randym / axlsx

xlsx generation with charts, images, automated column width, customizable styles and full schema validation. Axlsx excels at helping you generate beautiful Office Open XML Spreadsheet documents without having to understand the entire ECMA specification. Check out the README for some examples of how easy it is. Best of all, you can validate your xlsx file before serialization so you know for sure that anything generated is going to load on your client's machine.
MIT License
2.62k stars 696 forks source link

Axlsx escapes HTML entities from string formulas #598

Open romaslmd opened 6 years ago

romaslmd commented 6 years ago

Issue: replacing string with ="<raw_value>" no longer works due to string HTML escape on formulas

Example: user value: =Code&name= # looks like a formula but actually axlsx value: =Code%26name= # formula with escaped HTML entities Result: broken output in Excel

Example on Excel usage:

  1. Open excel
  2. set A1 cell to string value (e.g.: Hello)
  3. set B1 cell to this formula: A1&" World!"
  4. Observe results: B1 cell contains value of combined A1 and custom string

this won't work for axlsx gem due to string value been sanitized in formulas

Suggestions: do not sanitize HTML entities in formulas, as some entities may be a formula operators