HtmlWriter comments are not html encoded

[dstoever]

This is:

- [* ] a bug report
- [ ] a feature request
- [ ] **not** a usage question (ask them on https://stackoverflow.com/questions/tagged/phpspreadsheet or https://gitter.im/PHPOffice/PhpSpreadsheet)

What is the expected behavior?

Characters like < has to changed to < in the cell comments

What is the current behavior?

Characters like < are not html encoded

What are the steps to reproduce?

Save a spreadsheet with characters like < in a cell comment

// add code that show the issue here...

The error is in Html.php line 1662
Now:
$result .= '

' . nl2br($pSheet->getComment($coordinate)->getText()->getPlainText()) . '

';

Should be:
$result .= '

' . nl2br(htmlspecialchars($pSheet->getComment($coordinate)->getText()->getPlainText())) . '

';

Which versions of PhpSpreadsheet and PHP are affected?

1.7.0

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
If this is still an issue for you, please try to help by debugging it further and sharing your results.
Thank you for your contributions.

[oleibman]

Fixed by PR #3957 in April 2024.