naruto-lgtm opened a new pull request, #1478: URL: https://github.com/apache/poi/pull/1478
Repro: an .xlsx whose `sheetProtection`/`workbookProtection` carries `spinCount="2147483647"`, or a .docx whose `w:documentProtection` carries the same `w:cryptSpinCount`, makes `validateSheetPassword` / `validateWorkbookPassword` / `validateRevisionsPassword` / `XWPFDocument.validateProtectionPassword` run 2^31 hash rounds. That is roughly 40 minutes of CPU per call at the ~1.1 us per SHA-512 round I measured, against ~0.1 s for Excel's default of 100,000. Cause: `XSSFPasswordHelper.validatePassword` and `XWPFSettings.validateProtectionPassword` hand the document's spin count straight to `CryptoFunctions.hashPassword`. #1084 bounded the same value on the agile decryption path, but these two validators were not covered. Fix: apply the same `AgileEncryptionVerifier.getMaxSpinCount()` bound and `EncryptedDocumentException` in both validators, so a single limit covers every password hash POI derives from document input. Spin counts within the limit (default 1,000,000, 10x Office's default) behave as before. I chose to throw instead of returning false so that an over-limit file isn't misreported as a wrong password. The new tests in `TestXSSFSheet` and `TestDocumentProtection` set the count one above the limit and fail without the change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
