diff options
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell.rb | 15 | ||||
| -rw-r--r-- | lib/axlsx/workbook/worksheet/cell_serializer.rb | 6 | ||||
| -rw-r--r-- | lib/axlsx/workbook/worksheet/rich_text_run.rb | 5 | ||||
| -rw-r--r-- | test/workbook/worksheet/tc_worksheet.rb | 2 |
4 files changed, 19 insertions, 9 deletions
diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb index 46391229..cd9e1829 100644 --- a/lib/axlsx/workbook/worksheet/cell.rb +++ b/lib/axlsx/workbook/worksheet/cell.rb @@ -363,6 +363,17 @@ module Axlsx string_width(value, font_size) end end + + # Returns the sanatized value + # TODO find a better way to do this as it accounts for 30% of + # processing time in benchmarking... + def clean_value + if type == :string && !Axlsx::trust_input + Axlsx::sanitize(::CGI.escapeHTML(@value.to_s)) + else + @value.to_s + end + end private @@ -452,9 +463,7 @@ module Axlsx #consumer is responsible for ensuring the iso_8601 format when specifying this type v else - # TODO find a better way to do this as it accounts for 30% of - # processing time in benchmarking... - Axlsx::trust_input ? v.to_s : Axlsx::sanitize(::CGI.escapeHTML(v.to_s)) + v.to_s end end diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb index 73b7c110..9a9f9465 100644 --- a/lib/axlsx/workbook/worksheet/cell_serializer.rb +++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb @@ -28,7 +28,7 @@ module Axlsx elsif cell.contains_rich_text? cell.value.to_xml_string(str) else - str << ('<t>' << cell.value.to_s << '</t>') + str << ('<t>' << cell.clean_value << '</t>') end str end @@ -86,7 +86,7 @@ module Axlsx # @param [String] str The string the serialized content will be appended to. # @return [String] def formula_serialization(cell, str='') - str << ('t="str"><f>' << cell.value.to_s.sub('=', '') << '</f>') + str << ('t="str"><f>' << cell.clean_value.to_s.sub('=', '') << '</f>') str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil? end @@ -95,7 +95,7 @@ module Axlsx # @param [String] str The string the serialized content will be appended to. # @return [String] def array_formula_serialization(cell, str='') - str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.value.to_s.sub('{=', '').sub(/}$/, '') << '</f>') + str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.sub('{=', '').sub(/}$/, '') << '</f>') str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil? end diff --git a/lib/axlsx/workbook/worksheet/rich_text_run.rb b/lib/axlsx/workbook/worksheet/rich_text_run.rb index e91514ed..e56dc3ae 100644 --- a/lib/axlsx/workbook/worksheet/rich_text_run.rb +++ b/lib/axlsx/workbook/worksheet/rich_text_run.rb @@ -16,7 +16,7 @@ module Axlsx end def value=(value) - @value = Axlsx::trust_input ? value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(value.to_s)) + @value = value end attr_accessor :cell @@ -208,7 +208,8 @@ module Axlsx str << ('<' << key.to_s << ' val="' << xml_value(data[key]) << '"/>') end end - str << ('</rPr><t>' << @value.to_s << '</t></r>') + clean_value = Axlsx::trust_input ? @value.to_s : ::CGI.escapeHTML(Axlsx::sanitize(@value.to_s)) + str << ('</rPr><t>' << clean_value << '</t></r>') end private diff --git a/test/workbook/worksheet/tc_worksheet.rb b/test/workbook/worksheet/tc_worksheet.rb index b399b306..574522a2 100644 --- a/test/workbook/worksheet/tc_worksheet.rb +++ b/test/workbook/worksheet/tc_worksheet.rb @@ -402,7 +402,7 @@ class TestWorksheet < Test::Unit::TestCase Axlsx::trust_input = false nasties = "\v\u2028\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u001f" @ws.add_row [nasties] - assert_equal(nil, @ws.rows.last.cells.last.value.index("\v")) + assert_equal(0, @ws.rows.last.cells.last.value.index("\v")) assert_equal(nil, @ws.to_xml_string.index("\v")) Axlsx::trust_input = old end |