caxlsx 3.3.0 → 3.4.1

data/lib/axlsx/workbook/worksheet/border_creator.rb

@@ -1,39 +1,43 @@
-# encoding: UTF-8
-
 module Axlsx
   class BorderCreator
-    attr_reader :worksheet, :cells, :edges, :width, :color
-
-    def initialize(worksheet, cells, args)
+    def initialize(worksheet:, cells:, edges: nil, style: nil, color: nil)
       @worksheet = worksheet
-      @cells     = cells
-      if args.is_a?(Hash)
-        @edges = args[:edges] || Axlsx::Border::EDGES
-        @width = args[:style] || :thin
-        @color = args[:color] || '000000'
-      else
-        @edges = args || Axlsx::Border::Edges
-        @width = :thin
-        @color = '000000'
-      end
+      @cells = cells
+
+      @edges = edges || :all
+      @style = style || :thin
+      @color = color || "000000"
 
       if @edges == :all
         @edges = Axlsx::Border::EDGES
-      elsif @edges.is_a?(Array)
-        @edges = (@edges.map(&:to_sym).uniq & Axlsx::Border::EDGES)
+      elsif !@edges.is_a?(Array)
+        raise ArgumentError.new("Invalid edges provided, #{@edges}")
       else
-        @edges = []
+        @edges = @edges.map { |x| x&.to_sym }.uniq
+
+        if !(@edges - Axlsx::Border::EDGES).empty?
+          raise ArgumentError.new("Invalid edges provided, #{edges}")
+        end
       end
     end
 
     def draw
-      @edges.each do |edge| 
-        worksheet.add_style(
-          border_cells[edge], 
+      if @cells.size == 1
+        @worksheet.add_style(
+          first_cell,
           {
-            border: {style: @width, color: @color, edges: [edge]}
+            border: { style: @style, color: @color, edges: @edges }
           }
         )
+      else
+        @edges.each do |edge|
+          @worksheet.add_style(
+            border_cells[edge],
+            {
+              border: { style: @style, color: @color, edges: [edge] }
+            }
+          )
+        end
       end
     end
 
@@ -44,16 +48,16 @@ module Axlsx
         top:     "#{first_cell}:#{last_col}#{first_row}",
         right:   "#{last_col}#{first_row}:#{last_cell}",
         bottom:  "#{first_col}#{last_row}:#{last_cell}",
-        left:    "#{first_cell}:#{first_col}#{last_row}",
+        left:    "#{first_cell}:#{first_col}#{last_row}"
       }
     end
 
     def first_cell
-      @first_cell ||= cells.first.r
+      @first_cell ||= @cells.first.r
     end
 
     def last_cell
-      @last_cell ||= cells.last.r
+      @last_cell ||= @cells.last.r
     end
 
     def first_row
@@ -71,6 +75,5 @@ module Axlsx
     def last_col
       @last_col ||= last_cell.scan(/\D+/).first
     end
-
   end
 end

data/lib/axlsx/workbook/worksheet/break.rb

@@ -1,9 +1,7 @@
 module Axlsx
-
   # The Break class stores the details for row and column page breaks.
   # @see RowBreaks, ColBreaks
   class Break
-
     include Axlsx::OptionsParser
     include Axlsx::Accessors
     include Axlsx::SerializedAttributes
@@ -15,7 +13,7 @@ module Axlsx
     # @option options [Integer] max Zero-based index of end row or column of the break. For row breaks, specifies column index; for column breaks, specifies row index.
     # @option options [Boolean] man Manual Break flag. 1 means the break is a manually inserted break.
     # @option option [Boolean] pt Flag indicating that a PivotTable created this break.
-    def initialize(options={})
+    def initialize(options = {})
       parse_options options
       yield self if block_given?
     end
@@ -27,9 +25,8 @@ module Axlsx
     serializable_attributes :id, :min, :max, :man, :pt
 
     # serializes the break to xml
-    def to_xml_string(str='')
+    def to_xml_string(str = '')
       serialized_tag('brk', str)
     end
   end
 end
-

data/lib/axlsx/workbook/worksheet/cell.rb

@@ -1,4 +1,3 @@
-# encoding: UTF-8
 require 'cgi'
 module Axlsx
   # A cell in a worksheet.
@@ -7,7 +6,6 @@ module Axlsx
   #
   # @see Worksheet#add_row
   class Cell
-
     include Axlsx::OptionsParser
 
