WEBSERVICE

This function returns data from a web service on the Internet or Intranet.

Syntax

WEBSERVICE(url)

Arguments

This function has the following argument:

Remarks

The function supports HTTP (http and https) protocol. DsExcel.NET return "" as default value before the result is returned from the service. The correct result is displayed only when the response result is string type. If other formats like images, audio, video are used, it returns unreadable code.

The function returns a #VALUE! error in following scenarios:

• If the returned URL is a string with more than 2048 characters.

• If the request takes more than 10 seconds.

• If the request does not follow the same origin policy and the target website does not support CORS (Cross-Origin Resource Sharing) from source origin, on browser. In such case, the browser prints CORS Error on console instead of DsExcel.NET.

• If FTP or FILE protocol is used.

Security Risks

WEBSERVICE sends outbound HTTP or HTTPS requests during formula evaluation.

If a workbook containing WEBSERVICE formulas comes from an untrusted source, a malicious formula may attempt to access internal or protected network resources that are reachable from the application environment. In server-side or desktop scenarios, this may introduce a Server-Side Request Forgery (SSRF) risk.

Best Practices

When handling files that contain WEBSERVICE formulas, consider the following security practices:

Validate Input Files

• Only open or process Excel files from trusted sources.

• Inspect uploaded or imported files for formulas that use WEBSERVICE.

• Review formula content in automated workflows if files may come from external users or systems.

Restrict Network Access

• Run formula evaluation in an environment with restricted outbound network access when external data retrieval is not required.

• Use a proxy or other network controls to limit where WEBSERVICE can send requests.

• Avoid allowing direct access from the application environment to sensitive internal services unless it is explicitly required.

Restrict Runtime Behavior

• Override the default WEBSERVICE function with a custom implementation if your application must block or control outbound requests.

• Log WEBSERVICE activity, including blocked requests, for monitoring and audit purposes.

Secure Configuration

One practical mitigation is to replace the default WEBSERVICE function with a custom function that blocks outbound network access.

The following example shows how to override WEBSERVICE so that formula evaluation does not send an actual HTTP request.

Step 1: Create a Custom Function to Block WEBSERVICE

public class BlockedWebServiceFunction extends CustomFunction {

    public BlockedWebServiceFunction() {
        super(
            "WEBSERVICE",
            FunctionValueType.Text,
            new Parameter[] {
                new Parameter(FunctionValueType.Text)
            }
        );
    }

    @Override
    public Object evaluate(
            Object[] arguments,
            ICalcContext context) {

        String url = arguments != null
                && arguments.length > 0
                && arguments[0] != null
                ? arguments[0].toString()
                : "";

        // Log the blocked request for security monitoring.
        System.out.println(
            "[Security] WEBSERVICE request blocked: " + url
        );

        // Return a message indicating that the function is disabled.
        return "WEBSERVICE network access is blocked by security policy.";
    }
}

Step 2: Register the Custom Function

Workbook workbook = new Workbook();
IWorksheet worksheet = workbook.getWorksheets().get(0);

// Register the security override before loading or calculating formulas.
Workbook.AddCustomFunction(
    new BlockedWebServiceFunction(),
    true
);

worksheet.getRange("A1").setFormula(
    "=WEBSERVICE(\"https://example.com\")"
);

workbook.calculate();

// Output:
// WEBSERVICE network access is blocked by security policy.
System.out.println(
    worksheet.getRange("A1").getValue()
);

Examples

• WEBSERVICE("https://restcountries.eu/rest/v2/all")

• WEBSERVICE("https://jsonplaceholder.typicode.com/users")

• WEBSERVICE("https://www.google.com")