From a8d90aba91ba8788c784e644a6cff2acbcaba4f1 Mon Sep 17 00:00:00 2001
From: PJ Fanning <fanningpj@apache.org>
Date: Sun, 9 Aug 2020 21:15:15 +0000
Subject: [PATCH] [github-187] Add length validation for Excel DataValidations
 that are list literals. Thanks to Leo Webb. This closes #187

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1880727 13f79535-47bb-0310-9956-ffa450edef68
---
 .../scratchpad/java9/module-info.class        | Bin 2099 -> 2099 bytes
 .../scratchpad/test9/module-info.class        | Bin 2273 -> 2273 bytes
 .../XSSFDataValidationConstraint.java         |   9 ++++++--
 .../TestXSSFDataValidationConstraint.java     |  21 ++++++++++++++++++
 .../DataValidationListTooLong.xlsx            | Bin 0 -> 3286 bytes
 5 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 test-data/spreadsheet/DataValidationListTooLong.xlsx

diff --git a/src/multimodule/scratchpad/java9/module-info.class b/src/multimodule/scratchpad/java9/module-info.class
index 879d58efd6ccb9c00dfb67cafd7435dacc773e49..311deebf44d7d5674ba2b8e8a1f321869aa092e5 100644
GIT binary patch
literal 2099
zcmaKt*<RB?6vn?Of{3`#qkyuB8!j{g?)$!j`@T-ofkv7pCMn<@&*g;=;6wTI%xNuc
zGnI=!$$V$#tdsu!^Ya&gGl+U{!9n+YSge+H4i|H{l*8p5uH<l)aE)-CaD#A@aEox8
zaEEZ0aF1}G@PP1;@QCo3Fi%(@JRv+KJR>|Oydb<Jydu0Nydk_Lyd%6Pd?0)zd?I`%
zd?9=#C_;hY5sCy&SR^bFN(7(qjj&8869Pho5IX1!B-ClYvdC}4VZ4-Ak@8A9ABBEC
z@nV&FrAQSW^nOz-Dqm2Eb}-Op$F>f(i$PH*%V`)n==Z`P2rEfGP-$t-L5}yhwX<Ee
zcT0g@bTDXHb&Gn%!Kh8qYiX>!G>kjwDota*P)#|;jKAWN%^$DU{Oxb|XOtw3wF(l8
zH={O1Gh*A#X;xAl^Y$^Dtk*mpr9Ril!9JUTSE^Q)S<Ixe8rf3e)mkb;?S~m9iQ>SL
zhmpLnvZ7;-w1eK1XQnG=e>KrD&yg<ICa9&$Mz3p`8Z|W6=iwW-MJ-$1^hcy^MOqCO
z-B^2J%=4K|n#E$QR&7bK)D(1kQjL7wu&ie-^^Xd+`txds(KSlrP)m`FUN6!_dled*
z``s(}DVHI0XOeQ=ab}8)@~=ScS(c306jf$MYx>5FS`TO{W2OV<fI`{lkAeBHw2Xz3
z>KRXU)ZCQAi{dci;q=V_SUprzp9e1+T+%YwnLCsOwjT0ohaQTeQdOVDtUuoQ-)f4!
zQO(Tv#yE&n%y)@1%``)^TI;0Cj}9i=tJZ1|m8-UT8KVw&!bpu~t^*GLpw<2yY~t4i
zY?jw9bgi3*Etp_-n@98rXRuZN_X@WO`-Izt{lXo>ox)wh-NFH3PDsK%!o9*l;gE1x
zxKFrWI3gSsjtR$w6T$<+N#Q}^A>m=+5#dqcl<=7FxbTGVq;Oi87rMez!WrSLa87ty
Oct&_ucusg;DEJFC;XZBv

