1.8 KiB
Privacy and security model
Local processing
Selecting a file grants the current browser tab access to that file's bytes. Office Tools does not upload them, send telemetry or fetch a remote conversion service. Data remains in memory unless a future feature explicitly offers a user-triggered local download or browser-local save.
Threat model
The input may be hostile: a ZIP bomb, path traversal, deeply nested XML, oversized text, misleading MIME information, malformed relationships or active content disguised as media. Readers therefore need limits for compressed and expanded bytes, entry count, XML depth, node count, repeated elements, image dimensions and rendered output.
Package paths are normalized as OPC/ODF paths and may never escape the logical package root. External relationships and document links are not fetched or made active. Imported HTML is never trusted. Macros, scripts, OLE objects and embedded executables are never run. OpenDocument embedded objects are retained only as inert package bytes and reported as omitted from the semantic view.
The ODF reader rejects ambiguous or traversing names, unsupported/encrypted ZIP features, inconsistent headers, overlap, CRC errors, unsafe expansion, DTDs, entities and active XML. It applies byte, entry, ratio, node, depth, repeat, text, cell and image limits inside a disposable worker. OOXML readers likewise run with explicit package/resource limits and external links and Google Fonts disabled.
Browser limits
Local processing is not the same as zero risk: a large document can still cause memory pressure, and rendering depends on the browser's image and font engines. The application should remain cancellable, keep the previous stable UI until a new parse succeeds, and release resources promptly when a file closes.