Merge pull request #1009 from DFE-Digital/feature/sanitise-text-word-doc

Add string sanitisation to strings being exported to word

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/DocumentGenerator.cs

@@ -8,19 +8,18 @@
 using System;
 using System.IO;
 using System.Reflection;
-
-// Document Section Generators
-using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolAndTrustInformationAndProjectDatesGenerator;
-using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolOverviewGenerator;
-using static Dfe.PrepareConversions.Services.DocumentGenerator.OfstedInformationGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.EducationalAttendanceGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.KeyStage2Generator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.KeyStage4Generator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.KeyStage5Generator;
+using static Dfe.PrepareConversions.Services.DocumentGenerator.LegalRequirementsGenerator;
+using static Dfe.PrepareConversions.Services.DocumentGenerator.OfstedInformationGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.RationaleGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.RisksAndIssuesGenerator;
-using static Dfe.PrepareConversions.Services.DocumentGenerator.LegalRequirementsGenerator;
+// Document Section Generators
+using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolAndTrustInformationAndProjectDatesGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolBudgetInformationGenerator;
+using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolOverviewGenerator;
 using static Dfe.PrepareConversions.Services.DocumentGenerator.SchoolPupilForecastGenerator;
 
 namespace Dfe.PrepareConversions.Services.DocumentGenerator

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/DocumentGeneratorStringSanitiser.cs

@@ -0,0 +1,51 @@
+using Dfe.PrepareConversions.DocumentGeneration.Elements;
+using System.Linq;
+using System.Xml;
+
+namespace Dfe.PrepareConversions.Services.DocumentGenerator
+{
+   public static class DocumentGeneratorStringSanitiser
+   {
+      public static string SanitizeString(string input)
+      {
+         if (string.IsNullOrEmpty(input)) return input;
+
+         string output = input.Replace("<", "&lt;")
+                              .Replace(">", "&gt;")
+                              .Replace("&", "&amp;")
+                              .Replace("\"", "&quot;")
+                              .Replace("\'", "&apos;")
+                              .Replace("&amp;amp;", "&amp;");
+         output = new string(output.Where(ch => XmlConvert.IsXmlChar(ch)).ToArray());
+         return output;
+      }
+
+      // SanitizeTextElements method as provided
+      public static TextElement[] SanitizeTextElements(TextElement[] elements)
+      {
+         return elements.Select(element => new TextElement
+         {
+            Value = SanitizeString(element.Value),
+            Bold = element.Bold
+         }).ToArray();
+      }
+
+      // Utility method to create and sanitize TextElement arrays
+      public static TextElement[] CreateTextElements(string label, string value)
+      {
+         return SanitizeTextElements(new[]
+         {
+                new TextElement { Value = label, Bold = true },
+                new TextElement { Value = value }
+            });
+      }
+      public static TextElement[] CreateSingleTextElement(string value)
+      {
+         return new TextElement[]
+         {
+               new() { Value = SanitizeString(value) }
+         };
+      }
+
+   }
+}

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/LegalRequirementsGenerator.cs

@@ -16,21 +16,22 @@ public static void AddLegalRequirements(IDocumentBuilder builder, HtbTemplate do
             {
                build.AddHeading("Legal requirements", HeadingLevel.One);
                build.AddTable(new List<TextElement[]>
-               {
-                  new[] { new TextElement { Value = "Management commitee resolution", Bold = true }, new TextElement { Value = document.GoverningBodyResolution } },
-                  new[] { new TextElement { Value = "Consultation", Bold = true }, new TextElement { Value = document.Consultation } },
-                  new[] { new TextElement { Value = "Diocesan consent", Bold = true }, new TextElement { Value = document.DiocesanConsent } },
-                  new[] { new TextElement { Value = "Foundation consent", Bold = true }, new TextElement { Value = document.FoundationConsent } },
-               });
+                    {
+                        DocumentGeneratorStringSanitiser.CreateTextElements("Management committee resolution", document.GoverningBodyResolution ?? "N/A"),
+                        DocumentGeneratorStringSanitiser.CreateTextElements("Consultation", document.Consultation ?? "N/A"),
+                        DocumentGeneratorStringSanitiser.CreateTextElements("Diocesan consent", document.DiocesanConsent ?? "N/A"),
+                        DocumentGeneratorStringSanitiser.CreateTextElements("Foundation consent", document.FoundationConsent ?? "N/A"),
+                    });
                build.AddParagraph("");
             });
          }
          else
          {
             builder.ReplacePlaceholderWithContent("LegalRequirements", build =>
             {
+               // If the academy route is sponsored, no legal requirements are displayed
             });
          }
       }
    }
-}
+}