literal 2099
zcmZ{lX<O4k5XWZ~K?FSLDz_kBc+d!l_kCaBeV^N8O9M%>CR@OFd@f)30sK%t&Q5AA
zWy*^m$@8Dg@!v`M`_Io`05A`x3$_X9iIbof>FKaqP6Tu=&|Lv`2pCGzrJ^#*ujryl
z!eZv9%K8<ff&z32=w4Q<s#sE)E<m?{{+4Kbq5wStdMPZ>*@{g}0r~{=`AHln)vOpR
zTbYxvM?e7|_VQ95KIm0qU6!y<zyKq7fnJqR5HQAxdfleVw@E5tf140xZ5ozpR!bOQ
zY6nYLdx)uxLSB1Bz({LtCuTO)D$XQ~F_m3FQ*+}2M!6g~e%0y}lN=Iokc-gkzBV>Q
z2PGU9FwDjHm0EQL^`p#uYX;{#&di5GKHmuegRNPen3*(|aEckuseV#j)hYHaVY*F7
z)BIkWkXoiwTuB{Cn8|l=(_*+nb$O0)upxV4B4J*@I5!6+@azwx(W3K=g==xyOSPY*
zfrN{k8K?)TT9a^@8w1s*F|KY6Y53qJk)D-sojE2`!ehG091{xpG2PypxZ=b{b_sVG
z3tdRv!utXyS`BK*-gmzgT6E|k(?k~4n|RFF=fr>ZEig?wy{XBk%%bNZ{}=svn>0;6
zzhn-|r71<Bk?@*v!l`v9-U^s%b)q4A7P~cRVsO1fw=?hCl&aYf_x2;#YqseH`OF-6
z7UO|`<-B&==DvA~OYB5tRehWNHX%)RYtC-W()?XnV!m+LpJ!Bx?<YDCGD$QB<j3ye
zrGym$ldYa^jxkXUbH$9CE-rt=@K<Tehu*1;livUk_=A@J3D}Oei_k&09niVqE_T8M
za+kY=Ug8YwrvH11{X|JTKpZ3v6Gw>$i4(+0;t}F8;uP^D@iehWJVTr%o+X|mULal~
zULjs1-XPv0-XY#2J|I3KJ|Qj=pAlaWUlHFB-w{6$KM}tWzY$BsfLJD0h|9!?SS1qv
E0_}Z1ZU6uP

diff --git a/src/multimodule/scratchpad/test9/module-info.class b/src/multimodule/scratchpad/test9/module-info.class
index 86ad206e1a5518fd0ce1574254d99e2a52958de3..5809da74f2c1a22a93e58626e20a224185af7474 100644
GIT binary patch
literal 2273
zcmaKt*LKrD5QcwI5?W{)AR&bidb1#e-h1!8Bg^YpiDfC$+D^F2;jy^j0eC15vttt+
zYmF{GN&D~a)Rlhy{_zvQDSYe4We0ta;!?e;TwHN+)x|Xz*InFjanr>u!fnDG!d=2W
z!hOO6!b8F%!ehb{!c)RC!gIn4!b`#{!fV1C!dt>S!h6C8!bid<!e_!4!dHS%C=vof
ziJ%B&!Ze{m2njQUSwfW%5o&~(kPzkwDIp_hLY>ecGzs&B1qbUR@%&g=E5{Co;&i&;
zCw@>-g(MCOS&;fVs3d;L!P*(W;TMX2rW|bTn#Xe;Y>){hmCfonaWD|XQ54s*Lgeep
zNe8QE>a|d_MYA@FgV|8CMVH^amPL<u@hXujJJ?|v^-8MYVAQ6ld7b)!j?*5xuXP$0
z>zX~!*(*)k?D1&J-f*`)qhvZ&ew10P8MVWk5!-4Gv!+$b%g1c8nh#W>L(ZIoowf-<
zrCyt5F&9cRv4z5;txyKLH#16>q>&{KBL#7-p;Gp=hu#rqt}14IJyR)nm#Vh<YFU+y
z-qvzCTGG6b8)TQwYgy{)g+$qs)Qrkrs)9J>uFVI{Vkz~TwxC$*aJoCFrFgx#swOS@
zPl~qu^JtIOHOkVamLwUyouu*ZEG%i>Tu=-(ry+M{vTECKu8WNFH$mM|R*cx;Rjx-{
z`oA8vZqSj&Tm{Sq#cIf(2=lpF))q!;M|`lS=4o~>N#lf@Gc*lgwNTd~H(uVkY*}OH
z&QKQFYRIEKYAA}Y{dO<r?eWV0W>fTk+01=!jDf^Y`7Cjyxnd|*Tb1<q(ZNJ_)|O95
zs&!kw%%mP?!bly(+;7{z!jsI-oq^^PTV?lhqkL2s0f&F3t;@j*e*KP>^4f=0i{@c9
z#+iNQ5&gn7!nMLFtdskC;RfM=aHDXOaI<iWaI4T2l5m@FyKskaP&g#qDI6A#2uFou
z!d=2~;cnrCaF1}WaG!9$@PP23@R0DZ@QCoJ@R+b5^n}NSCxny2lfo(CDdB118R1#s
dIpKNX1*U^FxY)j5YTsADM8-dOn5fL1uRnj&Xc_<j

