From b60fa5c920b5eb7cf4a2e3e1cacfe779d2f9ff12 Mon Sep 17 00:00:00 2001
From: 若依 <yzz_ivy@163.com>
Date: Sat, 12 Feb 2022 14:01:41 +0800
Subject: [PATCH] !144 删除方法无返回值时，方法注释上的@return Merge pull request !144 from 我的世界有我/master
---
ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java | 10 +++++++++-
1 files changed, 9 insertions(+), 1 deletions(-)
diff --git a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
index f7e33a6..c5c8d7a 100644
--- a/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
+++ b/ruoyi-common/ruoyi-common-core/src/main/java/com/ruoyi/common/core/utils/poi/ExcelUtil.java
@@ -63,6 +63,8 @@
{
private static final Logger log = LoggerFactory.getLogger(ExcelUtil.class);
+ public static final String[] FORMULA_STR = { "=", "-", "+", "@" };
+
/**
* Excel sheet最大行数，默认65536
*/
@@ -589,7 +591,13 @@
{
if (ColumnType.STRING == attr.cellType())
{
- cell.setCellValue(StringUtils.isNull(value) ? attr.defaultValue() : value + attr.suffix());
+ String cellValue = Convert.toStr(value);
+ // 对于任何以表达式触发字符 =-+@开头的单元格，直接使用tab字符作为前缀，防止CSV注入。
+ if (StringUtils.containsAny(cellValue, FORMULA_STR))
+ {
+ cellValue = StringUtils.replaceEach(cellValue, FORMULA_STR, new String[] { "\t=", "\t-", "\t+", "\t@" });
+ }
+ cell.setCellValue(StringUtils.isNull(cellValue) ? attr.defaultValue() : cellValue + attr.suffix());
}
else if (ColumnType.NUMERIC == attr.cellType())
{
--
Gitblit v1.9.3