fix: prevent paste to locked cells (#7927) (CP: 23.6) (#7968)

* fix: prevent paste to locked cells (#7927)

* add isCellLocked overload

* replace usages of deprecated method

* fix LockIT

* add lock sheet test with existing cell

* cleanup

* chore: run formatter

---------

Co-authored-by: Sascha Ißbrücker <sissbruecker@vaadin.com>

Author: ugur-vaadin

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow-integration-tests/src/main/java/com/vaadin/flow/component/spreadsheet/tests/fixtures/LockCellFixture.java

@@ -22,8 +22,8 @@ public class LockCellFixture implements SpreadsheetFixture {
 
     @Override
     public void loadFixture(Spreadsheet spreadsheet) {
-
-        spreadsheet.setActiveSheetProtected("pwd");
+        // Sheet already needs to be locked for this fixture to work
+        // See LockSheetFixture
         Cell cell = spreadsheet.createCell(0, 0, "");
         Workbook wb = cell.getSheet().getWorkbook();
 
@@ -35,7 +35,7 @@ public void loadFixture(Spreadsheet spreadsheet) {
                         cellRef.getCol(), "");
             }
 
-            boolean wasLocked = spreadsheet.isCellLocked(cell);
+            boolean wasLocked = spreadsheet.isCellLocked(cell.getAddress());
 
             CellStyle cellStyle = wb.createCellStyle();
             // Toggle cell locked state

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow-integration-tests/src/main/java/com/vaadin/flow/component/spreadsheet/tests/fixtures/LockSheetFixture.java

@@ -0,0 +1,21 @@
+/**
+ * Copyright 2000-2025 Vaadin Ltd.
+ *
+ * This program is available under Vaadin Commercial License and Service Terms.
+ *
+ * See  {@literal <https://vaadin.com/commercial-license-and-service-terms>}  for the full
+ * license.
+ */
+package com.vaadin.flow.component.spreadsheet.tests.fixtures;
+
+import com.vaadin.flow.component.spreadsheet.Spreadsheet;
+
+public class LockSheetFixture implements SpreadsheetFixture {
+
+    @Override
+    public void loadFixture(Spreadsheet spreadsheet) {
+        spreadsheet.setActiveSheetProtected("pwd");
+        spreadsheet.getSpreadsheetStyleFactory()
+                .reloadActiveSheetColumnRowStyles();
+    }
+}

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow-integration-tests/src/main/java/com/vaadin/flow/component/spreadsheet/tests/fixtures/TestFixtures.java

@@ -39,6 +39,7 @@ public enum TestFixtures {
     CustomEditor(SimpleCustomEditorFixture.class),
     Styles(StylesFixture.class),
     LockCell(LockCellFixture.class),
+    LockSheet(LockSheetFixture.class),
     CustomComponent(CustomComponentFixture.class),
     Action(ActionFixture.class),
     InsertRow(InsertRowFixture.class),

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow-integration-tests/src/test/java/com/vaadin/flow/component/spreadsheet/test/LockIT.java

@@ -30,24 +30,20 @@ public void init() {
     public void testLockedCells() {
         SpreadsheetElement spreadsheet = getSpreadsheet();
 
-        // Lock cell C3
-        selectCell("C3");
-        loadTestFixture(TestFixtures.LockCell);
-
-        spreadsheet.getCellAt("B2").setValue("value");
-
-        // Toggle locked state of the region
-        selectRegion("B2", "D4");
-        loadTestFixture(TestFixtures.LockCell);
+        // Lock sheet, which locks all cells
+        loadTestFixture(TestFixtures.LockSheet);
 
         // Assert that a locked cell cannot be edited
-        Assert.assertEquals("locked", spreadsheet.getCellAt("B2").getValue());
         SheetCellElement lockedCell = spreadsheet.getCellAt("B2");
-        selectCell("B2"); // work around Selenium issue with double-click
-                          // targeting wrong cell
+        // work around Selenium issue with double-click targeting wrong cell
+        selectCell("B2");
         lockedCell.doubleClick();
         Assert.assertFalse(spreadsheet.getCellValueInput().isDisplayed());
 
