geckon01/PhpSpreadsheet
1
0
Fork 0
mirror of https://github.com/PHPOffice/PhpSpreadsheet.git synced 2026-09-16 13:06:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor Correction

Browse Source 
Sanitize font name.
This commit is contained in:
oleibman
2024-03-27 14:01:13 -07:00
parent a9ac138300
commit c695d5ca8b
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/PhpSpreadsheet/Writer/Html.php
+1 -1
View File
@@ -1039,7 +1039,7 @@ class Html extends BaseWriter
}
$css['color'] = '#' . $font->getColor()->getRGB();
$css['font-family'] = '\'' . $font->getName() . '\'';
$css['font-family'] = '\'' . htmlspecialchars((string) $font->getName(), ENT_QUOTES) . '\'';
$css['font-size'] = $font->getSize() . 'pt';
return $css;
tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php
+17
View File
@@ -59,4 +59,21 @@ class XssVulnerabilityTest extends Functional\AbstractFunctional
self::assertStringContainsString($expected, $verify);
$spreadsheet->disconnectWorksheets();
}
public function testXssInFontName(): void
{
$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();
$sheet->getCell('A1')->setValue('here');
$used = 'Calibri</style><script type="text/javascript">alert("hello");</script><style type="text/css">';
$expected = "font-family:'Calibri&lt;/style&gt;&lt;script type=&quot;text/javascript&quot;&gt;alert(&quot;hello&quot;);&lt;/script&gt;&lt;style type=&quot;text/css&quot;&gt;'";
$sheet->getStyle('A1')->getFont()->setName($used);
$writer = new Html($spreadsheet);
$verify = $writer->generateHtmlAll();
// Ensure that executable js has been stripped
self::assertStringNotContainsString($expected, $used);
self::assertStringContainsString($expected, $verify);
$spreadsheet->disconnectWorksheets();
}
}