Bug 148576

Summary: Calc doesn't open XLSX file with AES 256-bit password
Product: LibreOffice Reporter: michel.pamboukian
Component: CalcAssignee: Not Assigned <libreoffice-bugs>
Status: NEW ---    
Severity: normal CC: 79045_79045, aron.budea, pedro
Priority: medium Keywords: filter:xlsx
Version: 5.2.7.2 release   
Hardware: All   
OS: Windows (All)   
See Also: https://bugs.documentfoundation.org/show_bug.cgi?id=55425
https://bugs.documentfoundation.org/show_bug.cgi?id=156835
Whiteboard:
Crash report or crash signature: Regression By:
Bug Depends on:    
Bug Blocks: 143335    
Attachments: contains confidential data
Sanitized sample with password 1234

Description michel.pamboukian 2022-04-13 17:02:51 UTC
Description:
Dear all,

   I changed my computer few days ago and I am running Windows 11. The problem remains.

       The file concerned is attached. 

  The password    anemonE7  is accepted but the file is not opened. Please make sure that the file

    is deleted after use because it contains confidential data.    I might doing  something wrong.    

     Thank you and best regards,

     mp 

Actual Results:
File not openned

Expected Results:
open the file


Reproducible: Always


User Profile Reset: No



Additional Info:
 file concerned attached
Comment 1 michel.pamboukian 2022-04-13 17:04:22 UTC Comment hidden (obsolete)
Comment 2 Mike Kaganski 2022-04-13 17:53:40 UTC
Created attachment 179540 [details]
Sanitized sample with password 1234

Repro using Version: 7.3.2.2 (x64) / LibreOffice Community
Build ID: 49f2b1bff42cfccbd8f788c8dc32c1c309559be0
CPU threads: 12; OS: Windows 10.0 Build 19044; UI render: default; VCL: win
Locale: ru-RU (ru_RU); UI: en-US
Calc: 

This file has *everything* (including hidden data and metadata) removed using Excel 2016 (all original sheets are removed, and a new empty sheet added); the new password is 1234. The resulting file doesn't open after entering the password.
Comment 3 Buovjaga 2022-04-13 18:08:18 UTC Comment hidden (obsolete)
Comment 4 Roman Kuznetsov 2022-04-13 20:08:22 UTC Comment hidden (obsolete)
Comment 5 Mike Kaganski 2022-04-14 08:45:19 UTC
(In reply to Roman Kuznetsov from comment #4)
> Confirm in 7.4 and in 5.2.7.2

Not exactly. Before 6.2, all versions behave differently: they ask for password repeatedly several times, after which (if not cancelled) the file is opened in Writer (showing junk).

The related change is commit ce560ee99ebf97fa44aecedd5110b29913cf77a5
  Author Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk>
  Date   Wed Jul 04 22:23:44 2018 +0200
    oox: Agile encryption and data integrity verification

Note that regardless, this is not a regression of any kind; it could never be opened.
Comment 6 Timur 2022-04-26 09:19:03 UTC Comment hidden (obsolete)
Comment 7 Michael Warner 2022-04-27 03:28:50 UTC
(In reply to Timur from comment #6)
> This is AES 256-bit encryption. Lo has multiple bugs for opening AES PDF.
> If XLSX is saved in MSO as XLS, it's with a weak encryption so it opens in
> LO.

Opening an AES-256 encrypted PDF will leverage xpdf and of necessity be a different solution from opening an AES-256 encrypted XLSX. Despite the superficial similarity of the problem statements, there is not a common root cause between the two so I don't expect there to be any significant overlap in the resolution.
Comment 8 Pedro Côrte-Real 2023-06-04 22:13:39 UTC
I'm seeing the exact same problem on 7.4.7 as shipped by Ubuntu 22.10.1