poi.apache.org Open in urlscan Pro
2a04:4e42::644  Public Scan

Form analysis
1 forms found in the DOM

GET https://www.google.com/search

<form action="https://www.google.com/search" method="get" class="roundtopsmall">
  <input value="poi.apache.org" name="sitesearch" type="hidden"><input onfocus="getBlank (this, 'Search the site with google');" size="25" name="q" id="query" type="text" value="Search the site with google">&nbsp; <input name="Search" value="Search"
    type="submit">
</form>

Text Content

Apache Software Foundation > Apache POI >
 
 * Home
 * Help
 * Component APIs
 * Getting Involved


Last Published: 01/01/2024 01:24:18
 
Overview
Home
Download
Changelog
Javadocs
Text Extraction
Encryption support
Secure processing
Case Studies
Related projects
Legal
Apache Wide
Apache Software Foundation
License
Sponsorship
Thanks
Security
Privacy

--------------------------------------------------------------------------------





APACHE POI - THE JAVA API FOR MICROSOFT DOCUMENTS




PROJECT NEWS


25 NOVEMBER 2023 - POI 5.2.5 AVAILABLE

The Apache POI team is pleased to announce the release of 5.2.5. Several
dependencies were updated to their latest versions to pick up security fixes and
other improvements.

A summary of changes is available in the Release Notes. A full list of changes
is available in the change log. People interested should also follow the dev
list to track progress.

See the downloads page for more details.

POI requires Java 8 or newer since version 4.0.1.


4 MARCH 2022 - CVE-2022-26336 - A CAREFULLY CRAFTED TNEF FILE CAN CAUSE AN OUT
OF MEMORY EXCEPTION IN APACHE POI POI-SCRATCHPAD VERSIONS PRIOR TO 5.2.0

Description:
A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an
attacker to cause an Out of Memory exception. This package is used to read TNEF
files (Microsoft Outlook and Microsoft Exchange Server). If an application uses
poi-scratchpad to parse TNEF files and the application allows untrusted users to
supply them, then a carefully crafted file can cause an Out of Memory exception.

Mitigation:
Affected users are advised to update to poi-scratchpad 5.2.1 or above which
fixes this vulnerability. It is recommended that you use the same versions of
all POI jars.


10+16+18 DECEMBER 2021- LOG4J VULNERABILITIES CVE-2021-44228, CVE-2021-45046 AND
CVE-2021-45105

The Apache POI PMC has evaluated the security vulnerabilities reported for
Apache Log4j.

POI 5.1.0 and XMLBeans 5.0.2 only have dependencies on log4j-api 2.14.1. The
security vulnerabilities are not in log4j-api - they are in log4j-core.

If any POI or XMLBeans user uses log4j-core to control their logging of their
application, we strongly recommend that they upgrade all their log4j
dependencies to the latest version (currently v2.20.0) - including log4j-api.


13 JANUARY 2021 - CVE-2021-23926 - XML EXTERNAL ENTITY (XXE) PROCESSING IN
APACHE XMLBEANS VERSIONS PRIOR TO 3.0.0

Description:
When parsing XML files using XMLBeans 2.6.0 or below, the underlying parser
created by XMLBeans could be susceptible to XML External Entity (XXE) attacks.

This issue was fixed a few years ago but on review, we decided we should have a
CVE to raise awareness of the issue.

Mitigation:
Affected users are advised to update to Apache XMLBeans 3.0.0 or above which
fixes this vulnerability. XMLBeans 4.0.0 or above is preferable.

References: XML external entity attack


20 OCTOBER 2019 - CVE-2019-12415 - XML EXTERNAL ENTITY (XXE) PROCESSING IN
APACHE POI VERSIONS PRIOR TO 4.1.1

Description:
When using the tool XSSFExportToXml to convert user-provided Microsoft Excel
documents, a specially crafted document can allow an attacker to read files from
the local filesystem or from internal network resources via XML External Entity
(XXE) Processing.

