CODEWITHSUNDEEP
javaexcelapache-poi
mykola
mykola

Reputation: 1808

Apache POI creates xlsx file which it can't open later. Zip bomb detected

When I create xlsx file with Apache POI sometimes (when the file is big) it creates such a file that can't be opened by this same Apache POI while MS Excel or LibreOffice Calc open it without problems.

When I try to open this workbook with Apache POI it says that

Zip bomb detected

I can open it only if I call ZipSecureFile.setMinInflateRatio(0) or resave it in LibreOffice (MS Excel doesn't help here).

How to fix this? Why POI creates file which it can't open?

Upvotes: 0

Views: 2966

Answers (1)

centic
centic

Reputation: 15882

Simply do as the error message suggests and set the limits differently via

ZipSecureFile.setMinInflateRatio(0)

You seem to have a rather special use-case which produces a file that is similar to some files that malicious users could use to make your server crash, use up CPU or go out of memory. To avoid this, Apache POI has this limit, but allows to set it differently if needed. So if the file is not coming from untrusted users, you can easily adjust these limits to avoid the error message.

Excel or LibreOffice might optimize the file-content more than Apache POI does and thus produce a file that does not reach these limits.

Upvotes: 3

Related Questions