``` ```python # BAD: Unescaped user content QWeb.render('insecure_template', { 'info_message': user_provided_content, }) # GOOD: Separate structure from content QWeb.render('secure_template', { 'message': user_provided_content, }) ``` ### 5. Using Markup Safely ```python from markupsafe import Markup # GOOD: Structure is Markup, content is escaped message = Markup("

") % user_provided_content # GOOD: Use escape() to convert text to Markup from odoo.tools.misc import html_escape safe_content = html_escape(user_provided_content) message = Markup("

") % safe_content # BAD: f-strings insert before escaping # Markup(f"

{self.user_input}

") # WRONG! # GOOD: Use format() with Markup Markup("

{field}

").format(field=user_input) ``` ### 6. Evaluating Content ```python # VERY BAD: eval is dangerous domain = eval(self.filter_domain) self.search(domain) # BAD: safe_eval still powerful from odoo.tools import safe_eval domain = safe_eval(self.filter_domain) self.search(domain) # GOOD: Use literal_eval for parsing from ast import literal_eval domain = literal_eval(self.filter_domain) self.search(domain) ``` ### 7. Accessing Dynamic Attributes ```python # BAD: getattr can access private methods/attributes def _get_state(self, res_id, state_field): record = self.sudo().browse(res_id) return getattr(record, state_field) # Unsafe! # GOOD: Use __getitem__ which respects field access rules def _get_state(self, res_id, state_field): record = self.sudo().browse(res_id) return record[state_field] # Safe ``` ### 8. sudo() Overuse ```python # BAD: sudo() everywhere bypasses all security def action_archive(self): for record in self: record.sudo().write({'active': False}) # No checks! # GOOD: Use sudo() sparingly and only when needed def action_archive(self): # Archive as current user (ACL checked) self.write({'active': False}) # GOOD: Use sudo() to access related model for permission check def check_access(self): # Check if partner is accessible partner = self.partner_id.sudo() if not partner.check_access_rights('read'): raise AccessError("Cannot access partner") ``` ### 9. Missing Validation ```python # BAD: No validation on user input def update_from_form(self, values): self.write(values) # User could set any field! # GOOD: Validate and whitelist def update_from_form(self, values): allowed = {'name', 'date', 'notes'} updates = {k: v for k, v in values.items() if k in allowed} self.write(updates) ``` ### 10. Time-of-Check to Time-of-Use (TOCTOU) ```python # BAD: State changes between check and use def process_payment(self): if self.state != 'paid': # Check # ... time passes ... self.write({'state': 'processed'}) # Use (state might have changed) # GOOD: Use database constraints _state_constraint = sql_constraint( 'check_state_before_process', 'CHECK (state = ''paid'')', 'Can only process paid records' ) # Or use @api.constrains @api.constrains('state') def _check_state(self): for record in self: if record.state == 'processed' and record.state != 'paid': raise ValidationError("Must be paid to process") ``` --- ## Quick Reference ### Security Checklist | ☐ | Task | |---|------| | ☐ | Define user groups | | ☐ | Create ir.model.access.csv | | ☐ | Add ACL for each model | | ☐ | Create record rules for multi-company | | ☐ | Create record rules for own/all access | | ☐ | Test with different user roles | | ☐ | Test with portal/public users | | ☐ | Review public methods for security | | ☐ | Check for SQL injection risks | | ☐ | Check for XSS vulnerabilities | ### Common Security Patterns #### Own Records Only (Employee) ```python # Model user_id = fields.Many2one('res.users', default=lambda s: s.env.user) ``` ```xml access_model_user,model_my_model,base.group_user,1,0,0,0 [('user_id', '=', user.id)] ``` #### Managers See All ```xml [(1, '=', 1)] ``` #### Multi-Company ```python # Model company_id = fields.Many2one('res.company', default=lambda s: s.env.company) ``` ```xml ['|', ('company_id', '=', False), ('company_id', 'in', user.company_ids)] ``` ### Security Debugging ```python # Check current user's groups self.env.user.groups_id # All groups # Check specific group self.env.user.has_group('base.group_system') # Check access rights model.check_access_rights('read') model.check_access_rights('write', raise_exception=False) # Check record access record.check_access_rule('read') record.check_access_rule('write') ``` --- **For more Odoo 18 guides, see [SKILL.md](../SKILL.md)**