Merge pull request #25 from PHPOffice/develop

Release 0.2.9

CHANGELOG.md

@@ -48,4 +48,14 @@
 
 ### Features
 - Added `\PhpOffice\Common\File::fileGetContents()` (with support of zip://)
-- Added Support for PHP 7.1
+- Added Support for PHP 7.1
+
+## 0.2.8
+
+### Features
+- Added possibility to register namespaces to DOMXpath
+- Added Utility to get an Office compatible hash of a password
+- Write attribute's value of type float independently of locale
+
+## 0.2.9
+- Fix XML Entity injection vulnerability

VERSION

@@ -1 +1 @@
-0.2.7
+0.2.9

composer.json

@@ -19,7 +19,7 @@
         "pclzip/pclzip": "^2.8"
     },
     "require-dev": {
-        "phpunit/phpunit": "3.7.*",
+        "phpunit/phpunit": "^4.8.36 || ^7.0",
         "phpdocumentor/phpdocumentor":"2.*",
         "phpmd/phpmd": "2.*",
         "sebastian/phpcpd": "2.*",

phpunit.xml.dist

@@ -6,8 +6,7 @@
          convertNoticesToExceptions="true"
          convertWarningsToExceptions="true"
          processIsolation="false"
-         stopOnFailure="false"
-         syntaxCheck="false">
+         stopOnFailure="false">
     <testsuites>
         <testsuite name="PhpOffice Common Test Suite">
             <directory>./tests/Common</directory>
@@ -19,7 +18,7 @@
         </whitelist>
     </filter>
     <logging>
-        <log type="coverage-html" target="./build/coverage" charset="UTF-8" highlight="true" />
+        <log type="coverage-html" target="./build/coverage" />
         <log type="coverage-clover" target="./build/logs/clover.xml" />
     </logging>
 </phpunit>

src/Common/Microsoft/PasswordEncoder.php

@@ -164,7 +164,7 @@ private static function getAlgorithm($algorithmName)
     /**
      * Returns the algorithm ID
      *
-     * @param sting $algorithmName
+     * @param string $algorithmName
      * @return int
      */
     public static function getAlgorithmId($algorithmName)

src/Common/XMLReader.php

@@ -71,6 +71,7 @@ public function getDomFromZip($zipFile, $xmlFile)
      */
     public function getDomFromString($content)
     {
+        libxml_disable_entity_loader(true);
         $this->dom = new \DOMDocument();
         $this->dom->loadXML($content);
 

tests/Common/Tests/Adapter/Zip/AbstractZipAdapterTest.php

@@ -4,7 +4,7 @@
 
 use PhpOffice\Common\Tests\TestHelperZip;
 
-abstract class AbstractZipAdapterTest extends \PHPUnit_Framework_TestCase
+abstract class AbstractZipAdapterTest extends \PHPUnit\Framework\TestCase
 {
     protected $zipTest;
 

tests/Common/Tests/AutoloaderTest.php

@@ -21,7 +21,7 @@
 /**
  * Test class for Autoloader
  */
-class AutoloaderTest extends \PHPUnit_Framework_TestCase
+class AutoloaderTest extends \PHPUnit\Framework\TestCase
 {
     /**
      * Register

tests/Common/Tests/DrawingTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\IOFactory
  */
-class DrawingTest extends \PHPUnit_Framework_TestCase
+class DrawingTest extends \PHPUnit\Framework\TestCase
 {
     /**
      */

tests/Common/Tests/FileTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\File
  */
-class FileTest extends \PHPUnit_Framework_TestCase
+class FileTest extends \PHPUnit\Framework\TestCase
 {
     /**
      */

tests/Common/Tests/FontTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\Font
  */
-class FontTest extends \PHPUnit_Framework_TestCase
+class FontTest extends \PHPUnit\Framework\TestCase
 {
     /**
      */

tests/Common/Tests/Microsoft/PasswordEncoderTest.php

@@ -22,7 +22,7 @@
  * Test class for PhpOffice\Common\PasswordEncoder
  * @coversDefaultClass \PhpOffice\Common\PasswordEncoder
  */
-class PasswordEncoderTest extends \PHPUnit_Framework_TestCase
+class PasswordEncoderTest extends \PHPUnit\Framework\TestCase
 {
     /**
      * Test that a password can be hashed without specifying any additional parameters

tests/Common/Tests/TextTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\Text
  */
-class TextTest extends \PHPUnit_Framework_TestCase
+class TextTest extends \PHPUnit\Framework\TestCase
 {
     /**
      */
@@ -39,14 +39,14 @@ public function testControlCharacters()
         $this->assertEquals('', Text::controlCharacterOOXML2PHP(''));
         $this->assertEquals(chr(0x08), Text::controlCharacterOOXML2PHP('_x0008_'));
     }
-    
+
     public function testNumberFormat()
     {
         $this->assertEquals('2.1', Text::numberFormat('2.06', 1));
         $this->assertEquals('2.1', Text::numberFormat('2.12', 1));
-        $this->assertEquals('1234', Text::numberFormat(1234, 1));
+        $this->assertEquals('1234.0', Text::numberFormat(1234, 1));
     }
-    
+
     public function testChr()
     {
         $this->assertEquals('A', Text::chr(65));

tests/Common/Tests/XMLReaderTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\XMLReader
  */
-class XMLReaderTest extends \PHPUnit_Framework_TestCase
+class XMLReaderTest extends \PHPUnit\Framework\TestCase
 {
     /**
      * Test reading XML from string
@@ -94,16 +94,19 @@ public function testReturnNullOnNonExistingNode()
 
     /**
      * Test that xpath fails if custom namespace is not registered
-     *
-     * @expectedException Exception
      */
     public function testShouldThrowExceptionIfNamespaceIsNotKnown()
     {
-        $reader = new XMLReader();
-        $reader->getDomFromString('<element><test:child xmlns:test="http://phpword.com/my/custom/namespace">AAA</test:child></element>');
-
-        $this->assertTrue($reader->elementExists('/element/test:child'));
-        $this->assertEquals('AAA', $reader->getElement('/element/test:child')->textContent);
+        try {
+            $reader = new XMLReader();
+            $reader->getDomFromString('<element><test:child xmlns:test="http://phpword.com/my/custom/namespace">AAA</test:child></element>');
+
+            $this->assertTrue($reader->elementExists('/element/test:child'));
+            $this->assertEquals('AAA', $reader->getElement('/element/test:child')->textContent);
+            $this->fail();
+        } catch (\Exception $e) {
+            $this->assertTrue(true);
+        }
     }
 
     /**

tests/Common/Tests/XMLWriterTest.php

@@ -23,7 +23,7 @@
  *
  * @coversDefaultClass PhpOffice\Common\XMLWriter
  */
-class XMLWriterTest extends \PHPUnit_Framework_TestCase
+class XMLWriterTest extends \PHPUnit\Framework\TestCase
 {
     /**
      */