diff --git a/composer.lock b/composer.lock index 69d73294b..da9da23b1 100644 --- a/composer.lock +++ b/composer.lock @@ -1564,16 +1564,16 @@ }, { "name": "friendsofphp/php-cs-fixer", - "version": "v3.40.0", + "version": "v3.45.0", "source": { "type": "git", "url": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer.git", - "reference": "27d2b3265b5d550ec411b4319967ae7cfddfb2e0" + "reference": "c0daa33cb2533cd73f48dde1c70c2afa3e7953b5" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/27d2b3265b5d550ec411b4319967ae7cfddfb2e0", - "reference": "27d2b3265b5d550ec411b4319967ae7cfddfb2e0", + "url": "https://api.github.com/repos/PHP-CS-Fixer/PHP-CS-Fixer/zipball/c0daa33cb2533cd73f48dde1c70c2afa3e7953b5", + "reference": "c0daa33cb2533cd73f48dde1c70c2afa3e7953b5", "shasum": "" }, "require": { @@ -1603,10 +1603,7 @@ "php-cs-fixer/accessible-object": "^1.1", "php-cs-fixer/phpunit-constraint-isidenticalstring": "^1.4", "php-cs-fixer/phpunit-constraint-xmlmatchesxsd": "^1.4", - "phpspec/prophecy": "^1.17", - "phpspec/prophecy-phpunit": "^2.0", - "phpunit/phpunit": "^9.6", - "symfony/phpunit-bridge": "^6.3.8 || ^7.0", + "phpunit/phpunit": "^9.6 || ^10.5.5", "symfony/yaml": "^5.4 || ^6.0 || ^7.0" }, "suggest": { @@ -1645,7 +1642,7 @@ ], "support": { "issues": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues", - "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.40.0" + "source": "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/tree/v3.45.0" }, "funding": [ { @@ -1653,7 +1650,7 @@ "type": "github" } ], - "time": "2023-11-26T09:25:53+00:00" + "time": "2023-12-30T02:07:07+00:00" }, { "name": "masterminds/html5", @@ -5403,5 +5400,5 @@ "platform-overrides": { "php": "8.0.99" }, - "plugin-api-version": "2.6.0" + "plugin-api-version": "2.3.0" } diff --git a/samples/Basic/16_Csv.php b/samples/Basic/16_Csv.php index 137f6469c..381d8c79d 100644 --- a/samples/Basic/16_Csv.php +++ b/samples/Basic/16_Csv.php @@ -7,7 +7,6 @@ require __DIR__ . '/../Header.php'; $spreadsheet = require __DIR__ . '/../templates/sampleSpreadsheet.php'; $helper->log('Write to CSV format'); -/** @var \PhpOffice\PhpSpreadsheet\Writer\Csv $writer */ $writer = new CsvWriter($spreadsheet); $writer->setDelimiter(',') ->setEnclosure('"') @@ -20,7 +19,6 @@ $helper->logWrite($writer, $filename, $callStartTime); $helper->log('Read from CSV format'); -/** @var \PhpOffice\PhpSpreadsheet\Reader\Csv $reader */ $reader = new CsvReader(); $reader->setDelimiter(',') ->setEnclosure('"') @@ -36,7 +34,6 @@ $helper->write($spreadsheetFromCSV, __FILE__, ['Xlsx']); // Write CSV $filenameCSV = $helper->getFilename(__FILE__, 'csv'); -/** @var \PhpOffice\PhpSpreadsheet\Writer\Csv $writerCSV */ $writerCSV = new CsvWriter($spreadsheetFromCSV); //$writerCSV->setExcelCompatibility(true); $writerCSV->setUseBom(true); // because of non-ASCII chars diff --git a/samples/Basic/26_Utf8.php b/samples/Basic/26_Utf8.php index 2eeca067b..a04134447 100644 --- a/samples/Basic/26_Utf8.php +++ b/samples/Basic/26_Utf8.php @@ -45,7 +45,7 @@ $worksheet->removeRow(1, 2); // Export to CSV (.csv) $helper->log('Write to CSV format'); -/** @var \PhpOffice\PhpSpreadsheet\Writer\Csv $writer */ +/** @var Csv $writer */ $helper->write($spreadsheet, __FILE__, ['Csv']); // Export to CSV with BOM (.csv) diff --git a/samples/Pdf/21c_Pdf.php b/samples/Pdf/21c_Pdf.php index 6b6e6ab05..5a6a26d37 100644 --- a/samples/Pdf/21c_Pdf.php +++ b/samples/Pdf/21c_Pdf.php @@ -56,7 +56,7 @@ for ($row = 1; $row < 1001; ++$row) { } $helper->log('Write to Mpdf'); -IOFactory::registerWriter('Pdf', \PhpOffice\PhpSpreadsheet\Writer\Pdf\Mpdf::class); +IOFactory::registerWriter('Pdf', Mpdf::class); $helper->write($spreadsheet, __FILE__, ['Pdf']); $helper->write( $spreadsheet, diff --git a/src/PhpSpreadsheet/Helper/Sample.php b/src/PhpSpreadsheet/Helper/Sample.php index 2f7d95b06..c6020e8a5 100644 --- a/src/PhpSpreadsheet/Helper/Sample.php +++ b/src/PhpSpreadsheet/Helper/Sample.php @@ -190,7 +190,7 @@ class Sample public function log(string $message): void { $eol = $this->isCli() ? PHP_EOL : '
