Skip to content

Bound EPPlus4 XLSX loading resources - #22

Merged
jochenwezel merged 1 commit into
mainfrom
codex/epplus4-load-security-limits
Oct 1, 2026
Merged

jochenwezel merged 1 commit into
mainfrom
codex/epplus4-load-security-limits

Conversation

@jochenwezel

@jochenwezel jochenwezel commented Oct 1, 2026 •

Copy link
Copy Markdown
Member

Affected projects

  • CompuMaster.EPPlus4: BREAKING CHANGE: secure default limits now reject XLSX inputs that exceed configured compressed size, ZIP entry, expansion, XML, or encryption-work limits. Explicit ExcelPackageLoadLimits factories allow trusted callers to adjust them.
  • CompuMaster.Data.EpplusFreeFixCalcsEdition: ReadOptions can forward explicit package limits.
  • CompuMaster.Data.EpplusPolyformEdition: synchronized generated source; behavior remains unchanged.
  • CompuMaster.Excel.Test: regression coverage for oversized ZIP data, renamed XML, encrypted input, stream templates, and a valid XLSX larger than 50 MiB.

Validation

  • Targeted net8.0 and net48 tests pass; no local HTML tests were run.
  • Legacy net48 project builds and tools/check-api-docs.ps1 reports zero missing API docs.
  • Pull-request CI passed on Ubuntu, macOS, and Windows.

Versioning for a future release

The package pipeline currently assigns date-based NuGet versions. The requested 4.6 minor-line designation needs to be reconciled with that scheme before the next release; this PR does not publish or change a package version.

Apply secure default limits to ZIP entries, XML parts, encrypted metadata, and password hashing. Expose explicit limit configuration through EPPlus4 and the FixCalcs data facade, with regression tests for large valid workbooks and hostile inputs.
@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (ubuntu-latest) CompuMaster.MsExcelComInteropTest.dll

2 tests  ±0   2 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (ubuntu-latest) CompuMaster.Excel.Test.dll

68 tests  +9   68 ✅ +9   1s ⏱️ -1s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (ubuntu-latest) CompuMaster.Excel.TestFreeSpireXls.dll

6 tests  ±0   6 ✅ ±0   0s ⏱️ -2s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (ubuntu-latest) CompuMaster.Excel.TestSpireXls.dll

6 tests  ±0   6 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (macos-latest) CompuMaster.MsExcelComInteropTest.dll

2 tests  ±0   2 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (macos-latest) CompuMaster.Excel.Test.dll

68 tests  +9   68 ✅ +9   4s ⏱️ +3s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (macos-latest) CompuMaster.Excel.TestFreeSpireXls.dll

6 tests  ±0   6 ✅ ±0   1s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (macos-latest) CompuMaster.Excel.TestSpireXls.dll

6 tests  ±0   6 ✅ ±0   1s ⏱️ -1s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (windows-latest) CompuMaster.MsExcelComInteropTest.dll

2 tests  ±0   2 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (windows-latest) CompuMaster.Excel.Test.dll

279 tests  +9   279 ✅ +9   41s ⏱️ -6s
  1 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (windows-latest) CompuMaster.Excel.TestFreeSpireXls.dll

76 tests  ±0   76 ✅ ±0   20s ⏱️ -4s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@github-actions

github-actions Bot commented Oct 1, 2026

Copy link
Copy Markdown

Unit Test Statistics (windows-latest) CompuMaster.Excel.TestSpireXls.dll

78 tests  ±0   78 ✅ ±0   21s ⏱️ ±0s
 1 suites ±0    0 💤 ±0 
 1 files   ±0    0 ❌ ±0 

Results for commit 0a0f93d. ± Comparison against base commit 19e704c.

@jochenwezel
jochenwezel marked this pull request as ready for review October 1, 2026 02:14
@jochenwezel
jochenwezel merged commit e242de9 into main Oct 1, 2026
15 checks passed
@jochenwezel
jochenwezel deleted the codex/epplus4-load-security-limits branch October 1, 2026 02:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant