mcndave/spout
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix sheet name escaping

Browse Source 
Sheet names are stored as attributes of an XML entity. We therefore need a different escaping strategy, escaping quotes.
This commit is contained in:
Adrien Loison authored and Adrien Loison committed 2019-01-26 16:14:15 +01:00
1 parent ee998f7173
commit 71cf0fe339
6 files changed
+12 -13
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/Spout/Common/Helper/Escaper/ODS.php
+4 -5
View File
@@ -16,17 +16,16 @@ class ODS implements EscaperInterface
*/
public function escape($string)
{
// @NOTE: Using ENT_QUOTES as XML entities ('<', '>', '&') as well as
// single/double quotes (for XML attributes) need to be encoded.
if (defined('ENT_DISALLOWED')) {
// 'ENT_DISALLOWED' ensures that invalid characters in the given document type are replaced.
// Otherwise control characters like a vertical tab "\v" will make the XML document unreadable by the XML processor
// @link https://github.com/box/spout/issues/329
$replacedString = htmlspecialchars($string, ENT_NOQUOTES | ENT_DISALLOWED);
$replacedString = htmlspecialchars($string, ENT_QUOTES | ENT_DISALLOWED);
} else {
// We are on hhvm or any other engine that does not support ENT_DISALLOWED.
//
// @NOTE: Using ENT_NOQUOTES as only XML entities ('<', '>', '&') need to be encoded.
// Single and double quotes can be left as is.
$escapedString = htmlspecialchars($string, ENT_NOQUOTES);
$escapedString = htmlspecialchars($string, ENT_QUOTES);
// control characters values are from 0 to 1F (hex values) in the ASCII table
// some characters should not be escaped though: "\t", "\r" and "\n".
src/Spout/Common/Helper/Escaper/XLSX.php
+3 -3
View File
@@ -45,9 +45,9 @@ class XLSX implements EscaperInterface
$this->initIfNeeded();
$escapedString = $this->escapeControlCharacters($string);
// @NOTE: Using ENT_NOQUOTES as only XML entities ('<', '>', '&') need to be encoded.
// Single and double quotes can be left as is.
$escapedString = htmlspecialchars($escapedString, ENT_NOQUOTES);
// @NOTE: Using ENT_QUOTES as XML entities ('<', '>', '&') as well as
// single/double quotes (for XML attributes) need to be encoded.
$escapedString = htmlspecialchars($escapedString, ENT_QUOTES);
return $escapedString;
}