apache / apache/fesod

implement fuzzing

Open
#521 1 comment 1 reaction 0 assignees View on GitHub
discussion welcome suggest
Dominant language
Java
Stars
6.2k
Forks
532
Avg merge
1d 3h
Merged PRs (30d)
42

Description

### Search before asking

- [x] I searched in the [issues](https://github.com/fast-excel/fastexcel/issues) and found nothing similar.

### Motivation

https://github.com/google/oss-fuzz is one example of a tool that can be used to generate edge case documents that may cause issues for fastexcel when you parse the documents

Microsoft formats are very exploitable.
* Various XML based attacks (xlsx is a basically a zip of XML files) - XXE, etc.
* Zip bombs
* Legacy xls file is also very exploitable

Hopefully, fastexcel will write up a Security Model that says that lib users should be very wary of parsing excel files of unknown provenance.

### Solution

_No response_

### Alternatives

_No response_

### Anything else?

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.