Skip to content

Commit 20d7810

Browse files
EmpactEmpact
authored
Merge pull request #392 from welguisz/option-off-html-strings
Disable html injection
2 parents 85c2736 + ae2cb13 commit 20d7810

File tree

5 files changed

+80
-33
lines changed

5 files changed

+80
-33
lines changed

‎lib/roo/excelx.rb

100644100755
+4-2
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,9 @@ def initialize(filename_or_stream, options = {})
3939
sheet_options = {}
4040
sheet_options[:expand_merged_ranges] = (options[:expand_merged_ranges] || false)
4141
sheet_options[:no_hyperlinks] = (options[:no_hyperlinks] || false)
42-
42+
shared_options = {}
43+
44+
shared_options[:disable_html_wrapper] = (options[:disable_html_wrapper] || false)
4345
unless is_stream?(filename_or_stream)
4446
file_type_check(filename_or_stream, %w[.xlsx .xlsm], 'an Excel 2007', file_warning, packed)
4547
basename = find_basename(filename_or_stream)
@@ -52,7 +54,7 @@ def initialize(filename_or_stream, options = {})
5254
@tmpdir = self.class.make_tempdir(self, basename, options[:tmpdir_root])
5355
ObjectSpace.define_finalizer(self, self.class.finalize(object_id))
5456

55-
@shared = Shared.new(@tmpdir)
57+
@shared = Shared.new(@tmpdir, shared_options)
5658
@filename = local_filename(filename_or_stream, @tmpdir, packed)
5759
process_zipfile(@filename || filename_or_stream)
5860

‎lib/roo/excelx/extractor.rb

100644100755
+2-1
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,9 @@
11
module Roo
22
class Excelx
33
class Extractor
4-
def initialize(path)
4+
def initialize(path, options = {})
55
@path = path
6+
@options = options
67
end
78

89
private

‎lib/roo/excelx/shared.rb

100644100755
+3-2
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,20 @@ class Excelx
55
# to various inititializers.
66
class Shared
77
attr_accessor :comments_files, :sheet_files, :rels_files
8-
def initialize(dir)
8+
def initialize(dir, options = {})
99
@dir = dir
1010
@comments_files = []
1111
@sheet_files = []
1212
@rels_files = []
13+
@options = options
1314
end
1415

1516
def styles
1617
@styles ||= Styles.new(File.join(@dir, 'roo_styles.xml'))
1718
end
1819

1920
def shared_strings
20-
@shared_strings ||= SharedStrings.new(File.join(@dir, 'roo_sharedStrings.xml'))
21+
@shared_strings ||= SharedStrings.new(File.join(@dir, 'roo_sharedStrings.xml'), @options)
2122
end
2223

2324
def workbook

‎lib/roo/excelx/shared_strings.rb

+1
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ def to_html
2626
# Use to_html or to_a for html returns
2727
# See what is happening with commit???
2828
def use_html?(index)
29+
return false if @options[:disable_html_wrapper]
2930
to_html[index][/<([biu]|sup|sub)>/]
3031
end
3132

‎spec/lib/roo/excelx_spec.rb

+70-28
Original file line numberDiff line numberDiff line change
@@ -480,34 +480,36 @@
480480
end
481481

