fix(spp_simulation): escape HTML content to prevent XSS and fix missing targeting_accuracy field

- Add markupsafe Markup/escape imports and use Markup.format() for all
  HTML computed fields in simulation_run.py and simulation_comparison.py
  to safely escape user-controlled values (scenario names, area names,
  metric names, CEL expressions, targeting expressions, multiplier fields)
- Use Markup() for static HTML strings in html_parts lists so join works correctly
- Escape program.name in simulation_service.py chatter message_post body
- Replace non-existent doc.targeting_accuracy field in simulation_report.xml
  with a condition on the existing leakage_rate/undercoverage_rate fields
- Remove targeting_accuracy from comparison_table.js metrics array

Author: jeremi

spp_simulation/models/simulation_comparison.py

@@ -1,6 +1,8 @@
 import logging
 from datetime import datetime
 
+from markupsafe import Markup
+
 from odoo import _, api, fields, models
 from odoo.exceptions import ValidationError
 
@@ -36,8 +38,7 @@ class SimulationComparison(models.Model):
     overlap_count_json = fields.Json(
         string="Overlap Counts",
         readonly=True,
-        help="Aggregated overlap counts between scenarios. "
-        "Computed from current registry data, not historical state.",
+        help="Aggregated overlap counts between scenarios. Computed from current registry data, not historical state.",
     )
     staleness_warning = fields.Text(
         string="Staleness Warning",
@@ -140,10 +141,10 @@ def _compute_parameters_comparison_html(self):
                 continue
 
             # Build comparison table
-            html_parts = ['<table class="table table-bordered table-sm">']
+            html_parts = [Markup('<table class="table table-bordered table-sm">')]
 
             # Header row with scenario names and execution dates
-            html_parts.append("<thead><tr><th>Parameter</th>")
+            html_parts.append(Markup("<thead><tr><th>Parameter</th>"))
             for run_data in runs:
                 name = run_data.get("scenario_name", "Unknown")
                 executed_at = run_data.get("executed_at")
@@ -152,68 +153,72 @@ def _compute_parameters_comparison_html(self):
                     try:
                         dt = datetime.fromisoformat(executed_at.replace("Z", "+00:00"))
                         date_str = dt.strftime("%b %d, %Y %H:%M")
-                        html_parts.append(f"<th>{name}<br/><small class='text-muted'>{date_str}</small></th>")
+                        html_parts.append(
+                            Markup("<th>{}<br/><small class='text-muted'>{}</small></th>").format(name, date_str)
+                        )
                     except ValueError:
-                        html_parts.append(f"<th>{name}</th>")
+                        html_parts.append(Markup("<th>{}</th>").format(name))
                 else:
-                    html_parts.append(f"<th>{name}</th>")
-            html_parts.append("</tr></thead><tbody>")
+                    html_parts.append(Markup("<th>{}</th>").format(name))
+            html_parts.append(Markup("</tr></thead><tbody>"))
 
             # Target Type row
-            html_parts.append("<tr><td><strong>Target Type</strong></td>")
+            html_parts.append(Markup("<tr><td><strong>Target Type</strong></td>"))
             for run_data in runs:
                 val = target_type_labels.get(run_data.get("target_type"), run_data.get("target_type", "-"))
-                html_parts.append(f"<td>{val}</td>")
-            html_parts.append("</tr>")
+                html_parts.append(Markup("<td>{}</td>").format(val))
+            html_parts.append(Markup("</tr>"))
 
             # Targeting Expression row
-            html_parts.append("<tr><td><strong>Targeting Expression</strong></td>")
+            html_parts.append(Markup("<tr><td><strong>Targeting Expression</strong></td>"))
             for run_data in runs:
                 expr = run_data.get("targeting_expression") or "-"
-                html_parts.append(f"<td><code style='word-break:break-word'>{expr}</code></td>")
-            html_parts.append("</tr>")
+                html_parts.append(Markup("<td><code style='word-break:break-word'>{}</code></td>").format(expr))
+            html_parts.append(Markup("</tr>"))
 