     # @param [Row] row The row this cell belongs to.
@@ -30,10 +28,9 @@ module Axlsx
     # @option options [String] color an 8 letter rgb specification
     # @option options [Number] formula_value The value to cache for a formula cell.
     # @option options [Symbol] scheme must be one of :none, major, :minor
-    # @option options [Boolean] escape_formulas - Whether to treat a value starting with an equal
-    #    sign as formula (default) or as simple string.
-    #    Allowing user generated data to be interpreted as formulas can be dangerous
-    #   (see https://www.owasp.org/index.php/CSV_Injection for details).
+    # @option options [Boolean] escape_formulas Whether to treat values starting with an equals
+    #   sign as formulas or as literal strings. Allowing user-generated data to be interpreted as
+    #   formulas is a security risk. See https://www.owasp.org/index.php/CSV_Injection for details.
     def initialize(row, value = nil, options = {})
       @row = row
       # Do not use instance vars if not needed to use less RAM
@@ -42,15 +39,13 @@ module Axlsx
       type = options.delete(:type) || cell_type_from_value(value)
       self.type = type unless type == :string
 
-      escape_formulas = options[:escape_formulas]
-      self.escape_formulas = escape_formulas unless escape_formulas.nil?
-
       val = options.delete(:style)
       self.style = val unless val.nil? || val == 0
       val = options.delete(:formula_value)
       self.formula_value = val unless val.nil?
 
       parse_options(options)
+      self.escape_formulas = row.worksheet.escape_formulas if escape_formulas.nil?
 
       self.value = value
       value.cell = self if contains_rich_text?
@@ -75,6 +70,16 @@ module Axlsx
     CELL_TYPES = [:date, :time, :float, :integer, :richtext,
                   :string, :boolean, :iso_8601, :text].freeze
 
+    # Leading characters that indicate a formula.
+    # See: https://owasp.org/www-community/attacks/CSV_Injection
+    FORMULA_PREFIXES = ['='.freeze].freeze
+
+    # Leading characters that indicate an array formula.
+    ARRAY_FORMULA_PREFIXES = ['{='.freeze].freeze
+
+    # Trailing character that indicates an array formula.
+    ARRAY_FORMULA_SUFFIX = '}'.freeze
+
     # The index of the cellXfs item to be applied to this cell.
     # @return [Integer]
     # @see Axlsx::Styles
@@ -104,7 +109,7 @@ module Axlsx
       self.raw_style = new_style
 
       wb = row.worksheet.workbook
-      
+
       wb.styled_cells << self
     end
 
@@ -134,16 +139,17 @@ module Axlsx
       self.value = @value unless !defined?(@value) || @value.nil?
     end
 
-    # Whether to treat a value starting with an equal
-    #    sign as formula (default) or as simple string.
-    #    Allowing user generated data to be interpreted as formulas can be dangerous
-    #   (see https://www.owasp.org/index.php/CSV_Injection for details).
+    # Whether to treat values starting with an equals sign as formulas or as literal strings.
+    # Allowing user-generated data to be interpreted as formulas is a security risk.
+    # See https://www.owasp.org/index.php/CSV_Injection for details.
     # @return [Boolean]
     attr_reader :escape_formulas
 
-    def escape_formulas=(v)
-      Axlsx.validate_boolean(v)
-      @escape_formulas = v
+    # Sets whether to treat values starting with an equals sign as formulas or as literal strings.
+    # @param [Boolean] value The value to set.
+    def escape_formulas=(value)
+      Axlsx.validate_boolean(value)
+      @escape_formulas = value
     end
 
     # The value of this cell.
@@ -152,7 +158,7 @@ module Axlsx
 
     # @see value
     def value=(v)
-      #TODO: consider doing value based type determination first?
+      # TODO: consider doing value based type determination first?
       @value = cast_value(v)
     end
 
@@ -172,12 +178,14 @@ module Axlsx
         !is_text_run? &&          # No inline styles
         !@value.nil? &&           # Not nil
         !@value.empty? &&         # Not empty
-        !@value.start_with?(?=)  # Not a formula
+        !is_formula? &&           # Not a formula
+        !is_array_formula?        # Not an array formula
     end
 
     # The inline font_name property for the cell
     # @return [String]
     attr_reader :font_name
+
     # @see font_name
     def font_name=(v) set_run_style :validate_string, :font_name, v; end
 
@@ -204,6 +212,7 @@ module Axlsx
     # 255  OEM_CHARSET
     # @return [String]
     attr_reader :charset
+
     # @see charset
     def charset=(v) set_run_style :validate_unsigned_int, :charset, v; end
 
@@ -215,6 +224,7 @@ module Axlsx
     # 4 Script
     # 5 Decorative
     attr_reader :family
+
     # @see family
     def family=(v)
       set_run_style :validate_family, :family, v.to_i
@@ -223,42 +233,49 @@ module Axlsx
     # The inline bold property for the cell
     # @return [Boolean]
     attr_reader :b
+
     # @see b
     def b=(v) set_run_style :validate_boolean, :b, v; end
 
