CVE-2025-31672: Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

The vulnerability lies in the improper validation of OOXML files, which are essentially zip archives. Malicious users can craft files with duplicate zip entry names. The fix involves adding checks to detect and throw an exception when such duplicate entries are found.

1. ZipInputStreamZipEntrySource.ZipInputStreamZipEntrySource: This constructor is directly involved in reading zip entries. The patch explicitly adds logic to track filenames and throw an InvalidZipException if a duplicate is encountered. This is a primary vulnerable function that was fixed.
2. ZipSecureFile.validateEntryNames: This method already contained logic to detect duplicate names. The patch makes minor changes (making variables final). While not the direct fix, it's a key function involved in the validation process. The vulnerability existed because this check might not have been called or its results handled correctly in all scenarios prior to the patch.
3. OPCPackage.open (multiple overloads): These methods are high-level entry points for opening and parsing OOXML packages. The patches modify them to catch the newly introduced InvalidZipException (originating from lower-level zip processing) and rethrow it as an InvalidFormatException. This shows that these methods previously did not handle the duplicate entry scenario correctly and would proceed with parsing, leading to the vulnerability.
4. PackageHelper.open: This is another utility method for opening packages. It calls OPCPackage.open and its exception handling was updated in relation to the InvalidFormatException that can now be caused by duplicate entries.

The test cases added in TestXSSFWorkbook.java (e.g., testDuplicateFileReadAsOPCFile, testDuplicateFileReadAsFile, testDuplicateFileReadAsStream) confirm that opening a specially crafted file (duplicate-file.xlsx) now results in exceptions (InvalidFormatException or InvalidZipException), whereas previously it would have been processed, demonstrating the fix for the vulnerability in the XSSFWorkbook constructor and underlying OPCPackage.open calls.