OCA/web

Review signals: 14 encoded blob, 1 hardcoded secret.

Source contains encoded blob; review its purpose. 3 distinct locations. 4 findings.

Gitleaks found a possible hardcoded secret; value withheld. web_widget_bokeh_chart/static/src/lib/bokeh/bokeh-3.9.0.min.js

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• web_dialog_size addon serves the full-screen dialog width styling it describes: Real input produced the expected result: max-width: 100%

  Source: A module that lets the user expand a dialog box to the full screen width.

  Input: GET installed web_dialog_size static scss from the running Odoo 19 server

  Expected: full-width modal dialog rule (max-width: 100%) is served

  Command: <guest-path> <guest-path> -d oca_dialog --addons-path=<guest-path>,<guest-path> --db_host=localhost --db_user=odoo --db_password=odoo --http-port=8069 --without-demo=all

  Observed: …max-width: 100%; width: calc(100% - 50px); } } .dialog_button_restore, .dialog_button_extend { margin-left: auto; + .btn-close { margin: -8px -8px -8px 0px; } } }

Examples

• Run the web_dialog_size addon's Odoo test suite (CI equivalent: odoo tests with --test-enable): command completed successfully

  Source: .github/workflows/test.yml (Run tests step) and web_dialog_size/tests/test_web_dialog_size.py

  Input: odoo-bin -u web_dialog_size --test-enable --test-tags /web_dialog_size on database oca_test

  Expected: web_dialog_size tests pass with 0 failed, 0 error(s)

  Command: <guest-path> <guest-path> -d oca_test --addons-path=<guest-path>,<guest-path> --db_host=localhost --db_user=odoo --db_password=odoo -u web_dialog_size --test-enable --test-tags /web_dialog_size --stop-after-init --without-demo=all

  Observed: -tests in 0.00s, 0 queries 2026-10-28 06:08:44,320 7064 INFO oca_test odoo.tests.stats: web_dialog_size: 3 tests 0.22s 15 queries 2026-10-28 06:08:44,320 7064 INFO oca_test odoo.tests.result: 0 failed, 0 error(s) of 1 tests when loading database 'oca_test' 2026-10-28 06:08:44,321 7064 INFO oca_test odoo.service.server: Initiating shutdown 2026-10-28 06:08:44,321 7064 INFO oca_test odoo.service.server: Hit CTRL-C again or send a second signal to force the shutdown. 2026-10-28 06:08:44,602 7064 INFO oca_test odoo.sql_db: ConnectionPool(read/write;used=0/count=0/max=64): Closed 2 connections

Local or hosted: local

Run the OCA web_dialog_size Odoo 19 addon: install it into a PostgreSQL database, serve its assets from the Odoo HTTP server, and run its unit tests with Odoo's --test-enable

