groove/Part-DB-server
1
0
Fork 0
mirror of https://github.com/Part-DB/Part-DB-server.git synced 2026-07-15 22:01:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Prevent formula injection into XLSX export

Browse source
This commit is contained in:
Jan Böhmer 2026-07-14 18:14:59 +02:00
parent f53f77f6dc
commit 5110915de2
2 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tests/Services/ImportExportSystem/EntityExporterTest.php
View file

@ -101,6 +101,28 @@ final class EntityExporterTest extends WebTestCase
unlink($tempFile);
}
public function testExportExcelFormulaInjectionPrevention(): void
{
// Values starting with formula characters must be stored as plain strings, not evaluated formulas
$entity = (new Category())->setName('=1+1')->setComment('@SUM(A1)');
$xlsxData = $this->service->exportEntities([$entity], ['format' => 'xlsx', 'level' => 'simple']);
$this->assertNotEmpty($xlsxData);
$tempFile = tempnam(sys_get_temp_dir(), 'test_formula') . '.xlsx';
file_put_contents($tempFile, $xlsxData);
$spreadsheet = IOFactory::load($tempFile);
$worksheet = $spreadsheet->getActiveSheet();
// The formula-prefixed name must be stored as a plain string, not a formula
$cell = $worksheet->getCell('A2');
$this->assertSame(\PhpOffice\PhpSpreadsheet\Cell\DataType::TYPE_STRING, $cell->getDataType());
$this->assertSame('=1+1', $cell->getValue());
unlink($tempFile);
}
public function testExportExcelFromRequest(): void
{
$entities = $this->getEntities();