groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-15 05:41:37 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Prevent formula injection into XLSX export

Browse source
This commit is contained in:
Jan Böhmer 2026-07-14 18:14:59 +02:00
parent f53f77f6dc
commit 5110915de2
2 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/Services/ImportExportSystem/EntityExporter.php
View file

@ -23,6 +23,7 @@ declare(strict_types=1);
namespace App\Services\ImportExportSystem;
use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
use PhpOffice\PhpSpreadsheet\Cell\DataType;
use App\Entity\Base\AbstractNamedDBElement;
use App\Entity\Base\AbstractStructuralDBElement;
use App\Helpers\FilenameSanatizer;
@ -179,7 +180,11 @@ class EntityExporter
foreach ($columns as $column) {
$cellCoordinate = Coordinate::stringFromColumnIndex($colIndex) . $rowIndex;
$worksheet->setCellValue($cellCoordinate, $column);
if (is_numeric(trim($column, '"'))) { // Check if the column value is numeric after trimming quotes, as values are surrounded by quotes in CSV
$worksheet->setCellValueExplicit($cellCoordinate, $column, DataType::TYPE_NUMERIC);
} else {
$worksheet->setCellValueExplicit($cellCoordinate, $column, DataType::TYPE_STRING);
}
$colIndex++;
}
$rowIndex++;
@ -268,7 +273,7 @@ class EntityExporter
//Remove percent for fallback
$fallback = str_replace("%", "_", $filename);
// Create the disposition of the file
$disposition = $response->headers->makeDisposition(
ResponseHeaderBag::DISPOSITION_ATTACHMENT,

22
tests/Services/ImportExportSystem/EntityExporterTest.php
View file

@ -101,6 +101,28 @@ final class EntityExporterTest extends WebTestCase
unlink($tempFile);
}
public function testExportExcelFormulaInjectionPrevention(): void
{
// Values starting with formula characters must be stored as plain strings, not evaluated formulas
$entity = (new Category())->setName('=1+1')->setComment('@SUM(A1)');
$xlsxData = $this->service->exportEntities([$entity], ['format' => 'xlsx', 'level' => 'simple']);
$this->assertNotEmpty($xlsxData);
$tempFile = tempnam(sys_get_temp_dir(), 'test_formula') . '.xlsx';
file_put_contents($tempFile, $xlsxData);
$spreadsheet = IOFactory::load($tempFile);
$worksheet = $spreadsheet->getActiveSheet();
// The formula-prefixed name must be stored as a plain string, not a formula
$cell = $worksheet->getCell('A2');
$this->assertSame(\PhpOffice\PhpSpreadsheet\Cell\DataType::TYPE_STRING, $cell->getDataType());
$this->assertSame('=1+1', $cell->getValue());
unlink($tempFile);
}
public function testExportExcelFromRequest(): void
{
$entities = $this->getEntities();