Skip to content

Commit

Permalink
Html Writer Validate Hyperlink Protocols
Browse files Browse the repository at this point in the history
  • Loading branch information
oleibman committed Sep 14, 2024
1 parent fa657fd commit 8b9b378
Show file tree
Hide file tree
Showing 2 changed files with 41 additions and 1 deletion.
9 changes: 8 additions & 1 deletion src/PhpSpreadsheet/Writer/Html.php
Original file line number Diff line number Diff line change
Expand Up @@ -1512,7 +1512,14 @@ private function generateRow(Worksheet $worksheet, array $values, $row, $cellTyp

// Hyperlink?
if ($worksheet->hyperlinkExists($coordinate) && !$worksheet->getHyperlink($coordinate)->isInternal()) {
$cellData = '<a href="' . htmlspecialchars($worksheet->getHyperlink($coordinate)->getUrl(), Settings::htmlEntityFlags()) . '" title="' . htmlspecialchars($worksheet->getHyperlink($coordinate)->getTooltip(), Settings::htmlEntityFlags()) . '">' . $cellData . '</a>';
$url = $worksheet->getHyperlink($coordinate)->getUrl();
$urldecode = strtolower(html_entity_decode(trim($url), encoding: 'UTF-8'));

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'

Check failure on line 1516 in src/PhpSpreadsheet/Writer/Html.php

View workflow job for this annotation

GitHub Actions / PHP 7.4

syntax error, unexpected ':', expecting ')'
$parseScheme = preg_match('/^(\\w+):/', $urldecode, $matches);
if ($parseScheme === 1 && !in_array($matches[1], ['http', 'https', 'file', 'ftp', 's3'], true)) {
$cellData = htmlspecialchars($url, Settings::htmlEntityFlags());
} else {
$cellData = '<a href="' . htmlspecialchars($url, Settings::htmlEntityFlags()) . '" title="' . htmlspecialchars($worksheet->getHyperlink($coordinate)->getTooltip(), Settings::htmlEntityFlags()) . '">' . $cellData . '</a>';
}
}

// Should the cell be written or is it swallowed by a rowspan or colspan?
Expand Down
33 changes: 33 additions & 0 deletions tests/PhpSpreadsheetTests/Writer/Html/NoJavascriptLinksTest.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<?php

declare(strict_types=1);

namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;

use PhpOffice\PhpSpreadsheet\Cell\Hyperlink;
use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Html;
use PHPUnit\Framework\TestCase;

class NoJavascriptLinksTest extends TestCase
{
public function testNoJavascriptLinks(): void
{
$spreadsheet = new Spreadsheet();
$sheet = $spreadsheet->getActiveSheet();
$sheet->getCell('A1')->setValue('Click me');
$hyperlink = new Hyperlink('http://www.example.com');
$sheet->getCell('A1')->setHyperlink($hyperlink);
$sheet->getCell('A2')->setValue('JS link');
$hyperlink2 = new Hyperlink('javascript:alert(\'hello1\')');
$sheet->getCell('A2')->setHyperlink($hyperlink2);
$sheet->getCell('A3')->setValue('=HYPERLINK("javascript:alert(\'hello2\')", "jsfunc click")');

$writer = new Html($spreadsheet);
$html = $writer->generateHTMLAll();
self::assertStringContainsString('<td class="column0 style0 s"><a href="http://www.example.com" title="">Click me</a></td>', $html, 'http hyperlink retained');
self::assertStringContainsString('<td class="column0 style0 s">javascript:alert(\'hello1\')</td>', $html, 'javascript hyperlink dropped');
self::assertStringContainsString('<td class="column0 style0 f">javascript:alert(\'hello2\')</td>', $html, 'javascript hyperlink function dropped');
$spreadsheet->disconnectWorksheets();
}
}

0 comments on commit 8b9b378

Please sign in to comment.