Dde call safe handling (#891)

* Set handler for quoted text cells and DDE expressions in the Calculation engine

CHANGELOG.md

@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](https://semver.org).
 ### Added
 
 - Added support for inline styles in Html reader (borders, alignment, width, height)
+- QuotedText cells no longer treated as formulae if the content begins with a `=`
+- Clean handling for DDE in formulae
 
 ## [1.6.0] - 2019-01-02
 

src/PhpSpreadsheet/Calculation/Calculation.php

@@ -2703,7 +2703,7 @@ public function calculate(Cell $pCell = null)
      * @param Cell $pCell Cell to calculate
      * @param bool $resetLog Flag indicating whether the debug log should be reset or not
      *
-     * @throws Exception
+     * @throws \PhpOffice\PhpSpreadsheet\Exception
      *
      * @return mixed
      */
@@ -2807,7 +2807,7 @@ public function parseFormula($formula)
      * @param string $cellID Address of the cell to calculate
      * @param Cell $pCell Cell to calculate
      *
-     * @throws Exception
+     * @throws \PhpOffice\PhpSpreadsheet\Exception
      *
      * @return mixed
      */
@@ -2891,6 +2891,15 @@ public function _calculateFormulaValue($formula, $cellID = null, Cell $pCell = n
     {
         $cellValue = null;
 
+        //  Quote-Prefixed cell values cannot be formulae, but are treated as strings
+        if ($pCell !== null && $pCell->getStyle()->getQuotePrefix() === true) {
+            return self::wrapResult((string) $formula);
+        }
+
+        if (preg_match('/^=\s*cmd\s*\|/miu', $formula) !== 0) {
+            return self::wrapResult($formula);
+        }
+
         //    Basic validation that this is indeed a formula
         //    We simply return the cell value if not
         $formula = trim($formula);

tests/PhpSpreadsheetTests/Calculation/CalculationTest.php

@@ -140,4 +140,27 @@ public function testFormulaWithOptionalArgumentsAndRequiredCellReferenceShouldPa
         $cell->setValue('=OFFSET(D3, -1, -2)');
         self::assertEquals(5, $cell->getCalculatedValue(), 'missing arguments should be filled with null');
     }
+
+    public function testCellSetAsQuotedText()
+    {
+        $spreadsheet = new Spreadsheet();
+        $workSheet = $spreadsheet->getActiveSheet();
+        $cell = $workSheet->getCell('A1');
+
+        $cell->setValue("=cmd|'/C calc'!A0");
+        $cell->getStyle()->setQuotePrefix(true);
+
+        self::assertEquals("=cmd|'/C calc'!A0", $cell->getCalculatedValue());
+    }
+
+    public function testCellWithDdeExpresion()
+    {
+        $spreadsheet = new Spreadsheet();
+        $workSheet = $spreadsheet->getActiveSheet();
+        $cell = $workSheet->getCell('A1');
+
+        $cell->setValue("=cmd|'/C calc'!A0");
+
+        self::assertEquals("=cmd|'/C calc'!A0", $cell->getCalculatedValue());
+    }
 }