From a4f29eb5095abfc46d5064aa563fbb978ff41215 Mon Sep 17 00:00:00 2001
From: wandererfan <wandererfan@gmail.com>
Date: Mon, 3 Oct 2022 23:00:06 -0400
Subject: [PATCH] [TD]encode Xml characters in spreadsheet

---
 src/Mod/TechDraw/App/DrawUtil.cpp            | 32 +++++++++++++++++++-
 src/Mod/TechDraw/App/DrawUtil.h              |  1 +
 src/Mod/TechDraw/App/DrawViewSpreadsheet.cpp |  9 ++++--
 3 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/src/Mod/TechDraw/App/DrawUtil.cpp b/src/Mod/TechDraw/App/DrawUtil.cpp
index 2132f30ca6..a062c06e2a 100644
--- a/src/Mod/TechDraw/App/DrawUtil.cpp
+++ b/src/Mod/TechDraw/App/DrawUtil.cpp
@@ -851,7 +851,37 @@ int DrawUtil::countSubShapes(TopoDS_Shape shape, TopAbs_ShapeEnum subShape)
     return count;
 }
 
-
+//https://stackoverflow.com/questions/5665231/most-efficient-way-to-escape-xml-html-in-c-string
+//for every character in inoutText, check if it is on the list of characters to be substituted and
+//replace it with the encoding string
+void DrawUtil::encodeXmlSpecialChars(std::string& inoutText)
+{
+    std::string buffer;
+    buffer.reserve(inoutText.size());
+    for(size_t cursor = 0; cursor != inoutText.size(); ++cursor) {
+        switch(inoutText.at(cursor)) {
+            case '&':
+                buffer.append("&amp;");
+                break;
+            case '\"':
+                buffer.append("&quot;");
+                break;
+            case '\'':
+                buffer.append("&apos;");
+                break;
+            case '<':
+                buffer.append("&lt;");
+                break;
+            case '>':
+                buffer.append("&gt;");
+                break;
+            default:
+                buffer.append(&inoutText.at(cursor), 1);    //not a special character
+                break;
+        }
+    }
+    inoutText.swap(buffer);
+}
 
 // Supplementary mathematical functions
 // ====================================
diff --git a/src/Mod/TechDraw/App/DrawUtil.h b/src/Mod/TechDraw/App/DrawUtil.h
index 26549a3669..90070cae45 100644
--- a/src/Mod/TechDraw/App/DrawUtil.h
+++ b/src/Mod/TechDraw/App/DrawUtil.h
@@ -123,6 +123,7 @@ class TechDrawExport DrawUtil {
         static Base::Vector3d getFaceCenter(TopoDS_Face f);
         static bool circulation(Base::Vector3d A, Base::Vector3d B, Base::Vector3d C);
         static int countSubShapes(TopoDS_Shape shape, TopAbs_ShapeEnum subShape);
+        static void encodeXmlSpecialChars(std::string& inoutText);
 
 
         // Supplementary mathematical functions
diff --git a/src/Mod/TechDraw/App/DrawViewSpreadsheet.cpp b/src/Mod/TechDraw/App/DrawViewSpreadsheet.cpp
index 68202f2f2d..197fe1334a 100644
--- a/src/Mod/TechDraw/App/DrawViewSpreadsheet.cpp
+++ b/src/Mod/TechDraw/App/DrawViewSpreadsheet.cpp
@@ -42,6 +42,7 @@
 #include <Base/Parameter.h>
 
 #include "Preferences.h"
+#include "DrawUtil.h"
 #include "DrawViewSpreadsheet.h"
 
 #include <Mod/Spreadsheet/App/Cell.h>
@@ -284,13 +285,17 @@ std::string DrawViewSpreadsheet::getSheetImage(void)
             std::stringstream field;
             if (prop && cell) {
                 if (prop->isDerivedFrom((App::PropertyQuantity::getClassTypeId()))) {
-                    field << cell->getFormattedQuantity();
+                    std::string temp = cell->getFormattedQuantity();    //writable
+                    DrawUtil::encodeXmlSpecialChars(temp);
+                    field << temp;
                 } else if (prop->isDerivedFrom((App::PropertyFloat::getClassTypeId()))) {
                     field << cell->getFormattedQuantity();
                 } else if (prop->isDerivedFrom((App::PropertyInteger::getClassTypeId()))) {
                     field << cell->getFormattedQuantity();
                 } else if (prop->isDerivedFrom((App::PropertyString::getClassTypeId()))) {
-                    field << static_cast<App::PropertyString*>(prop)->getValue();
+                    std::string temp = static_cast<App::PropertyString*>(prop)->getValue();
+                    DrawUtil::encodeXmlSpecialChars(temp);
+                    field << temp;
                 } else {
                     Base::Console().Error("DVSS: Unknown property type\n");
                     celltext = "???";