Skip to content

fix(security): harden DOCX ZIP handling and output scrubbing#2

Merged
kipeum86 merged 6 commits into
mainfrom
fix/security-hardening
Apr 17, 2026
Merged

fix(security): harden DOCX ZIP handling and output scrubbing#2
kipeum86 merged 6 commits into
mainfrom
fix/security-hardening

Conversation

@kipeum86

Copy link
Copy Markdown
Owner

Summary

  • add ZIP-level and entry-level guards for DOCX loading paths
  • strip external http/https URLs from .rels files and fail verification if any survive
  • remove docProps/custom.xml and its [Content_Types].xml override during metadata scrubbing

Testing

  • bun run test
  • SKIP_REDOS_FUZZ=0 bun run test
  • bun run build

@kipeum86 kipeum86 merged commit 52c5d04 into main Apr 17, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant