From 3906c7eee12ba375b4a4b2050f6d7d1b4eae5797 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A9ry=20Debongnie?= <ged@odoo.com>
Date: Mon, 28 Jan 2019 11:55:05 +0100
Subject: [PATCH] add note on qweb template safety

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index eafdbac6..761d5b5b 100644
--- a/README.md
+++ b/README.md
@@ -167,6 +167,10 @@ We have 3 main folders and 3 main files:
 - **Qweb**
 
   - check qweb tests and see if it is reasonable (escaping? safety/security?)
+  - Expression evaluation: make sure we cannot inject JS in template function.
+    For example, a t-props directive such as t-props="state.someValueFromServer"
+    where the value would be something such as `"};console.log('Owned': context.env.actionManager.doAction('fuck you'))`
+
   - remove the "if (${exprID} || ${exprID} === 0) {"
   - need to implement t-extend (?)
   - improve qweb generated code: do not assign object/array if no props/attrs/children