# WEBSERVICE
## Content
This function returns data from a web service on the Internet or Intranet.
## Syntax
`WEBSERVICE(url)`
## Arguments
This function has the following argument:
| Argument | Description |
| -------- | ----------- |
| *url* | [required] The URL of the web service to be called. |
## Remarks
The function supports HTTP (http and https) protocol. DsExcel.NET return "" as default value before the result is returned from the service. The correct result is displayed only when the response result is string type. If other formats like images, audio, video are used, it returns unreadable code.
The function returns a #VALUE! error in following scenarios:
* If the returned URL is a string with more than 2048 characters.
* If the request takes more than 10 seconds.
* If the request does not follow the same origin policy and the target website does not support CORS (Cross-Origin Resource Sharing) from source origin, on browser. In such case, the browser prints CORS Error on console instead of DsExcel.NET.
* If FTP or FILE protocol is used.
## Security Risks
WEBSERVICE sends outbound HTTP or HTTPS requests during formula evaluation.
If a workbook containing WEBSERVICE formulas comes from an untrusted source, a malicious formula may attempt to access internal or protected network resources that are reachable from the application environment. In server-side or desktop scenarios, this may introduce a Server-Side Request Forgery (SSRF) risk.
## Best Practices
When handling files that contain WEBSERVICE formulas, consider the following security practices:
**Validate Input Files**
* Only open or process Excel files from trusted sources.
* Inspect uploaded or imported files for formulas that use WEBSERVICE.
* Review formula content in automated workflows if files may come from external users or systems.
**Restrict Network Access**
* Run formula evaluation in an environment with restricted outbound network access when external data retrieval is not required.
* Use a proxy or other network controls to limit where WEBSERVICE can send requests.
* Avoid allowing direct access from the application environment to sensitive internal services unless it is explicitly required.
**Restrict Runtime Behavior**
* Override the default WEBSERVICE function with a custom implementation if your application must block or control outbound requests.
* Log WEBSERVICE activity, including blocked requests, for monitoring and audit purposes.
## Secure Configuration
One practical mitigation is to replace the default WEBSERVICE function with a custom function that blocks outbound network access.
The following example shows how to override WEBSERVICE so that formula evaluation does not send an actual HTTP request.
**Step 1: Create a Custom Function to Block WEBSERVICE**
```java
public class BlockedWebServiceFunction extends CustomFunction {
public BlockedWebServiceFunction() {
super(
"WEBSERVICE",
FunctionValueType.Text,
new Parameter[] {
new Parameter(FunctionValueType.Text)
}
);
}
@Override
public Object evaluate(
Object[] arguments,
ICalcContext context) {
String url = arguments != null
&& arguments.length > 0
&& arguments[0] != null
? arguments[0].toString()
: "";
// Log the blocked request for security monitoring.
System.out.println(
"[Security] WEBSERVICE request blocked: " + url
);
// Return a message indicating that the function is disabled.
return "WEBSERVICE network access is blocked by security policy.";
}
}
```
**Step 2: Register the Custom Function**
```java
Workbook workbook = new Workbook();
IWorksheet worksheet = workbook.getWorksheets().get(0);
// Register the security override before loading or calculating formulas.
Workbook.AddCustomFunction(
new BlockedWebServiceFunction(),
true
);
worksheet.getRange("A1").setFormula(
"=WEBSERVICE(\"https://example.com\")"
);
workbook.calculate();
// Output:
// WEBSERVICE network access is blocked by security policy.
System.out.println(
worksheet.getRange("A1").getValue()
);
```
## Examples
* WEBSERVICE("https://restcountries.eu/rest/v2/all")
* WEBSERVICE("https://jsonplaceholder.typicode.com/users")
* WEBSERVICE("https://www.google.com")