Announcement

Collapse
No announcement yet.
X
Collapse
  • Page of 1
  • Filter
  • Time
Clear All
new posts
Previous template Next
    #1

    Apache POI compatibility 3.17 vs 4

    Hello,
    we just updated some of our system dependencies, specifically we went from POI 3.17 to POI 4 and the Excel export function is now broken.
    We have the stacktrace you can see below.


    Is support for POI 4 in your roadmap?
    And if so, what is the timeline for it.


    Thank you :)


    "java.lang.NoSuchMethodError: org.apache.poi.ss.usermodel.Row.createCell(II)Lorg/apache/poi/ss/usermodel/Cell;"
    " at com.isomorphic.rpc.ExcelDataExport.getExportObject(ExcelDataExport.java:757)"
    " at com.isomorphic.rpc.DataExport.exportResultSet(DataExport.java:654)"
    " at com.isomorphic.rpc.DataExport.exportResultSet(DataExport.java:453)"
    " at com.isomorphic.rpc.BuiltinRPC.downloadClientExport(BuiltinRPC.java:1243)"
    " at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)"
    " at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)"
    " at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)"
    " at java.lang.reflect.Method.invoke(Method.java:498)"
    " at com.isomorphic.base.Reflection._invokeMethod(Reflection.java:581)"
    " at com.isomorphic.base.Reflection.adaptArgsAndInvoke(Reflection.java:896)"
    " at com.isomorphic.base.Reflection.adaptArgsAndInvoke(Reflection.java:726)"
    " at com.isomorphic.rpc.RPCDMI.execute(RPCDMI.java:330)"
    " at com.isomorphic.rpc.RPCDMI.execute(RPCDMI.java:67)"
    " at com.isomorphic.rpc.RPCRequest.execute(RPCRequest.java:274)"
    " at com.pci.portal.server.DataSourceResolver.handleRPCRequest(DataSourceResolver.java:182)"
    " at com.isomorphic.servlet.IDACall.processRPCTransaction(IDACall.java:180)"
    " at com.isomorphic.servlet.IDACall.processRequest(IDACall.java:148)"
    " at com.isomorphic.servlet.IDACall._processRequest(IDACall.java:119)"
    " at com.isomorphic.servlet.IDACall.doPost(IDACall.java:79)"
    " at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)"
    Tags: None
    #2
    It's not currently in the roadmap, and looks like the POI guys chose not to provide backward compatibility.

    Why did you update? Were you also using POI directly and needed a new feature, or was it just a "latest and greatest" kind of thing?

    Note: you can use Feature Sponsorship as a means of getting support on your timetable, if you need it.

    Comment

      #3
      POI 3.17 has a series of security issues that are a concern for us and our customers.

      The update of POI is necessary for security reasons.


      Here the vulnerability concerning us:
      https://nvd.nist.gov/vuln/detail/CVE-2019-12415


      And a bit more reasons to update POI:
      https://www.cvedetails.com/vulnerabi...pache-POI.html

      Comment

        #4
        The first vulnerability is related to parsing Excel docs, which we do not do:

        In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
        All of the other ones are too. We use POI only to generate documents and never to parse, so none of these apply.

        However, we definitely understand that sometimes a customer sees an irrelevant vulnerability and just cannot be made to understand that it doesn't apply! You could use some of your booked consulting time to have us estimate the effort, and use Feature Sponsorship to get it done (at 2 for 1 hour usage).

        Comment

          #5
          By the way, another approach, if you end up desperate for a fix on an older version: just remove the classes with the vulnerabilities. We don't reference them, so this should work.

          Comment

            #6
            Thank you for the precise response and the workaround, I will pass that up the chain

            Comment

            Previous template Next
            Working...
            X