jmcnamara / spreadsheet-parseexcel Goto Github PK

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@haile01) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

sample/xls2csv.pl file reads:

# (c) kevin Mulholland 2002, [email protected]
# This code is released under the Perl Artistic License

Here is missing the GPL option as is granted in other files of Spreadsheet-ParseExcel-0.66. Is that on a purpose, or is it just a mistake and the intended license is "GPL+ OR Artistic-1.0-Perl"?

Hi, I'm japanese.
I found problem when using full-width numbers.

$worksheet->write('A1', '１２３４５６７８９', $id_format);

After, show message on my terminal.
「Argument "..." isn't numeric in addition (+) at ...」

So I thought the next of such a solution.
fix regex in write method

# Match number
elsif ( $token =~ /^([+-]?)(?=\d|\.\d)\d*(\.\d*)?([Ee]([+-]?\d+))?$/ ) {
    return $self->write_number( @_ );
}

to

# Match number
elsif ( $token =~/^([+-]?)(?=[0-9]|\.[0-9])[0-9]*(\.[0-9]*)?([Ee]([+-]?[0-9]+))?$/ ) {
    return $self->write_number( @_ );
}

Full-width numbers by converting from the "\d" to "[0-9]" is treated as a string, it will eliminate the error.
Thanks.