PhpSpreadsheet/tests/PhpSpreadsheetTests/Writer/Html/XssVulnerabilityTest.php

<?php

declare(strict_types=1);

namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;

use PhpOffice\PhpSpreadsheet\RichText\RichText;
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Html;
use PhpOffice\PhpSpreadsheetTests\Functional;

class XssVulnerabilityTest extends Functional\AbstractFunctional
{
    public static function providerXssRichText(): array
    {
        return [
            'basic text no problem' => ['Hello, I am safely viewing your site', 'Hello, I am safely viewing your site'],
            'link no problem' => ["<a href='Visit Google'>Google is here</a>", "<a href='Visit Google'>Google is here</a>"],
            'script tag' => ["Hello, I am trying to <script>alert('Hack');</script> your site", 'Hello, I am trying to  your site'],
            'javascript tag no hex' => ["<a href='javascript:alert(1)'>CLICK</a>", "<a href='(1)'>CLICK</a>"],
            'javascript tag' => ["<a href='&#x2000;javascript:alert(1)'>CLICK</a>", "<a href=' (1)'>CLICK</a>"],
            'with unicode' => ['<a href="\\u0001java\\u0003script:alert(1)">CLICK<a>', '<a href="(1)">CLICK<a>'],
            'inline css' => ['<li style="list-style-image: url(javascript:alert(0))">', '<li >'],
            'char value chevron' => ["\x3cscript src=http://www.example.com/malicious-code.js\x3e\x3c/script\x3e"],
            'hexadecimal html' => ['<IMG SRC=&#106&#x61&#x76&#x61&#x73&#109&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>', '<IMG >'],
            'iframe' => ['<iframe width="560" onclick="alert(\'xss\')" height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen></iframe>', '&lt;iframe width="560"  height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen&gt;&lt;/iframe&gt;'],
        ];
    }

    /**
     * @dataProvider providerXssRichText
     */
    public function testXssInComment(string $xssTextString, ?string $expected = null): void
    {
        $spreadsheet = new Spreadsheet();
        $startCell = '<td class="column0 style0 s">';
        $cellText = 'XSS Test';
        $endCell = $cellText . '</td>';
        if ($expected === null) { // whole comment stripped away
            $expected = $startCell . $endCell;
        } else {
            $expected = $startCell . '<a class="comment-indicator"></a><div class="comment">' . $expected . '</div>' . PHP_EOL . $endCell;
        }

        $richText = new RichText();
        $richText->createText($xssTextString);

        $spreadsheet->getActiveSheet()->getCell('A1')->setValue($cellText);

        $spreadsheet->getActiveSheet()
            ->getComment('A1')
            ->setText($richText);

        $writer = new Html($spreadsheet);

        $verify = $writer->generateHtmlAll();
        // Ensure that executable js has been stripped from the comments
        self::assertStringContainsString($expected, $verify);
        $spreadsheet->disconnectWorksheets();
    }
}