Copilot commented on code in PR #3063:
URL: https://github.com/apache/tika/pull/3063#discussion_r3846044555
##########
tika-core/src/main/java/org/apache/tika/metadata/Office.java:
##########
@@ -234,6 +234,29 @@ public interface Office {
// Security-relevant: Framesets can load external URLs
Property HAS_FRAMESETS =
Property.internalBoolean("msoffice:doc:has-framesets");
+ /**
+ * Security-relevant, best-effort: true when the OOXML package contains
one or more
+ * declared parts that are NOT reachable from the package root through the
OPC
+ * relationship graph. Office and Tika load content by following
relationships, so an
+ * unreferenced part is carried in the file but never parsed -- a place to
hide bytes
+ * that a raw-ZIP reader (AV/DLP/CDR) can still see. (Note: a part with no
declared
Review Comment:
This public Javadoc says an unreferenced part is "never parsed," but
`SXWPFWordExtractorDecorator` enumerates main-story parts by content type and
the new test deliberately shows that an unreferenced wordprocessing part is
still emitted. Please weaken this wording so consumers do not treat the signal
as proof that the bytes were not parsed.
##########
tika-core/src/main/java/org/apache/tika/metadata/Office.java:
##########
@@ -234,6 +234,29 @@ public interface Office {
// Security-relevant: Framesets can load external URLs
Property HAS_FRAMESETS =
Property.internalBoolean("msoffice:doc:has-framesets");
+ /**
+ * Security-relevant, best-effort: true when the OOXML package contains
one or more
+ * declared parts that are NOT reachable from the package root through the
OPC
+ * relationship graph. Office and Tika load content by following
relationships, so an
+ * unreferenced part is carried in the file but never parsed -- a place to
hide bytes
+ * that a raw-ZIP reader (AV/DLP/CDR) can still see. (Note: a part with no
declared
+ * content type is a different case -- POI rejects the whole package at
open time, so
+ * it cannot appear on a successfully parsed file.)
+ * <p>This is an informational signal, NOT a guarantee, and it is evadable
(a payload
+ * referenced by a relationship type Tika ignores is still reachable): per
+ * <a href="https://tika.apache.org/security-model.html";>Tika's security
model</a>,
+ * Tika is not a security boundary and does not attempt to detect parser
differentials.
+ * See {@link #UNREFERENCED_PART_NAMES} for the part names.
+ */
+ Property HAS_UNREFERENCED_PARTS =
+ Property.internalBoolean("msoffice:has-unreferenced-parts");
Review Comment:
This adds a new public metadata signal and changes OOXML parser output, but
the unreleased `CHANGES.txt` has no `TIKA-4837` entry. Please add a
release-note entry so consumers can discover the new metadata and the
repository's user-visible-change checklist is satisfied.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