cd <guest-path> && ls -la && head -c 4000 README.md 2>/dev/null; python3 --version; ls /inputs 2>/dev/null
cd <guest-path> && tail -c 6500 README.md; echo; cat requirements.txt; ls .coldpass; ls setup | head; ls .github/workflows
cd <guest-path> && cat .github/workflows/test.yml | head -150; ls .coldpass -la; ls web_company_color; ls web_company_color/readme 2>/dev/null
cat /etc/os-release | head -3; nproc; free -g | head -2; df -h /tmp | tail -1; which psql pg_ctl docker git node npm uv pip3 2>&1; python3 -m pip --version 2>&1; sudo -n true && echo SUDO_OK; echo $CDP_URL; curl -s -m 10 -w '\nHTTP %{http_code}\n' $CDP_URL/json/version
cd <guest-path> && git init -q && git remote add origin https://github.com/OCA/web && timeout 240 git fetch --depth 1 origin 5ee605962df607c20b0d8db9ea6e1236718620b7 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; git status --short | head -5
sudo -n apt-get -o DPkg::Lock::Timeout=300 update -qq 2>&1 | tail -3; sudo -n env DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 install -y -qq postgresql python3-venv python3-dev build-essential libldap2-dev libsasl2-dev libpq-dev libxml2-dev libxslt1-dev libjpeg-dev zlib1g-dev >/tmp/apt.log 2>&1; echo "apt exit $?"; tail -3 /tmp/apt.log; which psql
mkdir -p <guest-path> && cd <guest-path> && timeout 600 git clone --depth 1 -b 19.0 https://github.com/odoo/odoo odoo 2>&1 | tail -2; ls odoo | head -30; cat odoo/odoo/release.py 2>/dev/null | grep -E "^version" 
cd <guest-path> && python3 -m venv venv && timeout 1500 <guest-path> install -q -r deps/odoo/requirements.txt -r workspace/requirements.txt > <guest-path> 2>&1; echo "pip exit $?"; tail -5 <guest-path> | cut -c1-600
sudo -n systemctl start postgresql 2>&1 | tail -1; sudo -n -u postgres psql -qc "CREATE ROLE odoo WITH LOGIN SUPERUSER PASSWORD 'odoo';" 2>&1; sudo -n -u postgres psql -tc "select version();" | head -2 | cut -c1-120; PGPASSWORD=odoo psql -h localhost -U odoo -d postgres -tc "select 1" 
cd <guest-path> && timeout 1500 <guest-path> odoo-bin -d oca_dialog --addons-path=<guest-path>,<guest-path> --db_host=localhost --db_user=odoo --db_password=odoo -i web_dialog_size --stop-after-init --without-demo=all > <guest-path> 2>&1; echo "exit $?"; grep -E "ERROR|CRITICAL|Traceback|modules loaded|loading" <guest-path> | tail -8 | cut -c1-400; tail -3 <guest-path> | cut -c1-300
cd <guest-path> && find . -type f | grep -v i18n | head -40; grep -n "version\|license\|depends" __manifest__.py; ls tests 2>/dev/null; cat README.rst 2>/dev/null | head -30
cd <guest-path> && cat tests/test_web_dialog_size.py | head -60; grep -n "tour\|HttpCase\|browser" -r tests | head; grep -n "" static/src/scss/web_dialog_size.scss | head -5
cd <guest-path> && timeout 1500 <guest-path> odoo-bin -d oca_test --addons-path=<guest-path>,<guest-path> --db_host=localhost --db_user=odoo --db_password=odoo -i web_dialog_size --test-enable --test-tags /web_dialog_size --stop-after-init --without-demo=all > <guest-path> 2>&1; echo "exit $?"; grep -E "ERROR|FAIL|Ran |tests? (passed|failed)|test_web_dialog" <guest-path> | cut -c1-300 | tail -10
grep -E "web_dialog_size|Test|test" <guest-path> | cut -c1-260 | tail -12
cd <guest-path> && (nohup <guest-path> odoo-bin -d oca_dialog --addons-path=<guest-path>,<guest-path> --db_host=localhost --db_user=odoo --db_password=odoo --http-port=8069 --without-demo=all > <guest-path> 2>&1 &); sleep 15; curl -s -m 20 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8069/web_dialog_size/static/src/scss/web_dialog_size.scss | head -12
pkill -f "odoo-bin -d oca_dialog" ; sleep 3; (curl -s -m 3 -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8069/ || echo "port 8069 free"); cd <guest-path> && grep -rl "ir.cron\|ir_cron\|--once\|webhook" --include=*.py --include=*.xml --include=*.md . | head; grep -c "" <guest-path>
ps aux | grep "[o]doo-bin" | cut -c1-150; curl -s -m 3 -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8069/ ; echo done