'; - echo($this->isCli() ? date('H:i:s ') : '') . $message . $eol; + echo ($this->isCli() ? date('H:i:s ') : '') . $message . $eol; } /** diff --git a/src/PhpSpreadsheet/Reader/Gnumeric.php b/src/PhpSpreadsheet/Reader/Gnumeric.php index 729745f14..6e3d46575 100644 --- a/src/PhpSpreadsheet/Reader/Gnumeric.php +++ b/src/PhpSpreadsheet/Reader/Gnumeric.php @@ -253,7 +253,9 @@ class Gnumeric extends BaseReader $gFileData = $this->gzfileGetContents($filename); - $xml2 = simplexml_load_string($gFileData, 'SimpleXMLElement', Settings::getLibXmlLoaderOptions()); + /** @var XmlScanner */ + $securityScanner = $this->securityScanner; + $xml2 = simplexml_load_string($securityScanner->scan($gFileData), 'SimpleXMLElement', Settings::getLibXmlLoaderOptions()); $xml = self::testSimpleXml($xml2); $gnmXML = $xml->children(self::NAMESPACE_GNM); diff --git a/src/PhpSpreadsheet/Writer/Xls.php b/src/PhpSpreadsheet/Writer/Xls.php index 1b96579e0..b2f2bc48b 100644 --- a/src/PhpSpreadsheet/Writer/Xls.php +++ b/src/PhpSpreadsheet/Writer/Xls.php @@ -747,12 +747,12 @@ class Xls extends BaseWriter $dataSection_Content .= $dataProp['data']['data']; $dataSection_Content_Offset += 4 + 4 + strlen($dataProp['data']['data']); - /* Condition below can never be true - } elseif ($dataProp['type']['data'] == 0x40) { // Filetime (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601) - $dataSection_Content .= $dataProp['data']['data']; + /* Condition below can never be true + } elseif ($dataProp['type']['data'] == 0x40) { // Filetime (64-bit value representing the number of 100-nanosecond intervals since January 1, 1601) + $dataSection_Content .= $dataProp['data']['data']; - $dataSection_Content_Offset += 4 + 8; - */ + $dataSection_Content_Offset += 4 + 8; + */ } else { $dataSection_Content .= $dataProp['data']['data']; diff --git a/tests/PhpSpreadsheetTests/Functional/ReadFilterFilter.php b/tests/PhpSpreadsheetTests/Functional/ReadFilterFilter.php index 3da40cef7..2d7b208dd 100644 --- a/tests/PhpSpreadsheetTests/Functional/ReadFilterFilter.php +++ b/tests/PhpSpreadsheetTests/Functional/ReadFilterFilter.php @@ -13,7 +13,7 @@ class ReadFilterFilter implements IReadFilter * @param int $row Row number * @param string $worksheetName Optional worksheet name * - * @see \PhpOffice\PhpSpreadsheet\Reader\IReadFilter::readCell() + * @see IReadFilter::readCell() */ public function readCell($column, $row, $worksheetName = ''): bool { diff --git a/tests/PhpSpreadsheetTests/IOFactoryTest.php b/tests/PhpSpreadsheetTests/IOFactoryTest.php index 78cbef682..a13156d96 100644 --- a/tests/PhpSpreadsheetTests/IOFactoryTest.php +++ b/tests/PhpSpreadsheetTests/IOFactoryTest.php @@ -171,7 +171,7 @@ class IOFactoryTest extends TestCase public function testRegisterInvalidReader(): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Reader\Exception::class); + $this->expectException(ReaderException::class); IOFactory::registerReader('foo', 'bar'); } @@ -185,7 +185,7 @@ class IOFactoryTest extends TestCase public function testCreateInvalidReader(): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Reader\Exception::class); + $this->expectException(ReaderException::class); IOFactory::createReader('bad'); } @@ -212,7 +212,7 @@ class IOFactoryTest extends TestCase public function