BaseReader::securityScan() - Code Metrics - Inspection of "Stricter check whether file exists before reading" - PHPOffice/PhpSpreadsheet - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — develop ( 5e03e2...c8a8fd )

by Adrien

created 2016-12-08 15:23 UTC

BaseReader::securityScan() A

↳ Parent: BaseReader

Complexity

Conditions	2
Paths	2

Size

Total Lines	9
Code Lines	5

Duplication

Lines	9
Ratio	100 %

Code Coverage

Tests	5
CRAP Score	2

Importance

Changes

Metric	Value
cc	2
eloc	5
nc	2
nop	1
dl	9
loc	9
rs	9.6666
c	0
b	0
f	0
ccs	5
cts	5
cp	1
crap	2

<?php

namespace PhpOffice\PhpSpreadsheet\Reader;

use PhpOffice\PhpSpreadsheet\Shared\File;

/**
 * Copyright (c) 2006 - 2016 PhpSpreadsheet
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 *
 * @category   PhpSpreadsheet
 * @copyright  Copyright (c) 2006 - 2016 PhpSpreadsheet (https://github.com/PHPOffice/PhpSpreadsheet)
 * @license    http://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt    LGPL
 */
abstract class BaseReader implements IReader
{
    /**
     * Read data only?
     * Identifies whether the Reader should only read data values for cells, and ignore any formatting information;
     *        or whether it should read both data and formatting
     *
     * @var    bool
     */
    protected $readDataOnly = false;

    /**
     * Read empty cells?
     * Identifies whether the Reader should read data values for cells all cells, or should ignore cells containing
     *         null value or empty string
     *
     * @var    bool
     */
    protected $readEmptyCells = true;

    /**
     * Read charts that are defined in the workbook?
     * Identifies whether the Reader should read the definitions for any charts that exist in the workbook;
     *
     * @var    bool
     */
    protected $includeCharts = false;

    /**
     * Restrict which sheets should be loaded?
     * This property holds an array of worksheet names to be loaded. If null, then all worksheets will be loaded.
     *
     * @var array of string
     */
    protected $loadSheetsOnly;

    /**
     * IReadFilter instance
     *
     * @var IReadFilter
     */
    protected $readFilter;

    protected $fileHandle = null;

    /**
     * Read data only?
     *        If this is true, then the Reader will only read data values for cells, it will not read any formatting information.
     *        If false (the default) it will read data and formatting.
     *
     * @return    bool
     */
    public function getReadDataOnly()
    {
        return $this->readDataOnly;
    }

    /**
     * Set read data only
     *        Set to true, to advise the Reader only to read data values for cells, and to ignore any formatting information.
     *        Set to false (the default) to advise the Reader to read both data and formatting for cells.
     *
     * @param    bool    $pValue
     *
     * @return    IReader
     */
    public function setReadDataOnly($pValue = false)
    {
        $this->readDataOnly = (boolean) $pValue;

        return $this;
    }

    /**
     * Read empty cells?
     *        If this is true (the default), then the Reader will read data values for all cells, irrespective of value.
     *        If false it will not read data for cells containing a null value or an empty string.
     *
     * @return    bool
     */
    public function getReadEmptyCells()
    {
        return $this->readEmptyCells;
    }

    /**
     * Set read empty cells
     *        Set to true (the default) to advise the Reader read data values for all cells, irrespective of value.
     *        Set to false to advise the Reader to ignore cells containing a null value or an empty string.
     *
     * @param    bool    $pValue
     *
     * @return    IReader
     */
    public function setReadEmptyCells($pValue = true)
    {
        $this->readEmptyCells = (boolean) $pValue;

        return $this;
    }

    /**
     * Read charts in workbook?
     *        If this is true, then the Reader will include any charts that exist in the workbook.
     *      Note that a ReadDataOnly value of false overrides, and charts won't be read regardless of the IncludeCharts value.
     *        If false (the default) it will ignore any charts defined in the workbook file.
     *
     * @return    bool
     */
    public function getIncludeCharts()
    {
        return $this->includeCharts;
    }

    /**
     * Set read charts in workbook
     *        Set to true, to advise the Reader to include any charts that exist in the workbook.
     *      Note that a ReadDataOnly value of false overrides, and charts won't be read regardless of the IncludeCharts value.
     *        Set to false (the default) to discard charts.
     *
     * @param    bool    $pValue
     *
     * @return    IReader
     */
    public function setIncludeCharts($pValue = false)
    {
        $this->includeCharts = (boolean) $pValue;

        return $this;
    }

    /**
     * Get which sheets to load
     * Returns either an array of worksheet names (the list of worksheets that should be loaded), or a null
     *        indicating that all worksheets in the workbook should be loaded.
     *
     * @return mixed
     */
    public function getLoadSheetsOnly()
    {
        return $this->loadSheetsOnly;
    }

    /**
     * Set which sheets to load
     *
     * @param mixed $value
     *        This should be either an array of worksheet names to be loaded, or a string containing a single worksheet name.
     *        If NULL, then it tells the Reader to read all worksheets in the workbook
     *
     * @return IReader
     */
    public function setLoadSheetsOnly($value = null)
    {
        if ($value === null) {
            return $this->setLoadAllSheets();
        }

