Skip to content

fix: disambiguate legacy OLE DOC vs XLS detection (#178) - #179

Open
kryptobi wants to merge 2 commits into
mainfrom
fix/disambiguate-doc-xls
Open

kryptobi wants to merge 2 commits into
mainfrom
fix/disambiguate-doc-xls

Conversation

@kryptobi

Copy link
Copy Markdown
Collaborator

DOC and XLS both share the generic OLE/CFBF header (D0 CF 11 E0 A1 B1 1A E1). DOC previously matched only this container signature, which could cause XLS files to be classified as DOC and lead to null from validated type lookup.

Add a DOC-specific subheader check at offset 512:

  • EC A5 C1 00

This makes DOC detection stricter and prevents false positives for XLS files that match XLS-specific offset-512 signatures (e.g. FD FF FF FF ?? 00 / ?? 02).

Add regression tests to verify:

  • OLE + XLS subheader matches XLS and does not match DOC
  • OLE + DOC subheader matches DOC

issue: #178

@kryptobi

Copy link
Copy Markdown
Collaborator Author

@rcaunt fyi

@maxbreuker

Copy link
Copy Markdown
Contributor

@kryptobi Tested with six legacy OLE/CFBF files. doc-word97.doc is detected as Doc as intended. The other five (Word 6/95, LibreOffice-written .doc and .xls, Excel-written .xls) return no match on this branch, where they returned Doc on main. Files and console output attached.

Screen

@kryptobi

kryptobi commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator Author

@kryptobi Tested with six legacy OLE/CFBF files. doc-word97.doc is detected as Doc as intended. The other five (Word 6/95, LibreOffice-written .doc and .xls, Excel-written .xls) return no match on this branch, where they returned Doc on main. Files and console output attached.

Screen

Ok thanks max, i will checks this

DOC and XLS both share the generic OLE/CFBF header
(D0 CF 11 E0 A1 B1 1A E1). DOC previously matched only this
container signature, which could cause XLS files to be
classified as DOC and lead to null from validated type lookup.

Add a DOC-specific subheader check at offset 512:
- EC A5 C1 00

This makes DOC detection stricter and prevents false positives
for XLS files that match XLS-specific offset-512 signatures
(e.g. FD FF FF FF ?? 00 / ?? 02).

Add regression tests to verify:
- OLE + XLS subheader matches XLS and does not match DOC
- OLE + DOC subheader matches DOC

issue: #178
- add cross-family recognition tests for legacy OLE (.doc/.xls/.ppt) and modern OOXML (.docx/.xlsx/.pptx)
- extend FormFileTypeProvider.FindValidatedTypeAsync tests for legacy and modern office uploads
- add synthetic OLE/OOXML test payload builders to keep tests deterministic
@kryptobi
kryptobi force-pushed the fix/disambiguate-doc-xls branch from 2be94df to ecc3bdc Compare September 10, 2026 13:57
@kryptobi
kryptobi requested a review from maxbreuker September 10, 2026 13:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants