diff options
| author | Arkadiy Butermanov <[email protected]> | 2016-04-05 14:06:10 +0300 |
|---|---|---|
| committer | Arkadiy Butermanov <[email protected]> | 2016-04-05 14:06:10 +0300 |
| commit | a0dc908f9df76f8c31a3238b1829eea2fd10c666 (patch) | |
| tree | 63d08c43c7d1d5006441c47a512f3e97b4052be8 | |
| parent | 0d54b473cfa8a3325e1bc3fcd5525ebb7f4b68cb (diff) | |
| download | caxlsx-a0dc908f9df76f8c31a3238b1829eea2fd10c666.tar.gz caxlsx-a0dc908f9df76f8c31a3238b1829eea2fd10c666.zip | |
Escape html in :text type
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell.rb | 4 | ||||
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell_serializer.rb | 8 |
2 files changed, 8 insertions, 4 deletions
diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb index a96b3cb7..777b7812 100644 --- a/lib/axlsx/workbook/worksheet/cell.rb +++ b/lib/axlsx/workbook/worksheet/cell.rb @@ -123,7 +123,7 @@ module Axlsx # Indicates if the cell is good for shared string table def plain_string? - type == :string && # String typed + (type == :string || type == :text) && # String typed !is_text_run? && # No inline styles [email protected]? && # Not nil [email protected]? && # Not empty @@ -368,7 +368,7 @@ module Axlsx # TODO find a better way to do this as it accounts for 30% of # processing time in benchmarking... def clean_value - if type == :string && !Axlsx::trust_input + if (type == :string || type == :text) && !Axlsx::trust_input Axlsx::sanitize(::CGI.escapeHTML(@value.to_s)) else @value.to_s diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb index 4da391b6..76a3c386 100644 --- a/lib/axlsx/workbook/worksheet/cell_serializer.rb +++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb @@ -141,8 +141,12 @@ module Axlsx # @param [Cell] cell The cell that is being serialized # @param [String] str The string the serialized content will be appended to. # @return [String] - def text(cell, str='') - inline_string_serialization cell, str + def text(cell, str) + if cell.ssti.nil? + inline_string_serialization cell, str + else + value_serialization 's', cell.ssti, str + end end private |