mirror of
https://github.com/PHPOffice/PhpSpreadsheet.git
synced 2026-09-09 09:36:25 +00:00
Adrien Crivelli
bea2d4b30f
Prevent XEE by hiding custom entities by using single quote to declare a non-UTF-8 encoding. XML standard, https://www.w3.org/TR/xml/#NT-EncodingDecl, allows single quote to declare encoding, but we did not support it. Instead, we incorrectly fell back on the default of UTF-8. That incorrectly kept the XML as non-UTF-8, and thus prevented our regexp-based custom entity detection mechanism to work.