Skip to content

Commit fa9ab3b

Browse files
kandykandy
committed
Merge pull request #7 from magento-nord/develop
NORD P1
2 parents 4044c8b + 393d4c8 commit fa9ab3b

File tree

3 files changed

+36
-8
lines changed

3 files changed

+36
-8
lines changed

‎lib/internal/Magento/Framework/Convert/Excel.php

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,19 @@ protected function _getXmlRow($row, $useCallback)
134134
$value = htmlspecialchars($value);
135135
$dataType = is_numeric($value) && $value[0] !== '+' && $value[0] !== '0' ? 'Number' : 'String';
136136

137+
/**
138+
* Security enhancement for CSV data processing by Excel-like applications.
139+
* @see https://bugzilla.mozilla.org/show_bug.cgi?id=1054702
140+
*
141+
* @var $value string|\Magento\Framework\Phrase
142+
*/
143+
if (!is_string($value)) {
144+
$value = (string)$value;
145+
}
146+
if (isset($value[0]) && in_array($value[0], ['=', '+', '-'])) {
147+
$value = ' ' . $value;
148+
}
149+
137150
$value = str_replace("\r\n", '
', $value);
138151
$value = str_replace("\r", '
', $value);
139152
$value = str_replace("\n", '
', $value);

‎lib/internal/Magento/Framework/Convert/Test/Unit/ExcelTest.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,24 @@ class ExcelTest extends \PHPUnit_Framework_TestCase
1717
* @var array
1818
*/
1919
private $_testData = [
20-
['ID', 'Name', 'Email', 'Group', 'Telephone', '+Telephone', 'ZIP', '0ZIP', 'Country', 'State/Province'],
20+
[
21+
'ID', 'Name', 'Email', 'Group', 'Telephone', '+Telephone', 'ZIP', '0ZIP', 'Country', 'State/Province',
22+
'Symbol=', 'Symbol-', 'Symbol+'
23+
],
2124
[
2225
1, 'Jon Doe', 'jon.doe@magento.com', 'General', '310-111-1111', '+310-111-1111', 90232, '090232',
23-
'United States', 'California'
26+
'United States', 'California', '=', '-', '+'
2427
],
2528
];
2629

2730
protected $_testHeader = [
28-
'HeaderID', 'HeaderName', 'HeaderEmail', 'HeaderGroup', 'HeaderPhone', 'Header+Phone',
29-
'HeaderZIP', 'Header0ZIP', 'HeaderCountry', 'HeaderRegion',
31+
'HeaderID', 'HeaderName', 'HeaderEmail', 'HeaderGroup', 'HeaderPhone', 'Header+Phone', 'HeaderZIP',
32+
'Header0ZIP', 'HeaderCountry', 'HeaderRegion', 'HeaderSymbol=', 'HeaderSymbol-', 'HeaderSymbol+'
3033
];
3134

3235
protected $_testFooter = [
33-
'FooterID', 'FooterName', 'FooterEmail', 'FooterGroup', 'FooterPhone', 'Footer+Phone',
34-
'FooterZIP', 'Footer0ZIP', 'FooterCountry', 'FooterRegion',
36+
'FooterID', 'FooterName', 'FooterEmail', 'FooterGroup', 'FooterPhone', 'Footer+Phone', 'FooterZIP',
37+
'Footer0ZIP', 'FooterCountry', 'FooterRegion', 'FooterSymbol=', 'FooterSymbol-', 'FooterSymbol+'
3538
];
3639

3740
/**

‎lib/internal/Magento/Framework/Convert/Test/Unit/_files/sample.xml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,30 +29,39 @@
2929
<Cell><Data ss:Type="String">Header0ZIP</Data></Cell>
3030
<Cell><Data ss:Type="String">HeaderCountry</Data></Cell>
3131
<Cell><Data ss:Type="String">HeaderRegion</Data></Cell>
32+
<Cell><Data ss:Type="String">HeaderSymbol=</Data></Cell>
33+
<Cell><Data ss:Type="String">HeaderSymbol-</Data></Cell>
34+
<Cell><Data ss:Type="String">HeaderSymbol+</Data></Cell>
3235
</Row>
3336
<Row>
3437
<Cell><Data ss:Type="String">ID</Data></Cell>
3538
<Cell><Data ss:Type="String">Name</Data></Cell>
3639
<Cell><Data ss:Type="String">Email</Data></Cell>
3740
<Cell><Data ss:Type="String">Group</Data></Cell>
3841
<Cell><Data ss:Type="String">Telephone</Data></Cell>
39-
<Cell><Data ss:Type="String">+Telephone</Data></Cell>
42+
<Cell><Data ss:Type="String"> +Telephone</Data></Cell>
4043
<Cell><Data ss:Type="String">ZIP</Data></Cell>
4144
<Cell><Data ss:Type="String">0ZIP</Data></Cell>
4245
<Cell><Data ss:Type="String">Country</Data></Cell>
4346
<Cell><Data ss:Type="String">State/Province</Data></Cell>
47+
<Cell><Data ss:Type="String">Symbol=</Data></Cell>
48+
<Cell><Data ss:Type="String">Symbol-</Data></Cell>
49+
<Cell><Data ss:Type="String">Symbol+</Data></Cell>
4450
</Row>
4551
<Row>
4652
<Cell><Data ss:Type="Number">1</Data></Cell>
4753
<Cell><Data ss:Type="String">Jon Doe</Data></Cell>
4854
<Cell><Data ss:Type="String">jon.doe@magento.com</Data></Cell>
4955
<Cell><Data ss:Type="String">General</Data></Cell>
5056
<Cell><Data ss:Type="String">310-111-1111</Data></Cell>
51-
<Cell><Data ss:Type="String">+310-111-1111</Data></Cell>
57+
<Cell><Data ss:Type="String"> +310-111-1111</Data></Cell>
5258
<Cell><Data ss:Type="Number">90232</Data></Cell>
5359
<Cell><Data ss:Type="String">090232</Data></Cell>
5460
<Cell><Data ss:Type="String">United States</Data></Cell>
5561
<Cell><Data ss:Type="String">California</Data></Cell>
62+
<Cell><Data ss:Type="String"> =</Data></Cell>
63+
<Cell><Data ss:Type="String"> -</Data></Cell>
64+
<Cell><Data ss:Type="String"> +</Data></Cell>
5665
</Row>
5766
<Row>
5867
<Cell><Data ss:Type="String">FooterID</Data></Cell>
@@ -65,6 +74,9 @@
6574
<Cell><Data ss:Type="String">Footer0ZIP</Data></Cell>
6675
<Cell><Data ss:Type="String">FooterCountry</Data></Cell>
6776
<Cell><Data ss:Type="String">FooterRegion</Data></Cell>
77+
<Cell><Data ss:Type="String">FooterSymbol=</Data></Cell>
78+
<Cell><Data ss:Type="String">FooterSymbol-</Data></Cell>
79+
<Cell><Data ss:Type="String">FooterSymbol+</Data></Cell>
6880
</Row>
6981
</Table>
7082
</Worksheet>

0 commit comments

Comments
 (0)