Skip to content

Commit 5769885

Browse files
author
Mark Baker
authored
Changes to the default arguments for htmlspecialchars() and html_entity_decode() requires setting of the argument value explicitly to prevent changes in behaviour. (#2176)
Specifically, the default for these two functions has been changed from `ENT_COMPAT` to `ENT_QUOTES | ENT_SUBSTITUTE` This PR configures the argument used for those functions in Settings, and then explicitly applies it everywhere they are used in the codebase.
1 parent d200c53 commit 5769885

File tree

6 files changed

+48
-18
lines changed

6 files changed

+48
-18
lines changed

‎samples/Basic/45_Quadratic_equation_solver.php

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,35 @@
11
<?php
22

33
use PhpOffice\PhpSpreadsheet\Calculation\Calculation;
4+
use PhpOffice\PhpSpreadsheet\Settings;
45

56
require __DIR__ . '/../Header.php';
67
?>
78
<form action="45_Quadratic_equation_solver.php" method="POST">
89
Enter the coefficients for the Ax<sup>2</sup> + Bx + C = 0
910
<table border="0" cellpadding="0" cellspacing="0">
10-
<tr><td><b>A&nbsp;</b></td>
11-
<td><input name="A" type="text" size="8" value="<?php echo (isset($_POST['A'])) ? htmlentities($_POST['A']) : ''; ?>"></td>
11+
<tr>
12+
<td>
13+
<b>A&nbsp;</b>
14+
</td>
15+
<td>
16+
<input name="A" type="text" size="8" value="<?php echo (isset($_POST['A'])) ? htmlentities($_POST['A'], Settings::htmlEntityFlags()) : ''; ?>">
17+
</td>
1218
</tr>
13-
<tr><td><b>B&nbsp;</b></td>
14-
<td><input name="B" type="text" size="8" value="<?php echo (isset($_POST['B'])) ? htmlentities($_POST['B']) : ''; ?>"></td>
19+
<tr>
20+
<td>
21+
<b>B&nbsp;</b>
22+
</td>
23+
<td>
24+
<input name="B" type="text" size="8" value="<?php echo (isset($_POST['B'])) ? htmlentities($_POST['B'], Settings::htmlEntityFlags()) : ''; ?>">
25+
</td>
1526
</tr>
16-
<tr><td><b>C&nbsp;</b></td>
17-
<td><input name="C" type="text" size="8" value="<?php echo (isset($_POST['C'])) ? htmlentities($_POST['C']) : ''; ?>"></td>
27+
<tr>
28+
<td><b>C&nbsp;</b>
29+
</td>
30+
<td>
31+
<input name="C" type="text" size="8" value="<?php echo (isset($_POST['C'])) ? htmlentities($_POST['C'], Settings::htmlEntityFlags()) : ''; ?>">
32+
</td>
1833
</tr>
1934
</table>
2035
<input name="submit" type="submit" value="calculate"><br />

‎src/PhpSpreadsheet/Settings.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,11 @@ public static function getChartRenderer()
9999
return self::$chartRenderer;
100100
}
101101

102+
public static function htmlEntityFlags(): int
103+
{
104+
return \ENT_COMPAT;
105+
}
106+
102107
/**
103108
* Set default options for libxml loader.
104109
*

‎src/PhpSpreadsheet/Shared/XMLWriter.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,8 @@
22

33
namespace PhpOffice\PhpSpreadsheet\Shared;
44

5+
use PhpOffice\PhpSpreadsheet\Settings;
6+
57
class XMLWriter extends \XMLWriter
68
{
79
public static $debugEnabled = false;
@@ -87,6 +89,6 @@ public function writeRawData($text)
8789
$text = implode("\n", $text);
8890
}
8991

90-
return $this->writeRaw(htmlspecialchars($text ?? ''));
92+
return $this->writeRaw(htmlspecialchars($text ?? '', Settings::htmlEntityFlags()));
9193
}
9294
}

