exceljs · alubbe · Oct 5, 2020 · Oct 2, 2020 · Oct 2, 2020 · Oct 2, 2020
diff --git a/.gitignore b/.gitignore
@@ -63,3 +63,6 @@ _SpecRunner.html
 
 # Mac files
 .DS_Store
+
+# Ignore xlsx files generated during testing
+*.xlsx
diff --git a/lib/doc/workbook.js b/lib/doc/workbook.js
@@ -50,6 +50,21 @@ class Workbook {
       // eslint-disable-next-line no-console
       console.warn(`Worksheet name ${name} exceeds 31 chars. This will be truncated`);
     }
+
+    // Illegal character in worksheet name: asterisk (*), question mark (?),
+    // colon (:), forward slash (/ \), or bracket ([])
+    if (/[*?:/\\[\]]/.test(name)) {
+      throw new Error(
+        `Worksheet name ${name} cannot include any of the following characters: * ? : \\ / [ ]`
+      );
+    }
+
+    if (/(^')|('$)/.test(name)) {
+      throw new Error(
+        `The first or last character of worksheet name cannot be a single quotation mark: ${name}`
+      );
+    }
+
     name = (name || `sheet${id}`).substring(0, 31);
     if (this._worksheets.find(ws => ws && ws.name.toLowerCase() === name.toLowerCase())) {
       throw new Error(`Worksheet name already exists: ${name}`);

diff --git a/lib/stream/xlsx/workbook-reader.js b/lib/stream/xlsx/workbook-reader.js
@@ -297,9 +297,12 @@ class WorkbookReader extends EventEmitter {
       iterator,
       options: this.options,
     });
-
-    const matchingRel = (this.workbookRels || []).find(rel => rel.Target === `worksheets/sheet${sheetNo}.xml`);
-    const matchingSheet = matchingRel && (this.model.sheets || []).find(sheet => sheet.rId === matchingRel.Id);
+
+    const matchingRel = (this.workbookRels || []).find(
+      rel => rel.Target === `worksheets/sheet${sheetNo}.xml`
+    );
+    const matchingSheet =
+      matchingRel && (this.model.sheets || []).find(sheet => sheet.rId === matchingRel.Id);
     if (matchingSheet) {
       worksheetReader.id = matchingSheet.id;
       worksheetReader.name = matchingSheet.name;

diff --git a/spec/integration/issues/issue-1364-incorrect-worksheet-name-streaming-xlsx.spec.js b/spec/integration/issues/issue-1364-incorrect-worksheet-name-streaming-xlsx.spec.js
@@ -4,10 +4,13 @@ const TEST_XLSX_FILE_NAME = './spec/integration/data/test-issue-1364.xlsx';
 
 describe('github issues', () => {
   it('issue 1364 - Incorrect Worksheet Name on Streaming XLSX Reader', async () => {
-    const workbookReader = new ExcelJS.stream.xlsx.WorkbookReader(TEST_XLSX_FILE_NAME, {});
+    const workbookReader = new ExcelJS.stream.xlsx.WorkbookReader(
+      TEST_XLSX_FILE_NAME,
+      {}
+    );
     workbookReader.read();
     workbookReader.on('worksheet', worksheet => {
       expect(worksheet.name).to.equal('Sum Worksheet');
-    })
+    });
   });
 });
diff --git a/spec/integration/worksheet.spec.js b/spec/integration/worksheet.spec.js
@@ -659,6 +659,32 @@ describe('Worksheet', () => {
       });
     });
 
+    context('when the worksheet name contains illegal characters', () => {
+      it('throws an error', () => {
+        const workbook = new ExcelJS.Workbook();
+
+        const invalidCharacters = ['*', '?', ':', '/', '\\', '[', ']'];
+
+        for (const invalidCharacter of invalidCharacters) {
+          expect(() => workbook.addWorksheet(invalidCharacter)).to.throw(
+            `Worksheet name ${invalidCharacter} cannot include any of the following characters: * ? : \\ / [ ]`
+          );
+        }
+      });
+
+      it('throws an error', () => {
+        const workbook = new ExcelJS.Workbook();
+
+        const invalidNames = ['\'sheetName', 'sheetName\''];
+
+        for (const invalidName of invalidNames) {
+          expect(() => workbook.addWorksheet(invalidName)).to.throw(
+            `The first or last character of worksheet name cannot be a single quotation mark: ${invalidName}`
+          );
+        }
+      });
+    });
+
     context('when worksheet name already exists', () => {
       it('throws an error', () => {
         const wb = new ExcelJS.Workbook();