pjfanning opened a new pull request, #1384: URL: https://github.com/apache/poi/pull/1384
`ZipArchiveThresholdInputStream.read()` ran the zip-bomb check after every single byte. Each check calls `getUncompressedCount()` and `getCompressedCount()` on the commons-compress stream; for deflated entries those go to the `Inflater`, whose methods take a lock, followed by a division. Anything that reads an OOXML part byte by byte paid for that on every byte. (#1371 already buffered the VML drawing reader and stopped the check building the entry name.) Now: - **Single-byte `read()`** checks once every 1024 bytes, and once more before it returns -1 if any bytes since the last check are unchecked. So a caller always gets the exception before it sees the end of the entry. - **Bulk `read(byte[], int, int)` and `skip`** still check on every call. - The counter is reset on `getNextEntry()`. The only loosening: a caller using single-byte reads can get at most 1 KB past a limit before the exception is thrown. That's negligible next to the limits themselves (100 KB grace size, 4 GB default max entry size). New tests in `TestZipSecureFile`: - Single-byte reads of a 1 MB entry of zeros still fail the inflate-ratio check. - A 300-byte entry with the max entry size set to 200, which is shorter than the check interval, fails before the end of the entry is reported. The openxml4j, `TestXSSFFileChecks`, secure temp zip and VML drawing tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