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/OfstedInformationGenerator.cs

@@ -14,32 +14,21 @@ public static void AddOfstedInformation(DocumentBuilder builder, HtbTemplate doc
          SchoolPerformance schoolPerformance = document.SchoolPerformance;
 
          List<TextElement[]> ofstedInformation = new()
-      {
-         new[] { new TextElement { Value = "School name", Bold = true }, new TextElement { Value = project.SchoolName } },
-         new[]
-         {
-            new TextElement { Value = "Latest full inspection date", Bold = true },
-            new TextElement { Value = schoolPerformance.InspectionEndDate?.ToString("d MMMM yyyy") ?? "No data" }
-         },
-         new[] { new TextElement { Value = "Overall effectiveness", Bold = true }, new TextElement { Value = schoolPerformance.OverallEffectiveness.DisplayOfstedRating() } },
-         new[] { new TextElement { Value = "Quality of education", Bold = true }, new TextElement { Value = schoolPerformance.QualityOfEducation.DisplayOfstedRating() } },
-         new[] { new TextElement { Value = "Behaviour and attitudes", Bold = true }, new TextElement { Value = schoolPerformance.BehaviourAndAttitudes.DisplayOfstedRating() } },
-         new[] { new TextElement { Value = "Personal development", Bold = true }, new TextElement { Value = schoolPerformance.PersonalDevelopment.DisplayOfstedRating() } },
-         new[]
-         {
-            new TextElement { Value = "Effectiveness of leadership and management", Bold = true },
-            new TextElement { Value = schoolPerformance.EffectivenessOfLeadershipAndManagement.DisplayOfstedRating() }
-         }
-      };
+            {
+                DocumentGeneratorStringSanitiser.CreateTextElements("School name", project.SchoolName),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Latest full inspection date", schoolPerformance.InspectionEndDate?.ToString("d MMMM yyyy") ?? "No data"),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Overall effectiveness", schoolPerformance.OverallEffectiveness.DisplayOfstedRating()),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Quality of education", schoolPerformance.QualityOfEducation.DisplayOfstedRating()),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Behaviour and attitudes", schoolPerformance.BehaviourAndAttitudes.DisplayOfstedRating()),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Personal development", schoolPerformance.PersonalDevelopment.DisplayOfstedRating()),
+                DocumentGeneratorStringSanitiser.CreateTextElements("Effectiveness of leadership and management", schoolPerformance.EffectivenessOfLeadershipAndManagement.DisplayOfstedRating())
+            };
 
          PopulateIfLatestInspectionIsSection8(schoolPerformance, ofstedInformation);
          PopulateIfEarlyYearsProvision(schoolPerformance, ofstedInformation);
          PopulateIfSixthFormProvision(schoolPerformance, ofstedInformation);
 
-         ofstedInformation.Add(new[]
-         {
-         new TextElement { Value = "Additional information", Bold = true }, new TextElement { Value = project.SchoolPerformanceAdditionalInformation }
-      });
+         ofstedInformation.Add(DocumentGeneratorStringSanitiser.CreateTextElements("Additional information", project.SchoolPerformanceAdditionalInformation));
 
          builder.ReplacePlaceholderWithContent("SchoolPerformanceData", build =>
          {
@@ -53,36 +42,23 @@ private static void PopulateIfSixthFormProvision(SchoolPerformance schoolPerform
       {
          if (schoolPerformance.SixthFormProvision.DisplayOfstedRating().HasData())
          {
-            ofstedInformation.Add(new[]
-            {
-               new TextElement { Value = "Sixth form provision", Bold = true },
-               new TextElement { Value = schoolPerformance.SixthFormProvision.DisplayOfstedRating() }
-            });
+            ofstedInformation.Add(DocumentGeneratorStringSanitiser.CreateTextElements("Sixth form provision", schoolPerformance.SixthFormProvision.DisplayOfstedRating()));
          }
       }
 