literal 2273
zcmZ{lSzFUk5QgWVfXE_}qwI^QhzpIfxbORh`@W~?DGfADNKRVtipQVjg+IU_<>Q=5
zt)WbN@h0UPX8Fz}{r%_XF92AA@14*lpxX}$Nm<Q#m0}>EW0}5L&@Ny&h*ok==(r`7
z3j;3~yOE>aQs@*c=oHYk>QtRv-ieh3T>=K0qVYd0=oZjJVFeYh=^(VAS3s{D_<m4{
zbH1ZX3l{7X(7u{fJZ-^#?8oHs19#2Sfdor{g@3TqHf&64mwZ)}a6rHyBiIF1l`tq^
zoD<cCjvQA9k%ZwEA&%COmrt~kFv`>}tYGbNrZx&`?MVTn&9#jf>qt3%Ea4DS*#u;o
zJ1k&~%Yoxpw2CmvQ2`TNgxYXbs6BL7!Z86OT#Q>vDr=}8XXdMgINwQTJ`~dV<^&8i
zXEkCRM!p1_8P2F~P^qd2dzWygMM!4;g%%-6tRh@jRhF=n?&r3}Foo*!ImW?;Y<sv_
z7X(alb5H_XZ-xpjy2Mym^NV(*+#o7QxWbu%dLeRZ60UJ$pqd%u#?Fw24|Y&i^Ac_`
z#}wxAnC>vgghF~u_jV>O8L^RF!UM)a6H>SEk$|aYgBr5E?&dv>4lOfH#N~PuPZ|4+
z_|LxQOp`{>H2IQQ^fcuEqQ7pDCgby4=AcZPeAx>nyl0#+YTb#C0%n_?Xvnt4Zo?=D
zalJjWGoM?OO0<W2`<3f8-u8ev%z?)~9=OYSZMMz4^AwlZh>mvZ+q}{uBxAS7*^ODU
z@0B&?4Tt^Np%dZri4OQo5`_WjvD<hn0e@?zn?2ng6P6Rqwa&O{;?gH9W+pOf=HwFr
zGhCq(#+ee?Wvg+{m$BPTM!@&L7J$H?()1%>7k>Q#yXk8ObZnWMJurpbYi^;3*hlOq
zF2Vp^CGj9}h&VzVBTf*fh||O)#2Ml&@dWV{F-JU2oF^_4&l1lQFA^^kuM)2lZxU}4
z?-K759}*uEpAerBUl3mr-w@vsKM+3=zYxC>^TYzNNGuUoiDhDi7!o6*MhfVIYW=!V
RzqWyyOh7-Fsmv8We*rgOXl?)i

