From a0dc908f9df76f8c31a3238b1829eea2fd10c666 Mon Sep 17 00:00:00 2001 From: Arkadiy Butermanov Date: Tue, 5 Apr 2016 14:06:10 +0300 Subject: Escape html in :text type --- lib/axlsx/workbook/worksheet/cell.rb | 4 ++-- lib/axlsx/workbook/worksheet/cell_serializer.rb | 8 ++++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/axlsx/workbook/worksheet/cell.rb b/lib/axlsx/workbook/worksheet/cell.rb index a96b3cb7..777b7812 100644 --- a/lib/axlsx/workbook/worksheet/cell.rb +++ b/lib/axlsx/workbook/worksheet/cell.rb @@ -123,7 +123,7 @@ module Axlsx # Indicates if the cell is good for shared string table def plain_string? - type == :string && # String typed + (type == :string || type == :text) && # String typed !is_text_run? && # No inline styles !@value.nil? && # Not nil !@value.empty? && # Not empty @@ -368,7 +368,7 @@ module Axlsx # TODO find a better way to do this as it accounts for 30% of # processing time in benchmarking... def clean_value - if type == :string && !Axlsx::trust_input + if (type == :string || type == :text) && !Axlsx::trust_input Axlsx::sanitize(::CGI.escapeHTML(@value.to_s)) else @value.to_s diff --git a/lib/axlsx/workbook/worksheet/cell_serializer.rb b/lib/axlsx/workbook/worksheet/cell_serializer.rb index 4da391b6..76a3c386 100644 --- a/lib/axlsx/workbook/worksheet/cell_serializer.rb +++ b/lib/axlsx/workbook/worksheet/cell_serializer.rb @@ -141,8 +141,12 @@ module Axlsx # @param [Cell] cell The cell that is being serialized # @param [String] str The string the serialized content will be appended to. # @return [String] - def text(cell, str='') - inline_string_serialization cell, str + def text(cell, str) + if cell.ssti.nil? + inline_string_serialization cell, str + else + value_serialization 's', cell.ssti, str + end end private -- cgit v1.2.3