T09 · Insecure Skill Coding Practices
Warning
- Location
read_file.py:76- Finding
Unbounded Office archive decompression can cause resource exhaustion
- Content
View full analysis
]*>([^<]*)', content) for match in matches: texts.append(match.decode('utf-8')) return '\n'.join(texts) def read_xlsx(file_path): """读取 Excel 表格 (.xlsx) 内容""" texts = [] with zipfile.ZipFile(file_path, 'r') as z: # 读取 sharedStrings.xml try: content = z.read('xl/sharedStrings.xml') # 提取所有 t 标签中的文本 matches = re.findall(b'([^<]*)', content) for match in matches: texts.append(match.decode('utf-8')) except KeyError: # 如果没有 sharedStrings.xml，尝试读取 worksheets for name in z.namelist(): if name.startswith('xl/worksheets/sheet') and name.endswith('.xml'): content = z.read(name) # 提取 cell 中的值 matches = re.findall(b'([^<]*)', content) for match in matches: try: texts.append(match.decode('utf-8')) except: pass return '\n'.join(texts) ``` ### Technical Analysis DOCX and XLSX documents are ZIP archives. The implementation calls `ZipFile.read()` on archive entries without validating the input file size, uncompressed entry size, cumulative uncompressed size, compression ratio, or number of worksheet entries. `ZipFile.read()` decompresses an ent ...[truncated 1998 chars]- Remediation
View remediation