[FIX] account: fix regexp when partner name contains +

When the name of a partner contains a regular expression operator, such
as grouping parenthesis, +, *, brackets... the resulting regexp may
match wrong names or worse be invalid and lead to an exception.

With this commit, we create a regular expression from only the words
formed from at least 3 of [a-zA-Z0-9], ignoring all other characters,
including those who may have a meaning in a regular expression.

This avoids these issues:
- regexp injection (security issue)
- punctuation resulting in erroneous regular expression ("ABC + SPRL"
  resulted in "(?=.*ABC.*)(?=.*+.*)(?=.*SPRL.*)" which is invalid at
  the ".*+" part)
- false positives due to words that are too small (\b were added, and
  the minimal matching word size is 3)
- accentuation mismatch (both sides are filtered through unaccent)
- special cases in unicode that have a special behavior with lower().

See the discussion on odoo/odoo#63145 for a detailled explaination about
these issues.

OPW-2360687

Signed-off-by: wan <william-andre@users.noreply.github.com>

0 files changed, 0 insertions, 0 deletions