alaahong opened a new pull request, #959: URL: https://github.com/apache/fesod/pull/959
<!-- Thanks very much for contributing to Apache Fesod (Incubating)! Please make sure that your code changes are covered with tests. And in case of new features or big changes remember to adjust the documentation. Feel free to ping committers for the review! In case of an existing issue, reference it using one of the following: Closed: #ISSUE Related: #ISSUE --> ## Purpose of the pull request The refactor in 7fe23f0 added a finally block in WorkBookUtil.createWorkBook() that clears the Biff8EncryptionKey ThreadLocal immediately after setting it. However, workbook.write() (which applies BIFF8 encryption) runs later in WriteContextImpl.finish(). At that point the password is already null, so the file content is never encrypted - only a write-protection flag is set. Below two files, XLSX can protect the content, but xls only provide write permission protection. [sample-xls-password-buggy.xls](https://github.com/user-attachments/files/30159464/sample-xls-password-buggy.xls) <img width="149" height="96" alt="image" src="https://github.com/user-attachments/assets/1fba1a95-67a6-42b9-a153-3c639512b07b"; /> [sample-xlsx-password-encrypted.xlsx](https://github.com/user-attachments/files/30159465/sample-xlsx-password-encrypted.xlsx) <img width="159" height="83" alt="image" src="https://github.com/user-attachments/assets/53d04ab3-b661-4b07-9867-f3df06facc39"; /> Since code fixed, it also protect the content as below <img width="155" height="84" alt="image" src="https://github.com/user-attachments/assets/c0bbf3c6-dca4-4f3d-a016-df9435feba67"; /> ## What's changed? Fix: Remove the premature clearing. The password is correctly cleared by WriteContextImpl.clearEncrypt03() after workbook.write() completes. Tests: - Update WorkBookUtilTest to verify password remains set after createWorkBook() - Add EncryptDataTest.xlsPasswordWrite_isActuallyEncrypted to verify that reading an encrypted XLS without a password fails ## Checklist - [X] I have read the [Contributor Guide](https://fesod.apache.org/community/contribution/). - [X] I have written the necessary doc or comment. - [X] I have added the necessary unit tests and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