482482
describe '#html_strings' do
483-
let(:path) { 'test/files/html_strings_formatting.xlsx' }
484-
485-
it 'returns the expected result' do
486-
expect(subject.excelx_value(1, 1, "Sheet1")).to eq "This has no formatting."
487-
expect(subject.excelx_value(2, 1, "Sheet1")).to eq "<html>This has<b> bold </b>formatting.</html>"
488-
expect(subject.excelx_value(2, 2, "Sheet1")).to eq "<html>This has <i>italics</i> formatting.</html>"
489-
expect(subject.excelx_value(2, 3, "Sheet1")).to eq "<html>This has <u>underline</u> format.</html>"
490-
expect(subject.excelx_value(2, 4, "Sheet1")).to eq "<html>Superscript. x<sup>123</sup></html>"
491-
expect(subject.excelx_value(2, 5, "Sheet1")).to eq "<html>SubScript. T<sub>j</sub></html>"
492-
493-
expect(subject.excelx_value(3, 1, "Sheet1")).to eq "<html>Bold, italics <b><i>together</i></b>.</html>"
494-
expect(subject.excelx_value(3, 2, "Sheet1")).to eq "<html>Bold, Underline <b><u>together</u></b>.</html>"
495-
expect(subject.excelx_value(3, 3, "Sheet1")).to eq "<html>Bold, Superscript. <b>x</b><sup><b>N</b></sup></html>"
496-
expect(subject.excelx_value(3, 4, "Sheet1")).to eq "<html>Bold, Subscript. <b>T</b><sub><b>abc</b></sub></html>"
497-
expect(subject.excelx_value(3, 5, "Sheet1")).to eq "<html>Italics, Underline <i><u>together</u></i>.</html>"
498-
expect(subject.excelx_value(3, 6, "Sheet1")).to eq "<html>Italics, Superscript. <i>X</i><sup><i>abc</i></sup></html>"
499-
expect(subject.excelx_value(3, 7, "Sheet1")).to eq "<html>Italics, Subscript. <i>B</i><sub><i>efg</i></sub></html>"
500-
expect(subject.excelx_value(4, 1, "Sheet1")).to eq "<html>Bold, italics underline,<b><i><u> together</u></i></b>.</html>"
501-
expect(subject.excelx_value(4, 2, "Sheet1")).to eq "<html>Bold, italics, superscript. <b>X</b><sup><b><i>abc</i></b></sup><b><i>123</i></b></html>"
502-
expect(subject.excelx_value(4, 3, "Sheet1")).to eq "<html>Bold, Italics, subscript. <b><i>Mg</i></b><sub><b><i>ha</i></b></sub><b><i>2</i></b></html>"
503-
expect(subject.excelx_value(4, 4, "Sheet1")).to eq "<html>Bold, Underline, superscript. <b><u>AB</u></b><sup><b><u>C12</u></b></sup><b><u>3</u></b></html>"
504-
expect(subject.excelx_value(4, 5, "Sheet1")).to eq "<html>Bold, Underline, subscript. <b><u>Good</u></b><sub><b><u>XYZ</u></b></sub></html>"
505-
expect(subject.excelx_value(4, 6, "Sheet1")).to eq "<html>Italics, Underline, superscript. <i><u>Up</u></i><sup><i><u>swing</u></i></sup></html>"
506-
expect(subject.excelx_value(4, 7, "Sheet1")).to eq "<html>Italics, Underline, subscript. <i><u>T</u></i><sub><i><u>swing</u></i></sub></html>"
507-
expect(subject.excelx_value(5, 1, "Sheet1")).to eq "<html>Bold, italics, underline, superscript. <b><i><u>GHJK</u></i></b><sup><b><i><u>190</u></i></b></sup><b><i><u>4</u></i></b></html>"
508-
expect(subject.excelx_value(5, 2, "Sheet1")).to eq "<html>Bold, italics, underline, subscript. <b><i><u>Mike</u></i></b><sub><b><i><u>drop</u></i></b></sub></html>"
509-
expect(subject.excelx_value(6, 1, "Sheet1")).to eq "See that regular html tags do not create html tags.\n<ol>\n <li> Denver Broncos </li>\n <li> Carolina Panthers </li>\n <li> New England Patriots</li>\n <li>Arizona Panthers</li>\n</ol>"
510-
expect(subject.excelx_value(7, 1, "Sheet1")).to eq "<html>Does create html tags when formatting is used..\n<ol>\n <li> <b>Denver Broncos</b> </li>\n <li> <i>Carolina Panthers </i></li>\n <li> <u>New England Patriots</u></li>\n <li>Arizona Panthers</li>\n</ol></html>"
483+
describe "HTML Parsing Enabling" do
