[patch] Do not use ZipSecureFile in injectData()

59743.patch (text/plain), 790 bytes, created by Axel Howind on 2016-06-22 19:23:51 UTC

(hide)

Description: Do not use ZipSecureFile in injectData()

Filename:

MIME Type:

Creator: Axel Howind

Created: 2016-06-22 19:23:51 UTC

Size: 790 bytes

patch

obsolete

>diff --git a/src/ooxml/java/org/apache/poi/xssf/streaming/SXSSFWorkbook.java b/src/ooxml/java/org/apache/poi/xssf/streaming/SXSSFWorkbook.java >index 668e473..6f7b336 100644 >--- a/src/ooxml/java/org/apache/poi/xssf/streaming/SXSSFWorkbook.java >+++ b/src/ooxml/java/org/apache/poi/xssf/streaming/SXSSFWorkbook.java >@@ -355,7 +355,9 @@ public class SXSSFWorkbook implements Workbook { > > private void injectData(File zipfile, OutputStream out) throws IOException > { >- ZipFile zip = ZipHelper.openZipFile(zipfile); >+ // zipfile was created by POI itself. Do not use ZipSecureFile to >+ // avoid detection of zip bomb (see [Bug 58499]). >+ ZipFile zip = new ZipFile(zipfile); > try > { > ZipOutputStream zos = new ZipOutputStream(out); View Attachment As Diff View Attachment As Raw

This is ASF Bugzilla: the Apache Software Foundation bug system. In case of problems with the functioning of ASF Bugzilla, please contact bugzilla-admin@apache.org. Please Note: this e-mail address is only for reporting problems with ASF Bugzilla. Mail about any other subject will be silently ignored.

• • Home
  • | New
  • | Browse
  • | Search
  • |
    [?]
  • | Reports
  • | Help
  • | New Account
  • | Log In
    Remember [x]
  • | Forgot Password
    Login: [x]