Add option to protect against formula injection attacks (#34)

Caxlsx used to treat cell values beginning with an equal sign as formula by default.

This can be dangerous if the input data is user generated or coming from other untrusted sources (see https://www.owasp.org/index.php/CSV_Injection for details).

This commit adds a new option `escape_formulas` that can be used with `#add_row` and on instances of `Cell`. If set to true, cell values beginning with an equal sign are treated as normal strings (and will be displayed literally by Excel and co.)

2 files changed, 46 insertions, 1 deletions

diff --git a/test/workbook/worksheet/tc_cell.rb b/test/workbook/worksheet/tc_cell.rb
index 11b54f44..d3ca9fe8 100644
--- a/test/workbook/worksheet/tc_cell.rb
+++ b/test/workbook/worksheet/tc_cell.rb
@@ -8,7 +8,7 @@ class TestCell < Test::Unit::TestCase
     @ws = p.workbook.add_worksheet :name=>"hmmm"
     p.workbook.styles.add_style :sz=>20
     @row = @ws.add_row
-    @c = @row.add_cell 1, :type=>:float, :style=>1
+    @c = @row.add_cell 1, :type=>:float, :style=>1, :escape_formulas=>true
     data = (0..26).map { |index| index }
     @ws.add_row data
     @cAA = @ws["AA2"]
@@ -19,6 +19,7 @@ class TestCell < Test::Unit::TestCase
     assert_equal(@c.type, :float, "type option is applied")
     assert_equal(@c.style, 1, "style option is applied")
     assert_equal(@c.value, 1.0, "type option is applied and value is casted")
+    assert_equal(@c.escape_formulas, true, "escape formulas option is applied")
   end
 
   def test_style_date_data
@@ -321,6 +322,33 @@ class TestCell < Test::Unit::TestCase
     assert(doc.xpath("//f[text()='IF(2+2=4,4,5)']").any?)
   end
 
+  def test_to_xml_string_formula_escaped
+    p = Axlsx::Package.new
+    ws = p.workbook.add_worksheet do |sheet|
+      sheet.add_row ["=IF(2+2=4,4,5)"], escape_formulas: true
+    end
+    doc = Nokogiri::XML(ws.to_xml_string)
+    doc.remove_namespaces!
+    assert(doc.xpath("//t[text()='=IF(2+2=4,4,5)']").any?)
+  end
+
+  def test_to_xml_string_formula_escape_array_parameter
+    p = Axlsx::Package.new
+    ws = p.workbook.add_worksheet do |sheet|
+      sheet.add_row [
+        "=IF(2+2=4,4,5)",
+        "=IF(13+13=4,4,5)",
+        "=IF(99+99=4,4,5)"
+      ], escape_formulas: [true, false, true]
+    end
+    doc = Nokogiri::XML(ws.to_xml_string)
+    doc.remove_namespaces!
+
+    assert(doc.xpath("//t[text()='=IF(2+2=4,4,5)']").any?)
+    assert(doc.xpath("//f[text()='IF(13+13=4,4,5)']").any?)
+    assert(doc.xpath("//t[text()='=IF(99+99=4,4,5)']").any?)
+  end
+
   def test_to_xml_string_array_formula
     p = Axlsx::Package.new
     ws = p.workbook.add_worksheet do |sheet|
diff --git a/test/workbook/worksheet/tc_row.rb b/test/workbook/worksheet/tc_row.rb
index 43e7d23f..f909129c 100644
--- a/test/workbook/worksheet/tc_row.rb
+++ b/test/workbook/worksheet/tc_row.rb
@@ -60,6 +60,23 @@ class TestRow < Test::Unit::TestCase
 
   end
 
+  def test_array_to_cells_with_escape_formulas
+    row = ['=HYPERLINK("http://www.example.com", "CSV Payload")', '=Bar']
+    @ws.add_row row, escape_formulas: true
+
+    assert_equal @ws.rows.last.cells[0].escape_formulas, true
+    assert_equal @ws.rows.last.cells[1].escape_formulas, true
+  end
+
+  def test_array_to_cells_with_escape_formulas_as_an_array
+    row = ['=HYPERLINK("http://www.example.com", "CSV Payload")', '+Foo', '-Bar']
+    @ws.add_row row, escape_formulas: [true, false, true]
+
+    assert_equal @ws.rows.last.cells.first.escape_formulas, true
+    assert_equal @ws.rows.last.cells[1].escape_formulas, false
+    assert_equal @ws.rows.last.cells[2].escape_formulas, true
+  end
+
   def test_custom_height
     @row.height = 20
     assert(@row.custom_height)