Rules¶

Every rule has a code of the form OD and three digits, and a name. --select, --ignore, the configuration file and suppression comments take the code, or for the first three a prefix of it such as OD3.

The hundreds digit says what the rule reads. A code is never renumbered and never reused for another rule: once released, OD203 means the same check in every later version, so baselines, suppressions and links keep working. A retired rule leaves a gap.

A rule marked as needing the index checks one module against the others: the models, fields, methods, XML ids and views of every module it depends on. It is off unless base is among the indexed modules, and a notice says so. The other rules read one file, or one module, at a time.

The series of a rule is the range of Odoo versions it applies to. Each module is checked against the series its manifest version names, and a module whose series is unknown gets only the rules that apply to every series.

Load failures¶

Rule pages say a failure stops the install: that holds for a file of data. From saas~11.5 a failure while loading a file of demo stops neither the install nor the update: Odoo logs a warning and installs the module without its demo data. That covers the load alone: an update validates a view of that file again after it, so a view that no longer validates stops the update. Before saas~11.5 any failure in a demo file stops them like a data file.

OD0: parsing¶

A file that does not parse. Nothing else is checked in it.

OD1: Python, one file at a time¶

Python code checked on its own: security, deprecated APIs and ORM mistakes visible in one file.

OD2: models and fields¶

Models, fields and methods checked against every module in the dependency graph. A model class has Model, TransientModel, AbstractModel, their aliases osv, osv_memory and osv_abstract or, from 20.0, CachedModel among its bases, and any other base is a plain Python base class, which the rules whose page says so skip, since only Python knows its fields and methods. As each page says, they also skip a model when a class of it, or of a model it inherits or, for a rule reading fields, delegates to, has an _inherit element that is not a literal, such as a variable, since the scan cannot tell which model it names.

OD3: XML ids, views and data¶

XML ids, views and data records, within a file and across the dependency graph.

OD4: access¶

Access rights: models no one can reach, and rights granted too widely.

OD5: manifest and module graph¶

The manifest and the dependency graph: listed files, unlisted files and dependencies.

OD6: JavaScript and Owl¶

Scripts under static/src that a bundle loads, checked against the scripts of every indexed module.

OD7: data flows¶

Values a user controls, followed through one function to the calls that must not receive them.

The sources are the parameters of a controller method behind @route; the parameters of a public model method (no leading _, no @api.private), which any user with access to the model can call over RPC; and the request: request.params, request.get_json_data(), request.get_http_params(), and the args, form, values, files, cookies, headers, data and JSON of request.httprequest.

A value stays tainted through assignments, formatting, concatenation, f-strings, string methods, items, attributes, collections, comprehensions and module functions such as json.loads(). Records do not carry it: what a recordset method such as browse() or search() returns is not tainted. Both branches of an if are followed, a branch that returns or raises adds nothing after it, and a loop body is read twice.

A value passed to a method of self, of env["x"] or of a local bound to one is followed into every definition of that method the module's dependencies hold, overrides included, up to four calls deep; so is a value such a method returns. The finding is at the sink when the module holds it, otherwise at the call that leaves the module. A method that runs under sudo() only because its caller called it so is not known to write as superuser.

The flow ends at a sanitizer: int(), float(), bool(), len(), SQL.identifier(), escape(), html_escape(), html_sanitize() and plaintext2html(); at assert x in (...) or if x not in allowed: raise; and at an intersection with values the code chose, such as set(vals) & allowed.