mirror of
https://github.com/PHPOffice/PhpSpreadsheet.git
synced 2026-09-27 03:15:21 +00:00
oleibman
d647fe7ee7
With PhpUnit 10 came the ability to use Php attributes rather than doc-block annotations for things like "data provider". PhpUnit 11 deprecates the use of annotations, and PhpUnit 12 will not not permit their use. Since PhpUnit 11 requires Php8.2+, we cannot adopt it as long as we support Php8.1, which will continue to be the case for some time. However, there is no penalty for early adoption. Php-cs-fixer can use: ``` 'php_unit_attributes' => ['keep_annotations' => false], ``` This allows us to run `composer fix` to automate all the needed changes. No manual changes were needed for any of the test members. With this change, PhpUnit 9 can no longer be used with the test suite. File composer.json is updated to reflect that reality, and phpunit9.xml.dist, which has been supplied in case anyone needed to use PhpUnit 9, is no longer required, and is thus deleted. For now, PhpUnit 11 is not being added as a possibility. No source code is changed in this PR.
78 lines
4.6 KiB
PHP
78 lines
4.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace PhpOffice\PhpSpreadsheetTests\Writer\Html;
|
|
|
|
use PhpOffice\PhpSpreadsheet\RichText\RichText;
|
|
use PhpOffice\PhpSpreadsheet\Spreadsheet;
|
|
use PhpOffice\PhpSpreadsheet\Writer\Html;
|
|
use PhpOffice\PhpSpreadsheetTests\Functional;
|
|
|
|
class XssVulnerabilityTest extends Functional\AbstractFunctional
|
|
{
|
|
public static function providerXssRichText(): array
|
|
{
|
|
return [
|
|
'basic text no problem' => ['Hello, I am safely viewing your site', 'Hello, I am safely viewing your site'],
|
|
'link eliminated' => ["<a href='Visit Google'>Google is here</a>", "<a href='Visit Google'>Google is here</a>"],
|
|
'script tag' => ["Hello, I am trying to <script>alert('Hack');</script> your site", "Hello, I am trying to <script>alert('Hack');</script> your site"],
|
|
'script tag with quotes' => ['Hello, I am trying to <script>alert("Hack");</script> your site', 'Hello, I am trying to <script>alert("Hack");</script> your site'],
|
|
'javascript tag no hex' => ["<a href='javascript:alert(1)'>CLICK</a>", "<a href='javascript:alert(1)'>CLICK</a>"],
|
|
'javascript tag' => ["<a href=' javascript:alert(1)'>CLICK</a>", "<a href='&#x2000;javascript:alert(1)'>CLICK</a>"],
|
|
'with unicode' => ['<a href="\\u0001java\\u0003script:alert(1)">CLICK</a>', '<a href="\\u0001java\\u0003script:alert(1)">CLICK</a>'],
|
|
'inline css' => ['<li style="list-style-image: url(javascript:alert(0))">', '<li style="list-style-image: url(javascript:alert(0))">'],
|
|
'char value chevron' => ["\x3cscript src=http://www.example.com/malicious-code.js\x3e\x3c/script\x3e", '<script src=http://www.example.com/malicious-code.js></script>'],
|
|
'hexadecimal html' => ['<IMG SRC=javasmript:alert('XSS')>', '<IMG SRC=&#106&#x61&#x76&#x61&#x73&#109&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>'],
|
|
'iframe' => ['<iframe width="560" onclick="alert(\'xss\')" height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen></iframe>', '<iframe width="560" onclick="alert(\'xss\')" height="315" src="https://www.youtube.com/embed/whatever?rel=0&controls=0&showinfo=0" frameborder="0" allowfullscreen></iframe>'],
|
|
];
|
|
}
|
|
|
|
#[\PHPUnit\Framework\Attributes\DataProvider('providerXssRichText')]
|
|
public function testXssInComment(string $xssTextString, ?string $expected = null): void
|
|
{
|
|
$spreadsheet = new Spreadsheet();
|
|
$startCell = '<td class="column0 style0 s">';
|
|
$cellText = 'XSS Test';
|
|
$endCell = $cellText . '</td>';
|
|
if ($expected === null) { // whole comment stripped away
|
|
$expected = $startCell . $endCell;
|
|
} else {
|
|
$expected = $startCell . '<a class="comment-indicator"></a><div class="comment">' . $expected . '</div>' . PHP_EOL . $endCell;
|
|
}
|
|
|
|
$richText = new RichText();
|
|
$richText->createText($xssTextString);
|
|
|
|
$spreadsheet->getActiveSheet()->getCell('A1')->setValue($cellText);
|
|
|
|
$spreadsheet->getActiveSheet()
|
|
->getComment('A1')
|
|
->setText($richText);
|
|
|
|
$writer = new Html($spreadsheet);
|
|
|
|
$verify = $writer->generateHtmlAll();
|
|
// Ensure that executable js has been stripped from the comments
|
|
self::assertStringContainsString($expected, $verify);
|
|
$spreadsheet->disconnectWorksheets();
|
|
}
|
|
|
|
public function testXssInFontName(): void
|
|
{
|
|
$spreadsheet = new Spreadsheet();
|
|
$sheet = $spreadsheet->getActiveSheet();
|
|
$sheet->getCell('A1')->setValue('here');
|
|
$used = 'Calibri</style><script type="text/javascript">alert("hello");</script><style type="text/css">';
|
|
$expected = "font-family:'Calibri</style><script type="text/javascript">alert("hello");</script><style type="text/css">'";
|
|
$sheet->getStyle('A1')->getFont()->setName($used);
|
|
|
|
$writer = new Html($spreadsheet);
|
|
$verify = $writer->generateHtmlAll();
|
|
// Ensure that executable js has been stripped
|
|
self::assertStringNotContainsString($used, $verify);
|
|
self::assertStringContainsString($expected, $verify);
|
|
$spreadsheet->disconnectWorksheets();
|
|
}
|
|
}
|