From 4ab3edaf3b5a3ee540a76301039a80a79e063bb0 Mon Sep 17 00:00:00 2001
From: Higgs32584 <mhiggins217@gmail.com>
Date: Wed, 21 Oct 2026 20:06:33 -0400
Subject: [PATCH] xlsx: escape shape font typeface attribute (#2170)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/xlsx/src/drawing.rs              |  2 +-
 crates/xlsx/src/tests/shape_text_rtl.rs | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/crates/xlsx/src/drawing.rs b/crates/xlsx/src/drawing.rs
index a6892f0b8..6fd2c22f3 100644
--- a/crates/xlsx/src/drawing.rs
+++ b/crates/xlsx/src/drawing.rs
@@ -471,7 +471,7 @@ fn run_props(f: &ShapeFormat, theme: &Theme) -> (String, String) {
         let _ = write!(body, "<a:solidFill>{c}</a:solidFill>");
     }
     if let Some(font) = &f.font {
-        let _ = write!(body, "<a:latin typeface=\"{}\"/>", esc(font));
+        let _ = write!(body, "<a:latin typeface=\"{}\"/>", esc_attr(font));
     }
     (attrs, body)
 }
diff --git a/crates/xlsx/src/tests/shape_text_rtl.rs b/crates/xlsx/src/tests/shape_text_rtl.rs
index 36bdb861d..2ece04d31 100644
--- a/crates/xlsx/src/tests/shape_text_rtl.rs
+++ b/crates/xlsx/src/tests/shape_text_rtl.rs
@@ -84,3 +84,19 @@ fn shape_text_without_rtl_writes_unchanged_ppr() {
     let xml = written_drawing(&text_box("plain", ShapeFormat::default()));
     assert!(!xml.contains("<a:pPr"), "no paragraph properties without alignment or direction: {xml}");
 }
+
+/// #2170: a shape font typeface holding `"`, `<` or `&` is escaped as an attribute, so it can't
+/// close the `typeface` attribute early and inject others; it survives a save and reopen.
+#[test]
+fn shape_font_typeface_is_attribute_escaped() {
+    let font = r#"a"b<c&d' injected="x"#;
+    let wb = text_box("hi", ShapeFormat { font: Some(font.into()), ..Default::default() });
+    let xml = written_drawing(&wb);
+    assert!(xml.contains(r#"<a:latin typeface="a&quot;b&lt;c&amp;d"#), "typeface is attribute-escaped: {xml}");
+    assert!(!xml.contains(r#" injected="x""#), "no attribute injected: {xml}");
+
+    let (reopened, _) = read_xlsx(&write_xlsx(&wb).unwrap()).unwrap();
+    let after = &reopened.sheet(0).unwrap().shapes[0];
+    assert_eq!(after.format.font.as_deref(), Some(font));
+    assert_eq!(after.text, "hi");
+}