From 7bb62e8870ae369a9b2423c87d5e0875873c3834 Mon Sep 17 00:00:00 2001
From: Stefan Daschek <stefan@die-antwort.eu>
Date: Wed, 3 Jul 2013 16:37:35 +0200
Subject: Escape special chars for comments’ text and author.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/axlsx/workbook/worksheet/comment.rb | 4 ++--
 test/workbook/worksheet/tc_comment.rb   | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/axlsx/workbook/worksheet/comment.rb b/lib/axlsx/workbook/worksheet/comment.rb
index 0c885fda..eee2b58a 100644
--- a/lib/axlsx/workbook/worksheet/comment.rb
+++ b/lib/axlsx/workbook/worksheet/comment.rb
@@ -66,11 +66,11 @@ module Axlsx
       str << '<comment ref="' << ref << '" authorId="' << author_index.to_s << '">'
       str << '<text><r>'
       str << '<rPr> <b/><color indexed="81"/></rPr>'
-      str << '<t>' << author.to_s << ':
+      str << '<t>' << ::CGI.escapeHTML(author.to_s) << ':
 </t></r>'
       str << '<r>'
       str << '<rPr><color indexed="81"/></rPr>'
-      str << '<t>' << text << '</t></r></text>'
+      str << '<t>' << ::CGI.escapeHTML(text) << '</t></r></text>'
       str << '</comment>'
     end
 
diff --git a/test/workbook/worksheet/tc_comment.rb b/test/workbook/worksheet/tc_comment.rb
index e57409ca..9f30436d 100644
--- a/test/workbook/worksheet/tc_comment.rb
+++ b/test/workbook/worksheet/tc_comment.rb
@@ -5,7 +5,7 @@ class TestComment < Test::Unit::TestCase
     p = Axlsx::Package.new
     wb = p.workbook
     @ws = wb.add_worksheet
-    @c1 = @ws.add_comment :ref => 'A1', :text => 'penut machine', :author => 'crank', :visible => false
+    @c1 = @ws.add_comment :ref => 'A1', :text => 'text with special char <', :author => 'author with special char <', :visible => false
     @c2 = @ws.add_comment :ref => 'C3', :text => 'rust bucket', :author => 'PO'
   end
 
@@ -14,12 +14,12 @@ class TestComment < Test::Unit::TestCase
   end
 
   def test_author
-    assert(@c1.author == 'crank')
+    assert(@c1.author == 'author with special char <')
     assert(@c2.author == 'PO')
   end
 
   def test_text
-    assert(@c1.text == 'penut machine')
+    assert(@c1.text == 'text with special char <')
     assert(@c2.text == 'rust bucket')
   end
 
-- 
cgit v1.2.3