484+
let(:path) { 'test/files/html_strings_formatting.xlsx' }
485+
486+
it 'returns the expected result' do
487+
expect(subject.excelx_value(1, 1, "Sheet1")).to eq("This has no formatting.")
488+
expect(subject.excelx_value(2, 1, "Sheet1")).to eq("<html>This has<b> bold </b>formatting.</html>")
489+
expect(subject.excelx_value(2, 2, "Sheet1")).to eq("<html>This has <i>italics</i> formatting.</html>")
490+
expect(subject.excelx_value(2, 3, "Sheet1")).to eq("<html>This has <u>underline</u> format.</html>")
491+
expect(subject.excelx_value(2, 4, "Sheet1")).to eq("<html>Superscript. x<sup>123</sup></html>")
492+
expect(subject.excelx_value(2, 5, "Sheet1")).to eq("<html>SubScript. T<sub>j</sub></html>")
493+
494+
expect(subject.excelx_value(3, 1, "Sheet1")).to eq("<html>Bold, italics <b><i>together</i></b>.</html>")
495+
expect(subject.excelx_value(3, 2, "Sheet1")).to eq("<html>Bold, Underline <b><u>together</u></b>.</html>")
496+
expect(subject.excelx_value(3, 3, "Sheet1")).to eq("<html>Bold, Superscript. <b>x</b><sup><b>N</b></sup></html>")
497+
expect(subject.excelx_value(3, 4, "Sheet1")).to eq("<html>Bold, Subscript. <b>T</b><sub><b>abc</b></sub></html>")
498+
expect(subject.excelx_value(3, 5, "Sheet1")).to eq("<html>Italics, Underline <i><u>together</u></i>.</html>")
499+
expect(subject.excelx_value(3, 6, "Sheet1")).to eq("<html>Italics, Superscript. <i>X</i><sup><i>abc</i></sup></html>")
500+
expect(subject.excelx_value(3, 7, "Sheet1")).to eq("<html>Italics, Subscript. <i>B</i><sub><i>efg</i></sub></html>")
501+
expect(subject.excelx_value(4, 1, "Sheet1")).to eq("<html>Bold, italics underline,<b><i><u> together</u></i></b>.</html>")
502+
expect(subject.excelx_value(4, 2, "Sheet1")).to eq("<html>Bold, italics, superscript. <b>X</b><sup><b><i>abc</i></b></sup><b><i>123</i></b></html>")
503+
expect(subject.excelx_value(4, 3, "Sheet1")).to eq("<html>Bold, Italics, subscript. <b><i>Mg</i></b><sub><b><i>ha</i></b></sub><b><i>2</i></b></html>")
504+
expect(subject.excelx_value(4, 4, "Sheet1")).to eq("<html>Bold, Underline, superscript. <b><u>AB</u></b><sup><b><u>C12</u></b></sup><b><u>3</u></b></html>")
505+
expect(subject.excelx_value(4, 5, "Sheet1")).to eq("<html>Bold, Underline, subscript. <b><u>Good</u></b><sub><b><u>XYZ</u></b></sub></html>")
506+
expect(subject.excelx_value(4, 6, "Sheet1")).to eq("<html>Italics, Underline, superscript. <i><u>Up</u></i><sup><i><u>swing</u></i></sup></html>")
507+
expect(subject.excelx_value(4, 7, "Sheet1")).to eq("<html>Italics, Underline, subscript. <i><u>T</u></i><sub><i><u>swing</u></i></sub></html>")
508+
expect(subject.excelx_value(5, 1, "Sheet1")).to eq("<html>Bold, italics, underline, superscript. <b><i><u>GHJK</u></i></b><sup><b><i><u>190</u></i></b></sup><b><i><u>4</u></i></b></html>")
509+
expect(subject.excelx_value(5, 2, "Sheet1")).to eq("<html>Bold, italics, underline, subscript. <b><i><u>Mike</u></i></b><sub><b><i><u>drop</u></i></b></sub></html>")
510+
expect(subject.excelx_value(6, 1, "Sheet1")).to eq("See that regular html tags do not create html tags.\n<ol>\n <li> Denver Broncos </li>\n <li> Carolina Panthers </li>\n <li> New England Patriots</li>\n <li>Arizona Panthers</li>\n</ol>")
511+
expect(subject.excelx_value(7, 1, "Sheet1")).to eq("<html>Does create html tags when formatting is used..\n<ol>\n <li> <b>Denver Broncos</b> </li>\n <li> <i>Carolina Panthers </i></li>\n <li> <u>New England Patriots</u></li>\n <li>Arizona Panthers</li>\n</ol></html>")
512+
end
511513
end
512514
end
513515

