import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
void remapContentType(BleachSession session, PackagePart part) throws InvalidFormatException {
    String oldContentType = part.getContentType();
    if (!REMAPPED_CONTENT_TYPES.containsKey(oldContentType)) {
        return;
    }

    String newContentType = REMAPPED_CONTENT_TYPES.get(part.getContentType());
    part.setContentType(newContentType);

    LOGGER.debug("Content type of '{}' changed from '{}' to '{}'", part.getPartName(), oldContentType, newContentType);

    Threat threat = threat()
            .type(ThreatType.UNRECOGNIZED_CONTENT)
            .severity(ThreatSeverity.LOW)
            .action(ThreatAction.DISARM)
            .location(part.getPartName().getName())
            .details("Remapped content type: " + oldContentType)
            .build();

    session.recordThreat(threat);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
/**
* Read the part content.
* @param part The {@link org.apache.poi.openxml4j.opc.PackagePart PackagePart} the content must be read from
* @return A string containing the content of the part.
*/
  private static String readPartContent(PackagePart part) {
  	try (InputStream is = part.getInputStream()) {
  		// Read the file content first
  		BufferedReader reader = new BufferedReader(new InputStreamReader(is, StandardCharsets.UTF_8));
  		
      	StringBuilder buf = new StringBuilder();
  		String line = reader.readLine();
  		while (line != null) {
  			buf.append(line);
  			line = reader.readLine();
  		}
  		
  		return buf.toString();
  	} catch (IOException ex) {
  		LOGGER.error("Error while bleaching {}. The file may be corrupted :/", part.getPartName().getName(), ex);
  		return null;
  	}
  }
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
@Test
public void testOPC() throws Exception {
	// setup
	InputStream inputStream = OOXMLSignatureVerifierTest.class.getResourceAsStream("/hello-world-signed.docx");

	// operate
	OPCPackage opcPackage = OPCPackage.open(inputStream);

	ArrayList<PackagePart> parts = opcPackage.getParts();
	for (PackagePart part : parts) {
		LOG.debug("part name: " + part.getPartName().getName());
		LOG.debug("part content type: " + part.getContentType());
	}

	ArrayList<PackagePart> signatureParts = opcPackage
			.getPartsByContentType("application/vnd.openxmlformats-package.digital-signature-xmlsignature+xml");
	assertFalse(signatureParts.isEmpty());

	PackagePart signaturePart = signatureParts.get(0);
	LOG.debug("signature part class type: " + signaturePart.getClass().getName());

	PackageDigitalSignatureManager packageDigitalSignatureManager = new PackageDigitalSignatureManager();
	// yeah... POI implementation still missing
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
/**
 * Handles an embedded file in the document
 */
protected void handleEmbeddedFile(PackagePart part, ContentHandler handler, String rel)
        throws SAXException, IOException {
    Metadata metadata = new Metadata();
    metadata.set(Metadata.EMBEDDED_RELATIONSHIP_ID, rel);

    // Get the name
    String name = part.getPartName().getName();
    metadata.set(
            Metadata.RESOURCE_NAME_KEY,
            name.substring(name.lastIndexOf('/') + 1));

    // Get the content type
    metadata.set(
            Metadata.CONTENT_TYPE, part.getContentType());

    // Call the recursing handler
    if (embeddedExtractor.shouldParseEmbedded(metadata)) {
        embeddedExtractor.parseEmbedded(
                TikaInputStream.get(part.getInputStream()),
                new EmbeddedContentHandler(handler),
                metadata, false);
    }
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public void sanitize(OPCPackage pkg, BleachSession session) throws BleachException, InvalidFormatException {
    LOGGER.trace("File opened");
    Iterator<PackagePart> it = getPartsIterator(pkg);

    pkg.ensureRelationships();

    sanitize(session, pkg, pkg.getRelationships());

    PackagePart part;
    while (it.hasNext()) {
        part = it.next();
        sanitize(session, pkg, part);
        
