🐛 OOXML: Don't remove OLE objects

They are recursively sanitised by the OLE bleach
docbleach · May 4, 2017 · 77ee356 · 77ee356 · punkeel · May 4, 2017
1 parent 27a46db
commit 77ee356
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 10 deletions.
diff --git a/module/module-office/src/main/java/xyz/docbleach/module/ole2/OLE2Bleach.java b/module/module-office/src/main/java/xyz/docbleach/module/ole2/OLE2Bleach.java
@@ -42,6 +42,7 @@ public void sanitize(InputStream inputStream, OutputStream outputStream, BleachS
                 NPOIFSFileSystem fsIn = new NPOIFSFileSystem(inputStream);
                 NPOIFSFileSystem fs = new NPOIFSFileSystem()
         ) {
+            // @TODO: Filter based on Storage Class ID - see issue #23
             sanitize(session, fsIn, fs);
 
             if (ClassID.EXCEL97.equals(fs.getRoot().getStorageClsid())) {
@@ -72,6 +73,7 @@ protected void sanitize(BleachSession session, DirectoryEntry rootIn, DirectoryE
                 .and(new SummaryInformationSanitiser(session));
 
         LOGGER.debug("Root ClassID: {}", rootIn.getStorageClsid());
+        rootOut.setStorageClsid(rootIn.getStorageClsid());
 
         rootIn.getEntries().forEachRemaining(entry -> {
             if (!visitor.test(entry)) {

diff --git a/module/module-office/src/main/java/xyz/docbleach/module/ooxml/OOXMLBleach.java b/module/module-office/src/main/java/xyz/docbleach/module/ooxml/OOXMLBleach.java
@@ -46,12 +46,6 @@ public class OOXMLBleach implements Bleach {
             Relations.VBA_PROJECT_SIGNATURE,
             Relations.WORD_VBA_DATA,
 
-            // OLE Objects
-            Relations.OPENXML_OLE_OBJECT,
-            Relations.OLE_OBJECT,
-            Relations.E1_OBJECT,
-            Relations.E2_OBJECT,
-
             // ActiveX Controls
             Relations.OPENXML_CONTROL,
             Relations.OPENXML_ACTIVEX_CONTROL,
@@ -69,10 +63,6 @@ public class OOXMLBleach implements Bleach {
             // Blacklisting Postscript to prevent 0days
             ContentTypes.POSTSCRIPT,
 
-            // OLE Objects
-            ContentTypes.OLE_OBJECT,
-            ContentTypes.PACKAGE,
-
             // ActiveX objects
             ContentTypes.ACTIVEX,
             ContentTypes.OPENXML_ACTIVEX,