pjfanning opened a new pull request, #1474: URL: https://github.com/apache/poi/pull/1474
Follow-up to #1465. #1465 made `AgileDecryptor.getDataStream` throw when the DataIntegrity HMAC doesn't match. That check stays on by default. This PR adds a way to read such a file anyway: - `AgileDecryptor.setFailOnIntegrityError(false)` (and `isFailOnIntegrityError()`) logs a warning and decrypts the package instead of throwing. This follows the static `AgileEncryptionVerifier.setMaxSpinCount` pattern. - Why: I made a POI-encrypted `.xlsx` whose ciphertext is intact but whose `encryptedHmacValue` is altered. Excel for the web flags it but still opens it in read-only mode; the same file with the correct HMAC opens for editing. Read-only consumers such as text extraction should be able to get the content too. - The exception message now names the setting. `getDataStream` documents the `EncryptedDocumentException` it can throw, and the "password needs to be verified" message now says "verified successfully", since it also appears after a failed `verifyPassword`. - New test `testTamperedHmacValue`: with only the HMAC value altered, decryption fails by default and returns the original bytes once the check is turned off. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
