PHPExcel/Documentation/markdown/ReadingSpreadsheetFiles/02-Security.md

# PHPExcel User Documentation – Reading Spreadsheet Files


## Security

XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are susceptible to XML External Entity Processing (XXE) injection attacks (for an explanation of XXE injection see http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html) when reading spreadsheet files. This can lead to:

 - Disclosure whether a file is existent
 - Server Side Request Forgery
 - Command Execution (depending on the installed PHP wrappers)
 

To prevent this, PHPExcel sets `libxml_disable_entity_loader` to `true` for the XML-based Readers by default.
-												Updated documentation for XXE injection in readers

											
										
										
											2014-02-21 13:51:59 +04:00
+								# PHPExcel User Documentation – Reading Spreadsheet Files
 								## Security
 								XML-based formats such as OfficeOpen XML, Excel2003 XML, OASIS and Gnumeric are susceptible to XML External Entity Processing (XXE) injection attacks (for an explanation of XXE injection see http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html) when reading spreadsheet files. This can lead to:
 								 - Disclosure whether a file is existent
 								 - Server Side Request Forgery
 								 - Command Execution (depending on the installed PHP wrappers)
-												Update security section in Reader documentation

											
										
										
											2014-02-21 14:21:04 +04:00
+								To prevent this, PHPExcel sets `libxml_disable_entity_loader` to `true` for the XML-based Readers by default.