Sheet Password Protection not working with default algorithm and password length greater than 24

[Wazzledi]

This is:

- [x] a bug report
- [ ] a feature request
- [ ] **not** a usage question (ask them on https://stackoverflow.com/questions/tagged/phpspreadsheet or https://gitter.im/PHPOffice/PhpSpreadsheet)

What is the expected behavior?

If i use the Password Protection in PHPSpreadsheet i should not unprotect the File in Excel without using the password.

What is the current behavior?

When using the default hash algorithm for password protection with a password longer than 24 characters and write to a XLSX file, i can easily unprotect the worksheet without a password.

This error is only affecting XLSX files in my tests.

What are the steps to reproduce?

Run the code below to create an unprotected file and a protected file.

After creating the files open the notProtected.xlsx file in excel and try to remove the protection with the unprotect sheet option in the review tab.

In my tests the sheet gets unprotected without entering a password.

As comparison: When trying to remove the protection in the protected.xlsx file i have to enter a password to unlock the file.

<?php


use PhpOffice\PhpSpreadsheet\Spreadsheet;
use PhpOffice\PhpSpreadsheet\Writer\Xlsx;

require_once __DIR__ . "/vendor/autoload.php";

// Create new Spreadsheet object for protected spreadsheet
$spreadsheetProtected = new Spreadsheet();

$protection = $spreadsheetProtected->getActiveSheet()->getProtection();
//Password length <= 24
$protection->setPassword("ABCDEFGHIJKLMNOPQRSTUVWX");
$protection->setSheet(true);

$writer = new Xlsx($spreadsheetProtected);
$writer->save("protected.xls");

// Create new Spreadsheet object for unprotected spreadsheet
$spreadSheetNotProtected = new Spreadsheet();

$protection = $spreadSheetNotProtected->getActiveSheet()->getProtection();
//Password length > 24
$protection->setPassword("ABCDEFGHIJKLMNOPQRSTUVWXY");
$protection->setSheet(true);

//Only broken for xlsx
$writer = new Xlsx($spreadSheetNotProtected);
$writer->save("notProtected.xls");

Which versions of PhpSpreadsheet and PHP are affected?

Used PHPSpreadsheet Version: 1.17.1

Used PHP Version: 7.4.10

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
If this is still an issue for you, please try to help by debugging it further and sharing your results.
Thank you for your contributions.

[oleibman]

Not only do my tests fail when yours do, some of the tests where you succeed appear to fail for me. In particular, I can't use your 24-character password to unprotect either xls or xlsx. This doesn't seem to be entirely length-related - I can use a different 24-character key without problems. I will compare the code to the spec to try to determine why things are breaking down. It seems likely that your 25-character case is failing because the password hash is returning a string of 5 hex digits when only 4 are expected, but that is not the case for the 24-character failure.

As a workaround, you might consider setting the algorithm to, e.g. SHA-512, rather than using the default. This appears to work correctly for any key length in xlsx, but will fail for xls.

[PowerKiKi]

Fixed in 1.19.0