PhpSpreadsheet icon indicating copy to clipboard operation
PhpSpreadsheet copied to clipboard

Allow Xlsx Reader to Specify ParseHuge Release390

Open oleibman opened this issue 4 months ago • 0 comments

Fix #4260. A number of Security Advisories related to libxml_options were opened. In the end, we disabled the ability to specify any libxml_options. However, some users were adversely affected because they needed LIBXML_PARSEHUGE for some of their files. Having finally obtained access to a file demonstrating this problem, we can restore this ability.

  • The operation is potentially dangerous, a vector for memory leaks and out-of-memory errors. It is not recommended unless absolutely needed.
  • It will not be permitted as a global (static) property with the ability to adversely affect other users on the same server.
  • It will instead be implemented as an instance property of Xlsx Reader (default to false), with a setter. I do not see a use case for a getter.
  • People will need to set this property individually for each file which they think needs it.
  • This change will be backported to all supported releases.
  • The sheer size and processing time for the file involved makes it impractical to add a formal test case. It has, nevertheless, been tested satisfactorily.

This is:

  • [x] a bugfix
  • [ ] a new feature
  • [ ] refactoring
  • [ ] additional unit tests

Checklist:

  • [ ] Changes are covered by unit tests
    • [ ] Changes are covered by existing unit tests
    • [ ] New unit tests have been added
  • [x] Code style is respected
  • [x] Commit message explains why the change is made (see https://github.com/erlang/otp/wiki/Writing-good-commit-messages)
  • [x] CHANGELOG.md contains a short summary of the change and a link to the pull request if applicable
  • [ ] Documentation is updated as necessary

oleibman avatar Jun 19 '25 04:06 oleibman