Parsing a file safely

External entity declarations#

Several document formats allow a file to declare entities — named pieces of content the parser substitutes while reading. An entity may point outside the document: at a file on the machine doing the parsing, or at a network address. A parser that resolves those declarations is following instructions written by whoever sent the document, which is how a routine attachment becomes a way to read a server's own files or to make it call an address of somebody else's choosing.

Connect refuses documents carrying these declarations rather than parsing them with entity resolution turned off. The distinction is worth understanding: turning the feature off is a configuration, and a configuration is something that can be missed in one code path, restored by a library upgrade, or defaulted differently on another machine. A refusal has no setting to get wrong.

Archives that expand out of proportion#

DOCX, XLSX and PPTX are ZIP archives with structured content inside. That makes them compact, and it makes a particular trick possible: an archive of trivial size crafted to expand into a volume of data large enough to exhaust memory or disk on whatever opens it. The damage is done by the act of decompressing, so a check applied afterwards is a check applied after the outage.

The refusal is on the ratio between the stored size and the declared expanded size, evaluated before expansion. An ordinary spreadsheet expands roughly in proportion to its content and passes; a file whose ratio is absurd does not, regardless of how small it looked in a file listing.

Formula injection, on the way out#

The third case runs in the opposite direction. When Connect exports records as CSV, a cell whose value begins with an equals sign, a plus, a minus or an at sign is treated by most spreadsheet applications as a formula when the file is opened — and a formula in a spreadsheet can do considerably more than arithmetic. The value that becomes that cell may have come from outside your business: a company name typed into a form, a subject line, an imported row.

Export neutralises those values so they leave as text and open as text. This is why an exported CSV sometimes looks escaped when you inspect it in a plain editor — the escaping is the protection, and a CSV export that looks escaped explains what to do if you genuinely wanted a formula there.

What none of this covers#

• It is not a virus scanner. These are structural refusals about how a document is built, not a judgement about malicious content inside a well-formed one.
• It does not make a document's claims true. A safely parsed invoice is still whatever somebody wrote; parsing safety and factual accuracy are different subjects.
• It does not treat document content as instruction. Text inside a file asking Connect to act is reported as content, never obeyed — which is a separate rule from these three and applies to every format.
• It does not depend on a list of known attacks, which is the point. A refusal on structure holds against a variant nobody has named yet.

The reason to write those four down is that file-handling safety is often described as though one measure covered everything. These three do specific, provable jobs, and knowing their edges is more useful than a general assurance.

Questions#

Related#

• Validating a file
• Adding a file
• A CSV export looks escaped
• Security and isolation
• Prompt injection arrives as ordinary business mail