‎src/PhpSpreadsheet/Writer/Html.php

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use PhpOffice\PhpSpreadsheet\Chart\Chart;
1010
use PhpOffice\PhpSpreadsheet\RichText\RichText;
1111
use PhpOffice\PhpSpreadsheet\RichText\Run;
12+
use PhpOffice\PhpSpreadsheet\Settings;
1213
use PhpOffice\PhpSpreadsheet\Shared\Drawing as SharedDrawing;
1314
use PhpOffice\PhpSpreadsheet\Shared\File;
1415
use PhpOffice\PhpSpreadsheet\Shared\Font as SharedFont;
@@ -350,7 +351,9 @@ public function writeAllSheets()
350351

351352
private static function generateMeta($val, $desc)
352353
{
353-
return $val ? (' <meta name="' . $desc . '" content="' . htmlspecialchars($val) . '" />' . PHP_EOL) : '';
354+
return $val
355+
? (' <meta name="' . $desc . '" content="' . htmlspecialchars($val, Settings::htmlEntityFlags()) . '" />' . PHP_EOL)
356+
: '';
354357
}
355358

356359
/**
@@ -369,7 +372,7 @@ public function generateHTMLHeader($pIncludeStyles = false)
369372
$html .= ' <head>' . PHP_EOL;
370373
$html .= ' <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />' . PHP_EOL;
371374
$html .= ' <meta name="generator" content="PhpSpreadsheet, https://github.com/PHPOffice/PhpSpreadsheet" />' . PHP_EOL;
372-
$html .= ' <title>' . htmlspecialchars($properties->getTitle()) . '</title>' . PHP_EOL;
375+
$html .= ' <title>' . htmlspecialchars($properties->getTitle(), Settings::htmlEntityFlags()) . '</title>' . PHP_EOL;
373376
$html .= self::generateMeta($properties->getCreator(), 'author');
374377
$html .= self::generateMeta($properties->getTitle(), 'title');
375378
$html .= self::generateMeta($properties->getDescription(), 'description');
@@ -672,7 +675,7 @@ private function writeImageInCell(Worksheet $pSheet, $coordinates)
672675
$filename = preg_replace('@^[.]([^/])@', '$1', $filename);
673676

674677
// Convert UTF8 data to PCDATA
675-
$filename = htmlspecialchars($filename);
678+
$filename = htmlspecialchars($filename, Settings::htmlEntityFlags());
676679

677680
$html .= PHP_EOL;
678681
$imageData = self::winFileToUrl($filename);
@@ -1301,15 +1304,15 @@ private function generateRowCellDataValueRich($cell, &$cellData): void
13011304

13021305
// Convert UTF8 data to PCDATA
13031306
$cellText = $element->getText();
1304-
$cellData .= htmlspecialchars($cellText);
1307+
$cellData .= htmlspecialchars($cellText, Settings::htmlEntityFlags());
13051308

13061309
$cellData .= $cellEnd;
13071310

13081311
$cellData .= '</span>';
13091312
} else {
13101313
// Convert UTF8 data to PCDATA
13111314
$cellText = $element->getText();
1312-
$cellData .= htmlspecialchars($cellText);
1315+
$cellData .= htmlspecialchars($cellText, Settings::htmlEntityFlags());
13131316
}
13141317
}
13151318
}
@@ -1326,7 +1329,7 @@ private function generateRowCellDataValue($pSheet, $cell, &$cellData): void
13261329
[$this, 'formatColor']
13271330
);
13281331
if ($cellData === $origData) {
1329-
$cellData = htmlspecialchars($cellData ?? '');
1332+
$cellData = htmlspecialchars($cellData ?? '', Settings::htmlEntityFlags());
13301333
}
13311334
if ($pSheet->getParent()->getCellXfByIndex($cell->getXfIndex())->getFont()->getSuperscript()) {
13321335
$cellData = '<sup>' . $cellData . '</sup>';
@@ -1491,7 +1494,7 @@ private function generateRow(Worksheet $pSheet, array $pValues, $pRow, $cellType
14911494

