From: Andreas Beeker <kiwiwings@apache.org>
Date: Sat, 30 Jun 2018 11:20:23 +0000 (+0000)
Subject: #62513 - Don't try to parse embedded package relationships
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=9b50601458506a5ccfb7ca84c9bf94f19e4f288e;p=poi.git

#62513 - Don't try to parse embedded package relationships

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1834729 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/src/ooxml/java/org/apache/poi/ooxml/POIXMLFactory.java b/src/ooxml/java/org/apache/poi/ooxml/POIXMLFactory.java
index ca6cdb30c0..3c88f1fae2 100644
--- a/src/ooxml/java/org/apache/poi/ooxml/POIXMLFactory.java
+++ b/src/ooxml/java/org/apache/poi/ooxml/POIXMLFactory.java
@@ -44,10 +44,13 @@ public abstract class POIXMLFactory {
      * @since by POI 3.14-Beta1
      */
     public POIXMLDocumentPart createDocumentPart(POIXMLDocumentPart parent, PackagePart part) {
-        PackageRelationship rel = getPackageRelationship(parent, part);
-        POIXMLRelation descriptor = getDescriptor(rel.getRelationshipType());
-        
-        if (descriptor == null || descriptor.getRelationClass() == null) {
+        final PackageRelationship rel = getPackageRelationship(parent, part);
+        final String relType = rel.getRelationshipType();
+        final POIXMLRelation descriptor = getDescriptor(relType);
+
+        // don't parse the document parts, if its class can't be determined
+        // or if it's a package relation of another embedded resource
+        if (descriptor == null || descriptor.getRelationClass() == null || POIXMLDocument.PACK_OBJECT_REL_TYPE.equals(relType)) {
             LOGGER.log(POILogger.DEBUG, "using default POIXMLDocumentPart for " + rel.getRelationshipType());
             return new POIXMLDocumentPart(parent, part);
         }
diff --git a/src/ooxml/java/org/apache/poi/xslf/usermodel/XSLFRelation.java b/src/ooxml/java/org/apache/poi/xslf/usermodel/XSLFRelation.java
index 9ac9df3c30..62f009a15a 100644
--- a/src/ooxml/java/org/apache/poi/xslf/usermodel/XSLFRelation.java
+++ b/src/ooxml/java/org/apache/poi/xslf/usermodel/XSLFRelation.java
@@ -139,6 +139,8 @@ public class XSLFRelation extends POIXMLRelation {
             null
     );
 
+    // this is not the same as in XSSFRelation.WORKBOOK, as it is usually used by embedded charts
+    // referencing the original embedded excel workbook
     public static final XSLFRelation WORKBOOK = new XSLFRelation(
             "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
             POIXMLDocument.PACK_OBJECT_REL_TYPE,
diff --git a/src/ooxml/testcases/org/apache/poi/ooxml/TestPOIXMLDocument.java b/src/ooxml/testcases/org/apache/poi/ooxml/TestPOIXMLDocument.java
index 039169fa29..056ecbb8e9 100644
--- a/src/ooxml/testcases/org/apache/poi/ooxml/TestPOIXMLDocument.java
+++ b/src/ooxml/testcases/org/apache/poi/ooxml/TestPOIXMLDocument.java
@@ -323,7 +323,18 @@ public final class TestPOIXMLDocument {
             open.close();
         }
     }
-    
+
+    @Test
+    public void dontParseEmbeddedDocuments() throws IOException {
+        // bug #62513
+        POIDataSamples pds = POIDataSamples.getSlideShowInstance();
+        try (InputStream is = pds.openResourceAsStream("bug62513.pptx");
+            XMLSlideShow ppt = new XMLSlideShow(is)) {
+            POIXMLDocumentPart doc = ppt.getSlides().get(12).getRelationById("rId3");
+            assertEquals(POIXMLDocumentPart.class, doc.getClass());
+        }
+    }
+
     @Test
     public void testOSGIClassLoading() {
         // the schema type loader is cached per thread in POIXMLTypeLoader.
diff --git a/test-data/slideshow/bug62513.pptx b/test-data/slideshow/bug62513.pptx
new file mode 100644
index 0000000000..a65c8e20e8
Binary files /dev/null and b/test-data/slideshow/bug62513.pptx differ