33 lines
1.4 KiB
Markdown
33 lines
1.4 KiB
Markdown
# Security policy
|
|
|
|
Office files are untrusted structured packages. Reports about package traversal,
|
|
resource exhaustion, unsafe markup, external-resource loading, active-content
|
|
execution or privacy leakage are particularly welcome.
|
|
|
|
## Reporting
|
|
|
|
Please report a vulnerability privately to the repository owner through the
|
|
private contact mechanism on <https://git.add-ideas.de/lotobo/office-tools>.
|
|
Include the affected version, browser, a minimal reproducer when safe, and the
|
|
expected security boundary. Do not attach confidential source documents; reduce
|
|
them to synthetic fixtures first.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest tagged release receives security fixes before version 1.0.
|
|
|
|
## Security boundary
|
|
|
|
Office Tools promises local processing and no intentional telemetry or upload.
|
|
It does not promise that every malformed package can be recovered or that every
|
|
browser is immune to memory pressure. The implementation must:
|
|
|
|
- reject traversal, absolute and ambiguous package paths;
|
|
- bound compressed size, expanded size, entry count, XML depth and rendered
|
|
output;
|
|
- render parsed data through application-owned components rather than trusting
|
|
imported HTML;
|
|
- never execute macros, scripts, OLE objects or embedded executables;
|
|
- avoid automatic network access for document relationships and links; and
|
|
- release object URLs, workers and large buffers when a document closes.
|