pattern = $pattern; } public static function getInstance(Reader\IReader $reader): self { $pattern = ($reader instanceof Reader\Html) ? 'callback = $callback; } private static function forceString(mixed $arg): string { return is_string($arg) ? $arg : ''; } private function toUtf8(string $xml): string { $pattern = '/encoding="(.*?)"/'; $result = preg_match($pattern, $xml, $matches); $charset = strtoupper($result ? $matches[1] : 'UTF-8'); if ($charset !== 'UTF-8') { $xml = self::forceString(mb_convert_encoding($xml, 'UTF-8', $charset)); $result = preg_match($pattern, $xml, $matches); $charset = strtoupper($result ? $matches[1] : 'UTF-8'); if ($charset !== 'UTF-8') { throw new Reader\Exception('Suspicious Double-encoded XML, spreadsheet file load() aborted to prevent XXE/XEE attacks'); } } return $xml; } /** * Scan the XML for use of toUtf8($xml); // Don't rely purely on libxml_disable_entity_loader() $pattern = '/\\0?' . implode('\\0?', str_split($this->pattern)) . '\\0?/'; if (preg_match($pattern, $xml)) { throw new Reader\Exception('Detected use of ENTITY in XML, spreadsheet file load() aborted to prevent XXE/XEE attacks'); } if ($this->callback !== null) { $xml = call_user_func($this->callback, $xml); } return $xml; } /** * Scan theXML for use of scan(file_get_contents($filestream)); } }