From e65ec48bc86379efed0c1b87a13bff14930416d5 Mon Sep 17 00:00:00 2001
From: Zsolt Kozaroczy <kiskoza@gmail.com>
Date: Sun, 29 Dec 2019 19:11:05 +0100
Subject: Escape special characters in charts (#40)

Fixes #37
---
 lib/axlsx/drawing/series_title.rb |  4 +++-
 lib/axlsx/drawing/title.rb        |  5 +++--
 test/drawing/tc_series_title.rb   | 21 +++++++++++++++++++++
 test/drawing/tc_title.rb          | 16 ++++++++++++++++
 test/tc_axlsx.rb                  |  6 ++++++
 5 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/lib/axlsx/drawing/series_title.rb b/lib/axlsx/drawing/series_title.rb
index 9ef97304..2e730dea 100644
--- a/lib/axlsx/drawing/series_title.rb
+++ b/lib/axlsx/drawing/series_title.rb
@@ -7,13 +7,15 @@ module Axlsx
     # @param [String] str
     # @return [String]
     def to_xml_string(str = '')
+      clean_value = Axlsx::trust_input ? @text.to_s : ::CGI.escapeHTML(Axlsx::sanitize(@text.to_s))
+
       str << '<c:tx>'
       str << '<c:strRef>'
       str << ('<c:f>' << Axlsx::cell_range([@cell]) << '</c:f>')
       str << '<c:strCache>'
       str << '<c:ptCount val="1"/>'
       str << '<c:pt idx="0">'
-      str << ('<c:v>' << @text << '</c:v>')
+      str << ('<c:v>' << clean_value << '</c:v>')
       str << '</c:pt>'
       str << '</c:strCache>'
       str << '</c:strRef>'
diff --git a/lib/axlsx/drawing/title.rb b/lib/axlsx/drawing/title.rb
index 7f2ff9f4..002ae94f 100644
--- a/lib/axlsx/drawing/title.rb
+++ b/lib/axlsx/drawing/title.rb
@@ -62,6 +62,7 @@ module Axlsx
     def to_xml_string(str = '')
       str << '<c:title>'
       unless @text.empty?
+        clean_value = Axlsx::trust_input ? @text.to_s : ::CGI.escapeHTML(Axlsx::sanitize(@text.to_s))
         str << '<c:tx>'
         if @cell.is_a?(Cell)
           str << '<c:strRef>'
@@ -69,7 +70,7 @@ module Axlsx
           str << '<c:strCache>'
           str << '<c:ptCount val="1"/>'
           str << '<c:pt idx="0">'
-          str << ('<c:v>' << @text << '</c:v>')
+          str << ('<c:v>' << clean_value << '</c:v>')
           str << '</c:pt>'
           str << '</c:strCache>'
           str << '</c:strRef>'
@@ -80,7 +81,7 @@ module Axlsx
             str << '<a:p>'
               str << '<a:r>'
                 str << ('<a:rPr sz="' << @text_size.to_s << '"/>')
-                str << ('<a:t>' << @text.to_s << '</a:t>')
+                str << ('<a:t>' << clean_value << '</a:t>')
               str << '</a:r>'
             str << '</a:p>'
           str << '</c:rich>'
diff --git a/test/drawing/tc_series_title.rb b/test/drawing/tc_series_title.rb
index 90427e9c..b85aece3 100644
--- a/test/drawing/tc_series_title.rb
+++ b/test/drawing/tc_series_title.rb
@@ -30,4 +30,25 @@ class TestSeriesTitle < Test::Unit::TestCase
     assert(@title.text == "one")
   end
 
+  def test_to_xml_string_for_special_characters
+    @chart.add_series(title: @title, data: [3, 7], labels: ['A', 'B'])
+
+    @title.text = "&><'\""
+
+    doc = Nokogiri::XML(@chart.to_xml_string)
+    errors = doc.errors
+    assert(errors.empty?, "invalid xml: #{errors.map(&:to_s).join(', ')}")
+  end
+
+  def test_to_xml_string_for_special_characters_in_cell
+    @chart.add_series(title: @title, data: [3, 7], labels: ['A', 'B'])
+
+    cell = @row.cells.first
+    cell.value = "&><'\""
+    @title.cell = cell
+
+    doc = Nokogiri::XML(@chart.to_xml_string)
+    errors = doc.errors
+    assert(errors.empty?, "invalid xml: #{errors.map(&:to_s).join(', ')}")
+  end
 end
diff --git a/test/drawing/tc_title.rb b/test/drawing/tc_title.rb
index 95e44602..cdbd87e1 100644
--- a/test/drawing/tc_title.rb
+++ b/test/drawing/tc_title.rb
@@ -51,4 +51,20 @@ class TestTitle < Test::Unit::TestCase
     assert_equal(1, doc.xpath('//c:v[text()="one"]').size)
   end
 
+  def test_to_xml_string_for_special_characters
+    @chart.title.text = "&><'\""
+    doc = Nokogiri::XML(@chart.to_xml_string)
+    errors = doc.errors
+    assert(errors.empty?, "invalid xml: #{errors.map(&:to_s).join(', ')}")
+  end
+
+  def test_to_xml_string_for_special_characters_in_cell
+    cell = @row.cells.first
+    cell.value = "&><'\""
+
+    @chart.title.cell = cell
+    doc = Nokogiri::XML(@chart.to_xml_string)
+    errors = doc.errors
+    assert(errors.empty?, "invalid xml: #{errors.map(&:to_s).join(', ')}")
+  end
 end
diff --git a/test/tc_axlsx.rb b/test/tc_axlsx.rb
index 3d6a2e70..55bca1f4 100644
--- a/test/tc_axlsx.rb
+++ b/test/tc_axlsx.rb
@@ -24,8 +24,14 @@ class TestAxlsx < Test::Unit::TestCase
 
 
   def test_trust_input_can_be_set_to_true
+    # Class variables like this are not reset between test runs, so we have
+    # to save and restore the original value manually.
+    old = Axlsx.trust_input
+
     Axlsx.trust_input = true
     assert_equal true, Axlsx.trust_input
+
+    Axlsx.trust_input = old
   end
   def test_cell_range_relative
     p = Axlsx::Package.new
-- 
cgit v1.2.3