_type: "channel",
+                channel_type: 'channel',
                 id: 1,
                 is_pinned: true,
                 name: "General",
             }],
         },
     });
-
     this.data['mail.channel'].records = [{
-        id: 1,
-        name: "general",
-        channel_type: "channel",
         channel_message_ids: [1],
+        channel_type: 'channel',
+        id: 1,
+        is_pinned: true,
+        name: "General",
     }];
     this.data['mail.message'].records = [{
-        id: 1,
-        author_id: [1, 'Georges'],
+        author_id: [1, "Georges"],
         body: "<p><em>&shoulnotberaised</em><script>throw new Error('CodeInjectionError');</script></p>",
         channel_ids: [1],
+        id: 1,
     }];
-
     await this.start();
 
     await afterNextRender(() => {
@@ -851,6 +850,118 @@ QUnit.test('no code injection in message body preview', async function (assert)
     );
 });
 
+QUnit.test('no code injection in message body preview from sanitized message', async function (assert) {
+    assert.expect(5);
+
+    Object.assign(this.data.initMessaging, {
+        channel_slots: {
+            channel_channel: [{
+                channel_type: 'channel',
+                id: 1,
+                is_pinned: true,
+                name: "General",
+            }],
+        },
+    });
+    this.data['mail.channel'].records = [{
+        channel_message_ids: [1],
+        channel_type: 'channel',
+        id: 1,
+        is_pinned: true,
+        name: "General",
+    }];
+    this.data['mail.message'].records = [{
+        author_id: [1, "Georges"],
+        body: "<p>&lt;em&gt;&shoulnotberaised&lt;/em&gt;&lt;script&gt;throw new Error('CodeInjectionError');&lt;/script&gt;</p>",
+        channel_ids: [1],
+        id: 1,
+    }];
+    await this.start();
+
+    await afterNextRender(() => {
+        document.querySelector(`.o_MessagingMenu_toggler`).click();
+    });
+    assert.containsOnce(
+        document.body,
+        '.o_MessagingMenu_dropdownMenu .o_ThreadPreview',
+        "should display a preview",
+    );
+    assert.containsOnce(
+        document.body,
+        '.o_ThreadPreview_core',
+        "preview should have core in content",
+    );
+    assert.containsOnce(
+        document.body,
+        '.o_ThreadPreview_inlineText',
+        "preview should have inline text in core of content",
+    );
+    assert.strictEqual(
+        document.querySelector('.o_ThreadPreview_inlineText')
+            .textContent.replace(/\s/g, ""),
+        "Georges:<em>&shoulnotberaised</em><script>thrownewError('CodeInjectionError');</script>",
+        "should display correct uninjected last message inline content"
+    );
+    assert.containsNone(
+        document.querySelector('.o_ThreadPreview_inlineText'),
+        'script',
+        "last message inline content should not have any code injection"
+    );
+});
+
+QUnit.test('<br/> tags in message body preview are transformed in spaces', async function (assert) {
+    assert.expect(4);
+
+    Object.assign(this.data.initMessaging, {
+        channel_slots: {
+            channel_channel: [{
+                channel_type: 'channel',
+                id: 1,
+                is_pinned: true,
+                name: "General",
+            }],
+        },
+    });
+    this.data['mail.channel'].records = [{
+        channel_message_ids: [1],
+        channel_type: 'channel',
+        id: 1,
+        is_pinned: true,
+        name: "general",
+    }];
+    this.data['mail.message'].records = [{
+        author_id: [1, "Georges"],
+        body: "<p>a<br/>b<br>c<br   />d<br     ></p>",
+        channel_ids: [1],
+        id: 1,
+    }];
+    await this.start();
+
+    await afterNextRender(() => {
+        document.querySelector(`.o_MessagingMenu_toggler`).click();
+    });
+    assert.containsOnce(
+        document.body,
+        '.o_MessagingMenu_dropdownMenu .o_ThreadPreview',
+        "should display a preview",
+    );
+    assert.containsOnce(
+        document.body,
+        '.o_ThreadPreview_core',
+        "preview should have core in content",
+    );
+    assert.containsOnce(
+        document.body,
+        '.o_ThreadPreview_inlineText',
+        "preview should have inline text in core of content",
+    );
+    assert.strictEqual(
+        document.querySelector('.o_ThreadPreview_inlineText').textContent,
+        "Georges: a b c d",
+        "should display correct last message inline content with brs replaced by spaces"
+    );
+});
+
 });
 });
 });
diff --git a/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml b/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml
index ebdab785bba..b6a5c896174 100644
--- a/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml
+++ b/addons/mail/static/src/components/thread_needaction_preview/thread_needaction_preview.xml
@@ -45,7 +45,7 @@
                                     threadLocalId="thread.localId"
                                 />
                             </t>
-                            <t t-raw="inlineLastNeedactionMessageBody"/>
+                            <t t-esc="inlineLastNeedactionMessageBody"/>
                         </span>
                         <span class="o-autogrow"/>
                         <span class="o_ThreadNeedactionPreview_coreItem o_ThreadNeedactionPreview_markAsRead fa fa-check" title="Mark as Read" t-on-click="_onClickMarkAsRead" t-ref="markAsRead"/>
diff --git a/addons/mail/static/src/components/thread_preview/thread_preview.xml b/addons/mail/static/src/components/thread_preview/thread_preview.xml
index 8b067a5ae6f..da364d4f99d 100644
--- a/addons/mail/static/src/components/thread_preview/thread_preview.xml
+++ b/addons/mail/static/src/components/thread_preview/thread_preview.xml
@@ -48,7 +48,7 @@
                                     threadLocalId="thread.localId"
                                 />
                             </t>
-                            <t t-raw="inlineLastMessageBody"/>
+                            <t t-esc="inlineLastMessageBody"/>
                         </span>
                         <span class="o-autogrow"/>
                         <t t-if="thread.message_unread_counter > 0">
diff --git a/addons/mail/static/src/js/utils.js b/addons/mail/static/src/js/utils.js
index d54f5932619..bbb9a535716 100644
--- a/addons/mail/static/src/js/utils.js
+++ b/addons/mail/static/src/js/utils.js
@@ -95,6 +95,7 @@ function htmlToTextContentInline(htmlString) {
     const fragment = document.createDocumentFragment();
     const div = document.createElement('div');
     fragment.appendChild(div);
+    htmlString = htmlString.replace(/<br\s*\/?>/gi,' ');
     try {
         div.innerHTML = htmlString;
     } catch (e) {