pjfanning opened a new pull request, #1231: URL: https://github.com/apache/poi/pull/1231
A consistency/defense-in-depth follow-up from a review of the OOXML parsing paths. Nearly every `*.Factory.parse(...)` on an untrusted document part in POI passes `POIXMLTypeLoader.DEFAULT_XML_OPTIONS`, which sets `setDisallowDocTypeDeclaration(true)` and `setEntityExpansionLimit(1)`. Seven parse sites did not: - `xslf/usermodel/XSLFDiagramDrawing` (SmartArt drawing part) - `xslf/usermodel/XSLFTableStyles` (table styles part) - `xdgf/usermodel/XmlVisioDocument` (Visio document part) - `xdgf/usermodel/XDGFMasters`, `XDGFMasterContents`, `XDGFPageContents`, `XDGFPages` This routes those parses through `DEFAULT_XML_OPTIONS` too. ### Not an XXE fix — defense-in-depth for consistency xmlbeans 5.x already blocks external-entity resolution by default (its default loader installs an empty-`InputSource` entity resolver and enables secure processing — the CVE-2021-23926 hardening), so these sites were **not** exposed to external-entity XXE (local file read / SSRF). This change disallows DOCTYPE declarations and tightens the internal entity-expansion bound on these parts so they match every other OOXML parse in POI. No behaviour change for valid documents; the existing xdgf/xslf tests (`TestXmlVisioDocument`, `TestXDGFVisioExtractor`, `TestXSLFDiagram`, `TestXSLFTableStyles`) still pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
