Bug#973605: odoo: Multiple privacy-breach-generic (fetching data from an external website at runtime)

[Sebastien Delafond]

Source: odoo
Version: 14.0.0+dfsg-1
Severity: serious

Here's the corresponding lintian excerpt:

W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/digest/data/digest_data.xml [<img 
class="download_app" 
src="https://www.odoo.com/digest/static/src/img/google_play.png"; />] 
(https://www.odoo.com/digest/static/src/img/google_play.png)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/digest/data/digest_data.xml [<img 
src="https://www.odoo.com/web/image/24717933/odoo-mobile.png"; alt="odoo mobile" 
/>] (https://www.odoo.com/web/image/24717933/odoo-mobile.png)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/event/data/email_template_data.xml 
[<img 
src="http://maps.googleapis.com/maps/api/staticmap?autoscale=1&amp;size=598x200&amp;maptype=roadmap&amp;format=png&amp;visual_refresh=true&amp;markers=size:mid%7ccolor:0xa5117d%7clabel:%7c${location}";
 style="vertical-align:bottom; width: 100%;" alt="google maps"/>] 
(http://maps.googleapis.com/maps/api/staticmap?autoscale=1&amp;size=598x200&amp;maptype=roadmap&amp;format=png&amp;visual_refresh=true&amp;markers=size:mid%7ccolor:0xa5117d%7clabel:%7c${location})
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/survey/data/survey_demo_quiz.xml 
[<iframe src="//www.youtube.com/embed/7y4t6yv5l1k?autoplay=0&amp;rel=0" 
frameborder="0" contenteditable="false">] 
(//www.youtube.com/embed/7y4t6yv5l1k?autoplay=0&amp;rel=0)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/test_assetsbundle/views/views.xml 
[<link rel="stylesheet" href="http://test.external.link/style1.css"/>] 
(http://test.external.link/style1.css)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/test_assetsbundle/views/views.xml 
[<link rel="stylesheet" href="http://test.external.link/style2.css"/>] 
(http://test.external.link/style2.css)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/test_assetsbundle/views/views.xml 
[<script type="text/javascript" 
src="http://test.external.link/javascript1.js";>] 
(http://test.external.link/javascript1.js)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/test_assetsbundle/views/views.xml 
[<script type="text/javascript" 
src="http://test.external.link/javascript2.js";>] 
(http://test.external.link/javascript2.js)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/tests/template_qweb_test.xml 
[<img src="http://test.external.link/img.png"/>] 
(http://test.external.link/img.png)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/tests/template_qweb_test.xml 
[<link rel="stylesheet" href="http://test.external.link/style1.css"/>] 
(http://test.external.link/style1.css)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/tests/template_qweb_test.xml 
[<link rel="stylesheet" href="http://test.external.link/style2.css"/>] 
(http://test.external.link/style2.css)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/tests/template_qweb_test.xml 
[<script type="text/javascript" 
src="http://test.external.link/javascript1.js";>] 
(http://test.external.link/javascript1.js)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/tests/template_qweb_test.xml 
[<script type="text/javascript" 
src="http://test.external.link/javascript2.js";>] 
(http://test.external.link/javascript2.js)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website/views/website_templates.xml 
[<link rel="preconnect" href="https://fonts.gstatic.com/"; crossorigin=""/>] 
(https://fonts.gstatic.com/)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_google_map/views/google_map_templates.xml
 [<script src="//maps.google.com/maps/api/js">] (//maps.google.com/maps/api/js)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469355"/>] 
(//odoocdn.com/web/image/6469355)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469356"/>] 
(//odoocdn.com/web/image/6469356)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469360"/>] 
(//odoocdn.com/web/image/6469360)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469367"/>] 
(//odoocdn.com/web/image/6469367)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469369"/>] 
(//odoocdn.com/web/image/6469369)
W: odoo: privacy-breach-generic 
usr/lib/python3/dist-packages/odoo/addons/website_hr_recruitment/data/hr_job_demo.xml
 [<img alt="" class="img img-fluid" src="//odoocdn.com/web/image/6469456"/>] 
(//odoocdn.com/web/image/6469456)

Some of these are harmless placeholders used during testing, but others
need to be clarified and fixed with upstream's help.

I'm setting the severity to serious, to avoid migration to testing in
the current state.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.8.0-2-amd64 (SMP w/36 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled