From: PJ Fanning <fanningpj@apache.org>
Date: Sun, 9 Aug 2020 21:15:15 +0000 (+0000)
Subject: [github-187] Add length validation for Excel DataValidations that are list literals... 
X-Git-Tag: before_ooxml_3rd_edition~160
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=a8d90aba91ba8788c784e644a6cff2acbcaba4f1;p=poi.git

[github-187] Add length validation for Excel DataValidations that are list literals. Thanks to Leo Webb. This closes #187

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1880727 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/src/multimodule/scratchpad/java9/module-info.class b/src/multimodule/scratchpad/java9/module-info.class
index 879d58efd6..311deebf44 100644
Binary files a/src/multimodule/scratchpad/java9/module-info.class and b/src/multimodule/scratchpad/java9/module-info.class differ
diff --git a/src/multimodule/scratchpad/test9/module-info.class b/src/multimodule/scratchpad/test9/module-info.class
index 86ad206e1a..5809da74f2 100644
Binary files a/src/multimodule/scratchpad/test9/module-info.class and b/src/multimodule/scratchpad/test9/module-info.class differ
diff --git a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
index d42641eb86..b62a38e0a5 100644
--- a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
+++ b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
@@ -30,12 +30,14 @@ import org.openxmlformats.schemas.spreadsheetml.x2006.main.STDataValidationOpera
 public class XSSFDataValidationConstraint implements DataValidationConstraint {
     /**
      * Excel validation constraints with static lists are delimited with optional whitespace and the Windows List Separator,
-     * which is typically comma, but can be changed by users.  POI will just assume comma.
+     * which is typically comma, but can be changed by users. POI will just assume comma.
+	 * In addition, Excel validation with static lists has a maximum size of 255 characters, including separators and excluding quotes.
      */
     private static final String LIST_SEPARATOR = ",";
     private static final Pattern LIST_SPLIT_REGEX = Pattern.compile("\\s*" + LIST_SEPARATOR + "\\s*");
     private static final String QUOTE = "\"";
-    
+	private static final int MAX_EXPLICIT_LIST_LENGTH = 257;
+
 	private String formula1;
 	private String formula2;
 	private int validationType = -1;
@@ -204,6 +206,9 @@ public class XSSFDataValidationConstraint implements DataValidationConstraint {
 			if (isFormulaEmpty(formula1)) {
 				throw new IllegalArgumentException("A valid formula or a list of values must be specified for list validation.");
 			}
+			if(formula1.length() > MAX_EXPLICIT_LIST_LENGTH) {
+				throw new IllegalArgumentException("A valid formula or a list of values must be less than or equal to 255 characters (including separators).");
+			}
 		} else  {
 			if( isFormulaEmpty(formula1) ) {
 				throw new IllegalArgumentException("Formula is not specified. Formula is required for all validation types except explicit list validation.");
diff --git a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
index c48a135750..2409829384 100644
--- a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
+++ b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
@@ -18,11 +18,18 @@ package org.apache.poi.xssf.usermodel;
 
 import static org.junit.Assert.*;
 
+import org.apache.poi.ss.formula.DataValidationEvaluator;
 import org.apache.poi.ss.usermodel.DataValidationConstraint;
 import org.apache.poi.ss.usermodel.DataValidationConstraint.ValidationType;
+import org.apache.poi.xssf.XSSFTestDataSamples;
 import org.apache.poi.ss.usermodel.DataValidationConstraint.OperatorType;
+import org.apache.poi.ss.util.CellReference;
 import org.junit.Test;
 
+import java.util.Collections;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
 public class TestXSSFDataValidationConstraint {
     static final int listType = ValidationType.LIST;
     static final int ignoredType = OperatorType.IGNORED;
@@ -51,6 +58,20 @@ public class TestXSSFDataValidationConstraint {
         assertEquals(literal.replace(" ", ""), constraint.getFormula1());
     }
 
+    @Test
+    public void listLiteralsGreaterThan255CharactersThrows() {
+        String[] literal = IntStream.range(0, 129).mapToObj(i -> "a").toArray(String[]::new);
+        assertThrows(IllegalArgumentException.class, () -> new XSSFDataValidationConstraint(literal));
+    }
+    
+    @Test
+    public void dataValidationListLiteralTooLongFromFile() {
+        XSSFWorkbook wb = XSSFTestDataSamples.openSampleWorkbook("DataValidationListTooLong.xlsx");
+        XSSFFormulaEvaluator fEval = wb.getCreationHelper().createFormulaEvaluator();
+        DataValidationEvaluator dvEval = new DataValidationEvaluator(wb, fEval);
+        assertThrows(IllegalArgumentException.class, () -> dvEval.getValidationValuesForCell(new CellReference("Sheet0!A1")));
+    }
+
     @Test
     public void rangeReference() {
         // (unnamed range) reference list
diff --git a/test-data/spreadsheet/DataValidationListTooLong.xlsx b/test-data/spreadsheet/DataValidationListTooLong.xlsx
new file mode 100644
index 0000000000..7eab4adf15
Binary files /dev/null and b/test-data/spreadsheet/DataValidationListTooLong.xlsx differ