[GH] (poi/leak-aeszip-getinputstream): Workflow run "Java CI with Ant" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Java CI with Ant" on poi.git/leak-aeszip-getinputstream has failed.
Run started by GitHub user pjfanning (triggered by pjfanning).

Head commit for run:
383ac33569224070b5547feddb38d60c27b2bc32 / PJ Fanning <pj...@users.noreply.github.com>
Build the cipher before opening the zip entry in AesZipFileZipEntrySource

AesZipFileZipEntrySource.getInputStream opened the entry's stream first
and then built the decryption cipher:

    InputStream is = zipFile.getInputStream(entry);
    return new CipherInputStream(is, getCipher(Cipher.DECRYPT_MODE));

getCipher delegates to CryptoFunctions.getCipher, which throws
EncryptedDocumentException when the JCE cannot supply the cipher. That
happens after the entry stream is open and nothing has taken ownership of
it, so the stream leaks.

Swap the order so the cipher is built first and the entry is only opened
once it is known to succeed. EncryptedTempData.getInputStream already
uses this ordering.

Co-Authored-By: Claude Opus 5 (1M context) <no...@anthropic.com>

Report URL: https://github.com/apache/poi/actions/runs/34117281083

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org