        OOXMLTagHelper.removeExternalDataTagAndDDE(session, part);

        if (!part.isRelationshipPart()) {
            sanitize(session, part, part.getRelationships());
        }

        if (part.isDeleted())
            continue;

        remapContentType(session, part);
    }

    // If threats have been removed, then add the dummy file so the relationship
    // still refers to an existing dummy object.
    if (session.threatCount() > 0) {
    	pushDummyFile(pkg);
    }
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
private Iterator<PackagePart> getPartsIterator(OPCPackage pkg) throws BleachException {
    try {
        return pkg.getParts().iterator();
    } catch (InvalidFormatException e) {
        throw new BleachException(e);
    }
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
/**
 * Word documents are simple, they only have the one main part
 */
@Override
protected List<PackagePart> getMainDocumentParts() {
  List<PackagePart> parts = new ArrayList<PackagePart>();
  parts.add(document.getPackagePart());
  return parts;
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
/**
 * Detects the type of an OfficeOpenXML (OOXML) file from
 *  opened Package 
 */
public static MediaType detectOfficeOpenXML(OPCPackage pkg) {
    PackageRelationshipCollection core = 
       pkg.getRelationshipsByType(ExtractorFactory.CORE_DOCUMENT_REL);
    if (core.size() != 1) {
        // Invalid OOXML Package received
        return null;
    }

    // Get the type of the core document part
    PackagePart corePart = pkg.getPart(core.getRelationship(0));
    String coreType = corePart.getContentType();

    // Turn that into the type of the overall document
    String docType = coreType.substring(0, coreType.lastIndexOf('.'));

    // The Macro Enabled formats are a little special
    if(docType.toLowerCase().endsWith("macroenabled")) {
        docType = docType.toLowerCase() + ".12";
    }

    if(docType.toLowerCase().endsWith("macroenabledtemplate")) {
        docType = MACRO_TEMPLATE_PATTERN.matcher(docType).replaceAll("macroenabled.12");
    }

    // Build the MediaType object and return
    return MediaType.parse(docType);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public OPCEntry(final PackagePart packagePart, final DefaultMutableTreeNode treeNode) {
	this.packagePart = packagePart;
	this.treeNode = treeNode;
	Object oldUserObject = treeNode.getUserObject();
	surrugateEntry = (oldUserObject instanceof TreeModelEntry) ? (TreeModelEntry)oldUserObject : null;
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
@Override
protected void transformInternal(ContentReader reader,
                                 ContentWriter writer,
                                 TransformationOptions options) throws Exception
{
    final String sourceMimetype = reader.getMimetype();
    final String sourceExtension = getMimetypeService().getExtension(sourceMimetype);
    final String targetMimetype = writer.getMimetype();
    
    
    if (log.isDebugEnabled())
    {
        StringBuilder msg = new StringBuilder();
        msg.append("Transforming from ").append(sourceMimetype)
           .append(" to ").append(targetMimetype);
        log.debug(msg.toString());
    }
    
    
    OPCPackage pkg = null;
    try 
    {
        File ooxmlTempFile = TempFileProvider.createTempFile(this.getClass().getSimpleName() + "_ooxml", sourceExtension);
        reader.getContent(ooxmlTempFile);
        
        // Load the file
        pkg = OPCPackage.open(ooxmlTempFile.getPath());
        
        // Does it have a thumbnail?
        PackageRelationshipCollection rels = 
            pkg.getRelationshipsByType(PackageRelationshipTypes.THUMBNAIL);
        if (rels.size() > 0)
        {
            // Get the thumbnail part
            PackageRelationship tRel = rels.getRelationship(0);
            PackagePart tPart = pkg.getPart(tRel);
            
