Add possibility to configure Apache POI

NAMESPACE

@@ -92,6 +92,7 @@ export(
 	aref,
 	aref2idx,
 	col2idx,
+	configurePOI,
 	cref2idx,
 	extractSheetName,
 	idx2aref,

NEWS

@@ -1,6 +1,9 @@
 XLConnect News
 --------------
 
+1.x.x 2025-??-??
+  * Add possibility to configure Apache POI through configurePOI
+
 1.2.0 2025-02-17
   * Fix #225 (loading simple logging context factory)
   * Upgrade POI to 5.4.0

R/XLConnectSettings.R

@@ -46,6 +46,9 @@ XLConnectSettings <- function(pdesc) {
 	options(XLConnect.RownameCol = ".rownames")
 
 	options(XLConnect.setCustomAttributes = FALSE)
+
+	# Apply default POI configuration
+	configurePOI()
 
 	invisible()
 }

R/configurePOI.R

@@ -0,0 +1,47 @@
+#############################################################################
+#
+# XLConnect
+# Copyright (C) 2010-2024 Mirai Solutions GmbH
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+#
+#############################################################################
+
+#############################################################################
+#
+# Configures Apache POI and related components.
+# See https://poi.apache.org/components/configuration.html
+# 
+# Author: Martin Studer, Mirai Solutions GmbH
+#
+#############################################################################
+
+configurePOI <- function(
+    zip_max_files = 1000L,
+    zip_min_inflate_ratio = 0.001,
+    zip_max_entry_size = 0xFFFFFFFF,
+    zip_max_text_size = 10*1024*1024,
+    max_size_byte_array = -1L
+) {
+  ioutils <- J("org.apache.poi.util.IOUtils")
+  ioutils$setByteArrayMaxOverride(as.integer(max_size_byte_array))
+
+  zip <- J("org.apache.poi.openxml4j.util.ZipSecureFile")
+  zip$setMaxFileCount(rJava::.jlong(zip_max_files))
+  zip$setMinInflateRatio(zip_min_inflate_ratio)
+  zip$setMaxEntrySize(rJava::.jlong(zip_max_entry_size))
+  zip$setMaxTextSize(rJava::.jlong(zip_max_text_size))
+
+  invisible()
+}

man/configurePOI.Rd

@@ -0,0 +1,51 @@
+\name{configurePOI}
+\alias{configurePOI}
+\title{
+Configuring Apache POI
+}
+\description{
+Configures Apache POI and related components.
+}
+\usage{
+configurePOI(zip_max_files = 1000L, zip_min_inflate_ratio = 0.001,
+  zip_max_entry_size = 0xFFFFFFFF, zip_max_text_size = 10*1024*1024,
+  max_size_byte_array = -1L)
+}
+\arguments{
+  \item{zip_max_files}{Integer scalar specifying the maximum number of files
+  allowed inside an *.xlsx file. Defaults to \code{1000}.}
+  \item{zip_min_inflate_ratio}{Numeric scalar specifying the ratio between
+  de- and inflated bytes to detect zip-bombs. If the compression ratio is
+  better than the specified number an error will be thrown. Defaults to
+  \code{0.001}.}
+  \item{zip_max_entry_size}{Integer scalar specifying the maximum file size
+  of a single zip entry in an *.xlsx file. Defaults to 4'294'967'295 bytes,
+  which is 4GB.}
+  \item{zip_max_text_size}{Integer scalar specifying the maximum number of
+  characters of text that are extracted before an error is thrown. Defaults
+  to 10'485'760.}
+  \item{max_size_byte_array}{Integer scalar specifying the maximum number of
+  bytes that should be possible to be allocated in a single step. Increasing
+  this limit can help if you are dealing with large Excel files, but note that
+  this may demand a larger heap space (see option \code{java.parameters}; e.g.
+  \code{options(java.parameters = "-Xmx8192m")}. Defaults to -1, which means
+  that record-specific limits apply.)}
+}
+\details{
+Many of the settings exposed here exist for security reasons to prevent excessive
+memory consumption and protect against security vulnerabilities when processing
+documents provided by untrusted sources.
+}
+\references{
+Apache POI configuration: \url{https://poi.apache.org/components/configuration.html} 
+}
+\author{
+Martin Studer\cr
+Mirai Solutions GmbH \url{https://mirai-solutions.ch}
+}
+\examples{
+\dontrun{
+configurePOI(zip_max_files = 5000L, max_size_byte_array = 250000000L)
+}
+}
+\keyword{IO}