Limits: MIN_INFLATE_RATIO: 0.010000, Entry: xl/pivotCache/pivotCacheRecords2.xml(POI安全-压缩炸弹)

已于 2024-01-11 11:41:53 修改
阅读量780 收藏 7
点赞数 9
文章标签： xml 安全 java excel
于 2024-01-11 11:38:45 首次发布
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/LCJ0018/article/details/135523007
版权

报错信息：

java.io.IOException: Zip bomb detected! The file would exceed the max. ratio of compressed file size to the size of the expanded data.
This may indicate that the file is used to inflate memory usage and thus could pose a security risk.
You can adjust this limit via ZipSecureFile.setMinInflateRatio() if you need to work with files which exceed this limit.
Uncompressed size: 526559, Raw/compressed size: 5248, ratio: 0.009967
Limits: MIN_INFLATE_RATIO: 0.010000, Entry: xl/pivotCache/pivotCacheRecords2.xml
        at org.apache.poi.openxml4j.util.ZipArchiveThresholdInputStream.checkThreshold(ZipArchiveThresholdInputStream.java:132)
        at org.apache.poi.openxml4j.util.ZipArchiveThresholdInputStream.read(ZipArchiveThresholdInputStream.java:82)
        at org.apache.poi.util.IOUtils.toByteArray(IOUtils.java:182)
        at org.apache.poi.util.IOUtils.toByteArray(IOUtils.java:149)
        at org.apache.poi.openxml4j.util.ZipArchiveFakeEntry.<init>(ZipArchiveFakeEntry.java:47)
        at org.apache.poi.openxml4j.util.ZipInputStreamZipEntrySource.<init>(ZipInputStreamZipEntrySource.java:53)
        at org.apache.poi.openxml4j.opc.ZipPackage.<init>(ZipPackage.java:106)
        at org.apache.poi.openxml4j.opc.OPCPackage.open(OPCPackage.java:307)
        at org.apache.poi.ooxml.util.PackageHelper.open(PackageHelper.java:47)
        at org.apache.poi.xssf.usermodel.XSSFWorkbook.<init>(XSSFWorkbook.java:309)
        at com.mes.common.core.utils.poi.ExcelUtil.getWorkbok(ExcelUtil.java:961)
        at com.mes.file.service.impl.Dxbt0033ServiceImpl.writeExcel(Dxbt0033ServiceImpl.java:47)
        at com.mes.file.service.impl.Dxbt0033ServiceImpl.synchronousExcel(Dxbt0033ServiceImpl.java:34)
        at com.mes.file.controller.Dxbt0033Controller.synchronousExcel(Dxbt0033Controller.java:37)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
        at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150)
        at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895)
        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808)
        at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:665)
        at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:750)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:96)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:382)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:895)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1722)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:748)

