Please open a new bugzilla entry if you find something - of course you can reference #59738 in the text. If POI 3.10.1 is fine for you and you don't use POI to parse arbitrary files, then go for it. Since POI 3.10.1 there were some CVEs - so depending on your usecase, it might be safer to use a current version.
It's been a while that I've deployed on an application server and I don't know how it reacts on shaded jars, but maybe you can specify the classloading strategy to "parent last". Also try to include a current xerces parser. On 03.02.20 23:40, Kuro Kurosaka wrote: > I've read this issue > https://bz.apache.org/bugzilla/show_bug.cgi?id=59738 > which suggests version 3.10.1 works. And I tried this version and the > problem is gone! > > Should I re-open this issue, if I can find a way to reproduce it? > > On Mon, Feb 3, 2020 at 1:39 PM Kuro Kurosaka <[email protected]> > wrote: > >> OLE2 is a Windows file format, isn't it? I'm on Mac/Linux, and even if the >> validator exists and runs for .xlsx, I can't run it. (I'm assuming it's an >> .exe file.) >> The link to the article is broken also. >> >> I'll try to find if there's any code closer to validator in POI source. >> >> Thank you for mentioning .xsb files. They exist in the shaded jar but they >> weren't relocated. And if I did relocate them, I'm guessing there would be >> lots of file-not-found exceptions. I temporarily stopped relocation. But >> that didn't improve the situation. >> >> On Mon, Feb 3, 2020 at 12:55 PM Andreas Beeker <[email protected]> >> wrote: >> >>> We have two entries in the FAQ [1] about file validation, which I haven't >>> used myself yet ... and probably are futile in your case. >>> You can try to validate against the ECMA 376 schemes. >>> >>> If I have similar problems I try to go step-wise from the simple case to >>> the complex ... >>> and yes, it's sometimes quite time consuming. >>> >>> Can you try your shaded jar in the unit test? ... my guess is, it might >>> not include all XmlBeans files (*.xsb) >>> >>> [1] https://poi.apache.org/help/faq.html >>> >>> On 03.02.20 21:25, Kuro Kurosaka wrote: >>>> The .xlsx file from the test run has the same file structure as the >>> .xlsx >>>> from the real run that doesn't open. >>>> The JAR I upload to an application server is shaded and includes the POI >>>> library that is relocated to its version >>>> specific packages to avoid collision. So it's the same version of POI as >>>> the test run. >>>> >>>> If there is no better way, I could somehow record all POI calls in the >>> real >>>> run, and ptu it to the unit test, >>>> but I'd rather want to avoid this route as it is very time consuming. I >>> am >>>> hoping there's a way for >>>> Excel to tell me what errors it is seeing. >>> >>> >> -- >> T. Kuro Kurosaka, Software Engineer, Spartan Software Inc. >> >>
signature.asc
Description: OpenPGP digital signature
