pjfanning opened a new pull request, #1461: URL: https://github.com/apache/poi/pull/1461
`org.apache.poi.examples.ss.html.ToHtml` builds its HTML with string formatting. It wrote the formatted cell value into the `<td>` as it is, so a cell containing e.g. `<script>alert(1)</script>` or `<a href="javascript:...">` ended up as live markup in the generated page. The cell text is now escaped with `XMLHelper.escapeXml`. The other values ToHtml writes (style names, CSS values, widths, column letters) come from POI itself, not from the workbook, so they are unchanged. `TestToHtml` covers HSSF and XSSF and fails without the change. Separately: `printPage()` / `print()` load `excelStyle.css` with `getResourceAsStream`, but the file lives in `src/main/java`, so the Gradle build doesn't copy it to the output and those methods throw an NPE there. The test therefore uses `printSheet(Sheet)`. Moving the CSS to `src/main/resources` would be a separate fix. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
