From 089ffdfc04b5fcf25a3503d81a4e589f247e20e3 Mon Sep 17 00:00:00 2001
From: oleibman <10341515+oleibman@users.noreply.github.com>
Date: Sat, 11 Jan 2025 19:16:27 -0800
Subject: [PATCH] Backported Security Patch

---
 CHANGELOG.md                                  |  3 +-
 src/PhpSpreadsheet/Writer/Html.php            |  2 +-
 .../Writer/Html/NavigationBadTitleTest.php    | 35 +++++++++++++++++++
 3 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 tests/PhpSpreadsheetTests/Writer/Html/NavigationBadTitleTest.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 498a046e81..93b1f9557d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com)
 and this project adheres to [Semantic Versioning](https://semver.org).
 
-# TBD - 1.29.8
+# 2025-01-11 - 1.29.8
 
 ### Deprecated
 
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 
 ### Fixed
 
+- Backported security patch for Html navigation.
 - Change hash code for worksheet. Backport of [PR #4207](https://github.com/PHPOffice/PhpSpreadsheet/pull/4207)
 - Retitling cloned worksheets. Backport of [PR #4302](https://github.com/PHPOffice/PhpSpreadsheet/pull/4302)
 
diff --git a/src/PhpSpreadsheet/Writer/Html.php b/src/PhpSpreadsheet/Writer/Html.php
index 000ea36b81..3d507a5e2e 100644
--- a/src/PhpSpreadsheet/Writer/Html.php
+++ b/src/PhpSpreadsheet/Writer/Html.php
@@ -563,7 +563,7 @@ public function generateNavigation()
             $html .= '<ul class="navigation">' . PHP_EOL;
 
             foreach ($sheets as $sheet) {
-                $html .= '  <li class="sheet' . $sheetId . '"><a href="#sheet' . $sheetId . '">' . $sheet->getTitle() . '</a></li>' . PHP_EOL;
+                $html .= '  <li class="sheet' . $sheetId . '"><a href="#sheet' . $sheetId . '">' . htmlspecialchars($sheet->getTitle()) . '</a></li>' . PHP_EOL;
                 ++$sheetId;
             }
 
diff --git a/tests/PhpSpreadsheetTests/Writer/Html/NavigationBadTitleTest.php b/tests/PhpSpreadsheetTests/Writer/Html/NavigationBadTitleTest.php
new file mode 100644
index 0000000000..284fd9f4e5
--- /dev/null
+++ b/tests/PhpSpreadsheetTests/Writer/Html/NavigationBadTitleTest.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;
+
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Writer\Html as HtmlWriter;
+use PHPUnit\Framework\TestCase;
+
+class NavigationBadTitleTest extends TestCase
+{
+    public function testNavigationTitle(): void
+    {
+        $spreadsheet = new Spreadsheet();
+        $sheet = $spreadsheet->getActiveSheet();
+        $sheet->getCell('A1')->setValue(1);
+        $sheet2 = $spreadsheet->createSheet();
+        $sheet2->setTitle('<img src=x onerror=alert(1)>');
+        $sheet2->getCell('A2')->setValue(2);
+
+        $writer = new HtmlWriter($spreadsheet);
+        $writer->writeAllSheets();
+        $html = $writer->generateHTMLAll();
+        $expected = '<ul class="navigation">'
+            . PHP_EOL
+            . '  <li class="sheet0"><a href="#sheet0">Worksheet</a></li>'
+            . PHP_EOL
+            . '  <li class="sheet1"><a href="#sheet1">&lt;img src=x onerror=alert(1)&gt;</a></li>'
+            . PHP_EOL
+            . '</ul>';
+        self::assertStringContainsString($expected, $html, 'appropriate characters are escaped');
+        $spreadsheet->disconnectWorksheets();
+    }
+}