     # The inline italic property for the cell
     # @return [Boolean]
     attr_reader :i
+
     # @see i
     def i=(v) set_run_style :validate_boolean, :i, v; end
 
     # The inline strike property for the cell
     # @return [Boolean]
     attr_reader :strike
+
     # @see strike
     def strike=(v) set_run_style :validate_boolean, :strike, v; end
 
     # The inline outline property for the cell
     # @return [Boolean]
     attr_reader :outline
+
     # @see outline
     def outline=(v) set_run_style :validate_boolean, :outline, v; end
 
     # The inline shadow property for the cell
     # @return [Boolean]
     attr_reader :shadow
+
     # @see shadow
     def shadow=(v) set_run_style :validate_boolean, :shadow, v; end
 
     # The inline condense property for the cell
     # @return [Boolean]
     attr_reader :condense
+
     # @see condense
     def condense=(v) set_run_style :validate_boolean, :condense, v; end
 
     # The inline extend property for the cell
     # @return [Boolean]
     attr_reader :extend
+
     # @see extend
     def extend=(v) set_run_style :validate_boolean, :extend, v; end
 
@@ -268,6 +285,7 @@ module Axlsx
     # @return [String]
     # @note true is for backwards compatability and is reassigned to :single
     attr_reader :u
+
     # @see u
     def u=(v)
       v = :single if (v == true || v == 1 || v == :true || v == 'true')
@@ -277,15 +295,17 @@ module Axlsx
     # The inline color property for the cell
     # @return [Color]
     attr_reader :color
+
     # @param [String] v The 8 character representation for an rgb color #FFFFFFFF"
     def color=(v)
-      @color = v.is_a?(Color) ? v : Color.new(:rgb=>v)
+      @color = v.is_a?(Color) ? v : Color.new(:rgb => v)
       @is_text_run = true
     end
 
     # The inline sz property for the cell
     # @return [Inteter]
     attr_reader :sz
+
     # @see sz
     def sz=(v) set_run_style :validate_unsigned_int, :sz, v; end
 
@@ -293,6 +313,7 @@ module Axlsx
     # this must be one of [:baseline, :subscript, :superscript]
     # @return [Symbol]
     attr_reader :vertAlign
+
     # @see vertAlign
     def vertAlign=(v)
       RestrictionValidator.validate :cell_vertAlign, [:baseline, :subscript, :superscript], v
@@ -303,6 +324,7 @@ module Axlsx
     # this must be one of [:none, major, minor]
     # @return [Symbol]
     attr_reader :scheme
+
     # @see scheme
     def scheme=(v)
       RestrictionValidator.validate :cell_scheme, [:none, :major, :minor], v
@@ -329,7 +351,7 @@ module Axlsx
     # @example Absolute Cell Reference
     #   ws.rows.first.cells.first.r #=> "$A$1"
     def r_abs
-      "$#{r.match(%r{([A-Z]+)([0-9]+)})[1,2].join('$')}"
+      "$#{r.match(%r{([A-Z]+)([0-9]+)})[1, 2].join('$')}"
     end
 
     # @return [Integer] The cellXfs item index applied to this cell.
@@ -338,6 +360,7 @@ module Axlsx
       Axlsx::validate_unsigned_int(v)
       count = styles.cellXfs.size
       raise ArgumentError, "Invalid cellXfs id" unless v < count
+
       @style = v
     end
 
@@ -352,7 +375,7 @@ module Axlsx
     def merge(target)
       start, stop = if target.is_a?(String)
                       [self.r, target]
-                    elsif(target.is_a?(Cell))
+                    elsif target.is_a?(Cell)
                       Axlsx.sort_cells([self, target]).map { |c| c.r }
                     end
       self.row.worksheet.merge_cells "#{start}:#{stop}" unless stop.nil?
@@ -370,11 +393,15 @@ module Axlsx
     def is_formula?
       return false if escape_formulas
 
-      type == :string && @value.to_s.start_with?(?=)
+      type == :string && @value.to_s.start_with?(*FORMULA_PREFIXES)
     end
 
     def is_array_formula?
-      type == :string && @value.to_s.start_with?('{=') && @value.to_s.end_with?('}')
+      return false if escape_formulas
+
+      type == :string &&
+        @value.to_s.start_with?(*ARRAY_FORMULA_PREFIXES) &&
+        @value.to_s.end_with?(ARRAY_FORMULA_SUFFIX)
     end
 
     # returns the absolute or relative string style reference for
@@ -382,7 +409,7 @@ module Axlsx
     # @param [Boolean] absolute -when false a relative reference will be
     # returned.
     # @return [String]
-    def reference(absolute=true)
+    def reference(absolute = true)
       absolute ? r_abs : r
     end
 
@@ -452,6 +479,7 @@ module Axlsx
     # Utility method for setting inline style attributes
     def set_run_style(validator, attr, value)
       return unless INLINE_STYLES.include?(attr.to_sym)
+
       Axlsx.send(validator, value) unless validator.nil?
       self.instance_variable_set :"@#{attr.to_s}", value
       @is_text_run = true
@@ -499,6 +527,7 @@ module Axlsx
     # @see Axlsx#date1904
     def cast_value(v)
       return v if v.is_a?(RichText) || v.nil?
+
       case type
       when :date
         self.style = STYLE_DATE if self.style == 0
@@ -521,12 +550,11 @@ module Axlsx
       when :boolean
         v ? 1 : 0
       when :iso_8601
-        #consumer is responsible for ensuring the iso_8601 format when specifying this type
+        # consumer is responsible for ensuring the iso_8601 format when specifying this type
         v
       else
         v.to_s
       end
     end
-
   end
 end

data/lib/axlsx/workbook/worksheet/cell_serializer.rb

@@ -1,5 +1,4 @@
 module Axlsx
-
   # The Cell Serializer class contains the logic for serializing cells based on their type.
   class CellSerializer
     class << self
@@ -8,9 +7,10 @@ module Axlsx
       # @param [Integer] column_index The index of the cell's column
       # @param [String] str The string to apend serialization to.
       # @return [String]
-      def to_xml_string(row_index, column_index, cell, str='')
+      def to_xml_string(row_index, column_index, cell, str = '')
         str << ('<c r="' << Axlsx::cell_r(column_index, row_index) << '" s="' << cell.style.to_s << '" ')
         return str << '/>' if cell.value.nil?
+
         method = cell.type
         self.send(method, cell, str)
         str << '</c>'
@@ -22,7 +22,7 @@ module Axlsx
       def run_xml_string(cell, str = '')
         if cell.is_text_run?
           valid = RichTextRun::INLINE_STYLES - [:value, :type]
-          data = Hash[Axlsx.instance_values_for(cell).map{ |k, v| [k.to_sym, v] }]
+          data = Hash[Axlsx.instance_values_for(cell).map { |k, v| [k.to_sym, v] }]
           data = data.select { |key, value| valid.include?(key) && !value.nil? }
           RichText.new(cell.value.to_s, data).to_xml_string(str)
         elsif cell.contains_rich_text?
@@ -37,7 +37,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def iso_8601(cell, str='')
+      def iso_8601(cell, str = '')
         value_serialization 'd', cell.value, str
       end
 
@@ -45,7 +45,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def date(cell, str='')
+      def date(cell, str = '')
         value_serialization false, DateTimeConverter::date_to_serial(cell.value).to_s, str
       end
 
@@ -53,7 +53,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def time(cell, str='')
+      def time(cell, str = '')
         value_serialization false, DateTimeConverter::time_to_serial(cell.value).to_s, str
       end
 
@@ -61,7 +61,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def boolean(cell, str='')
+      def boolean(cell, str = '')
         value_serialization 'b', cell.value.to_s, str
       end
 
@@ -69,7 +69,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def float(cell, str='')
+      def float(cell, str = '')
         numeric cell, str
       end
 
@@ -85,7 +85,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def formula_serialization(cell, str='')
+      def formula_serialization(cell, str = '')
         str << ('t="str"><f>' << cell.clean_value.to_s.sub('=', '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
@@ -94,7 +94,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def array_formula_serialization(cell, str='')
+      def array_formula_serialization(cell, str = '')
         str << ('t="str">' << '<f t="array" ref="' << cell.r << '">' << cell.clean_value.to_s.sub('{=', '').sub(/}$/, '') << '</f>')
         str << ('<v>' << cell.formula_value.to_s << '</v>') unless cell.formula_value.nil?
       end
@@ -113,7 +113,7 @@ module Axlsx
       # @param [Cell] cell The cell that is being serialized
       # @param [String] str The string the serialized content will be appended to.
       # @return [String]
-      def string(cell, str='')
+      def string(cell, str = '')
         if cell.is_array_formula?
           array_formula_serialization cell, str
         elsif cell.is_formula?

