From 48c16de8bf74df0fa94a30d29e2e7e3446d48433 Mon Sep 17 00:00:00 2001 From: xuri Date: Sun, 15 Aug 2021 00:06:40 +0800 Subject: Improve security and simplify code - Make variable name more semantic - Reduce cyclomatic complexities for the formula calculate function - Support specified unzip size limit on open file options, avoid zip bombs vulnerability attack - Typo fix for documentation and error message --- sheet.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'sheet.go') diff --git a/sheet.go b/sheet.go index 1c4b355..7e15bbe 100644 --- a/sheet.go +++ b/sheet.go @@ -480,7 +480,7 @@ func (f *File) SetSheetBackground(sheet, picture string) error { if !ok { return ErrImgExt } - file, _ := ioutil.ReadFile(picture) + file, _ := ioutil.ReadFile(filepath.Clean(picture)) name := f.addMedia(file, ext) sheetRels := "xl/worksheets/_rels/" + strings.TrimPrefix(f.sheetMap[trimSheetName(sheet)], "xl/worksheets/") + ".rels" rID := f.addRels(sheetRels, SourceRelationshipImage, strings.Replace(name, "xl", "..", 1), "") @@ -655,13 +655,13 @@ func (f *File) SetSheetVisible(name string, visible bool) error { } } for k, v := range content.Sheets.Sheet { - xlsx, err := f.workSheetReader(v.Name) + ws, err := f.workSheetReader(v.Name) if err != nil { return err } tabSelected := false - if len(xlsx.SheetViews.SheetView) > 0 { - tabSelected = xlsx.SheetViews.SheetView[0].TabSelected + if len(ws.SheetViews.SheetView) > 0 { + tabSelected = ws.SheetViews.SheetView[0].TabSelected } if v.Name == name && count > 1 && !tabSelected { content.Sheets.Sheet[k].State = "hidden" -- cgit v1.2.1