alex
/
PhpSpreadsheet
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

case-insensitive charset name in xml scanner

This commit is contained in:
MarkBaker 2019-07-03 18:34:11 +02:00
parent 6ab969e9cc
commit d4eab49815
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/PhpSpreadsheet/Reader/Security/XmlScanner.php
View File

@ -100,7 +100,7 @@ class XmlScanner
$xml = mb_convert_encoding($xml, 'UTF-8', $charset); $xml = mb_convert_encoding($xml, 'UTF-8', $charset);
$result = preg_match($pattern, $xml, $matches); $result = preg_match($pattern, $xml, $matches);
$charset = $result ? $matches[1] : 'UTF-8'; $charset = strtoupper($result ? $matches[1] : 'UTF-8');
if ($charset !== 'UTF-8') { if ($charset !== 'UTF-8') {
throw new Reader\Exception('Suspicious Double-encoded XML, spreadsheet file load() aborted to prevent XXE/XEE attacks'); throw new Reader\Exception('Suspicious Double-encoded XML, spreadsheet file load() aborted to prevent XXE/XEE attacks');
} }