['Hello, I am safely viewing your site', 'Hello, I am safely viewing your site'],
'link' => ["Google is here", 'Google is here'],
];
}
/**
* @dataProvider providerAcceptableMarkupRichText
*
* @param string $safeTextString
* @param string $adjustedTextString
*/
public function testMarkupInComment($safeTextString, $adjustedTextString): void
{
$spreadsheet = new Spreadsheet();
$richText = new RichText();
$richText->createText($safeTextString);
$spreadsheet->getActiveSheet()->getCell('A1')->setValue('XSS Test');
$spreadsheet->getActiveSheet()
->getComment('A1')
->setText($richText);
$filename = tempnam(File::sysGetTempDir(), 'phpspreadsheet-test');
$writer = IOFactory::createWriter($spreadsheet, 'Html');
$writer->save($filename);
$verify = file_get_contents($filename);
// Ensure that executable js has been stripped from the comments
self::assertStringContainsString($adjustedTextString, $verify);
}
public function providerXssRichText()
{
return [
'script tag' => ["Hello, I am trying to your site"],
'javascript tag' => ["CLICK"],
'with unicode' => ['CLICK'],
'inline css' => [''],
'char value chevron' => ["\x3cscript src=http://www.example.com/malicious-code.js\x3e\x3c/script\x3e"],
];
}
private static $counter = 0;
/**
* @dataProvider providerXssRichText
*
* @param string $xssTextString
*/
public function testXssInComment($xssTextString): void
{
$spreadsheet = new Spreadsheet();
$richText = new RichText();
$richText->createText($xssTextString);
$spreadsheet->getActiveSheet()->getCell('A1')->setValue('XSS Test');
$spreadsheet->getActiveSheet()
->getComment('A1')
->setText($richText);
$filename = tempnam(File::sysGetTempDir(), 'phpspreadsheet-test');
$writer = IOFactory::createWriter($spreadsheet, 'Html');
$writer->save($filename);
$verify = file_get_contents($filename);
$counter = self::$counter++;
file_put_contents("verify{$counter}.html", $verify);
// Ensure that executable js has been stripped from the comments
self::assertStringNotContainsString($xssTextString, $verify);
}
}