From 3a8e5887b3bacb05f0d80b9af7bb268763fe155e Mon Sep 17 00:00:00 2001
From: Andreas Beeker <kiwiwings@apache.org>
Date: Fri, 18 Mar 2016 21:34:03 +0000
Subject: [PATCH] #59195 - POIXMLTypeLoader depends on XMLBeans 2.6.0 - remove
 piccolo classes from xmlbeans jars and disable xmloption in type loader

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1735685 13f79535-47bb-0310-9956-ffa450edef68
---
 build.xml                                           | 11 +++++++++--
 src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/build.xml b/build.xml
index ecc92de49f..b4781cd387 100644
--- a/build.xml
+++ b/build.xml
@@ -580,8 +580,15 @@ under the License.
     <target name="fetch-ooxml-jars" depends="check-ooxml-jars" unless="ooxml.jars.present">
         <mkdir dir="${ooxml.lib}"/>
         <downloadfile src="${ooxml.curvesapi.url}" dest="${ooxml.curvesapi.jar}"/>
-        <downloadfile src="${ooxml.xmlbeans23.url}" dest="${ooxml.xmlbeans23.jar}"/>
-        <downloadfile src="${ooxml.xmlbeans26.url}" dest="${ooxml.xmlbeans26.jar}"/>
+        <downloadfile src="${ooxml.xmlbeans23.url}" dest="${ooxml.xmlbeans23.jar}.orig"/>
+        <downloadfile src="${ooxml.xmlbeans26.url}" dest="${ooxml.xmlbeans26.jar}.orig"/>
+    	<!-- remove piccolo parser, so we don't use unsafe calls to it instead of using jaxp -->
+    	<zip destfile="${ooxml.xmlbeans23.jar}">
+    		<zipfileset src="${ooxml.xmlbeans23.jar}.orig" excludes="org/apache/xmlbeans/impl/piccolo/**"/>
+    	</zip>
+        <zip destfile="${ooxml.xmlbeans26.jar}">
+            <zipfileset src="${ooxml.xmlbeans26.jar}.orig" excludes="org/apache/xmlbeans/impl/piccolo/**"/>
+        </zip>
     </target>
 
     <target name="check-ooxml-xsds">
diff --git a/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java b/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
index 1fd55628ca..5304b3121a 100644
--- a/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
+++ b/src/ooxml/java/org/apache/poi/POIXMLTypeLoader.java
@@ -53,7 +53,10 @@ public class POIXMLTypeLoader {
         DEFAULT_XML_OPTIONS.setUseDefaultNamespace();
         DEFAULT_XML_OPTIONS.setSaveAggressiveNamespaces();
         DEFAULT_XML_OPTIONS.setCharacterEncoding("UTF-8");
-        DEFAULT_XML_OPTIONS.setLoadEntityBytesLimit(4096);
+        // Piccolo is disabled for POI builts, i.e. JAXP is used for parsing
+        // so only user code using XmlObject/XmlToken.Factory.parse
+        // directly can bypass the entity check, which is probably unlikely (... and not within our responsibility :)) 
+        // DEFAULT_XML_OPTIONS.setLoadEntityBytesLimit(4096);
 
         Map<String, String> map = new HashMap<String, String>();
         map.put("http://schemas.openxmlformats.org/drawingml/2006/main", "a");
-- 
2.39.5