pjfanning opened a new pull request, #1252: URL: https://github.com/apache/poi/pull/1252
`AesZipFileZipEntrySource.getInputStream` opens the entry's stream first and then builds the decryption cipher: ```java InputStream is = zipFile.getInputStream(entry); return new CipherInputStream(is, getCipher(Cipher.DECRYPT_MODE)); ``` `getCipher` delegates to `CryptoFunctions.getCipher`, which throws `EncryptedDocumentException` when the JCE cannot supply the cipher. That happens after the entry stream is already open and before anything has taken ownership of it, so the stream leaks. ### Fix Swap the order — build the cipher first, and open the entry only once that is known to have succeeded. No try/catch needed. `EncryptedTempData.getInputStream` already uses this ordering. No public signatures change, so there is nothing for MiMa to check. `TestSecureTempZip`, `TestEncryptedTempZipThreshold` and `TestSXSSFWorkbookWithCustomZipEntrySource` pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