data/lib/axlsx/workbook/worksheet/cfvo.rb

@@ -7,7 +7,6 @@ module Axlsx
   # @see ConditionalFormattingRule#initialize
   #
   class Cfvo
-
     include Axlsx::OptionsParser
     include Axlsx::SerializedAttributes
 
@@ -15,7 +14,7 @@ module Axlsx
     # @option options [Symbol] type The type of conditional formatting value object
     # @option options [Boolean]  gte threshold value usage indicator
     # @option options [String] val The value of the conditional formatting object
-    def initialize(options={})
+    def initialize(options = {})
       @gte = true
       parse_options options
     end
@@ -47,6 +46,7 @@ module Axlsx
     # @see val
     def val=(v)
       raise ArgumentError, "#{v.inspect} must respond to to_s" unless v.respond_to?(:to_s)
+
       @val = v.to_s
     end
 

data/lib/axlsx/workbook/worksheet/cfvos.rb

@@ -1,9 +1,7 @@
 module Axlsx
-
-  #A collection of Cfvo objects that initializes with the required
-  #first two items
+  # A collection of Cfvo objects that initializes with the required
+  # first two items
   class Cfvos < SimpleTypedList
-
     def initialize
       super(Cfvo)
     end
@@ -11,7 +9,7 @@ module Axlsx
     # Serialize the Cfvo object
     # @param [String] str
     # @return [String]
-    def to_xml_string(str='')
+    def to_xml_string(str = '')
       each { |cfvo| cfvo.to_xml_string(str) }
     end
   end

data/lib/axlsx/workbook/worksheet/col.rb

@@ -1,9 +1,6 @@
-# encoding: UTF-8
 module Axlsx
-
   # The Col class defines column attributes for columns in sheets.
   class Col
-
     # Maximum column width limit in MS Excel is 255 characters
     # https://support.microsoft.com/en-us/office/excel-specifications-and-limits-1672b34d-7043-467e-8e27-269d656771c3
     MAX_WIDTH = 255
@@ -19,7 +16,7 @@ module Axlsx
     # @option options [Boolean] phonetic see Col#phonetic
     # @option options [Integer] style see Col#style
     # @option options [Numeric] width see Col#width
-    def initialize(min, max, options={})
+    def initialize(min, max, options = {})
       Axlsx.validate_unsigned_int(max)
       Axlsx.validate_unsigned_int(min)
       @min = min
@@ -90,6 +87,7 @@ module Axlsx
     def outline_level=(v)
       Axlsx.validate_unsigned_numeric(v)
       raise ArgumentError, 'outlineLevel must be between 0 and 7' unless 0 <= v && v <= 7
+
       @outline_level = v
     end
     alias :outlineLevel= :outline_level=
@@ -106,14 +104,14 @@ module Axlsx
       @style = v
     end
 
-   # @see Col#width
+    # @see Col#width
     def width=(v)
       # Removing this validation make a 10% difference in performance
       # as it is called EVERY TIME A CELL IS ADDED - the proper solution
       # is to only set this if a calculated value is greated than the
       # current @width value.
       # TODO!!!
-      #Axlsx.validate_unsigned_numeric(v) unless v == nil
+      # Axlsx.validate_unsigned_numeric(v) unless v == nil
       @custom_width = @best_fit = v != nil
       @width = v.nil? ? v : [v, MAX_WIDTH].min
     end
@@ -140,6 +138,5 @@ module Axlsx
     def to_xml_string(str = '')
       serialized_tag('col', str)
     end
-
   end
 end

data/lib/axlsx/workbook/worksheet/col_breaks.rb

@@ -1,10 +1,8 @@
 module Axlsx
-
   # A collection of Brake objects.
-  # Please do not use this class directly. Instead use 
+  # Please do not use this class directly. Instead use
   # Worksheet#add_break
   class ColBreaks < SimpleTypedList
-
     # Instantiates a new list restricted to Break types
     def initialize
       super Break
@@ -12,7 +10,7 @@ module Axlsx
 
     # A column break specific helper for adding a break.
     # @param [Hash] options A list of options to pass into the Break object
-    # The max and man options are fixed, however any other valid option for 
+    # The max and man options are fixed, however any other valid option for
     # Break will be passed to the created break object.
     # @see Break
     def add_break(options)
@@ -25,8 +23,9 @@ module Axlsx
     # <colBreaks count="1" manualBreakCount="1">
     # <brk id="3" max="1048575" man="1"/>
     # </colBreaks>
-    def to_xml_string(str='')
+    def to_xml_string(str = '')
       return if empty?
+
       str << ('<colBreaks count="' << size.to_s << '" manualBreakCount="' << size.to_s << '">')
       each { |brk| brk.to_xml_string(str) }
       str << '</colBreaks>'