+        // Toggle locked state of the region (should unlock the cells)
+        selectRegion("B2", "D4");
+        loadTestFixture(TestFixtures.LockCell);
+
         // Assert that an unlocked cell can be edited
         Assert.assertEquals("unlocked", spreadsheet.getCellAt("C3").getValue());
         setCellValue("C3", "value");

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/CellSelectionManager.java

@@ -17,6 +17,7 @@
 import org.apache.poi.ss.usermodel.CellType;
 import org.apache.poi.ss.usermodel.Row;
 import org.apache.poi.ss.usermodel.Workbook;
+import org.apache.poi.ss.util.CellAddress;
 import org.apache.poi.ss.util.CellRangeAddress;
 import org.apache.poi.ss.util.CellRangeUtil;
 import org.apache.poi.ss.util.CellReference;
@@ -312,10 +313,13 @@ void handleCellAddressChange(int rowIndex, int colIndex,
                     }
                     spreadsheet.getRpcProxy().showSelectedCell(name, colIndex,
                             rowIndex, value, formula,
-                            spreadsheet.isCellLocked(cell), initialSelection);
+                            spreadsheet.isCellLocked(cell.getAddress()),
+                            initialSelection);
                 } else {
                     spreadsheet.getRpcProxy().showSelectedCell(name, colIndex,
-                            rowIndex, "", false, spreadsheet.isCellLocked(cell),
+                            rowIndex, "", false,
+                            spreadsheet.isCellLocked(
+                                    new CellAddress(rowIndex, colIndex)),
                             initialSelection);
                 }
             } else {

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/CellValueManager.java

@@ -47,6 +47,7 @@
 import org.apache.poi.ss.usermodel.Row;
 import org.apache.poi.ss.usermodel.Sheet;
 import org.apache.poi.ss.usermodel.Workbook;
+import org.apache.poi.ss.util.CellAddress;
 import org.apache.poi.ss.util.CellRangeAddress;
 import org.apache.poi.ss.util.CellReference;
 import org.apache.poi.xssf.usermodel.XSSFCell;
@@ -217,7 +218,7 @@ protected CellData createCellDataForCell(Cell cell) {
         cellData.col = cell.getColumnIndex() + 1;
         CellStyle cellStyle = cell.getCellStyle();
         cellData.cellStyle = "cs" + cellStyle.getIndex();
-        cellData.locked = spreadsheet.isCellLocked(cell);
+        cellData.locked = spreadsheet.isCellLocked(cell.getAddress());
         try {
             if (!spreadsheet.isCellHidden(cell)) {
                 if (cell.getCellType() == CellType.FORMULA) {
@@ -807,16 +808,17 @@ public void onDeleteSelectedCells() {
         if (selectedCellReference != null) {
             Row row = activeSheet.getRow(selectedCellReference.getRow());
             if (row != null && spreadsheet.isCellLocked(
-                    row.getCell(selectedCellReference.getCol()))) {
+                    new CellAddress(selectedCellReference.getRow(),
+                            selectedCellReference.getCol()))) {
                 return;
             }
         }
         List<CellReference> individualSelectedCells = getCellSelectionManager()
                 .getIndividualSelectedCells();
         for (CellReference cr : individualSelectedCells) {
             final Row row = activeSheet.getRow(cr.getRow());
-            if (row != null
-                    && spreadsheet.isCellLocked(row.getCell(cr.getCol()))) {
+            if (row != null && spreadsheet
+                    .isCellLocked(new CellAddress(cr.getRow(), cr.getCol()))) {
                 return;
             }
         }