        $this->loadSheetsOnly = is_array($value) ? $value : [$value];

        return $this;
    }

    /**
     * Set all sheets to load
     *        Tells the Reader to load all worksheets from the workbook.
     *
     * @return IReader
     */
    public function setLoadAllSheets()
    {
        $this->loadSheetsOnly = null;


        return $this;
    }

    /**
     * Read filter
     *
     * @return IReadFilter
     */
    public function getReadFilter()
    {
        return $this->readFilter;
    }

    /**
     * Set read filter
     *
     * @param IReadFilter $pValue
     * @return IReader
     */
    public function setReadFilter(IReadFilter $pValue)
    {
        $this->readFilter = $pValue;

        return $this;
    }

    /**
     * Open file for reading
     *
     * @param string $pFilename
     * @throws    Exception
     * @return resource
     */
    protected function openFile($pFilename)
    {
        File::assertFile($pFilename);

        // Open file
        $this->fileHandle = fopen($pFilename, 'r');
        if ($this->fileHandle === false) {
            throw new Exception('Could not open file ' . $pFilename . ' for reading.');
        }
    }

    /**
     * Scan theXML for use of <!ENTITY to prevent XXE/XEE attacks
     *
     * @param     string         $xml
     * @throws Exception
     */
    public function securityScan($xml)

    {
        $pattern = '/\\0?' . implode('\\0?', str_split('<!DOCTYPE')) . '\\0?/';
        if (preg_match($pattern, $xml)) {
            throw new Exception('Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks');
        }

        return $xml;
    }

    /**
     * Scan theXML for use of <!ENTITY to prevent XXE/XEE attacks
     *
     * @param     string         $filestream
     * @throws Exception
     */
    public function securityScanFile($filestream)
    {
        return $this->securityScan(file_get_contents($filestream));
    }
}