             # Budget Amount row
-            html_parts.append("<tr><td><strong>Budget Amount</strong></td>")
+            html_parts.append(Markup("<tr><td><strong>Budget Amount</strong></td>"))
             for run_data in runs:
                 amount = run_data.get("budget_amount") or 0
-                html_parts.append(f"<td>{amount:,.2f}</td>")
-            html_parts.append("</tr>")
+                html_parts.append(Markup("<td>{}</td>").format(f"{amount:,.2f}"))
+            html_parts.append(Markup("</tr>"))
 
             # Budget Strategy row
-            html_parts.append("<tr><td><strong>Budget Strategy</strong></td>")
+            html_parts.append(Markup("<tr><td><strong>Budget Strategy</strong></td>"))
             for run_data in runs:
                 strategy = budget_strategy_labels.get(
                     run_data.get("budget_strategy"), run_data.get("budget_strategy", "-")
                 )
-                html_parts.append(f"<td>{strategy}</td>")
-            html_parts.append("</tr>")
+                html_parts.append(Markup("<td>{}</td>").format(strategy))
+            html_parts.append(Markup("</tr>"))
 
             # Entitlement Rules row
-            html_parts.append("<tr><td><strong>Entitlement Rules</strong></td>")
+            html_parts.append(Markup("<tr><td><strong>Entitlement Rules</strong></td>"))
             for run_data in runs:
                 rules = run_data.get("entitlement_rules") or []
                 if rules:
-                    rules_html = "<ul style='margin:0;padding-left:1rem'>"
+                    rules_parts = [Markup("<ul style='margin:0;padding-left:1rem'>")]
                     for rule in rules:
                         mode = rule.get("amount_mode", "fixed")
                         amount = rule.get("amount", 0)
                         if mode == "fixed":
-                            rules_html += f"<li>Fixed: {amount:,.2f}</li>"
+                            rules_parts.append(Markup("<li>Fixed: {}</li>").format(f"{amount:,.2f}"))
                         elif mode == "multiplier":
                             field = rule.get("multiplier_field", "?")
-                            rules_html += f"<li>Multiplier: {amount:,.2f} × {field}</li>"
+                            rules_parts.append(
+                                Markup("<li>Multiplier: {} \u00d7 {}</li>").format(f"{amount:,.2f}", field)
+                            )
                         elif mode == "cel":
                             cel = rule.get("amount_cel_expression", "?")
-                            rules_html += f"<li>CEL: <code>{cel}</code></li>"
-                    rules_html += "</ul>"
-                    html_parts.append(f"<td>{rules_html}</td>")
+                            rules_parts.append(Markup("<li>CEL: <code>{}</code></li>").format(cel))
+                    rules_parts.append(Markup("</ul>"))
+                    html_parts.append(Markup("<td>{}</td>").format(Markup("").join(rules_parts)))
                 else:
-                    html_parts.append("<td>-</td>")
-            html_parts.append("</tr>")
+                    html_parts.append(Markup("<td>-</td>"))
+            html_parts.append(Markup("</tr>"))
 
-            html_parts.append("</tbody></table>")
-            record.parameters_comparison_html = "".join(html_parts)
+            html_parts.append(Markup("</tbody></table>"))
+            record.parameters_comparison_html = Markup("").join(html_parts)
 
     def action_compute_comparison(self):
         """Compute the side-by-side comparison data."""

spp_simulation/models/simulation_run.py

@@ -1,5 +1,7 @@
 import logging
 
+from markupsafe import Markup
+
 from odoo import Command, _, api, fields, models
 from odoo.exceptions import UserError
 