diff --git a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
index d42641eb86..b62a38e0a5 100644
--- a/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
+++ b/src/ooxml/java/org/apache/poi/xssf/usermodel/XSSFDataValidationConstraint.java
@@ -30,12 +30,14 @@ import org.openxmlformats.schemas.spreadsheetml.x2006.main.STDataValidationOpera
 public class XSSFDataValidationConstraint implements DataValidationConstraint {
     /**
      * Excel validation constraints with static lists are delimited with optional whitespace and the Windows List Separator,
-     * which is typically comma, but can be changed by users.  POI will just assume comma.
+     * which is typically comma, but can be changed by users. POI will just assume comma.
+	 * In addition, Excel validation with static lists has a maximum size of 255 characters, including separators and excluding quotes.
      */
     private static final String LIST_SEPARATOR = ",";
     private static final Pattern LIST_SPLIT_REGEX = Pattern.compile("\\s*" + LIST_SEPARATOR + "\\s*");
     private static final String QUOTE = "\"";
-    
+	private static final int MAX_EXPLICIT_LIST_LENGTH = 257;
+
 	private String formula1;
 	private String formula2;
 	private int validationType = -1;
@@ -204,6 +206,9 @@ public class XSSFDataValidationConstraint implements DataValidationConstraint {
 			if (isFormulaEmpty(formula1)) {
 				throw new IllegalArgumentException("A valid formula or a list of values must be specified for list validation.");
 			}
+			if(formula1.length() > MAX_EXPLICIT_LIST_LENGTH) {
+				throw new IllegalArgumentException("A valid formula or a list of values must be less than or equal to 255 characters (including separators).");
+			}
 		} else  {
 			if( isFormulaEmpty(formula1) ) {
 				throw new IllegalArgumentException("Formula is not specified. Formula is required for all validation types except explicit list validation.");
diff --git a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
index c48a135750..2409829384 100644
--- a/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
+++ b/src/ooxml/testcases/org/apache/poi/xssf/usermodel/TestXSSFDataValidationConstraint.java
@@ -18,11 +18,18 @@ package org.apache.poi.xssf.usermodel;
 
 import static org.junit.Assert.*;
 
+import org.apache.poi.ss.formula.DataValidationEvaluator;
 import org.apache.poi.ss.usermodel.DataValidationConstraint;
 import org.apache.poi.ss.usermodel.DataValidationConstraint.ValidationType;
+import org.apache.poi.xssf.XSSFTestDataSamples;
 import org.apache.poi.ss.usermodel.DataValidationConstraint.OperatorType;
+import org.apache.poi.ss.util.CellReference;
 import org.junit.Test;
 
+import java.util.Collections;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+
 public class TestXSSFDataValidationConstraint {
     static final int listType = ValidationType.LIST;
     static final int ignoredType = OperatorType.IGNORED;
@@ -51,6 +58,20 @@ public class TestXSSFDataValidationConstraint {
         assertEquals(literal.replace(" ", ""), constraint.getFormula1());
     }
 