testCreateReaderNotSpreadsheet(): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Reader\Exception::class); + $this->expectException(ReaderException::class); $filename = __FILE__; IOFactory::createReaderForFile($filename); } diff --git a/tests/PhpSpreadsheetTests/Reader/Gnumeric/GnumericLoadTest.php b/tests/PhpSpreadsheetTests/Reader/Gnumeric/GnumericLoadTest.php index 1d8d0060d..3f862cb99 100644 --- a/tests/PhpSpreadsheetTests/Reader/Gnumeric/GnumericLoadTest.php +++ b/tests/PhpSpreadsheetTests/Reader/Gnumeric/GnumericLoadTest.php @@ -200,4 +200,13 @@ class GnumericLoadTest extends TestCase $reader = new Gnumeric(); $reader->load($filename); } + + public function testDoctype(): void + { + $this->expectException(ReaderException::class); + $this->expectExceptionMessage('prevent XXE'); + $filename = 'tests/data/Reader/Gnumeric/xmlwithdoctype.gnumeric'; + $reader = new Gnumeric(); + $reader->load($filename); + } } diff --git a/tests/PhpSpreadsheetTests/Reader/Security/XmlScannerTest.php b/tests/PhpSpreadsheetTests/Reader/Security/XmlScannerTest.php index 8215b8781..7f78d8422 100644 --- a/tests/PhpSpreadsheetTests/Reader/Security/XmlScannerTest.php +++ b/tests/PhpSpreadsheetTests/Reader/Security/XmlScannerTest.php @@ -42,7 +42,7 @@ class XmlScannerTest extends TestCase */ public function testInvalidXML(mixed $filename): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Reader\Exception::class); + $this->expectException(ReaderException::class); $reader = XmlScanner::getInstance(new \PhpOffice\PhpSpreadsheet\Reader\Xml()); $expectedResult = 'FAILURE: Should throw an Exception rather than return a value'; diff --git a/tests/PhpSpreadsheetTests/Worksheet/AutoFilter/AutoFilterTest.php b/tests/PhpSpreadsheetTests/Worksheet/AutoFilter/AutoFilterTest.php index 7b1583d54..43d62e5c0 100644 --- a/tests/PhpSpreadsheetTests/Worksheet/AutoFilter/AutoFilterTest.php +++ b/tests/PhpSpreadsheetTests/Worksheet/AutoFilter/AutoFilterTest.php @@ -375,7 +375,7 @@ class AutoFilterTest extends SetupTeardown public function testGetColumnWithoutRangeSet(): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Exception::class); + $this->expectException(PhpSpreadsheetException::class); $sheet = $this->getSheet(); $autoFilter = $sheet->getAutoFilter(); $autoFilter->setRange(self::INITIAL_RANGE); diff --git a/tests/PhpSpreadsheetTests/Worksheet/Table/TableTest.php b/tests/PhpSpreadsheetTests/Worksheet/Table/TableTest.php index 0af783135..9c53dffec 100644 --- a/tests/PhpSpreadsheetTests/Worksheet/Table/TableTest.php +++ b/tests/PhpSpreadsheetTests/Worksheet/Table/TableTest.php @@ -455,7 +455,7 @@ class TableTest extends SetupTeardown public function testGetColumnWithoutRangeSet(): void { - $this->expectException(\PhpOffice\PhpSpreadsheet\Exception::class); + $this->expectException(PhpSpreadsheetException::class); $table = new Table(self::INITIAL_RANGE); // Clear the range diff --git a/tests/data/Reader/Gnumeric/xmlwithdoctype.gnumeric b/tests/data/Reader/Gnumeric/xmlwithdoctype.gnumeric new file mode 100644 index 000000000..677cc24f5 Binary files /dev/null and b/tests/data/Reader/Gnumeric/xmlwithdoctype.gnumeric differ diff --git a/tests/data/Reader/Xml/XEETestInvalidUTF-7_DoubleEncoded.xml b/tests/data/Reader/Xml/XEETestInvalidUTF-7_DoubleEncoded.xml index cc65a0ecc..44beb1222 100644 --- a/tests/data/Reader/Xml/XEETestInvalidUTF-7_DoubleEncoded.xml +++ b/tests/data/Reader/Xml/XEETestInvalidUTF-7_DoubleEncoded.xml @@ -1,2 +1,2 @@ -+-ADwAIQ-DOCTYPE xmlrootname +-AFsAPAAh-ENTITY +-ACU aaa SYSTEM +-ACI-http://127.0.0.1:8080/ext.dtd+-ACIAPgAl-aaa+-ADsAJQ-ccc+-ADsAJQ-ddd+-ADsAXQA+- ++-ADwAIQ-DOCTYPE xmlrootname +-AFsAPAAh-+AEU-NTITY +-ACU aaa SYSTEM +-ACI-http://127.0.0.1:8080/ext.dtd+-ACIAPgAl-aaa+-ADsAJQ-ccc+-ADsAJQ-ddd+-ADsAXQA+-