38 lines
1.8 KiB
Markdown
38 lines
1.8 KiB
Markdown
# Privacy and security model
|
|
|
|
## Local processing
|
|
|
|
Selecting a file grants the current browser tab access to that file's bytes.
|
|
Office Tools does not upload them, send telemetry or fetch a remote conversion
|
|
service. Data remains in memory unless the user explicitly chooses an exact-copy
|
|
or derived local download. Download actions create short-lived object URLs and
|
|
do not contact a service.
|
|
|
|
## Threat model
|
|
|
|
The input may be hostile: a ZIP bomb, path traversal, deeply nested XML,
|
|
oversized text, misleading MIME information, malformed relationships or active
|
|
content disguised as media. Readers therefore need limits for compressed and
|
|
expanded bytes, entry count, XML depth, node count, repeated elements, image
|
|
dimensions and rendered output.
|
|
|
|
Package paths are normalized as OPC/ODF paths and may never escape the logical
|
|
package root. External relationships and document links are not fetched or made
|
|
active. Imported HTML is never trusted. Macros, scripts, OLE objects and
|
|
embedded executables are never run. OpenDocument embedded objects are retained
|
|
only as inert package bytes and reported as omitted from the semantic view.
|
|
|
|
The ODF reader rejects ambiguous or traversing names, unsupported/encrypted ZIP
|
|
features, inconsistent headers, overlap, CRC errors, unsafe expansion, DTDs,
|
|
entities and active XML. It applies byte, entry, ratio, node, depth, repeat,
|
|
text, cell and image limits inside a disposable worker. OOXML readers likewise
|
|
run with explicit package/resource limits and external links and Google Fonts
|
|
disabled.
|
|
|
|
## Browser limits
|
|
|
|
Local processing is not the same as zero risk: a large document can still cause
|
|
memory pressure, and rendering depends on the browser's image and font engines.
|
|
The application should remain cancellable, keep the previous stable UI until a
|
|
new parse succeeds, and release resources promptly when a file closes.
|