From 2894d74db95888af50e82db0e320660fef9b086a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A9ry=20Debongnie?= <ged@odoo.com>
Date: Fri, 25 Jan 2019 09:24:21 +0100
Subject: [PATCH] prevent directives from polluting rendering context

---
 web/static/src/ts/core/qweb_vdom.ts |  3 +++
 web/static/tests/qweb_vdom.test.ts  | 13 +++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/web/static/src/ts/core/qweb_vdom.ts b/web/static/src/ts/core/qweb_vdom.ts
index eb5f985d..d6637194 100644
--- a/web/static/src/ts/core/qweb_vdom.ts
+++ b/web/static/src/ts/core/qweb_vdom.ts
@@ -192,6 +192,9 @@ export class QWeb {
 
     const doc = this.parsedTemplates[name];
     const ctx = new Context();
+    // this is necessary to prevent some directives (t-forach for ex) to
+    // pollute the rendering context by adding some keys in it.
+    ctx.addLine("context = Object.create(context)");
     const mainNode = doc.firstChild!;
     this._compileNode(mainNode, ctx);
 
diff --git a/web/static/tests/qweb_vdom.test.ts b/web/static/tests/qweb_vdom.test.ts
index d19dc9f1..839dc66c 100644
--- a/web/static/tests/qweb_vdom.test.ts
+++ b/web/static/tests/qweb_vdom.test.ts
@@ -566,6 +566,19 @@ describe("foreach", () => {
     const expected = `<div>[0:a1-even][1:b2-odd][2:c3-even]</div>`;
     expect(result).toBe(expected);
   });
+
+  test("does not pollute the rendering context", () => {
+    const qweb = new QWeb();
+    qweb.addTemplate(
+      "test",
+      `<div>
+        <t t-foreach="[1]" t-as="item"><t t-esc="item"/></t>
+      </div>`
+    );
+    const context = {};
+    renderToString(qweb, "test", context);
+    expect(Object.keys(context).length).toBe(0);
+  });
 });
 
 describe("misc", () => {