@@ -20,7 +22,7 @@ def _compute_display_name(self):
             if record.scenario_id and record.executed_at:
                 date_str = record.executed_at.strftime("%b %d, %Y %H:%M")
                 record.display_name = (
-                    f"{record.scenario_id.name} - {date_str} " f"({record.beneficiary_count:,} beneficiaries)"
+                    f"{record.scenario_id.name} - {date_str} ({record.beneficiary_count:,} beneficiaries)"
                 )
             elif record.scenario_id:
                 record.display_name = f"{record.scenario_id.name} - Run #{record.id}"
@@ -233,22 +235,29 @@ def _compute_summary_html(self):
             target_type_label = "households" if record.scenario_id.target_type == "group" else "individuals"
             coverage_pct = f"{record.coverage_rate:.1f}" if record.coverage_rate else "0.0"
             parts = [
-                f"<strong>{scenario_name}</strong> targets "
-                f"<strong>{record.beneficiary_count:,}</strong> {target_type_label} "
-                f"({coverage_pct}% of registry).",
+                Markup("<strong>{}</strong> targets <strong>{}</strong> {} ({}% of registry).").format(
+                    scenario_name,
+                    f"{record.beneficiary_count:,}",
+                    target_type_label,
+                    coverage_pct,
+                ),
             ]
             if record.total_cost:
-                parts.append(f" Total estimated cost: <strong>{record.total_cost:,.2f}</strong>.")
+                parts.append(Markup(" Total estimated cost: <strong>{}</strong>.").format(f"{record.total_cost:,.2f}"))
             if record.budget_utilization and record.scenario_id.budget_amount:
-                parts.append(f" Budget utilization: {record.budget_utilization:.1f}%.")
+                parts.append(Markup(" Budget utilization: {}%.").format(f"{record.budget_utilization:.1f}"))
             if record.equity_score:
                 parity_label = (
                     "proportional"
                     if record.equity_score >= 80
                     else ("some variation" if record.equity_score >= 60 else "significant variation")
                 )
-                parts.append(f" Parity score: <strong>{record.equity_score:.0f}/100</strong> ({parity_label}).")
-            record.summary_html = "<p>" + "".join(parts) + "</p>"
+                parts.append(
+                    Markup(" Parity score: <strong>{}/100</strong> ({}).").format(
+                        f"{record.equity_score:.0f}", parity_label
+                    )
+                )
+            record.summary_html = Markup("<p>{}</p>").format(Markup("").join(parts))
 
     @api.depends("gini_coefficient", "distribution_json")
     def _compute_distribution_summary_html(self):
@@ -261,7 +270,7 @@ def _compute_distribution_summary_html(self):
             gini_label = (
                 "nearly equal" if gini < 0.2 else ("moderately distributed" if gini < 0.4 else "unequally distributed")
             )
-            parts = [f"Benefits are <strong>{gini_label}</strong> " f"(Gini coefficient: {gini:.2f})."]
+            parts = [f"Benefits are <strong>{gini_label}</strong> (Gini coefficient: {gini:.2f})."]
             minimum = distribution.get("minimum", 0)
             maximum = distribution.get("maximum", 0)
             mean = distribution.get("mean", 0)
@@ -344,10 +353,10 @@ def _compute_geographic_html(self):
                 continue
 
             html_parts = [
-                '<table class="table table-sm table-bordered">',
-                "<thead><tr>",
-                "<th>Area</th><th>Beneficiaries</th><th>Amount</th><th>Coverage</th>",
-                "</tr></thead><tbody>",
+                Markup('<table class="table table-sm table-bordered">'),
+                Markup("<thead><tr>"),
+                Markup("<th>Area</th><th>Beneficiaries</th><th>Amount</th><th>Coverage</th>"),
+                Markup("</tr></thead><tbody>"),
             ]
             # Sort by beneficiary count descending
             sorted_areas = sorted(geo_data.items(), key=lambda x: x[1].get("count", 0), reverse=True)
@@ -357,10 +366,12 @@ def _compute_geographic_html(self):
                 amount = area_info.get("amount", 0)
                 coverage = area_info.get("coverage_rate", 0)
                 html_parts.append(
-                    f"<tr><td>{name}</td><td>{count:,}</td>" f"<td>{amount:,.2f}</td><td>{coverage:.1f}%</td></tr>"
+                    Markup("<tr><td>{}</td><td>{}</td><td>{}</td><td>{}%</td></tr>").format(
+                        name, f"{count:,}", f"{amount:,.2f}", f"{coverage:.1f}"
+                    )
                 )
-            html_parts.append("</tbody></table>")
-            record.geographic_html = "".join(html_parts)
+            html_parts.append(Markup("</tbody></table>"))
+            record.geographic_html = Markup("").join(html_parts)
 