       private static void PopulateIfEarlyYearsProvision(SchoolPerformance schoolPerformance, List<TextElement[]> ofstedInformation)
       {
          if (schoolPerformance.EarlyYearsProvision.DisplayOfstedRating().HasData())
          {
-            ofstedInformation.Add(new[]
-            {
-               new TextElement { Value = "Early years provision", Bold = true },
-               new TextElement { Value = schoolPerformance.EarlyYearsProvision.DisplayOfstedRating() }
-            });
+            ofstedInformation.Add(DocumentGeneratorStringSanitiser.CreateTextElements("Early years provision", schoolPerformance.EarlyYearsProvision.DisplayOfstedRating()));
          }
       }
 
       private static void PopulateIfLatestInspectionIsSection8(SchoolPerformance schoolPerformance, List<TextElement[]> ofstedInformation)
       {
          if (schoolPerformance.LatestInspectionIsSection8)
          {
-            ofstedInformation.Insert(1,
-               new[]
-               {
-                  new TextElement { Value = "Latest short inspection date", Bold = true },
-                  new TextElement { Value = schoolPerformance.DateOfLatestSection8Inspection?.ToString("d MMMM yyyy") }
-               });
+            ofstedInformation.Insert(1, DocumentGeneratorStringSanitiser.CreateTextElements("Latest short inspection date", schoolPerformance.DateOfLatestSection8Inspection?.ToString("d MMMM yyyy") ?? "No data"));
          }
       }
    }

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/RationaleGenerator.cs

@@ -4,29 +4,30 @@
 using Dfe.PrepareConversions.Models;
 using System.Collections.Generic;
 
-namespace Dfe.PrepareConversions.Services.DocumentGenerator;
-
-public static class RationaleGenerator
+namespace Dfe.PrepareConversions.Services.DocumentGenerator
 {
-   public static void AddRationale(IDocumentBuilder builder, HtbTemplate document, AcademyConversionProject project)
+   public static class RationaleGenerator
    {
-      builder.ReplacePlaceholderWithContent("Rationale", build =>
+      public static void AddRationale(IDocumentBuilder builder, HtbTemplate document, AcademyConversionProject project)
       {
-         build.AddHeading("Rationale", HeadingLevel.One);
-         if (project.AcademyTypeAndRoute.Equals(AcademyTypeAndRoutes.Sponsored) is false)
+         builder.ReplacePlaceholderWithContent("Rationale", build =>
          {
-            build.AddHeading("Rationale for the project", HeadingLevel.Two);
-            build.AddTable(new List<TextElement[]>
+            build.AddHeading("Rationale", HeadingLevel.One);
+            if (!project.AcademyTypeAndRoute.Equals(AcademyTypeAndRoutes.Sponsored))
             {
-               new[] { new TextElement { Value = document.RationaleForProject ?? "N/A" } }
-            });
-         }
-
-         build.AddHeading("Rationale for the trust or sponsor", HeadingLevel.Two);
-         build.AddTable(new List<TextElement[]>
-         {
-            new[] { new TextElement { Value = document.RationaleForTrust ?? "N/A" } }
+               build.AddHeading("Rationale for the project", HeadingLevel.Two);
+               build.AddTable(new List<TextElement[]>
+                    {
+                        DocumentGeneratorStringSanitiser.CreateSingleTextElement(document.RationaleForProject ?? "N/A")
+                    });
+            }
+
+            build.AddHeading("Rationale for the trust or sponsor", HeadingLevel.Two);
+            build.AddTable(new List<TextElement[]>
+                {
+                    DocumentGeneratorStringSanitiser.CreateSingleTextElement(document.RationaleForTrust ?? "N/A")
+                });
          });
-      });
+      }
    }
-}
+}

Dfe.PrepareConversions/Dfe.PrepareConversions/Services/DocumentGenerator/RisksAndIssuesGenerator.cs

@@ -13,10 +13,10 @@ public static void AddRisksAndIssues(IDocumentBuilder builder, HtbTemplate docum
          {
             build.AddHeading("Risks and issues", HeadingLevel.One);
             build.AddTable(new List<TextElement[]>
-            {
-               new[] { new TextElement { Value = document.RisksAndIssues ?? "N/A" } }
-            });
+                {
+                    DocumentGeneratorStringSanitiser.CreateSingleTextElement(document.RisksAndIssues ?? "N/A")
+                });
          });
       }
    }
-}
+}