cd <guest-path> && grep -rl "ir.cron\|ir_cron\|--once\|webhook" --include=*.py --include=*.xml --include=*.md . | head -5; echo "---"; grep -c "" README.md; echo ok
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","<guest-path>","-d","oca_dialog","--addons-path=<guest-path>,<guest-path>","--db_host=localhost","--db_user=odoo","--db_password=odoo","--http-port=8069","--without-demo=all"],"cwd":"<guest-path>","env":{"PGHOST":"localhost","PGUSER":"odoo","PGPASSWORD":"odoo"},"url":"http://127.0.0.1:8069/web_dialog_size/static/src/scss/web_dialog_size.scss","expected_text":"max-width: 100%"}
EOF
python3 -m json.tool probe.json >/dev/null && echo valid; grep -n "A module that lets the user expand a dialog box to the full screen width." ../README.md | cut -c1-200
cd <guest-path> && cat > claims.json <<'EOF'
[{"kind":"claim","claim":"web_dialog_size addon serves the full-screen dialog width styling it describes","source":"A module that lets the user expand a dialog box to the full screen width.","input":"GET installed web_dialog_size static scss from the running Odoo 19 server","expected":"full-width modal dialog rule (max-width: 100%) is served","probe_kind":"http","argv":["<guest-path>","<guest-path>","-d","oca_dialog","--addons-path=<guest-path>,<guest-path>","--db_host=localhost","--db_user=odoo","--db_password=odoo","--http-port=8069","--without-demo=all"],"url":"http://127.0.0.1:8069/web_dialog_size/static/src/scss/web_dialog_size.scss","expected_text":"max-width: 100%","cwd":"<guest-path>","env":{"PGHOST":"localhost","PGUSER":"odoo","PGPASSWORD":"odoo"}}]
EOF
python3 -m json.tool claims.json >/dev/null && echo valid
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Run the web_dialog_size addon's Odoo test suite (CI equivalent: odoo tests with --test-enable)","source":".github/workflows/test.yml (Run tests step) and web_dialog_size/tests/test_web_dialog_size.py","input":"odoo-bin -u web_dialog_size --test-enable --test-tags /web_dialog_size on database oca_test","expected":"web_dialog_size tests pass with 0 failed, 0 error(s)","argv":["<guest-path>","<guest-path>","-d","oca_test","--addons-path=<guest-path>,<guest-path>","--db_host=localhost","--db_user=odoo","--db_password=odoo","-u","web_dialog_size","--test-enable","--test-tags","/web_dialog_size","--stop-after-init","--without-demo=all"],"cwd":"<guest-path>","env":{"PGHOST":"localhost","PGUSER":"odoo","PGPASSWORD":"odoo"},"expected_text":"0 failed, 0 error(s) of 1 tests"}]
EOF
python3 -m json.tool examples.json >/dev/null && echo valid; cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md, .github/workflows/test.yml and web_dialog_size sources. The README is an addon catalog with no cron, loop, webhook or --once/--now entrypoint. Odoo ir.cron scheduled actions exist only as demo data in some other addons (e.g. web_timeline/demo/ir_cron_view.xml, web_widget_numeric_step/demo/ir_cron.xml), not in web_dialog_size, and no scheduled cycle is documented."}
EOF
python3 -m json.tool cycles.json >/dev/null && echo valid
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit $?"; cut -c1-500 <guest-path> | tail -40
cd <guest-path> && python3 -I -c "
import json,sys
d=json.load(open('<guest-path>')) if False else None
" ; python3 - <<'EOF'
import json
txt=open('<guest-path>').read()
i=txt.index('{')
d=json.loads(txt[i:])
print('valid',d.get('valid'),'problems',d.get('problems'))
r=d.get('replay',{})
print('replay status',r.get('status'))
det=r.get('details',{})
for k,v in det.items():
    s=json.dumps(v)
    print(k, s[:300])
EOF
python3 - <<'EOF'
import json
txt=open('<guest-path>').read()
d=json.loads(txt[txt.index('{'):])
print(list(d.keys()))
for k in d:
    if k not in ('replay','valid','problems'):
        print(k, json.dumps(d[k])[:600])
EOF
grep -o '"claims[^]]*' <guest-path> | head -c 300; echo; wc -c <guest-path>
