Skip to content

fix(security): harden DOCX ZIP handling and output scrubbing#2

Merged
lowtidebuild merged 6 commits into
mainfrom
fix/security-hardening
Apr 17, 2026
Merged

fix(security): harden DOCX ZIP handling and output scrubbing#2
lowtidebuild merged 6 commits into
mainfrom
fix/security-hardening

Conversation

@lowtidebuild

Copy link
Copy Markdown
Owner

Summary

  • add ZIP-level and entry-level guards for DOCX loading paths
  • strip external http/https URLs from .rels files and fail verification if any survive
  • remove docProps/custom.xml and its [Content_Types].xml override during metadata scrubbing

Testing

  • bun run test
  • SKIP_REDOS_FUZZ=0 bun run test
  • bun run build

@lowtidebuild lowtidebuild merged commit 52c5d04 into main Apr 17, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant