diff options
| -rw-r--r-- | lib/axlsx/util/constants.rb | 10 | ||||
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell.rb | 14 | ||||
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell_serializer.rb | 4 |
3 files changed, 14 insertions, 14 deletions
diff --git a/lib/axlsx/util/constants.rb b/lib/axlsx/util/constants.rb index 4697bb3a..42a7683c 100644 --- a/lib/axlsx/util/constants.rb +++ b/lib/axlsx/util/constants.rb @@ -413,4 +413,14 @@ module Axlsx # Numeric recognition NUMERIC_REGEX = /\A[+-]?\d+?\Z/.freeze + + # Leading characters that indicate a formula. + # See: https://owasp.org/www-community/attacks/CSV_Injection + FORMULA_PREFIX = '=' + + # Leading characters that indicate an array formula. + ARRAY_FORMULA_PREFIX = '{=' + + # Trailing character that indicates an array formula. + ARRAY_FORMULA_SUFFIX = '}' end diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb index 929a7c28..f47781f0 100644 --- a/lib/axlsx/workbook/worksheet/cell.rb +++ b/lib/axlsx/workbook/worksheet/cell.rb @@ -72,16 +72,6 @@ module Axlsx CELL_TYPES = [:date, :time, :float, :integer, :richtext, :string, :boolean, :iso_8601, :text].freeze - # Leading characters that indicate a formula. - # See: https://owasp.org/www-community/attacks/CSV_Injection - FORMULA_PREFIXES = ['='].freeze - - # Leading characters that indicate an array formula. - ARRAY_FORMULA_PREFIXES = ['{='].freeze - - # Trailing character that indicates an array formula. - ARRAY_FORMULA_SUFFIX = '}' - # The index of the cellXfs item to be applied to this cell. # @return [Integer] # @see Axlsx::Styles @@ -395,14 +385,14 @@ module Axlsx def is_formula? return false if escape_formulas - type == :string && @value.to_s.start_with?(*FORMULA_PREFIXES) + type == :string && @value.to_s.start_with?(FORMULA_PREFIX) end def is_array_formula? return false if escape_formulas type == :string && - @value.to_s.start_with?(*ARRAY_FORMULA_PREFIXES) && + @value.to_s.start_with?(ARRAY_FORMULA_PREFIX) && @value.to_s.end_with?(ARRAY_FORMULA_SUFFIX) end diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb index e1bdf728..9d39add3 100644 --- a/lib/axlsx/workbook/worksheet/cell_serializer.rb +++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb @@ -88,7 +88,7 @@ module Axlsx # @param [String] str The string the serialized content will be appended to. # @return [String] def formula_serialization(cell, str = +'') - str << 't="str"><f>' << cell.clean_value.to_s.sub('=', '') << '</f>' + str << 't="str"><f>' << cell.clean_value.to_s.delete_prefix(FORMULA_PREFIX) << '</f>' str << '<v>' << cell.formula_value.to_s << '</v>' unless cell.formula_value.nil? end @@ -97,7 +97,7 @@ module Axlsx # @param [String] str The string the serialized content will be appended to. # @return [String] def array_formula_serialization(cell, str = +'') - str << 't="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.sub('{=', '').sub(/}$/, '') << '</f>' + str << 't="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.delete_prefix(ARRAY_FORMULA_PREFIX).delete_suffix(ARRAY_FORMULA_SUFFIX) << '</f>' str << '<v>' << cell.formula_value.to_s << '</v>' unless cell.formula_value.nil? end |