Bug 62943 - Runtime error trying to set entity expansion limit property
Summary: Runtime error trying to set entity expansion limit property
Status: RESOLVED FIXED
Alias: None
Product: POI
Classification: Unclassified
Component: XSSF (show other bugs)
Version: 4.0.0-FINAL
Hardware: PC Linux
: P2 critical (vote)
Target Milestone: ---
Assignee: POI Developers List
URL:
Keywords:
Depends on: 62692
Blocks:
  Show dependency tree
 
Reported: 2018-11-23 01:17 UTC by Aris Anastasatos
Modified: 2018-12-21 07:47 UTC (History)
1 user (show)


Attachments
Error on org.apache.poi.ooxml.util.DocumentHelper.trySetXercesSecurityManager for attribute http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit (7.91 KB, text/plain)
2018-11-23 01:17 UTC, Aris Anastasatos 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Aris Anastasatos 2018-11-23 01:17:46 UTC 
Created attachment 36274 [details]
Error on org.apache.poi.ooxml.util.DocumentHelper.trySetXercesSecurityManager for attribute http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit

Getting error in runtime (attached) trying to get an XSSFWorkbook on an Weblogic deployment.
In trySetXercesSecurityManager it seems that the com.sun.org.apache.xerces.internal.util.SecurityManager has been commented out.
This result on reach of line dbf.setAttribute(POIXMLConstants.PROPERTY_ENTITY_EXPANSION_LIMIT, 1);
which results the error.

My setup : 
Weblogic 12.1.3
JDK 8
Comment 1 Andreas Beeker 2018-11-23 01:33:21 UTC 
I think this is fixed / will be fixed in POI 4.0.1, because of XmlBeans 3.0.2

https://issues.apache.org/jira/browse/XMLBEANS-519
Comment 2 Aris Anastasatos 2018-11-23 10:54:04 UTC 
I am using XmlBeans 3.0.2 at the moment but I guess that this has to do with the XercesImpl which is included in jdk in JDK8.

It seems that the http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit is an unknown attribute. Shouldn't the comment of the com.sun.org.apache.xerces.internal.util.SecurityManager be uncommented? 

Reviewing the repository that this has been uncommented only in the latest revision of the trunk. 

Is this is included in 4.0.0 to try something else or go to a previous version or should I wait for 4.0.1 to use?
Comment 3 Dominik Stadler 2018-12-21 07:47:40 UTC 
As far as I see this should be fixed via r1840304, bug 62692 and released via Apache POI 4.0.1, we now ignore failures to set the attribute if the actual XML parser implementation does not support it.