grep -o '"status": "[A-Z]*"\|"status":"[A-Z]*"\|PASS\|FAIL\|"problems": \[[^]]' <guest-path> | sort | uniq -c; grep -o 'example[^,]\{0,120\}' <guest-path> | head -5; grep -o 'expected_text[^,]\{0,120\}' <guest-path> | head
python3 - <<'EOF'
txt=open('<guest-path>').read()
import re
for m in re.finditer(r'"(claim_checks|example_checks|cycle_checks|claims|examples|cycles)"', txt):
    print(m.group(1), txt[m.start():m.start()+700].replace('\\"','"'))
    print('---')
EOF
python3 - <<'EOF'
import re
txt=open('<guest-path>').read().replace('\\"','"')
for m in re.finditer(r'"verdict": "(\w+)"', txt):
    print('verdict', m.group(1))
i=txt.index('"example_checks"')
print(txt[i:i+1400])
EOF
cd <guest-path> && find . -name __pycache__ -type d -not -path './.git/*' -prune -exec rm -rf {} + ; git rev-parse HEAD; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the OCA web_dialog_size Odoo 19 addon: install it into a PostgreSQL database, serve its assets from the Odoo HTTP server, and run its unit tests with Odoo's --test-enable","operation_scope":"Single addon web_dialog_size (19.0.1.0.2) of OCA/web pinned at 5ee605962df607c20b0d8db9ea6e1236718620b7. Requires Odoo 19.0 core, Python 3.12 venv, PostgreSQL 16 with role odoo. Not a full-repo test run; the browser-based tours were not run.","steps":["README.md has no install or run steps (addon catalog only); used .github/workflows/test.yml as the reference: install addons and requirements, run tests with Odoo.","git init; git remote add origin https://github.com/OCA/web; git fetch --depth 1 origin 5ee605962df607c20b0d8db9ea6e1236718620b7; git reset --mixed FETCH_HEAD","sudo apt-get -o DPkg::Lock::Timeout=300 install postgresql python3-venv python3-dev build-essential libldap2-dev libsasl2-dev libpq-dev libxml2-dev libxslt1-dev libjpeg-dev zlib1g-dev","git clone --depth 1 -b 19.0 https://github.com/odoo/odoo (outside the workspace)","python3 -m venv <guest-path>; pip install -r odoo/requirements.txt -r workspace/requirements.txt","CREATE ROLE odoo WITH LOGIN SUPERUSER PASSWORD 'odoo' (CI service credentials)","odoo-bin -d oca_dialog -i web_dialog_size --stop-after-init (install, exit 0)","odoo-bin -d oca_test -i web_dialog_size --test-enable --test-tags /web_dialog_size --stop-after-init: 3 tests, 0 failed, 0 error(s)","odoo-bin -d oca_dialog --http-port=8069; GET /web_dialog_size/static/src/scss/web_dialog_size.scss returns the addon's full-width dialog CSS (max-width: 100%)"],"deviations":["README has no install instructions; followed CI test workflow instead.","CI helper commands (oca_install_addons, oca_init_test_database, oca_run_tests, manifestoo) were not used because they are not available in this guest; odoo-bin was driven directly with the same test flags.","Odoo core was cloned from github odoo/odoo branch 19.0 (not pinned; only OCA/web is pinned).","PostgreSQL 16 was used instead of the CI's postgres:13 service.","Only web_dialog_size was installed and tested; the other 47 addons were not run.","Browser (HttpCase/tour) tests were not run; the shared CDP endpoint http://<internal-ip>:9226/json/version returned HTTP 200 (Chrome 155) but was not needed for the chosen operation.","/inputs/coldpass-preflight.py does not exist in this VM; the validation was run with <guest-path> as provided in the task.","Odoo runs wrote __pycache__ directories into the workspace; they were removed afterwards."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for this addon. For full CI parity, install the OCA CI tooling and run oca_install_addons, oca_init_test_database, oca_run_tests against all addons."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report valid; ls .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit $?"; python3 -c "
import json;t=open('<guest-path>').read();d=json.loads(t[t.index('{'):]);print('valid',d['valid'],d['problems'],d['replay']['status'])"; ps aux | grep -c "[o]doo-bin"