You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by "jmestwa-coder (via GitHub)" <gi...@apache.org> on 2026/05/05 15:28:17 UTC
[PR] Enforce max entry size consistently for streaming ZIP entries [poi]
jmestwa-coder opened a new pull request, #1055:
URL: https://github.com/apache/poi/pull/1055
### Summary
Enforce `maxEntrySize` consistently for ZIP entries processed via streaming, including when the entry size is unknown.
---
### Changes
- Add fail-fast validation for known-size entries.
- Replace size-limited copy with explicit bounded streaming:
- Track bytes read.
- Throw `RecordFormatException` when the limit is exceeded.
- Apply the same enforcement to temp-file paths.
---
### Test
- Adds a deterministic test for an unknown-size entry exceeding the limit.
- Fails on previous behavior, passes with this change.
---
### Notes
- Tightens validation; oversized entries are now rejected earlier.
- Scope limited to `ZipArchiveFakeEntry`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] Enforce max entry size consistently for streaming ZIP entries [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1055:
URL: https://github.com/apache/poi/pull/1055#issuecomment-4380999060
LGTM.
I don't like the use of RecordFormatException here but it is consistent with some existing IOUtil code.
I might follow up and rework the exception type.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] Enforce max entry size consistently for streaming ZIP entries [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning merged PR #1055:
URL: https://github.com/apache/poi/pull/1055
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
Re: [PR] Enforce max entry size consistently for streaming ZIP entries [poi]
Posted by "pjfanning (via GitHub)" <gi...@apache.org>.
pjfanning commented on PR #1055:
URL: https://github.com/apache/poi/pull/1055#issuecomment-4381195099
I reverted this. I had a look again and I don't think this is needed. The whole point of ZipInputStreamZipEntrySource.getThresholdBytesForTempFiles() is that users can opt in to protecting memory by using temp files.
The MaxEntrySize is a way to protect memory usage and the code you modified is using temp files so we don't need the check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org