Mitigation:
Apache POI 4.1.0 and before: users who do not use the tool XSSFExportToXml are
not affected. Affected users are advised to update to Apache POI 4.1.1 which
fixes this vulnerability.

Credit: This issue was discovered by Artem Smotrakov from SAP

References: XML external entity attack


26 MARCH 2019 - XMLBEANS 3.1.0 AVAILABLE

The Apache POI team is pleased to announce the release of XMLBeans 3.1.0.
Featured are a handful of bug fixes.

The Apache POI project has unretired the XMLBeans codebase and is maintaining it
as a sub-project, due to its importance in the poi-ooxml codebase.

A summary of changes is available in the Release Notes. People interested should
also follow the POI dev list to track progress.

The XMLBeans JIRA project has been reopened and feel free to open issues.

POI 4.1.0 uses XMLBeans 3.1.0.

XMLBeans requires Java 6 or newer since version 3.0.2.


11 JANUARY 2019 - INITIAL SUPPORT FOR JDK 11

We did some work to verify that compilation with Java 11 is working and that all
unit-tests pass.

See the details in the FAQ entry.


MISSION STATEMENT

The Apache POI Project's mission is to create and maintain Java APIs for
manipulating various file formats based upon the Office Open XML standards
(OOXML) and Microsoft's OLE 2 Compound Document format (OLE2). In short, you can
read and write MS Excel files using Java. In addition, you can read and write MS
Word and MS PowerPoint files using Java. Apache POI is your Java Excel solution
(for Excel 97-2008). We have a complete API for porting other OOXML and OLE2
formats and welcome others to participate.

OLE2 files include most Microsoft Office files such as XLS, DOC, and PPT as well
as MFC serialization API based file formats. The project provides APIs for the
OLE2 Filesystem (POIFS) and OLE2 Document Properties (HPSF).

Office OpenXML Format is the new standards based XML file format found in
Microsoft Office 2007 and 2008. This includes XLSX, DOCX and PPTX. The project
provides a low level API to support the Open Packaging Conventions using
openxml4j.

For each MS Office application there exists a component module that attempts to
provide a common high level Java api to both OLE2 and OOXML document formats.
This is most developed for Excel workbooks (SS=HSSF+XSSF). Work is progressing
for Word documents (WP=HWPF+XWPF) and PowerPoint presentations (SL=HSLF+XSLF).

The project has some support for Outlook (HSMF). Microsoft opened the
specifications to this format in October 2007. We would welcome contributions.

There are also projects for Visio (HDGF and XDGF), TNEF (HMEF), and Publisher
(HPBF).

As a general policy we collaborate as much as possible with other projects to
provide this functionality. Examples include: Cocoon for which there are
serializers for HSSF; Open Office.org with whom we collaborate in documenting
the XLS format; and Tika / Lucene, for which we provide format interpretors.
When practical, we donate components directly to those projects for POI-enabling
them.


WHY SHOULD I USE APACHE POI?

A major use of the Apache POI api is for Text Extraction applications such as
web spiders, index builders, and content management systems.

So why should you use POIFS, HSSF or XSSF?

You'd use POIFS if you had a document written in OLE 2 Compound Document Format,
probably written using MFC, that you needed to read in Java. Alternatively,
you'd use POIFS to write OLE 2 Compound Document Format if you needed to
inter-operate with software running on the Windows platform. We are not just
bragging when we say that POIFS is the most complete and correct implementation
of this file format to date!

You'd use HSSF if you needed to read or write an Excel file using Java (XLS).
You'd use XSSF if you need to read or write an OOXML Excel file using Java
(XLSX). The combined SS interface allows you to easily read and write all kinds
of Excel files (XLS and XLSX) using Java. Additionally there is a specialized
SXSSF implementation which allows to write very large Excel (XLSX) files in a
memory optimized way.


COMPONENTS

The Apache POI Project provides several component modules some of which may not
be of interest to you. Use the information on our Components page to determine
which jar files to include in your classpath.