+    @Test
+    public void listLiteralsGreaterThan255CharactersThrows() {
+        String[] literal = IntStream.range(0, 129).mapToObj(i -> "a").toArray(String[]::new);
+        assertThrows(IllegalArgumentException.class, () -> new XSSFDataValidationConstraint(literal));
+    }
+    
+    @Test
+    public void dataValidationListLiteralTooLongFromFile() {
+        XSSFWorkbook wb = XSSFTestDataSamples.openSampleWorkbook("DataValidationListTooLong.xlsx");
+        XSSFFormulaEvaluator fEval = wb.getCreationHelper().createFormulaEvaluator();
+        DataValidationEvaluator dvEval = new DataValidationEvaluator(wb, fEval);
+        assertThrows(IllegalArgumentException.class, () -> dvEval.getValidationValuesForCell(new CellReference("Sheet0!A1")));
+    }
+
     @Test
     public void rangeReference() {
         // (unnamed range) reference list
diff --git a/test-data/spreadsheet/DataValidationListTooLong.xlsx b/test-data/spreadsheet/DataValidationListTooLong.xlsx
new file mode 100644
index 0000000000000000000000000000000000000000..7eab4adf15ffa598e110e467706c4186d891987f
GIT binary patch
literal 3286
zcmZ`*c|4R07aqnoc9&|p_Py<r#y*8Rmh9O{moSZW%rGdEF-Q$D7)zFtG{#nGu}9M6
zmNhZLi0oxelEN)~uYBKC^W8i1JMa6OKc4eD^PJ~7=h#?)ImAF99v)CxJ)7<MjJ9An
z8we!90RoAFK%i5GSWGAi6MEVKAA|~VQwa}5SJ}5?o*owdcBQ5NfabD|<E|J(>E_*~
z%iupE(p^>+@7-KnapTs`u)E9~yoB`j@pk@lraHLV)es>{XnIcg^T6T(--&us<RSOj
z2q(`>cMI{O>K)vg*Q|FB^0?TRHj_T<G;_<^d>&O;5~hnXNRwxZkh4Y^{`=v=H3i+*
zZRkFW4?B%xt&~r6wOx79JF)QCRLk<YZ&F&0-Q}wO<J8aY6y^J1?g-J3B%V9xhbe7$
z#Sy8OVG_xF?K!i<zACN0tIm~O)h025{%=bz8rt^e&t=DFm&ZhQKD1nO)cr-wC{Hxu
z0&PukIPO6SW%N)J;!(@Tl2c>|?YWc;y!}BIWI4imIhz>Abom$?^h^RDaKiE?2b2<E
z9qqJ0`&c~Gh;Sv6?mx<l3Wk1(8W566@Z2kniyw<P(a2`=6W7J$^9>UK$7bvx5FhY9
zjYFYBR8_W~WodN(ro;TC)6b@dwcmS?ZELcQOb3z|*wjy%S$efIUuQO~cc`4Q;1!?W
zrx3Zx%{Z$cXVze=l2;HD)^maCJFvzS57#?(XTe|>eL85|luNFOSQANw6k;;y#nc0G
zyTP%hb^UeB81_t(=(E=|+T0ng@7$Fu<-gFh0wZpJI>D6->+Rm#a=eBs?CDTCG+TMS
z6HoAzx|UFulw#Bfd3*O$rXcz>*!X12<7`mFeEHhhV6-%>-^y~P5#_r(A$jOPFGt&W
z=^wDVlZVT5XRzk|DO4~-SL_?rooA*(ni<LdGZ$lobIeqLgBl=&fjEOj+TgH3A*!B1
zL0h7;N~ZGyqBHtHG;V2lGyA&{BjW;3-u&<SGPFU>E;ORtTz@3@)kMePl;XM<_r{a<
z*Bg`#^(Tp$YLb)RIq6CF&nmzh><xKEMByD&iG4LV&t#uy^qys<epFGpr7XTlv1sp8
zb)Cd4kJD0@$GX&yKS@e8k+{9eX<qgh)Y(U15BHnn_7tz$5wUM8yhOpjz(1E?pofm;
z1Z;C32$3JlM`CfPt@;BgZWc|4#YmgxEs@vMFR2+0%C;HUNVwQO;%j~Io2IlvcV`sV
