Secure coding in Odoo

sudo discipline, SQL injection, XSS in QWeb and HTML fields, controller security, secrets and personal data.

In this lesson

sudo discipline
SQL injection and XSS
Controllers, secrets and personal data (NDPA)

Key points

Narrow, justified sudo; never sudo on visitor-controlled searches
Parameterised SQL / odoo.tools.SQL; never format user input into SQL
t-out escapes; don't Markup unsanitised input; keep Html sanitize
auth/csrf on routes; secrets out of code; minimise and protect personal data

Real-world example

A delivery-tracking page accepted ?ref= and ran cr.execute("SELECT ... WHERE name = '%s'" % ref). A tester sent ' OR 1=1 -- and saw every delivery. Rewriting it with the ORM and a domain on the visitor's token closed the hole; a pylint-odoo check now flags SQL string formatting in CI.

Questions and answers

Where should an API secret be stored?

System parameter (ir.config_parameter) or environment variable, not code.

Which Nigerian law governs personal data processing?

The Nigeria Data Protection Act 2023 (NDPC as regulator).

Read the full lesson, worked example and quiz