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/Spreadsheet.java

@@ -39,6 +39,7 @@
 import org.apache.poi.ss.formula.BaseFormulaEvaluator;
 import org.apache.poi.ss.formula.ConditionalFormattingEvaluator;
 import org.apache.poi.ss.usermodel.Cell;
+import org.apache.poi.ss.usermodel.CellStyle;
 import org.apache.poi.ss.usermodel.CellType;
 import org.apache.poi.ss.usermodel.ClientAnchor.AnchorType;
 import org.apache.poi.ss.usermodel.Comment;
@@ -1541,16 +1542,10 @@ protected boolean isRangeEditable(CellRangeAddress cellRangeAddress) {
     protected boolean isRangeEditable(int row1, int col1, int row2, int col2) {
         if (isActiveSheetProtected()) {
             for (int r = row1; r <= row2; r++) {
-                final Row row = getActiveSheet().getRow(r);
-                if (row != null) {
-                    for (int c = col1; c <= col2; c++) {
-                        final Cell cell = row.getCell(c);
-                        if (isCellLocked(cell)) {
-                            return false;
-                        }
+                for (int c = col1; c <= col2; c++) {
+                    if (isCellLocked(new CellAddress(r, c))) {
+                        return false;
                     }
-                } else {
-                    return false;
                 }
             }
         }
@@ -3761,7 +3756,11 @@ public boolean isCellHidden(Cell cell) {
      * @param cell
      *            The cell to check
      * @return true if the cell is locked, false otherwise
+     * @deprecated Due to requiring a cell instance, this method can not
+     *             determine the locked state of cells that have not been
+     *             created yet. Use {@link #isCellLocked(CellAddress)} instead.
      */
+    @Deprecated(since = "24.9.0", forRemoval = true)
     public boolean isCellLocked(Cell cell) {
         if (isActiveSheetProtected()) {
             if (cell != null) {
@@ -3781,6 +3780,39 @@ && getLockedRowIndexes()
         }
     }
 
+    /**
+     * Returns whether or not the cell at the given address in the active sheet
+     * is locked.
+     *
+     * @param cellAddress
+     *            The address of the cell to check
+     * @return true if the cell is locked, false otherwise
+     */
+    public boolean isCellLocked(CellAddress cellAddress) {
+        // Locking cells only works if the sheet is protected
+        if (!isActiveSheetProtected()) {
+            return false;
+        }
+
+        Sheet sheet = getActiveSheet();
+        Row row = sheet.getRow(cellAddress.getRow());
+        Cell cell = row != null ? row.getCell(cellAddress.getColumn()) : null;
+
+        // If there is a cell with a custom cell style, return its locked state
+        if (cell != null && cell.getCellStyle().getIndex() != 0) {
+            return cell.getCellStyle().getLocked();
+        }
+
+        // Otherwise inherit locked state from row or column styles
+        // If neither is unlocked, the locked state is inherited from the sheet
+        CellStyle rowStyle = row != null ? row.getRowStyle() : null;
+        CellStyle columnStyle = sheet.getColumnStyle(cellAddress.getColumn());
+        boolean rowLocked = rowStyle == null || rowStyle.getLocked();
+        boolean columnLocked = columnStyle == null || columnStyle.getLocked();
+
+        return rowLocked && columnLocked;
+    }
+
     /**
      * Gets the RPC proxy for communication to the client side.
      *
@@ -4541,7 +4573,7 @@ void loadRangeComponents(HashSet<Component> newCustomComponents,
                                 key);
                         newCustomComponents.add(customComponent);
                         rowsWithComponents.add(r);
-                    } else if (!isCellLocked(cell)) {
+                    } else if (!isCellLocked(new CellAddress(r, c))) {
                         // no custom component and not locked, check if
                         // the cell has a custom editor
                         Component customEditor = customComponentFactory

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/main/java/com/vaadin/flow/component/spreadsheet/SpreadsheetHandlerImpl.java

@@ -26,6 +26,7 @@
 import org.apache.poi.ss.usermodel.Row;
 import org.apache.poi.ss.usermodel.Sheet;
 import org.apache.poi.ss.usermodel.Workbook;
+import org.apache.poi.ss.util.CellAddress;
 import org.apache.poi.ss.util.CellRangeAddress;
 import org.apache.poi.ss.util.CellReference;
 
