BC since Settings::libXmlLoaderOptions is ignored

[JulienChavee]

This is:

- [x] a bug report
- [ ] a feature request
- [ ] **not** a usage question (ask them on https://stackoverflow.com/questions/tagged/phpspreadsheet or https://gitter.im/PHPOffice/PhpSpreadsheet)

What is the expected behavior?

Currently, we use the Settings::setLibXmlLoaderOptions() function to use the constant LIBXML_PARSEHUGE
While we added this 4 years ago and I can hardly find which files we are receiving is using this functionality, I would like to be sure that updating the library will not cause a BC on our side, since it was removed in the #4233
Is it something that was considered, do we have another way to allow to parse huge XML files?

What is the current behavior?

Huge XLXS files can be parsed with the library

What are the steps to reproduce?

What features do you think are causing the issue

• Reader
• Writer
• Styles
• Data Validations
• Formula Calculations
• Charts
• AutoFilter
• Form Elements

Does an issue affect all spreadsheet file formats? If not, which formats are affected?

Format using XML files

Which versions of PhpSpreadsheet and PHP are affected?

= 3.5

[oleibman]

It was not something that we considered. As far as I could tell, libXmlLoaderOptions was nothing but a vector for malicious exploits. If you can upload a file with this problem, I can work on finding a solution for it.

[quentindarrigade]

We were also using libXmlLoaderOptions to set LIBXML_PARSEHUGE up until version 1.29.4.
We tried to update the lib to 1.29.6 and are not able to read some of our uploaded excel files anymore.
If a replacement could be developped that would be great ! :)

[oleibman]

I would need to understand why you need it. The reason for restricting files to those which don't require PARSEHUGE is to prevent DOS attacks using too much memory. The recent set of security fixes has made me paranoid. Is it possible to upload an affected file?

[quentindarrigade]

I am not sure why, we noticed that if we remove the LIBXML_PARSEHUGE some of our excel files (the biggest ones) can not be read by php spreadsheet anymore. Once the option is set back up, everything works fine.

[oleibman]

If you are able to upload a failing file, I can investigate.

[jomocag]

If you are able to upload a failing file, I can investigate.

Hi @oleibman,
I had to downgrade to v3.4.0 to be able to pass flags so simplexml_load_string() does not raise error Warning: simplexml_load_string(): Entity: line 57304: parser error : internal error: Huge input lookup.

I have streamlined an xlsx file so it still causes the error but most unnecessary data has been removed. However, there is still some data that I would rather not sharing publicly. How could I send you or share with you this test file?

[oleibman]

If I set up a private repository on github and grant access only to you and me, will that be sufficient?

[oleibman]

Assuming that your answer would be yes, I have set up oleibman/Parsehuge and invited you to collaborate there.