naruto-lgtm opened a new pull request, #1436: URL: https://github.com/apache/poi/pull/1436
Repro: `new DataFormatter().formatRawCellContents(1.5, -1, "[<" + "1".repeat(20_000))` takes about 15 s, and about 12 s again on every later call with the same format. The format string can come straight from styles.xml or an HSSF FORMAT record, and a 20 KB run of digits compresses to almost nothing inside an .xlsx, so one style applied to many cells makes text extraction take hours (a ReDoS, CWE-1333). Cause: in `rangeConditionalPattern` the constant `-?[0-9]*\.?[0-9]+` can split a run of digits between `[0-9]*` and `[0-9]+` in every possible way, so when the closing `]` is missing the regex retries each split. `getFormat` runs this `find()` before the format cache, so the cost is paid per cell, not per format. Fix: `-?(?:[0-9]*\.)?[0-9]+` accepts the same strings with only one way to match a digit run. I checked old and new patterns against each other over all 5.4M strings up to length 7 built from `[<>=1.- ]`, and they give identical matches and groups. | format length | before (1st / 2nd call) | after (1st / 2nd call) | |---|---|---| | 4,002 | 605 ms / 449 ms | 3 ms / 1 ms | | 20,002 | 15,552 ms / 12,306 ms | 38 ms / 12 ms | | 100,002 | not run | 69 ms / 55 ms | `testConditionalRangeWithLongNumber` times out after 10 s before the change and passes after. `TestDataFormatter`, the `ss` and `hssf.usermodel` suites, `TestDataFormatterAgainstExcel`, `TestCellFormatPart`, `TestXSSFDataFormat` and `:poi:forbiddenApis` pass. (`TestDateSerialRange.testEdgesOfTheRange` fails on trunk without this change too.) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