CONTRIBUTING

So you'd like to contribute to the project? Great! We need enthusiastic,
hard-working, talented folks to help us on the project, no matter your
background. So if you're motivated, ready, and have the time: Download the
source from the Subversion Repository, build the code, join the mailing lists,
and we'll be happy to help you get started on the project!

Tasks the Apache POI Project would like help
with:TitleLanguagesDifficultyCreated
1
Work on shifting/cloning/copying rows/cells in HSSF/XSSF file formatsjava
Expert3.10.2019, 17:33:18Project: poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 3.10.2019, 17:33:18
Description:

> The support for shifting/copying/cloning rows in the Excel file formats in
> Apache POI has a few hard to fix problems. If you want to dive deep into the
> inner workings of the Microsoft Excel file formats and how Apache POI provides
> support for them, this task may be right for you.
> 
> As a start you can take a look at some of the related bug-reports:
> https://bz.apache.org/bugzilla/buglist.cgi?bug_id=63463%2C63352%2C63228%2C63189%2C62581%2C62328%2C62030%2C61851%2C61474%2C60902%2C60642%2C60072%2C59733%2C59731%2C59677%2C59306%2C59239%2C58348%2C58221%2C57885%2C57423%2C56454%2C56123%2C54533%2C54509%2C54470%2C54399%2C53832%2C53769%2C53678%2C53320%2C46742%2C46266&list_id=183205&order=bug_id%20DESC&query_format=advanced

Further information:
https://bz.apache.org/bugzilla/buglist.cgi?bug_id=63463%2C63352%2C63228%2C63189%2C62581%2C62328%2C62030%2C61851%2C61474%2C60902%2C60642%2C60072%2C59733%2C59731%2C59677%2C59306%2C59239%2C58348%2C58221%2C57885%2C57423%2C56454%2C56123%2C54533%2C54509%2C54470%2C54399%2C53832%2C53769%2C53678%2C53320%2C46742%2C46266&list_id=183205&order=bug_id%20DESC&query_format=advanced

2
Beginner15.7.2016, 19:47:11Project: poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 15.7.2016, 19:47:11
Description:

> We are looking for examples of using Apache POI in languages other than
> Java to include on https://poi.apache.org/poi-jvm-languages.html
> 
> Examples should be idiomatic (they way you import, the way you loop over a
> sequence with an index, the way you declare variables, whitespace, etc).
> 
> We already have Jython, Scala, and Groovy examples (improvements to make
> the examples more language idiomatic are welcome).
> We are looking for JRuby, Clojure, Kotlin, and anything else that can run
> POI code.
> 
> Also, if anyone is using Ruby, the POI Ruby page could probably use an
> update. https://poi.apache.org/poi-ruby.html

Further information: https://poi.apache.org/poi-jvm-languages.html

3
Enhance support for charts in the Microsoft Excel file format supportxml,java
Expert29.5.2016, 09:43:13Project: poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 29.5.2016, 09:43:13
Description:

> Apache POI only provides very limited support for charts in Microsoft Excel
> files, see http://poi.apache.org/spreadsheet/limitations.html
> 
> We have a number of enhancement requests to add more support for charts, see
> e.g.
> https://bz.apache.org/bugzilla/buglist.cgi?bug_id=49472%2C52067%2C53264%2C54353%2C54470%2C56557%2C57369%2C57596%2C57835%2C58494%2C59306%2C59622%2C59623&list_id=146706&query_format=advanced&order=bug_id&query_based_on=
> 
> However work for this task should probably start with first assessing the
> existing functionality around charts and to decide on next steps in a more
> structured way than to implement single enhancement requests.
> 
> You will need good knowledge about the general implementation of the Excel
> file formats in Apache POI and very good knowledge about how charts are
> represented in the Microsoft file formats
> (http://poi.apache.org/guidelines.html#FileFormatInformation), but both pieces
> can also be acquired on the go if you are willing to invest some time.
> 
> You should also plan to stay on this task for some time longer so you also
> help in stabilizing code that is produced to avoid having lots of new unstable
> code afterwards.

