Office Open XML
A .docx, .xlsx or .pptx file is a ZIP archive containing XML parts and a map of how they relate. That makes them readable without the application that wrote them, and it makes them archives — which is why a parser has to refuse both external entity declarations and archives that expand out of all proportion to their size.
Inside the container#
Unzip any of the three and the same pattern appears: a content-types part declaring what each file is, a relationships part linking them, and then the document's own XML. Text and formatting are separate — the runs of characters are in one place and the styling that makes them look like a heading is in another.
| Format | Principal parts | What extracts cleanly |
|---|---|---|
| DOCX | The document body, styles, numbering, headers and footers, embedded media | Paragraph text, headings, lists and tables, in reading order |
| XLSX | A workbook part, one part per sheet, a shared-strings table, styles | Cell values, sheet names, formulas and the grid — a real structure rather than an inferred one |
| PPTX | One part per slide, plus layouts, masters, notes and media | Slide text, speaker notes, and the order of slides |
The shared-strings table in a spreadsheet is worth knowing about: repeated text is stored once and referenced by index, so a cell's XML often contains a number where you expected a word.
Spreadsheets have two answers per cell#
A formula cell stores the formula and the value last computed by an application that opened the file. A reader that does not evaluate formulas — which is most of them — reports the cached value. That is usually right and occasionally stale, if the file was generated by a tool that wrote formulas without computing them.
- Dates
- Stored as serial numbers counted from a workbook epoch, with formatting deciding how they display. A date read as a five-digit number is the number being read faithfully
- Numbers as text
- A cell formatted as text holds a string, and a column that mixes the two sorts and totals in ways nobody intended
- Merged cells
- One value, several apparent cells. Extraction places it once and leaves the rest empty
- Hidden sheets and rows
- Present in the file and invisible in the application. A reader sees everything
- The older
.xls,.doc,.ppt - A completely different binary format, not a ZIP of XML. A reader for one cannot read the other
Two attacks that belong to the container, not the content#
Because these formats are XML inside a ZIP, they inherit the risks of both.
- External entity declarations. XML permits a document to declare an entity that resolves to something else — a file on the parsing machine, or a URL. A parser that honours it can be made to read or fetch on the attacker's behalf, and the result may be returned inside what looks like ordinary document text.
- Archive expansion. A small archive can be crafted to decompress into something enormous, exhausting memory or disk before anything has been read. The file is a few kilobytes; the extraction is not.
Does Connect use Office Open XML?#
Yes. DOCX, XLSX and PPTX are among the formats read with the standard library, alongside PNG, JPEG and WebP images, PDF, CSV and TSV, and plain TXT, Markdown and JSON. Files attach by button, drop or paste, and go through one file service both audiences share — file_workspace over records that are already workspace-scoped and under row-level security, so no separate store was introduced for them.
DOCTYPE and ENTITY declarations are refused, and so are zip bombs. That is the direct answer to the two attacks above, applied at the point of parsing rather than left to whatever opens the file next.
Connect can also create and modify files, as new versions with provenance and an audit entry rather than as edits in place — so a spreadsheet Connect changed can be compared with the one it started from.
Questions#
Why does a spreadsheet cell come back as a number when it shows a date?
Because that is what the file contains. Dates are serial numbers counted from the workbook's epoch, and the display you see is a formatting instruction applied on top. A reader that reports the underlying value is being accurate; converting it needs the epoch and the format, both of which are elsewhere in the archive.
Can Connect read an old .doc or .xls file?
Those are a different format — a binary layout that predates the XML-in-ZIP one and shares nothing with it structurally. The documented formats are the modern DOCX, XLSX and PPTX. Re-saving an old file in the current format is the reliable route.
Is a formula's result trustworthy if nobody opened the file?
The value read is the one last cached by an application that computed it. For files produced by a spreadsheet application that is the correct current value; for files generated programmatically it may never have been computed at all. Where a total matters, check it rather than assuming the cache is fresh.