Validating a file
Validation happens before parsing, not during it. The declared type is checked against what the bytes actually are, and two structural refusals are applied: a document that declares external entities, and an archive-backed format that expands out of proportion. A file that fails is refused at the door, before any reader has seen it.
Why the order matters more than the checks#
Almost every serious file-handling failure is a parser that started work on input it should have refused. Once a parser is running, it is doing what the document tells it to do — resolving references, expanding structures, allocating memory — and a check applied at that point is a check applied too late. So the order here is fixed: identify, refuse, and only then parse.
The consequence you can see is that a refused file leaves nothing behind. There is no partially extracted text, no half-populated row and no temporary artefact to clean up, because extraction never began.
The type check#
A file arrives with a declared type and a name, and neither is evidence. The check compares the declaration against the bytes themselves, and the bytes win. A spreadsheet renamed to end in .png is not an image, and a file claiming to be a PDF whose contents are something else is refused rather than handed to the PDF reader to find out.
| Claimed | Actual | Result |
|---|---|---|
image/png | PNG bytes | Accepted; the image reader runs |
image/png | A ZIP-backed document | Refused; the declaration and the bytes disagree |
application/pdf | PDF bytes with a text layer | Accepted; text extraction runs |
| Anything | A format with no reader here | Refused; nothing could be extracted from it |
The two attacks it stops#
- External entity declarations
- A document can declare an entity that points at something outside itself — another file on the machine, or a network address — and a naive parser resolves it while parsing. The result is a document that reads a server's own files, or reaches out to an address of the author's choosing. Connect refuses documents carrying these declarations rather than parsing with the feature disabled, because refusal has no configuration to get wrong.
- Zip bombs
- Several formats here are ZIP archives underneath — DOCX, XLSX, PPTX. A small archive can be crafted to expand into an enormous volume of data, exhausting memory or disk on the machine that opens it. The refusal is on the expansion ratio, applied before expanding, so nothing is spent finding out.
Both are refused on structure alone. Neither refusal depends on recognising a particular attack, a signature or a known-bad list, which is what makes them hold against variants nobody has catalogued. Parsing a file safely goes through each in more detail, including the third protection that applies on the way out rather than on the way in.
What a refusal looks like to you#
You add the file.
Result It is checked. On failure you are told it was refused and given the class of reason.
Check the obvious explanation first: is this actually the format the name says?
Result A file renamed rather than converted is the commonest cause by a wide margin.
If it is genuinely the format it claims, open it in its own application and re-save it.
Result Re-saving through the application that owns the format removes the structural oddity in most cases, because the application writes a clean file.
If it still fails, send the content another way — export the sheet as CSV, print the document to a text-layer PDF.
Result The content reaches Connect through a format with nothing structurally unusual in it.
Questions#
Does validation read the contents of my document?
No. It examines the structure — what the bytes say the format is, and whether the document declares things a parser should not follow. What the document is about plays no part in whether it is accepted.
Why refuse a document with external entities instead of ignoring them?
Because ignoring them is a setting, and a setting can be wrong somewhere, once, later. Refusing the document is a decision that cannot be misconfigured, and a legitimate business document has no reason to carry those declarations.
Is a large file the same as a zip bomb?
No. The refusal is on the ratio between the compressed size and what it expands to, not on size alone. An ordinary large spreadsheet expands roughly in proportion and is accepted.