More Tests

Author: oleibman

tests/PhpSpreadsheetTests/Reader/Security/XmlScannerTest.php

@@ -166,4 +166,20 @@ public function testEncodingAllowsMixedCase(): void
         $output = $scanner->scan($input = '<?xml version="1.0" encoding="utf-8"?><foo>bar</foo>');
         self::assertSame($input, $output);
     }
+
+    public function testUtf7Whitespace(): void
+    {
+        $this->expectException(ReaderException::class);
+        $this->expectExceptionMessage('Double-encoded');
+        $reader = new Xlsx();
+        $reader->load('tests/data/Reader/XLSX/utf7white.dontuse');
+    }
+
+    public function testUtf8Entity(): void
+    {
+        $this->expectException(ReaderException::class);
+        $this->expectExceptionMessage('Detected use of ENTITY');
+        $reader = new Xlsx();
+        $reader->load('tests/data/Reader/XLSX/utf8entity.dontuse');
+    }
 }

tests/data/Reader/XLSX/utf7white.dontuse

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding ='UTF-7' standalone="yes"?>
+    +ADw-+ACE-DOCTYPE+ACA-foo+ACA-+AFs-+ADw-+ACE-ENTITY+ACA-toreplace+ACA-+ACI-xxe+AF8-test+ACI-+AD4-+ACA-+AF0-+AD4-+AAo-+ADw-sst+ACA-xmlns+AD0-+ACI-http://schemas.openxmlformats.org/spreadsheetml/2006/main+ACI-+ACA-count+AD0-+ACI-2+ACI-+ACA-uniqueCount+AD0-+ACI-1+ACI-+AD4-+ADw-si+AD4-+ADw-t+AD4-+ACY-toreplace+ADs-+ADw-/t+AD4-+ADw-/si+AD4-+ADw-/sst+AD4-

tests/data/Reader/XLSX/utf8entity.dontuse

@@ -0,0 +1,4 @@
+<?xml version='1.0' encoding = "UTF-8" standalone='yes'?>
+<root>
+	test: Valid
+</root>