1.4 KiB
Security policy
Office files are untrusted structured packages. Reports about package traversal, resource exhaustion, unsafe markup, external-resource loading, active-content execution or privacy leakage are particularly welcome.
Reporting
Please report a vulnerability privately to the repository owner through the private contact mechanism on https://git.add-ideas.de/lotobo/office-tools. Include the affected version, browser, a minimal reproducer when safe, and the expected security boundary. Do not attach confidential source documents; reduce them to synthetic fixtures first.
Supported versions
Only the latest tagged release receives security fixes before version 1.0.
Security boundary
Office Tools promises local processing and no intentional telemetry or upload. It does not promise that every malformed package can be recovered or that every browser is immune to memory pressure. The implementation must:
- reject traversal, absolute and ambiguous package paths;
- bound compressed size, expanded size, entry count, XML depth and rendered output;
- render parsed data through application-owned components rather than trusting imported HTML;
- never execute macros, scripts, OLE objects or embedded executables;
- avoid automatic network access for document relationships and links; and
- release object URLs, workers and large buffers when a document closes.