     @api.depends("metric_results_json")
     def _compute_metric_results_html(self):
@@ -375,10 +386,10 @@ def _compute_metric_results_html(self):
                 continue
 
             html_parts = [
-                '<table class="table table-sm table-bordered">',
-                "<thead><tr>",
-                "<th>Metric</th><th>Value</th><th>Type</th>",
-                "</tr></thead><tbody>",
+                Markup('<table class="table table-sm table-bordered">'),
+                Markup("<thead><tr>"),
+                Markup("<th>Metric</th><th>Value</th><th>Type</th>"),
+                Markup("</tr></thead><tbody>"),
             ]
             for metric_name, metric_data in metrics.items():
                 value = metric_data.get("value", 0)
@@ -392,9 +403,13 @@ def _compute_metric_results_html(self):
                     formatted_value = f"{value:,.2f}"
                 else:
                     formatted_value = str(value)
-                html_parts.append(f"<tr><td>{metric_name}</td><td>{formatted_value}</td><td>{metric_type}</td></tr>")
-            html_parts.append("</tbody></table>")
-            record.metric_results_html = "".join(html_parts)
+                html_parts.append(
+                    Markup("<tr><td>{}</td><td>{}</td><td>{}</td></tr>").format(
+                        metric_name, formatted_value, metric_type
+                    )
+                )
+            html_parts.append(Markup("</tbody></table>"))
+            record.metric_results_html = Markup("").join(html_parts)
 
     @api.depends("targeting_efficiency_json")
     def _compute_targeting_efficiency_html(self):
@@ -474,11 +489,11 @@ def _compute_scenario_snapshot_fields(self):
             rules = snapshot.get("entitlement_rules") or []
             if rules:
                 html_parts = [
-                    '<table class="table table-sm table-bordered">',
-                    "<thead><tr>",
-                    "<th>Mode</th><th>Amount</th><th>Multiplier Field</th><th>Max Multiplier</th>",
-                    "<th>CEL Expression</th><th>Condition</th>",
-                    "</tr></thead><tbody>",
+                    Markup('<table class="table table-sm table-bordered">'),
+                    Markup("<thead><tr>"),
+                    Markup("<th>Mode</th><th>Amount</th><th>Multiplier Field</th><th>Max Multiplier</th>"),
+                    Markup("<th>CEL Expression</th><th>Condition</th>"),
+                    Markup("</tr></thead><tbody>"),
                 ]
                 amount_mode_labels = {
                     "fixed": "Fixed",
@@ -493,12 +508,21 @@ def _compute_scenario_snapshot_fields(self):
                     cel_expr = rule.get("amount_cel_expression") or "-"
                     condition = rule.get("condition_cel_expression") or "-"
                     html_parts.append(
-                        f"<tr><td>{mode}</td><td>{amount:,.2f}</td><td>{mult_field}</td>"
-                        f"<td>{max_mult}</td><td><code>{cel_expr}</code></td>"
-                        f"<td><code>{condition}</code></td></tr>"
+                        Markup(
+                            "<tr><td>{}</td><td>{}</td><td>{}</td>"
+                            "<td>{}</td><td><code>{}</code></td>"
+                            "<td><code>{}</code></td></tr>"
+                        ).format(
+                            mode,
+                            f"{amount:,.2f}",
+                            mult_field,
+                            max_mult,
+                            cel_expr,
+                            condition,
+                        )
                     )
-                html_parts.append("</tbody></table>")
-                record.scenario_snapshot_entitlement_rules_html = "".join(html_parts)
+                html_parts.append(Markup("</tbody></table>"))
+                record.scenario_snapshot_entitlement_rules_html = Markup("").join(html_parts)
             else:
                 record.scenario_snapshot_entitlement_rules_html = (
                     "<p class='text-muted'>No entitlement rules defined</p>"