You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by bu...@apache.org on 2025/06/04 07:51:03 UTC
[Bug 69705] New: ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Bug ID: 69705
Summary: ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Product: POI
Version: unspecified
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: normal
Priority: P2
Component: XSSF
Assignee: dev@poi.apache.org
Reporter: rakhi.narayanan@gmail.com
Target Milestone: ---
I am trying with this simple code in my application which will set the value
only only for 1000 rows.
For &rowNum = 2 To 1000
For &colNum = 1 To 18
If &colNum = 14 Or
&colNum = 16 Then
&ssObject.SetCellstring(&rowNum, &colNum, &rowNum | "-" | &colNum);
End-If;
End-For;
End-For;
I am getting zip bomb detected in this.Could you please help to resolve this.
SetCellstring will internally call setStringValue and setFormat . the code is
as below.
public void setStringValue(String stringValue)
{
LOGGER.info("Enter setStringValue " + stringValue);
cell.setCellType(CellType.STRING);
cell.setCellValue(stringValue);
LOGGER.info("Exit getStringValue ");
}
public void setFormat(String format)
{
LOGGER.info("Enter setFormat " + format);
if (format == null)
return;
CellStyle cellStyle = wb.createCellStyle();
DataFormat dataFormat = wb.createDataFormat();
CellStyle currentCellStyle = cell.getCellStyle();
if (cellStyle != null)
{
cellStyle.cloneStyleFrom(currentCellStyle);
}
cellStyle.setDataFormat(dataFormat.getFormat(format));
cell.setCellStyle(cellStyle);
LOGGER.info("Exit setFormat ");
}
We are not doing any customization in poi code.
why calling any of this poi functions for 1000 rows causing the issue.When i
reduce the row count to 200 or 300 issue resolves.
That will have only poi methods setcelltype and setcellvalue
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
PJ Fanning <fa...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |RESOLVED
Resolution|--- |INFORMATIONPROVIDED
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #2 from Rakhi Barayanan <ra...@gmail.com> ---
Hi Fanning,
Thanks for your quick response.This work around is in poi code.We are not doing
customization in poi code.Is there a way to resolve this outside of poi code.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Rakhi Barayanan <ra...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INFORMATIONPROVIDED |---
--- Comment #6 from Rakhi Barayanan <ra...@gmail.com> ---
Hi Dominik,
Thanks for helping me with that.But the issue is still existing.
I have to create 9 sheets of data and if I am creating only 100 rows in each
sheet ,all the 9 sheets in workbook get generated.But I create 1000 rows in
each sheet ,out of 9 only 7 sheets are generating.And if I generate 4500 rows
in each sheet only 3 sheets out of 9 is getting generated.
But now we are not seeing zip bomb detected issue in then log,after code change
that error goes off.But functionality is not completely working.
For 100 rows in sheet- It generated whole file(all 9 sheets).
For 1000 rows in sheet - It generated 7 sheets and exception for last 2 sheets
For 4500 rows in sheet - It generated 3 sheets and exception for last 6 sheets.
Could you throw some light on this.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #8 from Rakhi Barayanan <ra...@gmail.com> ---
Hi Dominik,
Issue is still the same.We are not able to generate the complete report.If the
number of rows are less its creating good.But as the row number increases it is
throwing error.Earlier the exception was zip bomb.Now issue still persist even
after setting ZipSecureFile.setMinInflateRatio().
Ony difference is we are not seeing Zipbomb exception from the logs.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Dominik Stadler <do...@gmx.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |INFORMATIONPROVIDED
--- Comment #7 from Dominik Stadler <do...@gmx.at> ---
Please don't continue discussing your specific implementation issue on
bug-reports.
I could not see any issue with POI here, it seems you just need to use the
static configuration-methods properly for your use-case.
As described before, there are public methods which allow to disable this check
if you need to, so if you call them properly, the check will not activate any
more.
If you need even more help with how to use these methods when using POI, please
ask on the mailing lists or Stackoverflow Questions.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #3 from Dominik Stadler <do...@gmx.at> ---
The error message tries to state how you can ignore this in your code if you
are sure the file is not malicious.
Please try the suggestion from the error-message and report back if that does
not work for you.
Related excerpt from the code showing the amount of information which should be
included in the error message:
private static final String MAX_ENTRY_SIZE_MSG =
"Zip bomb detected! The file would exceed the max size of the expanded
data in the zip-file.\n" +
"This may indicates that the file is used to inflate memory usage and
thus could pose a security risk.\n" +
"You can adjust this limit via ZipSecureFile.setMaxEntrySize() if you
need to work with files which are very large.\n" +
"Uncompressed size: %d, Raw/compressed size: %d\n" +
"Limits: MAX_ENTRY_SIZE: %d, Entry: %s";
private static final String MIN_INFLATE_RATIO_MSG =
"Zip bomb detected! The file would exceed the max. ratio of compressed
file size to the size of the expanded data.\n" +
"This may indicate that the file is used to inflate memory usage and
thus could pose a security risk.\n" +
"You can adjust this limit via ZipSecureFile.setMinInflateRatio() if
you need to work with files which exceed this limit.\n" +
"Uncompressed size: %d, Raw/compressed size: %d, ratio: %f\n" +
"Limits: MIN_INFLATE_RATIO: %f, Entry: %s";
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
PJ Fanning <fa...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
Status|NEW |NEEDINFO
Severity|critical |normal
Hardware|PC |All
--- Comment #1 from PJ Fanning <fa...@yahoo.com> ---
Is this what you are talking about?
https://stackoverflow.com/questions/44897500/using-apache-poi-zip-bomb-detected
The stackoverflow question has an answer.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Rakhi Barayanan <ra...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
OS|Mac OS X 10.1 |Windows Server 2012 R2
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Matafagafo <ma...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |matafagafo@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
Rakhi Barayanan <ra...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P1
Severity|normal |critical
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #9 from Dominik Stadler <do...@gmx.at> ---
Sounds like a different problem, please share details including error messages
and how you use Apache POI in a new issue. Ideally with a self-sufficient
code-sample which allows to reproduce the problem.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #5 from Dominik Stadler <do...@gmx.at> ---
They are public static methods which you can call whenever you use Apache POI
in your code.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 69705] ZIP BOMB DETECTED WHILE WORKING WITH apache poi 5.0.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69705
--- Comment #4 from Rakhi Barayanan <ra...@gmail.com> ---
Hi Dominik,
Thanks for the update.I hope Even ZipSecureFile.setMaxEntrySize() and
ZipSecureFile.setMinInflateRatio() should be set from the poi code,not from the
api we are consuming.Could you please let me know if any exposed functions are
there to call this methods from user side.
Regards,
Rakhi
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org