PhpSpreadsheet is a library for reading and writing spreadsheet files

#!/usr/bin/env python3
# check_cve_2026_34084.py
# Exit codes:
#   0 = PATCHED / not present
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import json
import os
import re
import sys
from typing import Any, Dict, List, Optional, Tuple

PKG = 'phpoffice/phpspreadsheet'


def usage() -> None:
    print('Usage: python3 check_cve_2026_34084.py <app_root|composer.lock|installed.json>')


def read_json(path: str) -> Optional[Any]:
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def find_manifest(target: str) -> Tuple[Optional[str], Optional[str]]:
    target = os.path.abspath(target)
    candidates: List[Tuple[str, str]] = []

    if os.path.isdir(target):
        candidates.extend([
            ('composer.lock', os.path.join(target, 'composer.lock')),
            ('installed.json', os.path.join(target, 'vendor', 'composer', 'installed.json')),
        ])
    else:
        base = os.path.basename(target)
        if base == 'composer.lock':
            candidates.append(('composer.lock', target))
        elif base == 'installed.json':
            candidates.append(('installed.json', target))

    for kind, path in candidates:
        if os.path.isfile(path):
            return kind, path
    return None, None


def normalize_version(v: str) -> Optional[str]:
    if not v:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    v = v.split('@', 1)[0]
    v = v.split('+', 1)[0]
    if any(tag in v for tag in ['dev', 'alpha', 'beta', 'rc']):
        return None
    m = re.match(r'^(\d+)(?:\.(\d+))?(?:\.(\d+))?', v)
    if not m:
        return None
    parts = [m.group(1) or '0', m.group(2) or '0', m.group(3) or '0']
    return '.'.join(parts)


def to_tuple(v: str) -> Tuple[int, int, int]:
    a, b, c = v.split('.')
    return int(a), int(b), int(c)


def cmpv(a: str, b: str) -> int:
    ta, tb = to_tuple(a), to_tuple(b)
    return (ta > tb) - (ta < tb)


def in_range(v: str, lo: Optional[str], hi: Optional[str]) -> bool:
    if lo is not None and cmpv(v, lo) < 0:
        return False
    if hi is not None and cmpv(v, hi) > 0:
        return False
    return True


def classify(v: str) -> str:
    # Vulnerable ranges from advisory
    vulnerable = [
        (None, '1.30.2'),
        ('2.0.0', '2.1.14'),
        ('2.2.0', '2.4.3'),
        ('3.3.0', '3.10.3'),
        ('4.0.0', '5.5.0'),
    ]
    for lo, hi in vulnerable:
        if in_range(v, lo, hi):
            return 'VULNERABLE'

    # Clearly unaffected/patched windows
    patched = [
        ('1.30.3', None),
        ('2.1.15', '2.1.999'),
        ('2.4.4', '2.999.999'),
        ('3.0.0', '3.2.999'),
        ('3.10.4', '3.999.999'),
        ('5.6.0', None),
    ]
    for lo, hi in patched:
        if in_range(v, lo, hi):
            return 'PATCHED'

    return 'UNKNOWN'


def extract_version_from_composer_lock(data: Any) -> Optional[str]:
    if not isinstance(data, dict):
        return None
    packages = []
    for key in ('packages', 'packages-dev'):
        if isinstance(data.get(key), list):
            packages.extend(data[key])
    for pkg in packages:
        if isinstance(pkg, dict) and pkg.get('name') == PKG:
            return pkg.get('version') or pkg.get('pretty_version')
    return None


def extract_version_from_installed_json(data: Any) -> Optional[str]:
    packages = []
    if isinstance(data, list):
        packages = data
    elif isinstance(data, dict):
        if isinstance(data.get('packages'), list):
            packages = data['packages']
        elif isinstance(data.get('installed'), list):
            packages = data['installed']
    for pkg in packages:
        if isinstance(pkg, dict) and pkg.get('name') == PKG:
            return pkg.get('version') or pkg.get('pretty_version')
    return None


def main() -> int:
    if len(sys.argv) != 2:
        usage()
        print('UNKNOWN')
        return 2

    kind, path = find_manifest(sys.argv[1])
    if not path:
        print('UNKNOWN')
        print('Reason: could not find composer.lock or vendor/composer/installed.json')
        return 2

    data = read_json(path)
    if data is None:
        print('UNKNOWN')
        print(f'Reason: unable to parse JSON from {path}')
        return 2

    raw_version = None
    if kind == 'composer.lock':
        raw_version = extract_version_from_composer_lock(data)
    elif kind == 'installed.json':
        raw_version = extract_version_from_installed_json(data)

    if not raw_version:
        print('PATCHED')
        print(f'Reason: package {PKG} not present in {path}')
        return 0

    version = normalize_version(raw_version)
    if version is None:
        print('UNKNOWN')
        print(f'Reason: found {PKG} version {raw_version!r}, but could not normalize it safely')
        return 2

    result = classify(version)
    print(result)
    print(f'Package: {PKG}')
    print(f'Version: {raw_version} (normalized: {version})')
    if result == 'VULNERABLE':
        print('Fixed versions: 1.30.3 / 2.1.15 / 2.4.4 / 3.10.4 / 5.6.0 or newer on supported branches')
        return 1
    elif result == 'PATCHED':
        return 0
    else:
        return 2


if __name__ == '__main__':
    sys.exit(main())