From 8ec7a6f9bf32b21ff3b57180ebf9f3bc9a233bfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?G=C3=A9ry=20Debongnie?= <ged@odoo.com>
Date: Wed, 16 Feb 2022 17:05:10 +0100
Subject: [PATCH] [FIX] compiler: prevent block- attributes and tags

---
 doc/reference/templates.md       | 11 +++++++++++
 src/compiler/parser.ts           |  5 +++++
 tests/compiler/blacklist.test.ts | 13 +++++++++++++
 3 files changed, 29 insertions(+)
 create mode 100644 tests/compiler/blacklist.test.ts

diff --git a/doc/reference/templates.md b/doc/reference/templates.md
index 91c62dfe..a2f400c3 100644
--- a/doc/reference/templates.md
+++ b/doc/reference/templates.md
@@ -21,6 +21,7 @@
 - [Fragments](#fragments)
 - [Inline templates](#inline-templates)
 - [Rendering svg](#rendering-svg)
+- [Restrictions](#restrictions)
 
 ## Overview
 
@@ -680,3 +681,13 @@ if a template is supposed to be included in a svg namespace or not. Therefore,
 Owl depends on a heuristic: if a tag is either `svg`, `g` or `path`, then it will
 be considered as svg. In practice, this means that each component or each sub
 templates (included with `t-call`) should have one of these tag as root tag.
+
+## Restrictions
+
+Note that Owl templates forbid the use of tag and or attributes starting with
+the `block-` string. This restriction prevents name collision with the internal
+code of Owl.
+
+```xml
+<div><block-1>this will not be accepted by Owl</block-1></div>
+```
diff --git a/src/compiler/parser.ts b/src/compiler/parser.ts
index 2f99c76a..385bb2d0 100644
--- a/src/compiler/parser.ts
+++ b/src/compiler/parser.ts
@@ -305,6 +305,9 @@ function parseDOMNode(node: Element, ctx: ParsingContext): AST | null {
   if (tagName === "t" && !dynamicTag) {
     return null;
   }
+  if (tagName.startsWith("block-")) {
+    throw new Error(`Invalid tag name: '${tagName}'`);
+  }
   ctx = Object.assign({}, ctx);
   if (tagName === "pre") {
     ctx.inPreTag = true;
@@ -371,6 +374,8 @@ function parseDOMNode(node: Element, ctx: ParsingContext): AST | null {
         ctx = Object.assign({}, ctx);
         ctx.tModelInfo = model;
       }
+    } else if (attr.startsWith("block-")) {
+      throw new Error(`Invalid attribute: '${attr}'`);
     } else if (attr !== "t-name") {
       if (attr.startsWith("t-") && !attr.startsWith("t-att")) {
         throw new Error(`Unknown QWeb directive: '${attr}'`);
diff --git a/tests/compiler/blacklist.test.ts b/tests/compiler/blacklist.test.ts
new file mode 100644
index 00000000..85daa0ee
--- /dev/null
+++ b/tests/compiler/blacklist.test.ts
@@ -0,0 +1,13 @@
+import { renderToString } from "../helpers";
+
+describe("blacklisted tags and attributes", () => {
+  test("template with block-text tag", () => {
+    const template = `<div><block-text-0/>hello</div>`;
+    expect(() => renderToString(template)).toThrow("Invalid tag name: 'block-text-0'");
+  });
+
+  test("template with block-handler tag", () => {
+    const template = `<div block-handler-0="click">hello</div>`;
+    expect(() => renderToString(template)).toThrow("Invalid attribute: 'block-handler-0'");
+  });
+});