在...poi.jar包中，找到ZipSecureFile类，如图：（也可以直接搜索这个类ZipSecureFile）

ZipSecureFile部分代码展示：

报错的原因：上传的文件的压缩已经低于默认的阈值：0.01

在报错代码上一行加上，问题得以解决（阅读报错信息，发现 ratio: 0.009949，而Limits: MIN_INFLATE_RATIO: 0.010000

处理方式：在读取文件前，将这个阈值重新设值，代码如下：

ZipSecureFile.setMinInflateRatio(0.001);
//XSSFWorkbook workbook = new XSSFWorkbook("url"); 或者
Workbook workBook = ExcelUtil.getWorkbok(finalXlsxFile);
// 代表将接受所有可能的比率
// ZipSecureFile.setMinInflateRatio(-1.0d)
// ZipSecureFile.setMinInflateRatio(0)
Junkii
关注
Ubuntu中ssh远程报错:packet_write_wait: Connection to 192.168.163.190 port 22: Broken pipe lost connection
qq_40907977的博客
11-10 3284
ssh远程报错 ：packet_write_wait: Connection to 192.168.163.190 port 22: Broken pipe lost connection 网上常见问题解决版本 ： 1、 用 ssh 命令连接服务器之后，如果一段时间不操作，再次进入时会有一段时间没有响应，然后就出现错误提示：Write failed: Broken pipe 只能重新用 ssh ...
XAI/ML：机器学习模型可解释性之量化特征贡献度(特征重要性)的函数详解(feature_importances_/plot_partial_dependence/permutation_impor
近期请国内外头部出版社可尽快私信博主！——心比天高，仗剑走天涯，保持热爱，奔赴向梦想！低调，谦虚，自律，反思，成长，还算是比较正能量的博主，公益免费传播……内心特别想在AI界做出一些可以推进历史进程影响力的东西(兴趣使然，有点小情怀，也有点使命感呀)…
05-29 3653
​ XAI/ML：机器学习模型可解释性之量化特征贡献度(特征重要性)的函数详解(feature_importances_/plot_partial_dependence/permutation_importance) 目录 1、feature_importances_函数 2、plot_partial_dependence函数 3、permutation_importance函数 1、feature_importances_函数 简单来说，每个特征对于提升整个模型的预测能力的贡献
导入报错：Limits: MIN_INFLATE_RATIO: 0.010000, Entry: xl/drawings/drawing1.xml
6个日的博客
05-23 1733
与此同时，我觉得，以前并没有遇到这样的问题啊，这文件也不大，在看看文件里面的Sheet2,Sheet3都是空白的，也会进入压缩，抱着试一试的心态，就去掉多余模板的sheet2,sheet3,也不是道复制哪边的，太不认真了，再次执行原来的代码。只有sheet1有使用，是导入的文件内容，Sheet2,Sheet3是空白，也没有使用，下载模板不知道为什么要下载下来。这时候只能定位是模板中Sheet2,sheet3格式有问题，最终的解决方案也是调整模板，但是了解了一个压缩爆炸的思想，还是挺有意思的。
poi读取excel报错：Zip bomb detected! The file would exceed the max
adions0819的博客
08-10 2628
POI导出导入场景遇到的问题。
Limits: MIN_INFLATE_RATIO: 0.010000, Entry: word/media/image5.png
我的博客
08-26 1013
主要原因是文件太大，解决办法增加如下代码。
easyexcel 读取Excel报错：Limits: MIN_INFLATE_RATIO: 0.010000, Entry: xl/styles.xml
离风的博客
04-03 2107
Limits: MIN_INFLATE_RATIO: 0.010000, Entry: xl/styles.xml 在报错代码上一行加上，问题得以解决（阅读报错信息，发现 ratio: 0.009949，而Limits: MIN_INFLATE_RATIO: 0.010000。
Java 读取 Excel 报错
Minh-X
06-10 1535
Caused by: java.io.IOException: Zip bomb detected! The file would exceed the max. ratio of compressed file size to the size of the expanded data. This may indicate that the file is used to inflate memory usage and thus could pose a security risk. You can a
Zip bomb detected! The file would exceed the max. ratio of compressed file size to the size
zcxbd的博客
04-24 417
【代码】Zip bomb detected!
/usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libmysqlclient.a(libmysql.c.o): In function
热门推荐
迷雾江湖 的博客
12-07 1万+
在CentOS系统中编译mysql程序，出现这种错误：  usr/lib/gcc/x86_64-redhat-linux/4.8.5/../../../../lib64/libmysqlclient.a(libmysql.c.o): In function `fetch_float_with_conversion': (.text+0x7ce): undefined reference
/etc/security/limits.d/90-nproc.conf
zhuxuerong的博客
11-29 2028
/etc/security/limits.d/90-nproc.conf 与 /etc/security/limits.conf 都是系统用户资源配置文件 /etc/security/limits.d/90-nproc.conf 配置文件： [root@ ~]# cat /etc/security/limits.d/90-nproc.conf # Default limit for number ...
使用 run-java.sh 运行 Java 应用
成富的专栏
11-11 4158
当需要运行Java应用时，不管在机器上还是容器里，一般的做法是运行java命令。一些 Java 应用会被打包成单个可执行的 JAR 文件，如 Spring Boot 应用。对于这样的 ...
使用 Apache POI - 检测到 Zip Bomb
最新发布
由入门到精通
07-02 289
压缩文件大小与展开数据大小的比率。这可能表示该文件用于膨胀内存使用，因此可能会造成安全风险。如果需要处理超过此限制的文件，则可以通过ZipSecureFile.setMinInflateRatio()调整此限制。计数器: 820224，cis.counter: 8192，比率:0.009987515605493134限制: MIN_INFLATE_RATIO: 0.01。
java导出到excel工具类
qq_39205291的博客
12-12 868
直接上代码，解释下参数，str1的格式为"姓名=年龄=分数"       list的格式为List注意:你如果想拿过去直接用工具类这里的集合必须放object[]数组 str1 是你的excel 的列名代表有三列   ：姓名、年龄、分数 list为一行的数据，用object[]装载   ，比如我有 小米    5   90分    就用一个object  数组把这三个装进去  然后加入list
java.io.IOException: Zip bomb detected! The file would exceed the max.
专研技术结交志同道合的朋友
08-26 224
解决办法： 添加一行代码即可 ZipSecureFile.setMinInflateRatio(-1.0d); 参考： FileInputStream file = new FileInputStream("D:\\newData.xlsx"); ZipSecureFile.setMinInflateRatio(-1.0d); XSSFWorkbook wb = new XSSFWork...
解决JAVA导出大数据的EXCEL文件
riapgypm的专栏
10-29 1万+