Further information:
https://bz.apache.org/bugzilla/buglist.cgi?bug_id=49472%2C52067%2C53264%2C54353%2C54470%2C56557%2C57369%2C57596%2C57835%2C58494%2C59306%2C59622%2C59623&list_id=146706&query_format=advanced&order=bug_id&query_based_on=

4
Document the new Microsoft Visio 2007+ support codeenglish,xml
Journeyman29.5.2016, 09:34:20Project: poi
Requested by: centic@apache.org
Type: Documentation and Guides
Created: 29.5.2016, 09:34:20
Description:

> We introduced classes which provide support for the Microsoft Visio file
> format (.vsdx ). Internally this is called XDGF.
> 
> Unfortunately the documentation about XDGF is lacking a bit,
> http://poi.apache.org/overview.html does not list it correctly and the sidebar
> point to http://poi.apache.org/hdgf/index.html, which is the pre-Office 2007
> .vsd-format, not .vsdx.
> 
> The documentation is built as Apache Forrest XML files. The source for these
> is located at https://svn.apache.org/repos/asf/poi/site/
> 
> The task includes reviewing the overview description of formats supported by
> Apache POI to properly list the support for Visio file formats and to add new
> documentation for the XDGF file format if necessary/appropriate.

5
Add support for OOXML strict formatxml,java Advanced27.2.2016, 11:28:54Project:
poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 27.2.2016, 11:28:54
Description:

> There is a different format for the XML-based file formats of the Microsoft
> Office suite which Apache POI does not support yet.
> 
> See https://bz.apache.org/bugzilla/show_bug.cgi?id=57699 for some initial work
> being done on this, however it seems that there is more work to do, details of
> how much are not fully understood yet.
> 
> So a first step for this task would be to read up on the "OOXML strict" file
> format and summarize the expected amount of work and then go about adjusting
> Apache POI so that it can successfully read these documents.
> 
> A bonus would be to add support for writing these format as well.

Further information: https://bz.apache.org/bugzilla/show_bug.cgi?id=57699

6
Improve test-coverage of new Microsoft Visio 2007+ support codejava
Journeyman27.2.2016, 09:07:19Project: poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 27.2.2016, 09:07:19
Description:

> Look at the newly introduced classes which provide support for the Microsoft
> Visio file format (.vsdx ).
> 
> POI has overly good coverage via a concise set of unit-tests, but the newly
> introduced code was bulk-merged and thus still lacks the appropriate unit-test
> coverage.
> 
> The task is to take a look at the classes and provide some unit-test to cover
> the most important parts of the API for Microsoft Visio documents.
> 
> Bugs found in the core code can be either fixed at the same time or reported
> as bugs.

7
Addd/Update documentation for Visio Document supportenglish,xml,java
Journeyman27.2.2016, 09:03:54Project: poi
Requested by: centic@apache.org
Type: Programming and Development
Created: 27.2.2016, 09:03:54
Description:

> Recently Apache POI added support for the 2007+ Visio Document Format by
> incorporating code from https://github.com/BBN-D/poi-visio.
> 
> The related documentation at http://poi.apache.org/ is not up-to-date yet, the
> current section for Visio (http://poi.apache.org/hdgf/index.html) only talks
> about the previous 2003-and-before format.
> 
> The task mostly consists of collecting some information about the new suppport
> and writing some "howto" guide that shows how the new format can be used.
> 
> Also the existing pages can be reviewed to make sure the information is
> complete and consistent regarding Visio support in POI.
> 
> Most of this task consists of writing documentation in a HTML-like XML format
> and looking at the API.

Powered by Help Wanted - a task directory for Apache projects

Please read our Contribution Guidelines. When your contribution is ready submit
a patch to our Bug Database.

 
Last Published: 01/01/2024 01:24:18
Copyright © 2001-2024 The Apache Software Foundation

Send feedback about the website to: dev@poi.apache.org