moestika commented on issue #1447: URL: https://github.com/apache/poi/issues/1447#issuecomment-6283230900
Thank you very much @pjfanning and @dave2wave for taking the time to investigate and trace this back to the OSS-Fuzz report and Sonatype guide. This explanation provides tremendous clarity. We completely understand and agree with your point regarding application-level defense; in our application, we already enforce strict pre-parsing controls (whitelisting `.xlsx` only, validating magic bytes via Apache Tika, and path canonicalization) and we do not invoke arbitrary dynamic formula evaluations on user uploads. Knowing that this originates from an OSS-Fuzz formula evaluation report and that fixes are already included in the newly built **POI 6.0.0 RC1** gives us the exact technical justification needed to approve an internal policy waiver with our enterprise security team while we await the official 6.0.0 release on Maven Central. Thank you again for your transparency, support, and hard work in preparing the 6.0.0 release! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