@@ -535,3 +537,43 @@
535537
end
536538
end
537539
end
540+
541+
describe 'Roo::Excelx with options set' do
542+
subject(:xlsx) do
543+
Roo::Excelx.new(path, disable_html_wrapper: true)
544+
end
545+
546+
describe '#html_strings' do
547+
describe "HTML Parsing Disabled" do
548+
let(:path) { 'test/files/html_strings_formatting.xlsx' }
549+
550+
it 'returns the expected result' do
551+
expect(subject.excelx_value(1, 1, "Sheet1")).to eq("This has no formatting.")
552+
expect(subject.excelx_value(2, 1, "Sheet1")).to eq("This has bold formatting.")
553+
expect(subject.excelx_value(2, 2, "Sheet1")).to eq("This has italics formatting.")
554+
expect(subject.excelx_value(2, 3, "Sheet1")).to eq("This has underline format.")
555+
expect(subject.excelx_value(2, 4, "Sheet1")).to eq("Superscript. x123")
556+
expect(subject.excelx_value(2, 5, "Sheet1")).to eq("SubScript. Tj")
557+
558+
expect(subject.excelx_value(3, 1, "Sheet1")).to eq("Bold, italics together.")
559+
expect(subject.excelx_value(3, 2, "Sheet1")).to eq("Bold, Underline together.")
560+
expect(subject.excelx_value(3, 3, "Sheet1")).to eq("Bold, Superscript. xN")
561+
expect(subject.excelx_value(3, 4, "Sheet1")).to eq("Bold, Subscript. Tabc")
562+
expect(subject.excelx_value(3, 5, "Sheet1")).to eq("Italics, Underline together.")
563+
expect(subject.excelx_value(3, 6, "Sheet1")).to eq("Italics, Superscript. Xabc")
564+
expect(subject.excelx_value(3, 7, "Sheet1")).to eq("Italics, Subscript. Befg")
565+
expect(subject.excelx_value(4, 1, "Sheet1")).to eq("Bold, italics underline, together.")
566+
expect(subject.excelx_value(4, 2, "Sheet1")).to eq("Bold, italics, superscript. Xabc123")
567+
expect(subject.excelx_value(4, 3, "Sheet1")).to eq("Bold, Italics, subscript. Mgha2")
568+
expect(subject.excelx_value(4, 4, "Sheet1")).to eq("Bold, Underline, superscript. ABC123")
569+
expect(subject.excelx_value(4, 5, "Sheet1")).to eq("Bold, Underline, subscript. GoodXYZ")
570+
expect(subject.excelx_value(4, 6, "Sheet1")).to eq("Italics, Underline, superscript. Upswing")
571+
expect(subject.excelx_value(4, 7, "Sheet1")).to eq("Italics, Underline, subscript. Tswing")
572+
expect(subject.excelx_value(5, 1, "Sheet1")).to eq("Bold, italics, underline, superscript. GHJK1904")
573+
expect(subject.excelx_value(5, 2, "Sheet1")).to eq("Bold, italics, underline, subscript. Mikedrop")
574+
expect(subject.excelx_value(6, 1, "Sheet1")).to eq("See that regular html tags do not create html tags.\n<ol>\n <li> Denver Broncos </li>\n <li> Carolina Panthers </li>\n <li> New England Patriots</li>\n <li>Arizona Panthers</li>\n</ol>")
575+
expect(subject.excelx_value(7, 1, "Sheet1")).to eq("Does create html tags when formatting is used..\n<ol>\n <li> Denver Broncos </li>\n <li> Carolina Panthers </li>\n <li> New England Patriots</li>\n <li>Arizona Panthers</li>\n</ol>")
576+
end
577+
end
578+
end
579+
end

0 commit comments

Comments
 (0)