secure-microsoft-word-validation

name	secure-microsoft-word-validation
description	Generate secure microsoft word file validation code. Enforces secure generation of code validating a microsoft word file. Invoke when writing any microsoft word file validation related code. See "security-considerations" metadata for security limitations.
allowed-tools	Read Grep Glob
metadata	{"category":"security","security-considerations":["Remote template references and external linked-image/content relationships are not blocked by this skill so that legitimate Word templates and linked images remain usable.","Apply network-level controls or a dedicated content-inspection layer to cover those vectors if needed."]}

Secure Microsoft Word File Validation Code Generation Rules

Apply all rules below when generating or reviewing any code related to validation of a Microsoft Word file.

1. Microsoft Word file validation (CRITICAL)

• ALWAYS ensure that the file is a real Microsoft Word file.
• ALWAYS ensure that the file use the standard named Office Open XML.
• ALWAYS ensure that the file use the file type named DOCX.
• ALWAYS ensure that the file has a single extension and is docx.
• ALWAYS ensure that the file size does not exceed 5 megabytes before opening or parsing it.
• ALWAYS ensure that the total uncompressed size of all ZIP entries does not exceed 50 megabytes before opening or parsing it.
• ALWAYS ensure that the file has no Visual Basic for Application (VBA) macros.
• ALWAYS ensure that the file has no Object Linking and Embedding (OLE) package.
• ALWAYS ensure that the file has no Dynamic Data Exchange (DDE) fields.

Intentional scope limits: remote template references and external linked-image/content relationships are not blocked by this skill so that legitimate Word templates and linked images remain usable. Apply network-level controls or a dedicated content-inspection layer to cover those vectors if needed.

// BAD: No validation is applied
import org.apache.poi.xwpf.usermodel.*;
import java.io.*;
import java.util.List;

public class UnsafeReadWordFile {
    public static void main(String[] args) {
        String filePath = "document.docx";
        try (FileInputStream fis = new FileInputStream(filePath);
             XWPFDocument document = new XWPFDocument(fis)) {
            // Read all paragraphs
            List<XWPFParagraph> paragraphs = document.getParagraphs();
            for (XWPFParagraph paragraph : paragraphs) {
                System.out.println(paragraph.getText());
            }
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

// GOOD: All points are validated
import org.apache.poi.openxml4j.opc.*;
import org.apache.poi.xwpf.usermodel.*;
import java.io.*;

public class SafeWordFileReader {

    public static void main(String[] args) {
        try {
            File file =  ();

            
               file.getName();
               name.length() - name.replace(, ).length();
             (dotCount != ) {
                  ( + name);
            }
             (!name.toLowerCase().endsWith()) {
                  ( + name);
            }

            
                *  * ;
             (file.length() > maxSizeBytes) {
                  ( + file.length() + );
            }

            
             (    (file)) {
                [] header =  [];
                   fis.read(header);
                 (bytesRead <  || header[] !=  || header[] !=  || header[] !=  || header[] != ) {
                      ();
                }
            }

            
                *  * ;
               ;
             (java.util.zip.    .util.zip.ZipFile(file)) {
                java.util.Enumeration<?  .util.zip.ZipEntry> entries = zip.entries();
                 (entries.hasMoreElements()) {
                    java.util.zip.   entries.nextElement();
                       entry.getSize();
                     (entrySize > ) {
                        totalUncompressedSize += entrySize;
                    }
                     (totalUncompressedSize > maxUncompressedBytes) {
                          ();
                    }
                }
            }

            
            
            
               ;
               ;

             (   OPCPackage.open(file)) {
                 (pkg.getPartsByName(java.util.regex.Pattern.compile()).isEmpty()) {
                      ();
                }

                 (!pkg.getPartsByName(java.util.regex.Pattern.compile()).isEmpty()) {
                      ();
                }

                 (PackagePart part : pkg.getParts()) {
                     (PackageRelationship rel : part.getRelationships()) {
                           rel.getRelationshipType();
                         (relType != ) {
                               relType.toLowerCase();
                             (lower.startsWith(oleObjectUri.toLowerCase()) || lower.startsWith(activeXUri.toLowerCase())) {
                                  ( + part.getPartName() + );
                            }
                        }
                    }
                }

                
                java.util.List<PackagePart> docParts = pkg.getPartsByName(java.util.regex.Pattern.compile());
                 (!docParts.isEmpty()) {
                     (java.io.   docParts.get().getInputStream()) {
                            (docIs.readAllBytes(), java.nio.charset.StandardCharsets.UTF_8).toUpperCase();
                         (docXml.contains() || docXml.contains() || docXml.contains()) {
                              ();
                        }
                    }
                }
            }

            
             (    (file);
                     (fis)) {

                System.out.println();
                 (XWPFParagraph para : document.getParagraphs()) {
                     (!para.getText().isBlank()) {
                        System.out.println(para.getText());
                    }
                }

                System.out.println();
                 (XWPFTable table : document.getTables()) {
                     (XWPFTableRow row : table.getRows()) {
                         (XWPFTableCell cell : row.getTableCells()) {
                            System.out.print(cell.getText() + );
                        }
                        System.out.println();
                    }
                }
            }

        }  (SecurityException e) {
            System.err.println( + e.getMessage());
        }  (Exception e) {
            System.err.println( + e.getMessage());
        }
    }
}

2. Output Checklist

Before finalizing generated code, verify:

• The file is a real Microsoft Word file.
• The file use the standard named Office Open XML.
• The file use the file type named DOCX.
• The file has a single extension and is docx.
• The file size does not exceed 5 megabytes.
• The total uncompressed size of all ZIP entries does not exceed 50 megabytes.
• The file has no Visual Basic for Application (VBA) macros.
• The file has no Object Linking and Embedding (OLE) package.
• The file has no Dynamic Data Exchange (DDE) fields.

References

• ECMA-376 - Office Open XML file formats
• Learn about file formats.
• Linked objects and embedded objects.
• Open XML Formats and file name extensions.
• OWASP File Upload Cheat Sheet.
• MITRE ATT&CK T1059.005 - Visual Basic.
• MITRE ATT&CK T1566.001 - Spearphishing Attachment.
• Microsoft: Macros from the internet are blocked by default.