pjfanning opened a new pull request, #1230: URL: https://github.com/apache/poi/pull/1230
Defensive hardening spotted during a review of the XWPF write path. `XWPFRun.addChart(String chartRelId)` builds the inline-drawing XML by concatenating `chartRelId` directly into the `r:id` attribute value, then parses the result: ```java "... r:id=\"" + chartRelId + "\" />" ... ``` A relationship id is an `xsd:ID` and cannot legitimately contain `"`/`<`/`&`, and this method is `@Internal` with the id generated by POI (`XWPFChart.attach` → `createChart`), so **this is not reachable from an untrusted document**. But a malformed or hostile id would break out of the attribute — corrupting the fragment or throwing `IllegalStateException` on parse. Escaping `&`, `<`, and `"` in the value closes that off. Added `TestXWPFRun.addChartEscapesRelationshipId`, which fails before this change (the crafted id throws) and passes after; it also checks a normal id still round-trips. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
