Merge commit from fork

src/PhpSpreadsheet/Style/NumberFormat/Formatter.php

@@ -144,11 +144,16 @@ class Formatter extends BaseFormatter
                 ['\$', self::QUOTE_REPLACEMENT],
                 StringHelper::convertToString($value, lessFloatPrecision: $lessFloatPrecision)
             );
+            $temp = preg_replace(self::SYMBOL_AT, $value, $formatx) ?? $value;
+            if (is_callable($callBack)) {
+                $temp = $callBack($temp, $formatx);
+            }
+            /** @var string $temp */
 
             return str_replace(
                 ['"', self::QUOTE_REPLACEMENT],
                 ['', '"'],
-                preg_replace(self::SYMBOL_AT, $value, $formatx) ?? $value
+                $temp
             );
         }
 

src/PhpSpreadsheet/Writer/Html.php

@@ -2102,7 +2102,7 @@ class Html extends BaseWriter
         }
 
         // convert to PCDATA
-        $result = htmlspecialchars($value, Settings::htmlEntityFlags());
+        $result = htmlspecialchars($value, ENT_NOQUOTES);
 
         // color span tag
         if ($color !== null) {

tests/PhpSpreadsheetTests/Writer/Html/AtSignFormatTest.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;
+
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Writer\Html as HtmlWriter;
+use PHPUnit\Framework\TestCase;
+
+class AtSignFormatTest extends TestCase
+{
+    public function testAtSignFormat(): void
+    {
+        $spreadsheet = new Spreadsheet();
+        $sheet = $spreadsheet->getActiveSheet();
+        $payload = '<img src=x onerror=alert(document.domain)>';
+        $formatCode = '@ "items"';
+        $sheet->setCellValue('A1', $payload);
+        $sheet->getStyle('A1')
+            ->getNumberFormat()
+            ->setFormatCode($formatCode);
+
+        $writer = new HtmlWriter($spreadsheet);
+        $html = $writer->generateHTMLAll();
+        self::assertStringContainsString('<td class="column0 style1 s">&lt;img src=x onerror=alert(document.domain)&gt; items</td>', $html);
+        $spreadsheet->disconnectWorksheets();
+    }
+}