Table of Contents

Security policy

DocWright parses files other people wrote: DOCX, DOC, RTF, HTML, Markdown, PDF, report definitions, compound files, metafiles, fonts and images. It is built on the assumption that every input is hostile.

Reporting a vulnerability

Email salwan@albahadly.com with "Security" in the subject. Please report privately and don't post details publicly before a fix ships.

Include the input that triggers it if you can (a file is worth more than a description), the DocWright version, the target framework, and what you saw: a crash, hang, memory growth, an unexpected exception type, or incorrect output.

What counts

In scope. Any input file that, with the default settings, makes DocWright:

  • terminate the process, for example with a StackOverflowException;
  • exhaust memory out of proportion to the input, for example with a decompression bomb;
  • hang, doing unbounded work on bounded input;
  • throw an exception outside its taxonomy. Everything DocWright throws deliberately derives from DocWrightException. A raw NullReferenceException or OverflowException escaping a public method is a bug, because a caller can't write a correct catch for it;
  • read or write outside the streams it was given: path traversal, or any file or network access you didn't ask for;
  • misrepresent the input in a security-relevant way: a signature reported valid when it isn't, or encrypted content written out in the clear.

Out of scope. Rendering differences from Word (bugs, but not security bugs). Resource exhaustion after you raised or removed a limit. Anything that requires the attacker to control your code rather than the document.

The defences

  • Resource limits on size, time, pages, memory, images and nesting. See Hardening untrusted input.
  • Recursion is bounded structurally, wherever exceeding it would end the process, by ceilings a caller can't remove.
  • Numbers from files are clamped where they're parsed, before they reach arithmetic or allocation.
  • Decoders bound their own output from the declared header before allocating: a declared size is a request, not a fact.
  • Nothing is fetched and nothing is executed: no network or file access on a document's behalf, no scripts, macros or report code.

These rules are tested with structurally valid documents carrying hostile values and depths, driven end to end through every reader.