MDL-60288 libraries: Upgrade spout to 2.7.3

lib/spout/readme_moodle.txt

@@ -1,9 +1,14 @@
-Description of Spout library import 2.6.0
+Description of Spout library import 2.7.3
 =========================================
 * Download / Clone from https://github.com/box/spout/
 * Only include the src/Spout directory.
 * Update lib/thirdpartylibs.xml with the latest version.
 
+2017/10/10
+----------
+Updated to v2.7.3 (MDL-60288)
+by Ankit Agarwal <[email protected]>
+
 2016/09/20
 ----------
 Updated to v2.6.0 (MDL-56012)

lib/spout/src/Spout/Common/Escaper/ODS.php

@@ -22,7 +22,29 @@ class ODS implements EscaperInterface
      */
     public function escape($string)
     {
-        return htmlspecialchars($string, ENT_QUOTES);
+        if (defined('ENT_DISALLOWED')) {
+            // 'ENT_DISALLOWED' ensures that invalid characters in the given document type are replaced.
+            // Otherwise control characters like a vertical tab "\v" will make the XML document unreadable by the XML processor
+            // @link https://github.com/box/spout/issues/329
+            $replacedString = htmlspecialchars($string, ENT_NOQUOTES | ENT_DISALLOWED);
+        } else {
+            // We are on hhvm or any other engine that does not support ENT_DISALLOWED.
+            //
+            // @NOTE: Using ENT_NOQUOTES as only XML entities ('<', '>', '&') need to be encoded.
+            //        Single and double quotes can be left as is.
+            $escapedString =  htmlspecialchars($string, ENT_NOQUOTES);
+
+            // control characters values are from 0 to 1F (hex values) in the ASCII table
+            // some characters should not be escaped though: "\t", "\r" and "\n".
+            $regexPattern = '[\x00-\x08' .
+                            // skipping "\t" (0x9) and "\n" (0xA)
+                            '\x0B-\x0C' .
+                            // skipping "\r" (0xD)
+                            '\x0E-\x1F]';
+            $replacedString = preg_replace("/$regexPattern/", '�', $escapedString);
+        }
+
+        return $replacedString;
     }
 
     /**
@@ -33,6 +55,12 @@ public function escape($string)
      */
     public function unescape($string)
     {
-        return htmlspecialchars_decode($string, ENT_QUOTES);
+        // ==============
+        // =   WARNING  =
+        // ==============
+        // It is assumed that the given string has already had its XML entities decoded.
+        // This is true if the string is coming from a DOMNode (as DOMNode already decode XML entities on creation).
+        // Therefore there is no need to call "htmlspecialchars_decode()".
+        return $string;
     }
 }

lib/spout/src/Spout/Common/Escaper/XLSX.php

@@ -42,7 +42,9 @@ protected function init()
     public function escape($string)
     {
         $escapedString = $this->escapeControlCharacters($string);
-        $escapedString = htmlspecialchars($escapedString, ENT_QUOTES);
+        // @NOTE: Using ENT_NOQUOTES as only XML entities ('<', '>', '&') need to be encoded.
+        //        Single and double quotes can be left as is.
+        $escapedString = htmlspecialchars($escapedString, ENT_NOQUOTES);
 
         return $escapedString;
     }
@@ -55,8 +57,13 @@ public function escape($string)
      */
     public function unescape($string)
     {
-        $unescapedString = htmlspecialchars_decode($string, ENT_QUOTES);
-        $unescapedString = $this->unescapeControlCharacters($unescapedString);
+        // ==============
+        // =   WARNING  =
+        // ==============
+        // It is assumed that the given string has already had its XML entities decoded.
+        // This is true if the string is coming from a DOMNode (as DOMNode already decode XML entities on creation).
+        // Therefore there is no need to call "htmlspecialchars_decode()".
+        $unescapedString = $this->unescapeControlCharacters($string);
 
         return $unescapedString;
     }

lib/spout/src/Spout/Common/Helper/FileSystemHelper.php

@@ -13,15 +13,15 @@
  */
 class FileSystemHelper
 {
-    /** @var string Path of the base folder where all the I/O can occur */
-    protected $baseFolderPath;
+    /** @var string Real path of the base folder where all the I/O can occur */
+    protected $baseFolderRealPath;
 
     /**
      * @param string $baseFolderPath The path of the base folder where all the I/O can occur
      */
     public function __construct($baseFolderPath)
     {
-        $this->baseFolderPath = $baseFolderPath;
+        $this->baseFolderRealPath = realpath($baseFolderPath);
     }
 
     /**
@@ -124,9 +124,10 @@ public function deleteFolderRecursively($folderPath)
      */
     protected function throwIfOperationNotInBaseFolder($operationFolderPath)
     {
-        $isInBaseFolder = (strpos($operationFolderPath, $this->baseFolderPath) === 0);
+        $operationFolderRealPath = realpath($operationFolderPath);
+        $isInBaseFolder = (strpos($operationFolderRealPath, $this->baseFolderRealPath) === 0);
         if (!$isInBaseFolder) {
-            throw new IOException("Cannot perform I/O operation outside of the base folder: {$this->baseFolderPath}");
+            throw new IOException("Cannot perform I/O operation outside of the base folder: {$this->baseFolderRealPath}");
         }
     }
 }

lib/spout/src/Spout/Reader/AbstractReader.php

@@ -19,8 +19,15 @@ abstract class AbstractReader implements ReaderInterface
     /** @var \Box\Spout\Common\Helper\GlobalFunctionsHelper Helper to work with global functions */
     protected $globalFunctionsHelper;
 
