feat: release Office Tools 0.1.0

2026-08-31 22:37:01 +02:00
commit a5524e27e3
90 changed files with 16328 additions and 0 deletions
@@ -0,0 +1,36 @@
+# Privacy and security model
+
+## Local processing
+
+Selecting a file grants the current browser tab access to that file's bytes.
+Office Tools does not upload them, send telemetry or fetch a remote conversion
+service. Data remains in memory unless a future feature explicitly offers a
+user-triggered local download or browser-local save.
+
+## Threat model
+
+The input may be hostile: a ZIP bomb, path traversal, deeply nested XML,
+oversized text, misleading MIME information, malformed relationships or active
+content disguised as media. Readers therefore need limits for compressed and
+expanded bytes, entry count, XML depth, node count, repeated elements, image
+dimensions and rendered output.
+
+Package paths are normalized as OPC/ODF paths and may never escape the logical
+package root. External relationships and document links are not fetched or made
+active. Imported HTML is never trusted. Macros, scripts, OLE objects and
+embedded executables are never run. OpenDocument embedded objects are retained
+only as inert package bytes and reported as omitted from the semantic view.
+
+The ODF reader rejects ambiguous or traversing names, unsupported/encrypted ZIP
+features, inconsistent headers, overlap, CRC errors, unsafe expansion, DTDs,
+entities and active XML. It applies byte, entry, ratio, node, depth, repeat,
+text, cell and image limits inside a disposable worker. OOXML readers likewise
+run with explicit package/resource limits and external links and Google Fonts
+disabled.
+
+## Browser limits
+
+Local processing is not the same as zero risk: a large document can still cause
+memory pressure, and rendering depends on the browser's image and font engines.
+The application should remain cancellable, keep the previous stable UI until a
+new parse succeeds, and release resources promptly when a file closes.