1			<?php
2
3			namespace PhpOffice\PhpSpreadsheet\Reader;
4
5			use PhpOffice\PhpSpreadsheet\Shared\File;
6
7			/**
8			* Copyright (c) 2006 - 2016 PhpSpreadsheet
9			*
10			* This library is free software; you can redistribute it and/or
11			* modify it under the terms of the GNU Lesser General Public
12			* License as published by the Free Software Foundation; either
13			* version 2.1 of the License, or (at your option) any later version.
14			*
15			* This library is distributed in the hope that it will be useful,
16			* but WITHOUT ANY WARRANTY; without even the implied warranty of
17			* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18			* Lesser General Public License for more details.
19			*
20			* You should have received a copy of the GNU Lesser General Public
21			* License along with this library; if not, write to the Free Software
22			* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
23			*
24			* @category PhpSpreadsheet
25			* @copyright Copyright (c) 2006 - 2016 PhpSpreadsheet (https://github.com/PHPOffice/PhpSpreadsheet)
26			* @license http://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt LGPL
27			*/
28			abstract class BaseReader implements IReader
29			{
30			/**
31			* Read data only?
32			* Identifies whether the Reader should only read data values for cells, and ignore any formatting information;
33			* or whether it should read both data and formatting
34			*
35			* @var bool
36			*/
37			protected $readDataOnly = false;
38
39			/**
40			* Read empty cells?
41			* Identifies whether the Reader should read data values for cells all cells, or should ignore cells containing
42			* null value or empty string
43			*
44			* @var bool
45			*/
46			protected $readEmptyCells = true;
47
48			/**
49			* Read charts that are defined in the workbook?
50			* Identifies whether the Reader should read the definitions for any charts that exist in the workbook;
51			*
52			* @var bool
53			*/
54			protected $includeCharts = false;
55
56			/**
57			* Restrict which sheets should be loaded?
58			* This property holds an array of worksheet names to be loaded. If null, then all worksheets will be loaded.
59			*
60			* @var array of string
61			*/
62			protected $loadSheetsOnly;
63
64			/**
65			* IReadFilter instance
66			*
67			* @var IReadFilter
68			*/
69			protected $readFilter;
70
71			protected $fileHandle = null;
72
73			/**
74			* Read data only?
75			* If this is true, then the Reader will only read data values for cells, it will not read any formatting information.
76			* If false (the default) it will read data and formatting.
77			*
78			* @return bool
79			*/
80			public function getReadDataOnly()
81			{
82			return $this->readDataOnly;
83			}
84
85			/**
86			* Set read data only
87			* Set to true, to advise the Reader only to read data values for cells, and to ignore any formatting information.
88			* Set to false (the default) to advise the Reader to read both data and formatting for cells.
89			*
90			* @param bool $pValue
91			*
92			* @return IReader
93			*/
94			public function setReadDataOnly($pValue = false)
95			{
96			$this->readDataOnly = (boolean) $pValue;
97
98			return $this;
99			}
100
101			/**
102			* Read empty cells?
103			* If this is true (the default), then the Reader will read data values for all cells, irrespective of value.
104			* If false it will not read data for cells containing a null value or an empty string.
105			*
106			* @return bool
107			*/
108			public function getReadEmptyCells()
109			{
110			return $this->readEmptyCells;
111			}
112
113			/**
114			* Set read empty cells
115			* Set to true (the default) to advise the Reader read data values for all cells, irrespective of value.
116			* Set to false to advise the Reader to ignore cells containing a null value or an empty string.
117			*
118			* @param bool $pValue
119			*
120			* @return IReader
121			*/
122			public function setReadEmptyCells($pValue = true)
123			{
124			$this->readEmptyCells = (boolean) $pValue;
125
126			return $this;
127			}
128
129			/**
130			* Read charts in workbook?
131			* If this is true, then the Reader will include any charts that exist in the workbook.
132			* Note that a ReadDataOnly value of false overrides, and charts won't be read regardless of the IncludeCharts value.
133			* If false (the default) it will ignore any charts defined in the workbook file.
134			*
135			* @return bool
136			*/
137			public function getIncludeCharts()
138			{
139			return $this->includeCharts;
140			}
141
142			/**
143			* Set read charts in workbook
144			* Set to true, to advise the Reader to include any charts that exist in the workbook.
145			* Note that a ReadDataOnly value of false overrides, and charts won't be read regardless of the IncludeCharts value.
146			* Set to false (the default) to discard charts.
147			*
148			* @param bool $pValue
149			*
150			* @return IReader
151			*/
152	2		public function setIncludeCharts($pValue = false)
153			{
154	2		$this->includeCharts = (boolean) $pValue;
155
156	2		return $this;
157			}
158
159			/**
160			* Get which sheets to load
161			* Returns either an array of worksheet names (the list of worksheets that should be loaded), or a null
162			* indicating that all worksheets in the workbook should be loaded.
163			*
164			* @return mixed
165			*/
166			public function getLoadSheetsOnly()
167			{
168			return $this->loadSheetsOnly;
169			}
170
171			/**
172			* Set which sheets to load
173			*
174			* @param mixed $value
175			* This should be either an array of worksheet names to be loaded, or a string containing a single worksheet name.
176			* If NULL, then it tells the Reader to read all worksheets in the workbook
177			*
178			* @return IReader
179			*/
180			public function setLoadSheetsOnly($value = null)
181			{
182			if ($value === null) {
183			return $this->setLoadAllSheets();
184			}
185
186			$this->loadSheetsOnly = is_array($value) ? $value : [$value];
187
188			return $this;
189			}
190
191			/**
192			* Set all sheets to load
193			* Tells the Reader to load all worksheets from the workbook.
194			*
195			* @return IReader
196			*/
197			public function setLoadAllSheets()
198			{
199			$this->loadSheetsOnly = null;
			0 ignored issues – show Documentation Bug introduced 2016-08-14 05:24 UTC by Report Bug Copy Issue Report It seems like `null` of type `null` is incompatible with the declared type `array` of property `$loadSheetsOnly`. Our type inference engine has found an assignment to a property that is incompatible with the declared type of that property. Either this assignment is in error or the assigned type should be added to the documentation/type hint for that property.. Loading history...
200
201			return $this;
202			}
203
204			/**
205			* Read filter
206			*
207			* @return IReadFilter
208			*/
209	15		public function getReadFilter()
210			{
211	15		return $this->readFilter;
212			}
213
214			/**
215			* Set read filter
216			*
217			* @param IReadFilter $pValue
218			* @return IReader
219			*/
220	1		public function setReadFilter(IReadFilter $pValue)
221			{
222	1		$this->readFilter = $pValue;
223
224	1		return $this;
225			}
226
227			/**
228			* Open file for reading
229			*
230			* @param string $pFilename
231			* @throws Exception
232			* @return resource
233			*/
234	6		protected function openFile($pFilename)
235			{
236	6		File::assertFile($pFilename);
237
238			// Open file
239	6		$this->fileHandle = fopen($pFilename, 'r');
240	6		if ($this->fileHandle === false) {
241			throw new Exception('Could not open file ' . $pFilename . ' for reading.');
242			}
243	6		}
244
245			/**
246			* Scan theXML for use of <!ENTITY to prevent XXE/XEE attacks
247			*
248			* @param string $xml
249			* @throws Exception
250			*/
251	21	View Code Duplication	public function securityScan($xml)
			0 ignored issues – show Duplication introduced 2016-08-14 05:24 UTC by Report Bug Copy Issue Report This method seems to be duplicated in your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
252			{
253	21		$pattern = '/\\0?' . implode('\\0?', str_split('<!DOCTYPE')) . '\\0?/';
254	21		if (preg_match($pattern, $xml)) {
255	4		throw new Exception('Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks');
256			}
257
258	17		return $xml;
259			}
260
261			/**
262			* Scan theXML for use of <!ENTITY to prevent XXE/XEE attacks
263			*
264			* @param string $filestream
265			* @throws Exception
266			*/
267	9		public function securityScanFile($filestream)
268			{
269	9		return $this->securityScan(file_get_contents($filestream));
270			}
271			}
272

PHPOffice / PhpSpreadsheet

Push — develop ( 5e03e2...c8a8fd )

BaseReader::securityScan() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like