在工作中遇到了要导出30多万条数据的excel文件，写了一个工具类。如下： import java.beans.BeanInfo; import java.beans.IntrospectionException; import java.beans.Introspector; import java.beans.PropertyDescriptor; import java.io.File;
JAVA 导入 Excel 报错如下: java.io.IOException: Failed to read zip entry source ...java.io.IOException: Fai
weixin_43996311的博客
03-11 5940
JAVA 导入 Excel 报错如下: java.io.IOException: Failed to read zip entry source …java.io.IOException: Failed to read zip entry source! … 代码报错如下如下： java.io.IOException: Failed to read zip entry source at org...
Failed to read zip entry source
xcc_2269861428的博客
02-25 6917
java.io.IOException: Failed to read zip entry source at org.apache.poi.openxml4j.opc.ZipPackage.<init>(ZipPackage.java:103) at org.apache.poi.openxml4j.opc.OPCPackage.open(OPCPackage.java:324) at org.apache.poi.util.PackageHelper.open(PackageHelp.
java.io.IOException: Zip archive '*****.apk' doesn't contain classes.dex
potatomagic的博客
11-09 1174
运行时点击出现崩溃， 查看Logcat 发现是 RuntimeException 异常， 然后是 ClassNotFoundException 异常， 最根本的原因是 IOException 意思是解压apk的时候，找不到dex文件，确实是一个很奇怪的错误，然后去看apk所在的目录，发现还会有一个目录，目录里面存放这.odex文件。 普及一下 dex 与 odex 的区别： dex: 正常的
给下列程序添加注释： void DWAPlannerROS::reconfigureCB(DWAPlannerConfig &config, uint32_t level) { if (setup_ && config.restore_defaults) { config = default_config_; config.restore_defaults = false; } if ( ! setup_) { default_config_ = config; setup_ = true; } // update generic local planner params base_local_planner::LocalPlannerLimits limits; limits.max_vel_trans = config.max_vel_trans; limits.min_vel_trans = config.min_vel_trans; limits.max_vel_x = config.max_vel_x; limits.min_vel_x = config.min_vel_x; limits.max_vel_y = config.max_vel_y; limits.min_vel_y = config.min_vel_y; limits.max_vel_theta = config.max_vel_theta; limits.min_vel_theta = config.min_vel_theta; limits.acc_lim_x = config.acc_lim_x; limits.acc_lim_y = config.acc_lim_y; limits.acc_lim_theta = config.acc_lim_theta; limits.acc_lim_trans = config.acc_lim_trans; limits.xy_goal_tolerance = config.xy_goal_tolerance; limits.yaw_goal_tolerance = config.yaw_goal_tolerance; limits.prune_plan = config.prune_plan; limits.trans_stopped_vel = config.trans_stopped_vel; limits.theta_stopped_vel = config.theta_stopped_vel; planner_util_.reconfigureCB(limits, config.restore_defaults); // update dwa specific configuration dp_->reconfigure(config); }
06-12
/** * @brief Callback function for dynamic reconfiguration of DWA planner parameters * * @param config Reference to the configuration object that stores the updated parameters * @param level The level of reconfiguration, unused in this function */ void DWAPlannerROS::reconfigureCB(DWAPlannerConfig &config, uint32_t level) { // If the setup has been completed and restore_defaults flag is set, restore default configuration if (setup_ && config.restore_defaults) { config = default_config_; config.restore_defaults = false; } // If setup has not been completed, store default configuration and set the setup flag to true if ( ! setup_) { default_config_ = config; setup_ = true; } // Update generic local planner parameters base_local_planner::LocalPlannerLimits limits; limits.max_vel_trans = config.max_vel_trans; limits.min_vel_trans = config.min_vel_trans; limits.max_vel_x = config.max_vel_x; limits.min_vel_x = config.min_vel_x; limits.max_vel_y = config.max_vel_y; limits.min_vel_y = config.min_vel_y; limits.max_vel_theta = config.max_vel_theta; limits.min_vel_theta = config.min_vel_theta; limits.acc_lim_x = config.acc_lim_x; limits.acc_lim_y = config.acc_lim_y; limits.acc_lim_theta = config.acc_lim_theta; limits.acc_lim_trans = config.acc_lim_trans; limits.xy_goal_tolerance = config.xy_goal_tolerance; limits.yaw_goal_tolerance = config.yaw_goal_tolerance; limits.prune_plan = config.prune_plan; limits.trans_stopped_vel = config.trans_stopped_vel; limits.theta_stopped_vel = config.theta_stopped_vel; // Call reconfigureCB function of the planner_util_ object with updated limits and restore_defaults flag planner_util_.reconfigureCB(limits, config.restore_defaults); // Call reconfigure function of the dp_ object with updated configuration dp_->reconfigure(config); }
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值