dotnet / dotnet/Open-XML-SDK

New DOCX document is created with Override node rather than Default node in [Content_Types].xml

Open
#994 3 comments 0 reactions 0 assignees View on GitHub
more-information-needed
Dominant language
C#
Stars
4.6k
Forks
605
PR merge metrics
No merged PRs in 30d

Description

**Description**

When creating a blank DOCX document with Open XML SDK. 'Default' nodes were created rather than 'Override' node in [Content_Types].xml, which would fail security checks when streaming the document

**Information**

- .NET Target: .NET Framework 4.6
- DocumentFormat.OpenXml Version: 2.13.0

**Repro**

```csharp
using (WordprocessingDocument wordDocument =
WordprocessingDocument.Create(filepath, WordprocessingDocumentType.Document))
{
// Add a main document part.
MainDocumentPart mainPart = wordDocument.AddMainDocumentPart();

// Create the document structure and add some text.
mainPart.Document = new Document();
Body body = mainPart.Document.AppendChild(new Body());
Paragraph para = body.AppendChild(new Paragraph());
Run run = para.AppendChild(new Run());
run.AppendChild(new Text("Create text in body - CreateWordprocessingDocument"));
}
```

**Observed**

'Default' nodes were created rather than 'Override' node in [Content_Types].xml, which would fail security checks when streaming the document.

According to https://social.msdn.microsoft.com/Forums/en-US/1849f943-598f-43d1-bef5-99aad5d18b0c/override-vs-default?forum=oxmlsdk:
If the package is intended for streaming consumption:
· The package implementer should not allow Default elements; as a consequence, there should be one Override element for each part in the package.
· The format producer should write the Override elements to the package so they appear before the parts to which they correspond, or in close proximity to the part to which they correspond.

Also, if I opened the document in Word and re-saved it, the 'Override' node will be created automatically by MS Office, so MS Office also seems to use the 'Override' node as the preferred option.

This also caused issues when streaming/uploading the document, some security checks will scan if the document has the 'Override' node defined and mapped properly so that it can be determined as a safe and valid DOCX file.

**Expected**

'Override' node should be created when a new document is created with Open XML SDK, with each xml part of the package be explicitly mapped to the node.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.