z)rWJ+Ep0_dNEurNpB0IW7K+u-P{AdLK>d0>>VDO){)$etjeojN%@wSnx%<Oab6u6P
zxY!y&f`m*yO)bX4c|y;m83HNi{tc1Glm66st}1?J7CwHFASx+rGDGr>M_k_5a;Rg-
z|4-$@wA+k^ufZbw%se;*l(_6BIoD9~;gTDYE@@Yek~|BG{Mw3fV+<2c{Nwsam&})3
zuqZcn%&qjR7D93t5N1y%iY=19DV%uQ8&=;eP(bz$y=L3TNUPxM)KuNI2Gi$jeA%a!
zRZ5ZS8r$%G*Ef}r+dD*Hk^lUgw7_J5t8yTK0R#$1tA_Y`;!tPoLvel>pO7uujwS!T
z)pp~RJh_fx>-Pwwv{2b__G1RV&6*xc8n9g{Sh3)hk<CSXbyQ(J-YzwJfPUAHE-Zv6
zAJwUK?;Hd#6OqQR`0=Q)u9%ZLdQQ6Q4~h4+vmLYKsr;})87uerIb6FUXPJvqMxhN9
zrNjtrz8kobjX1ODM6F2}9#<yN4_<Z>Nc`*e1J_lppL<@a=3-z7^qUIUSKz<(hvLzw
z?}ZnpJ-{@{2$NRyIK8kzM;vS~wc6}=oTAw|dv$6akl0OWS?JkA?xESoS)W@8*=!zz
zjU@F^_*U~J`$8LT?PEjdGMK%~>$OosjO*c}vesOJ#|#u&qi+^PlAB=2n=|yb`#7+N
zuHW^VBSnmJhxnyvyaQ(h1|51uE9~TVNxVFZMam?>k$3!zb4JUWu9X)V3m+w<CaRmY
z78F)L-#c~Lgj2rcDyD+OK+K#^HM#L956|$2?ZT&D!ZQkA`iJTz-WfU)N3ndJeM45W
zlIMcZ5tGH*6PzcPCe#hAx@E;WhE|T(q-}iaZJ+5>iwphOiocQ>w7DS%!Q>~kj)wJ5
zLEk)C@+5Z_8Tk$9WGKnsOI9>va*=f=dm}3wnMjK^!C{AuZwmUGSBqjYD?Q9p*H$W@
zZfIqa-(xq(-Zdju1Qv&(HBkMp0hZkW#)Y=oK8M8xcww;tTS7^q(5;)c<^$nU)j9uS
zV;-t@L%w-~tZgm!y%kcUx}eH$jgafWmYmyHfQQ3z73)i}wZh7KVoCmm1~!Mg>w*}I
zMCKcPdUZp<-PD)O(3jLvS-<HJset|IGp$J1XQ_zbx)!OBR6?5H8N{{o)OqfQPP4Y>
zL)kD8jZJ0wv)5tEzq}|ereI|)!SC!eKVvMrHq;|fo@(}=??|bKYAdi0Xr_M}o4!h<
zoAIg-xJ^eN7w{jSlnz>WWGT{>PO6!4+aLw_Xe<t63_3O*xA<GT^iASQ*13Kb9SICi
zeFgk|7$CY|w`tg38$Xh<y+Ts00)Q1_u$j;u8O)$V3oxq4uDQN-5b|KKuiRdXuhWe;
z>YMruxZ%qR<i!Y~%3)$>I=)#>K0Ow&kPK(Cynvwl$_cF%52Ito`f4}9UQA5iOKp6a
zzCzMTOJj<*>8&-oD+J=BD&Rw_n|avbK3Bo7`88+}{MvDFcmUTKt=Kb9jV(`<%x+Kx
z-vXOG_8@fIwbM#R>vX-prDT33@~^gx1)4DU&eliAHb_+HCU#F;?7z2Kv{Bf&-WwI9
zV~TiXkC%K?WkKX9hSt}9dB?ZIMR5$ft*)<>U;rQocQ6P91xaiTkS!KMd{L;-5MY)7
zFSRXgI66Q;U{@*S(_0Z1&Ie-Sm<Ax<A8+jk0p0LNjyN0PNholzh<Tzx^r+`A<6rWs
zFyg-@S&Wy>e+aHi%>Du?F`pBaZq`e_jg4|ub`qu<-)Nl)m*ZSzx0su=BodEacW)mg
z&?5K~nIMYC<CGk9e4TiqSGPgHI267(UwXKb1SPpXQ;FUmm)}=f(K=~Y_56I!9HV;F
z9wCz7Hu=Wk)*nKDs`5pCLndaNORhB?E$mRpI_|w8D9FqHTr879?X_L)v1tnsR&?;5
znHKo!b3e@R&e8?cf}I}p$U{M9;uER6cTKta6|(p4y|+~AbkN#%(Q8;`K<WPEN>*@Y
z<Dq>C>{)r5+>&)1W$+eSMJg?R1pfA^cHDXcjQGG&UWSAJL*-e^l#7x*;`7oy3;bT{
z8t9yd*6Z%Nuos0oYf~w&{6_@J1S6s<>4uD8X&<FmnW}-wM$Dzqq<bo~5@84eF=eNI
zv?*dVpBkfR%p@~BK1l{5dlVL;t`L@i=CQGhZB6=rIW++_|M2;T!;>`u>;1HYMgyw&
z;hJIvvK|{dz;M7;tfvPnnswLjptS&1{f++L=4XYouDu<20C02v(-LIOz`A&LG92XG
z&hYmdVui9!(H&?G*LUcTV}upVI(v4&`P|>Z|1ycT@<@TV8~^{lg?>*1Gz>(Gxx@2!
f5&z&~&TSX7IM~L56DS=7f&gD<pnZP4TfhDT_WC`E

literal 0
HcmV?d00001

-- 
2.39.5