Fix autowidth in combination with sanitizing

By only sanitizing just before serialisation.

3 files changed, 18 insertions, 8 deletions

diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb
index 46391229..cd9e1829 100644
--- a/lib/axlsx/workbook/worksheet/cell.rb
+++ b/lib/axlsx/workbook/worksheet/cell.rb
@@ -363,6 +363,17 @@ module Axlsx
         string_width(value, font_size)
       end
     end
+    
+    # Returns the sanatized value
+    # TODO find a better way to do this as it accounts for 30% of
+    # processing time in benchmarking...
+    def clean_value
+      if type == :string && !Axlsx::trust_input
+        Axlsx::sanitize(::CGI.escapeHTML(@value.to_s))
+      else
+        @value.to_s
+      end
+    end
 
     private
     
@@ -452,9 +463,7 @@ module Axlsx
         #consumer is responsible for ensuring the iso_8601 format when specifying this type
         v
       else
-        # TODO find a better way to do this as it accounts for 30% of
-        # processing time in benchmarking...
-        Axlsx::trust_input ? v.to_s : Axlsx::sanitize(::CGI.escapeHTML(v.to_s))
+        v.to_s
       end
     end
 
diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb
index 73b7c110..9a9f9465 100644
--- a/lib/axlsx/workbook/worksheet/cell_serializer.rb
+++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb
@@ -28,7 +28,7 @@ module Axlsx
         elsif cell.contains_rich_text?
           cell.value.to_xml_string(str)
         else
-          str << ('<t>' << cell.value.to_s << '</t>')
+          str << ('<t>' << cell.clean_value << '</t>')
         end
         str
       end
@@ -86,7 +86,7 @@ module Axlsx
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
       def formula_serialization(cell, str='')
-        str << ('t="str"><f>' << cell.value.to_s.sub('=', '') << '</f>')
+        str << ('t="str"><f>' << cell.clean_value.to_s.sub('=', '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
 
@@ -95,7 +95,7 @@ module Axlsx
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
       def array_formula_serialization(cell, str='')
-        str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.value.to_s.sub('{=', '').sub(/}$/, '') << '</f>')
+        str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.sub('{=', '').sub(/}$/, '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
 
diff --git a/lib/axlsx/workbook/worksheet/rich_text_run.rb b/lib/axlsx/workbook/worksheet/rich_text_run.rb
index e91514ed..e56dc3ae 100644
--- a/lib/axlsx/workbook/worksheet/rich_text_run.rb
+++ b/lib/axlsx/workbook/worksheet/rich_text_run.rb
@@ -16,7 +16,7 @@ module Axlsx
     end
     
     def value=(value)
-      @value = Axlsx::trust_input ? value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(value.to_s))
+      @value = value
     end
     
     attr_accessor :cell
@@ -208,7 +208,8 @@ module Axlsx
           str << ('<' << key.to_s << ' val="' << xml_value(data[key]) << '"/>')
         end
       end
-      str << ('</rPr><t>' << @value.to_s << '</t></r>')
+      clean_value = Axlsx::trust_input ? @value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(@value.to_s))
+      str << ('</rPr><t>' << clean_value << '</t></r>')
     end
     
     private