-    /** @var bool Whether date/time values should be returned as PHP objects or be formatted as strings */
-    protected $shouldFormatDates = false;
+    /** @var \Box\Spout\Reader\Common\ReaderOptions Reader's customized options */
+    protected $options;
+
+    /**
+     * Returns the reader's current options
+     *
+     * @return \Box\Spout\Reader\Common\ReaderOptions
+     */
+    abstract protected function getOptions();
 
     /**
      * Returns whether stream wrappers are supported
@@ -42,7 +49,7 @@ abstract protected function openReader($filePath);
      *
      * @return \Iterator To iterate over sheets
      */
-    abstract public function getConcreteSheetIterator();
+    abstract protected function getConcreteSheetIterator();
 
     /**
      * Closes the reader. To be used after reading the file.
@@ -64,12 +71,26 @@ public function setGlobalFunctionsHelper($globalFunctionsHelper)
     /**
      * Sets whether date/time values should be returned as PHP objects or be formatted as strings.
      *
+     * @api
      * @param bool $shouldFormatDates
      * @return AbstractReader
      */
     public function setShouldFormatDates($shouldFormatDates)
     {
-        $this->shouldFormatDates = $shouldFormatDates;
+        $this->getOptions()->setShouldFormatDates($shouldFormatDates);
+        return $this;
+    }
+
+    /**
+     * Sets whether empty rows should be returned or skipped.
+     *
+     * @api
+     * @param bool $shouldPreserveEmptyRows
+     * @return AbstractReader
+     */
+    public function setShouldPreserveEmptyRows($shouldPreserveEmptyRows)
+    {
+        $this->getOptions()->setShouldPreserveEmptyRows($shouldPreserveEmptyRows);
         return $this;
     }
 

lib/spout/src/Spout/Reader/CSV/Reader.php

@@ -4,7 +4,6 @@
 
 use Box\Spout\Reader\AbstractReader;
 use Box\Spout\Common\Exception\IOException;
-use Box\Spout\Common\Helper\EncodingHelper;
 
 /**
  * Class Reader
@@ -20,20 +19,21 @@ class Reader extends AbstractReader
     /** @var SheetIterator To iterator over the CSV unique "sheet" */
     protected $sheetIterator;
 
-    /** @var string Defines the character used to delimit fields (one character only) */
-    protected $fieldDelimiter = ',';
+    /** @var string Original value for the "auto_detect_line_endings" INI value */
+    protected $originalAutoDetectLineEndings;
 
-    /** @var string Defines the character used to enclose fields (one character only) */
-    protected $fieldEnclosure = '"';
-
-    /** @var string Encoding of the CSV file to be read */
-    protected $encoding = EncodingHelper::ENCODING_UTF8;
-
-    /** @var string Defines the End of line */
-    protected $endOfLineCharacter = "\n";
-
-    /** @var string */
-    protected $autoDetectLineEndings;
+    /**
+     * Returns the reader's current options
+     *
+     * @return ReaderOptions
+     */
+    protected function getOptions()
+    {
+        if (!isset($this->options)) {
+            $this->options = new ReaderOptions();
+        }
+        return $this->options;
+    }
 
     /**
      * Sets the field delimiter for the CSV.
@@ -44,7 +44,7 @@ class Reader extends AbstractReader
      */
     public function setFieldDelimiter($fieldDelimiter)
     {
-        $this->fieldDelimiter = $fieldDelimiter;
+        $this->getOptions()->setFieldDelimiter($fieldDelimiter);
         return $this;
     }
 
@@ -57,7 +57,7 @@ public function setFieldDelimiter($fieldDelimiter)
      */
     public function setFieldEnclosure($fieldEnclosure)
     {
-        $this->fieldEnclosure = $fieldEnclosure;
+        $this->getOptions()->setFieldEnclosure($fieldEnclosure);
         return $this;
     }
 
@@ -70,7 +70,7 @@ public function setFieldEnclosure($fieldEnclosure)
      */
     public function setEncoding($encoding)
     {
-        $this->encoding = $encoding;
+        $this->getOptions()->setEncoding($encoding);
         return $this;
     }
 
@@ -83,7 +83,7 @@ public function setEncoding($encoding)
      */
     public function setEndOfLineCharacter($endOfLineCharacter)
     {
-        $this->endOfLineCharacter = $endOfLineCharacter;
+        $this->getOptions()->setEndOfLineCharacter($endOfLineCharacter);
         return $this;
     }
 
@@ -107,7 +107,7 @@ protected function doesSupportStreamWrapper()
      */
     protected function openReader($filePath)
     {
-        $this->autoDetectLineEndings = ini_get('auto_detect_line_endings');
+        $this->originalAutoDetectLineEndings = ini_get('auto_detect_line_endings');
         ini_set('auto_detect_line_endings', '1');
 
         $this->filePointer = $this->globalFunctionsHelper->fopen($filePath, 'r');
@@ -117,10 +117,7 @@ protected function openReader($filePath)
 
         $this->sheetIterator = new SheetIterator(
             $this->filePointer,
-            $this->fieldDelimiter,
-            $this->fieldEnclosure,
-            $this->encoding,
-            $this->endOfLineCharacter,
+            $this->getOptions(),
             $this->globalFunctionsHelper
         );
     }
@@ -130,7 +127,7 @@ protected function openReader($filePath)
      *
      * @return SheetIterator To iterate over sheets
      */
-    public function getConcreteSheetIterator()
+    protected function getConcreteSheetIterator()
     {
         return $this->sheetIterator;
     }
@@ -147,6 +144,6 @@ protected function closeReader()
             $this->globalFunctionsHelper->fclose($this->filePointer);
         }
 
-        ini_set('auto_detect_line_endings', $this->autoDetectLineEndings);
+        ini_set('auto_detect_line_endings', $this->originalAutoDetectLineEndings);
     }
 }