1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
From: Daniel Ruoso <daniel@ruoso.com>
Date: Thu, 28 Dec 2023 11:56:10 -0500
Subject: Do not use string eval for conditional formatting
Origin: https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
Bug-Debian: https://bugs.debian.org/1059450
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2023-7101
---
lib/Spreadsheet/ParseExcel/Utility.pm | 31 +++++++++++++++++++--------
1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/lib/Spreadsheet/ParseExcel/Utility.pm b/lib/Spreadsheet/ParseExcel/Utility.pm
index c0c26a0a17f6..d8cfb99164da 100644
--- a/lib/Spreadsheet/ParseExcel/Utility.pm
+++ b/lib/Spreadsheet/ParseExcel/Utility.pm
@@ -78,10 +78,12 @@ sub ExcelFmt {
$format_str = '@' if uc($format_str) eq "GENERAL";
# Check for a conditional at the start of the format. See notes above.
- my $conditional;
- if ( $format_str =~ /^\[([<>=][^\]]+)\](.*)$/ ) {
- $conditional = $1;
- $format_str = $2;
+ my $conditional_op;
+ my $conditional_value;
+ if ( $format_str =~ /^\[([<>=]+)([^\]]+)\](.*)$/ ) {
+ $conditional_op = $1;
+ $conditional_value = $2;
+ $format_str = $3;
}
# Ignore the underscore token which is used to indicate a padding space.
@@ -166,12 +168,23 @@ sub ExcelFmt {
}
# Override the previous choice if the format is conditional.
- if ($conditional) {
-
- # TODO. Replace string eval with a function.
- $section = eval "$number $conditional" ? 0 : 1;
+ if ($conditional_op) {
+ if ($conditional_op eq '>') {
+ $section = $number > $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '>=') {
+ $section = $number >= $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '<') {
+ $section = $number < $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '<=') {
+ $section = $number <= $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '=') {
+ $section = $number == $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '==') {
+ $section = $number == $conditional_value ? 0 : 1;
+ } elsif ($conditional_op eq '<>') {
+ $section = $number != $conditional_value ? 0 : 1;
+ }
}
-
# We now have the required format.
$format = $formats[$section];
--
2.43.0
|