@@ -270,14 +271,12 @@ public void onPaste(String text) {
 
         // Check for protected cells at target
         for (int i = 0; i < pasteHeight; i++) {
-            Row row = activesheet.getRow(rowIndex + i);
-            if (row != null) {
-                for (int j = 0; j < pasteWidth; j++) {
-                    Cell cell = row.getCell(colIndex + j);
-                    if (spreadsheet.isCellLocked(cell)) {
-                        protectedCellWriteAttempted();
-                        return;
-                    }
+            for (int j = 0; j < pasteWidth; j++) {
+                CellAddress cellAddress = new CellAddress(rowIndex + i,
+                        colIndex + j);
+                if (spreadsheet.isCellLocked(cellAddress)) {
+                    protectedCellWriteAttempted();
+                    return;
                 }
             }
         }
@@ -414,7 +413,7 @@ public void clearSelectedCellsOnCut() {
                         .getLastColumn(); col++) {
                     Cell cell = spreadsheet.getCell(row, col);
                     if (cell != null) {
-                        if (spreadsheet.isCellLocked(cell)) {
+                        if (spreadsheet.isCellLocked(cell.getAddress())) {
                             protectedCellWriteAttempted();
                             return;
                         }
@@ -429,7 +428,7 @@ public void clearSelectedCellsOnCut() {
                 .getSelectedCellReference();
         Cell cell = spreadsheet.getCell(reference.getRow(), reference.getCol());
         if (cell != null) {
-            if (spreadsheet.isCellLocked(cell)) {
+            if (spreadsheet.isCellLocked(cell.getAddress())) {
                 protectedCellWriteAttempted();
                 return;
             }

vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow/src/test/java/com/vaadin/flow/component/spreadsheet/tests/ClipboardTest.java

@@ -103,6 +103,71 @@ public void lockedCell_paste_firesProtectedEditEvent() {
         Assert.assertNotNull(event.get());
     }
 
+    @Test
+    public void lockSheet_pasteIntoNonExistingCell_cellNotCreated() {
+        lockSheet();
+        spreadsheet.setSelection("A1");
+        // Try pasting the value to a non-existing cell in a locked sheet
+        paste("['A1']");
+        Assert.assertNull(spreadsheet.getCell("A1"));
+    }
+
+    @Test
+    public void createCell_lockSheet_pasteIntoExistingCell_cellValueNotUpdated() {
+        spreadsheet.createCell(9, 1, "initial");
+
+        lockSheet();
+
+        // Try pasting after locking
+        spreadsheet.setSelection("B10");
+        paste("['new data']");
+        Assert.assertEquals("initial", getCellValue("B10"));
+    }
+
+    @Test
+    public void lockSheet_unlockRow_shouldAllowPaste() {
+        lockSheet();
+
+        // Unlock a row
+        var workbook = spreadsheet.getActiveSheet().getWorkbook();
+        var unlockedRowStyle = workbook.createCellStyle();
+        unlockedRowStyle.setLocked(false);
+
+        var row = spreadsheet.getActiveSheet().createRow(5);
+        row.setRowStyle(unlockedRowStyle);
+
+        // Try pasting to a cell in the unlocked row
+        spreadsheet.setSelection("A6");
+        paste("['test data']");
+        Assert.assertEquals("test data", getCellValue("A6"));
+
+        // Try pasting again after cell has been created
+        paste("['new data']");
+        Assert.assertEquals("new data", getCellValue("A6"));
+    }
+
+    @Test
+    public void lockSheet_unlockColumn_shouldAllowPaste() {
+        lockSheet();
+
+        // Unlock a column
+        var workbook = spreadsheet.getActiveSheet().getWorkbook();
+        var unlockedColumnStyle = workbook.createCellStyle();
+        unlockedColumnStyle.setLocked(false);
+
+        spreadsheet.getActiveSheet().setDefaultColumnStyle(1,
+                unlockedColumnStyle);
+
+        // Try pasting to a cell in the unlocked column
+        spreadsheet.setSelection("B10");
+        paste("['test data']");
+        Assert.assertEquals("test data", getCellValue("B10"));
+
+        // Try pasting again after cell has been created
+        paste("['new data']");
+        Assert.assertEquals("new data", getCellValue("B10"));
+    }
+
     @Test
     public void paste_selectionUpdated() {
         spreadsheet.setSelection("A1:A2");
@@ -244,8 +309,12 @@ private void cut() {
                 "[]");
     }
 
-    private void lockCell(String cellAddress) {
+    private void lockSheet() {
         spreadsheet.setSheetProtected(0, "password");
+    }
+
+    private void lockCell(String cellAddress) {
+        lockSheet();
         spreadsheet.createCell(0, 0, "locked");
         var lockedCellStyle = spreadsheet.getActiveSheet().getWorkbook()
                 .createCellStyle();