14921495
// Hyperlink?
14931496
if ($pSheet->hyperlinkExists($coordinate) && !$pSheet->getHyperlink($coordinate)->isInternal()) {
1494-
$cellData = '<a href="' . htmlspecialchars($pSheet->getHyperlink($coordinate)->getUrl()) . '" title="' . htmlspecialchars($pSheet->getHyperlink($coordinate)->getTooltip()) . '">' . $cellData . '</a>';
1497+
$cellData = '<a href="' . htmlspecialchars($pSheet->getHyperlink($coordinate)->getUrl(), Settings::htmlEntityFlags()) . '" title="' . htmlspecialchars($pSheet->getHyperlink($coordinate)->getTooltip(), Settings::htmlEntityFlags()) . '">' . $cellData . '</a>';
14951498
}
14961499

14971500
// Should the cell be written or is it swallowed by a rowspan or colspan?
@@ -1671,7 +1674,7 @@ public function formatColor($pValue, $pFormat)
16711674
}
16721675

16731676
// convert to PCDATA
1674-
$value = htmlspecialchars($pValue);
1677+
$value = htmlspecialchars($pValue, Settings::htmlEntityFlags());
16751678

16761679
// color span tag
16771680
if ($color !== null) {

‎src/PhpSpreadsheet/Writer/Xlsx/Worksheet.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
use PhpOffice\PhpSpreadsheet\Cell\Cell;
66
use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
77
use PhpOffice\PhpSpreadsheet\RichText\RichText;
8+
use PhpOffice\PhpSpreadsheet\Settings;
89
use PhpOffice\PhpSpreadsheet\Shared\StringHelper;
910
use PhpOffice\PhpSpreadsheet\Shared\XMLWriter;
1011
use PhpOffice\PhpSpreadsheet\Style\Conditional;
@@ -1172,7 +1173,10 @@ private function writeCellInlineStr(XMLWriter $objWriter, string $mappedType, $c
11721173
{
11731174
$objWriter->writeAttribute('t', $mappedType);
11741175
if (!$cellValue instanceof RichText) {
1175-
$objWriter->writeElement('t', StringHelper::controlCharacterPHP2OOXML(htmlspecialchars($cellValue)));
1176+
$objWriter->writeElement(
1177+
't',
1178+
StringHelper::controlCharacterPHP2OOXML(htmlspecialchars($cellValue, Settings::htmlEntityFlags()))
1179+
);
11761180
} elseif ($cellValue instanceof RichText) {
11771181
$objWriter->startElement('is');
11781182
$this->getParentWriter()->getWriterPartstringtable()->writeRichText($objWriter, $cellValue);

‎tests/PhpSpreadsheetTests/Writer/Html/HtmlNumberFormatTest.php

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;
44

55
use DOMDocument;
6+
use PhpOffice\PhpSpreadsheet\Settings;
67
use PhpOffice\PhpSpreadsheet\Shared\StringHelper;
78
use PhpOffice\PhpSpreadsheet\Spreadsheet;
89
use PhpOffice\PhpSpreadsheet\Writer\Html;
@@ -175,7 +176,7 @@ public function testFormatValueWithMask($expectedResult, $val, $fmt): void
175176
$rows = $tbod[0]->getElementsByTagName('tr');
176177

177178
$tds = $rows[0]->getElementsByTagName('td');
178-
$nbsp = html_entity_decode('&nbsp;');
179+
$nbsp = html_entity_decode('&nbsp;', Settings::htmlEntityFlags());
179180
self::assertEquals($expectedResult, str_replace($nbsp, ' ', $tds[0]->textContent));
180181

181182
$this->writeAndReload($spreadsheet, 'Html');
@@ -211,7 +212,7 @@ public function testFormatValueWithMaskDate($expectedResult, $val, $fmt): void
211212
$rows = $tbod[0]->getElementsByTagName('tr');
212213

213214
$tds = $rows[0]->getElementsByTagName('td');
214-
$nbsp = html_entity_decode('&nbsp;');
215+
$nbsp = html_entity_decode('&nbsp;', Settings::htmlEntityFlags());
215216
self::assertEquals($expectedResult, str_replace($nbsp, ' ', $tds[0]->textContent));
216217

217218
$this->writeAndReload($spreadsheet, 'Html');

0 commit comments

Comments
 (0)