loveJesus
/
PHPExcel-1.8-aleluya
1
0
Fork 0
Code Issues 0 Pull Requests 0 Projects 0 Releases 0 Wiki Activity
For God so loved the world, that He gave His only begotten Son, that all who believe in Him should not perish but have everlasting life
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1 Commit
1 Branch
3.5 MiB
 
Tree: fd8b184a5f
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from 'fd8b184a5f'
${ noResults }
PHPExcel-1.8-aleluya/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md

621 B
Raw Blame History

PHPExcel User Documentation – Reading Spreadsheet Files

Security

XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are susceptible to XML External Entity Processing (XXE) injection attacks (for an explanation of XXE injection see http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html) when reading spreadsheet files. This can lead to:

  • Disclosure whether a file is existent
  • Server Side Request Forgery
  • Command Execution (depending on the installed PHP wrappers)

To prevent this, PHPExcel sets libxml_disable_entity_loader to true for the XML-based Readers by default.