Fix autowidth in combination with sanitizing

By only sanitizing just before serialisation.

4 files changed, 19 insertions, 9 deletions

diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb
index 46391229..cd9e1829 100644
--- a/lib/axlsx/workbook/worksheet/cell.rb
+++ b/lib/axlsx/workbook/worksheet/cell.rb
@@ -363,6 +363,17 @@ module Axlsx
         string_width(value, font_size)
       end
     end
+    
+    # Returns the sanatized value
+    # TODO find a better way to do this as it accounts for 30% of
+    # processing time in benchmarking...
+    def clean_value
+      if type == :string && !Axlsx::trust_input
+        Axlsx::sanitize(::CGI.escapeHTML(@value.to_s))
+      else
+        @value.to_s
+      end
+    end
 
     private
     
@@ -452,9 +463,7 @@ module Axlsx
         #consumer is responsible for ensuring the iso_8601 format when specifying this type
         v
       else
-        # TODO find a better way to do this as it accounts for 30% of
-        # processing time in benchmarking...
-        Axlsx::trust_input ? v.to_s : Axlsx::sanitize(::CGI.escapeHTML(v.to_s))
+        v.to_s
       end
     end
 
diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb
index 73b7c110..9a9f9465 100644
--- a/lib/axlsx/workbook/worksheet/cell_serializer.rb
+++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb
@@ -28,7 +28,7 @@ module Axlsx
         elsif cell.contains_rich_text?
           cell.value.to_xml_string(str)
         else
-          str << ('<t>' << cell.value.to_s << '</t>')
+          str << ('<t>' << cell.clean_value << '</t>')
         end
         str
       end
@@ -86,7 +86,7 @@ module Axlsx
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
       def formula_serialization(cell, str='')
-        str << ('t="str"><f>' << cell.value.to_s.sub('=', '') << '</f>')
+        str << ('t="str"><f>' << cell.clean_value.to_s.sub('=', '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
 
@@ -95,7 +95,7 @@ module Axlsx
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
       def array_formula_serialization(cell, str='')
-        str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.value.to_s.sub('{=', '').sub(/}$/, '') << '</f>')
+        str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.sub('{=', '').sub(/}$/, '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
 
diff --git a/lib/axlsx/workbook/worksheet/rich_text_run.rb b/lib/axlsx/workbook/worksheet/rich_text_run.rb
index e91514ed..e56dc3ae 100644
--- a/lib/axlsx/workbook/worksheet/rich_text_run.rb
+++ b/lib/axlsx/workbook/worksheet/rich_text_run.rb
@@ -16,7 +16,7 @@ module Axlsx
     end
     
     def value=(value)
-      @value = Axlsx::trust_input ? value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(value.to_s))
+      @value = value
     end
     
     attr_accessor :cell
@@ -208,7 +208,8 @@ module Axlsx
           str << ('<' << key.to_s << ' val="' << xml_value(data[key]) << '"/>')
         end
       end
-      str << ('</rPr><t>' << @value.to_s << '</t></r>')
+      clean_value = Axlsx::trust_input ? @value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(@value.to_s))
+      str << ('</rPr><t>' << clean_value << '</t></r>')
     end
     
     private
diff --git a/test/workbook/worksheet/tc_worksheet.rb b/test/workbook/worksheet/tc_worksheet.rb
index b399b306..574522a2 100644
--- a/test/workbook/worksheet/tc_worksheet.rb
+++ b/test/workbook/worksheet/tc_worksheet.rb
@@ -402,7 +402,7 @@ class TestWorksheet < Test::Unit::TestCase
     Axlsx::trust_input = false
     nasties =  "\v\u2028\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u001f"
     @ws.add_row [nasties]
-    assert_equal(nil, @ws.rows.last.cells.last.value.index("\v"))
+    assert_equal(0, @ws.rows.last.cells.last.value.index("\v"))
     assert_equal(nil, @ws.to_xml_string.index("\v"))
     Axlsx::trust_input = old
   end