This fixes GHSA-5h23-36rv-pm65 panic on negative style index (#2367)

- Update unit tests

Author: arpitjain099

styles.go

@@ -1171,17 +1171,17 @@ var (
 		"fill": func(xf xlsxXf, s *xlsxStyleSheet) bool {
 			return (xf.ApplyFill == nil || (xf.ApplyFill != nil && *xf.ApplyFill)) &&
 				xf.FillID != nil && s.Fills != nil &&
-				*xf.FillID < len(s.Fills.Fill)
+				0 <= *xf.FillID && *xf.FillID < len(s.Fills.Fill)
 		},
 		"border": func(xf xlsxXf, s *xlsxStyleSheet) bool {
 			return (xf.ApplyBorder == nil || (xf.ApplyBorder != nil && *xf.ApplyBorder)) &&
 				xf.BorderID != nil && s.Borders != nil &&
-				*xf.BorderID < len(s.Borders.Border)
+				0 <= *xf.BorderID && *xf.BorderID < len(s.Borders.Border)
 		},
 		"font": func(xf xlsxXf, s *xlsxStyleSheet) bool {
 			return (xf.ApplyFont == nil || (xf.ApplyFont != nil && *xf.ApplyFont)) &&
 				xf.FontID != nil && s.Fonts != nil &&
-				*xf.FontID < len(s.Fonts.Font)
+				0 <= *xf.FontID && *xf.FontID < len(s.Fonts.Font)
 		},
 		"alignment": func(xf xlsxXf, s *xlsxStyleSheet) bool {
 			return xf.ApplyAlignment == nil || (xf.ApplyAlignment != nil && *xf.ApplyAlignment)

styles_test.go

@@ -897,4 +897,24 @@ func TestGetStyle(t *testing.T) {
 	style, err = f.GetStyle(1)
 	assert.Nil(t, style)
 	assert.EqualError(t, err, "XML syntax error on line 1: invalid UTF-8")
+
+	t.Run("with_negative_index", func(t *testing.T) {
+		styleSheet := `<styleSheet xmlns="%s"><fonts count="1"><font><sz val="11"/><name val="Calibri"/></font></fonts><fills count="1"><fill><patternFill patternType="none"/></fill></fills><borders count="1"><border/></borders><cellStyleXfs count="1"><xf numFmtId="0" fontId="0" fillId="0" borderId="0"/></cellStyleXfs><cellXfs count="2"><xf numFmtId="0" fontId="0" fillId="0" borderId="0" xfId="0"/><xf numFmtId="0" %s xfId="0" applyFont="1" applyFill="1" applyBorder="1"/></cellXfs></styleSheet>`
+		for _, testCase := range []struct {
+			label string
+			attrs string
+		}{
+			{"negative fill index", `fontId="0" fillId="-1" borderId="0"`},
+			{"negative border index", `fontId="0" fillId="0" borderId="-1"`},
+			{"negative font index", `fontId="-1" fillId="0" borderId="0"`},
+		} {
+			f := NewFile()
+			f.Styles = nil
+			f.Pkg.Store(defaultXMLPathStyles, fmt.Appendf(nil, styleSheet, NameSpaceSpreadSheet.Value, testCase.attrs))
+			style, err := f.GetStyle(1)
+			assert.NoError(t, err, testCase.label)
+			assert.NotNil(t, style, testCase.label)
+			assert.NoError(t, f.Close(), testCase.label)
+		}
+	})
 }