            // Write it to the target
            InputStream tStream = tPart.getInputStream();
            writer.putContent( tStream );
            tStream.close();
        }
        else
        {
            log.debug("No thumbnail present in " + reader.toString());
            throw new UnimportantTransformException(NO_THUMBNAIL_PRESENT_IN_FILE + targetMimetype);
        }
    } 
    catch (IOException e) 
    {
       throw new AlfrescoRuntimeException("Unable to transform " + sourceExtension + " file.", e);
    }
    finally
    {
        if (pkg != null)
        {
            pkg.close();
        }
    }
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
/**
    * The externalData tag is embedded in xml files to automatically load OLE object or
    * macro, or any kind of potential threat. Remove this tag prevent MS Office from
    * crashing. Actually, if you only remove the relation it crashes, that's why you have 
    * to remove the relation and the reference of the relation (via the externalData tag)
    * in the xml file.
    * Also removes DDE.
    * @param session The current bleach session where the threat can be reported
    * @param part The package part to sanitize
    */
   protected static void removeExternalDataTagAndDDE(BleachSession session, PackagePart part) {
   	// Only applicable if the file is an XML file (not a _refs or whatever)
   	// And is a ZipPackagePart, not a config file or whatever.
   	if (!XML_EXTENSION.equals(part.getPartName().getExtension()) || !(part instanceof ZipPackagePart)) {
   		return;
   	}
  		
   	String content = readPartContent(part);
   	// An error occured
   	if (content == null) {
   		return;
   	}
   	
   	boolean external = content.indexOf(TAG_EXTERNAL_DATA) != -1;
   	boolean ddeauto = content.indexOf(DDEAUTO) != -1 || content.indexOf(ATTRIBUTE_DDESERVICE_DATA) != -1;
   	
   	// The evil tag has not been found, return
   	if (!external && !ddeauto) {
   		return;
   	}
   	
   	LOGGER.debug((external ? "externalData tag" : "DDE ") + " has been spotted {}", part);
   	
   	// Replace the tag by a comment
   	content = content.replaceAll(REGEXP_EXTERNAL_DATA, XML_COMMENT_BLEACHED);
   	
   	// Replace DDEAUTO with nothing, DDE will not trigger
   	content = content.replaceAll(DDEAUTO, "");
   	
   	// Replace ddeService & ddeTopic with cmd.exe exit
   	content = content.replaceAll(REGEXP_DDESERVICE_DATA, ATTRIBUTE_DDESERVICE_DATA + "=\""+ DDE_DATA_BLEACHED1 +"\"");
   	content = content.replaceAll(REGEXP_DDETOPIC_DATA, ATTRIBUTE_DDETOPIC_DATA + "=\""+ DDE_DATA_BLEACHED2 +"\"");
   	
   	// Write the result
   	try (OutputStream os = part.getOutputStream()) {
   		os.write(content.getBytes());
   		os.close();
   	} catch (IOException ex) {
   		LOGGER.error("Error while writing the part content. The file may be corrupted.", ex);
   		return;
   	}
   			
       session.recordThreat(
       	threat()
       		.type(external ? ThreatType.EXTERNAL_CONTENT : ThreatType.ACTIVE_CONTENT)
   		    .severity(ThreatSeverity.HIGH)
   		    .action(ThreatAction.REMOVE)
   		    .location(part.getPartName().getName())
   		    .details("Removed tag \" " + (external ? "externalData" : "DDEAUTO") + "\" from the document.")
   		    .build()
       );
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public ExcelReadOnlySharedStringsTable(PackagePart part,
		PackageRelationship rel_ignored) throws IOException, SAXException {
	super(part, rel_ignored);

}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFMasters(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel, document);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFBaseContents(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel, document);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFPages(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel, document);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFMasterContents(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel, document);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
@Override
public List<PackagePart> getAllEmbedds() throws OpenXML4JException {
	throw new UnsupportedOperationException("Not implemented");
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFPageContents(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel, document);
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
public XDGFXMLDocumentPart(PackagePart part, PackageRelationship rel, XDGFDocument document) {
	super(part, rel);
	_document = document;
}
 

import org.apache.poi.openxml4j.opc.PackagePart; //导入依赖的package包/类
@Override
protected List<PackagePart> getMainDocumentParts() {
   return new ArrayList<PackagePart>();
}