Safer Document Processing for .NET Apps

using DevExpress.XtraRichEdit;

using var wordProcessor = new RichEditDocumentServer();
var securityLoadingLimits = wordProcessor.Options.SecurityLoadingLimits;
securityLoadingLimits.MaxFileSize = 50 * 1024 * 1024; 
securityLoadingLimits.MaxParagraphCount = 100_000; 
securityLoadingLimits.MaxTableCount = 1_000; 
securityLoadingLimits.MaxXmlElementDepth = 128; 

wordProcessor.SecurityLoadingLimitExceeded += (_, e) => { 
    auditLog.Record($"Rejected: {e.PropertyName}"); 
    e.Handled = false; // abort loading 
}; 

using var inputStream = new MemoryStream(File.ReadAllBytes("incoming.docx"));
wordProcessor.LoadDocument(inputStream, DocumentFormat.Docx);

using DevExpress.Spreadsheet;  

using var workbook = new Workbook(); 
var securityLoadingLimits = workbook.Options.SecurityLoadingLimits;
securityLoadingLimits.MaxFileSize = 150 * 1024 * 1024; 
securityLoadingLimits.MaxWorksheetCount = 50; 
securityLoadingLimits.MaxSheetCellCount = 500_000; 
securityLoadingLimits.MaxChartCount = 10; 

workbook.SecurityLoadingLimitExceeded += (_, e) => { 
    auditLog.Record($"Rejected: {e.PropertyName}"); 
    e.Handled = false; 
}; 

using var inputStream = new MemoryStream(File.ReadAllBytes("upload.xlsx"));
workbook.LoadDocument(inputStream, DocumentFormat.Xlsx);

using DevExpress.XtraRichEdit;

using var wordProcessor = new RichEditDocumentServer();
using var inputStream = new MemoryStream(File.ReadAllBytes("Document.docm"));
wordProcessor.LoadDocument(inputStream, DocumentFormat.Docm);

//...
// Word — all options (equivalent to CreateStrict())
var options = new WordProcessingSanitizeOptions {
    Metadata             = MetadataRemovalScope.All,
    RemoveComments       = true,
    RemoveCustomXmlParts = true,
    RemoveActiveXContent = true,
    RemoveMacros         = true,
    RemoveOleObjects     = true,
    TrackChanges         = TrackChangesSanitizeMode.Reject,
    HiddenText           = HiddenContentSanitizeMode.Remove,
    InvisibleText        = InvisibleContentSanitizeMode.Remove
};

// Returns a structured findings list — use as an audit record
IList<WordProcessingSanitizeResult> findings = wordProcessor.Sanitize(options);

foreach (var f in findings)
    auditLog.Record($"{f.Type}: {f.Action}");

using var sanitizedStream = new MemoryStream();
wordProcessor.SaveDocument(sanitizedStream, DocumentFormat.Docm);

using DevExpress.Office;
using DevExpress.Spreadsheet;

using var workbook = new Workbook();
using var inputStream = new MemoryStream(File.ReadAllBytes("Template.xlsm"));
workbook.LoadDocument(inputStream, DocumentFormat.Xlsm);

//...
// Excel — selective: expose hidden structure, strip metadata
var options = new WorkbookSanitizeOptions {
    Metadata                    = MetadataRemovalScope.All,
    HiddenSheets                = HiddenContentSanitizeMode.MakeVisible,
    HiddenRows                  = HiddenContentSanitizeMode.Remove,
    HiddenColumns               = HiddenContentSanitizeMode.Remove,
    InvisibleCellText           = InvisibleContentSanitizeMode.Remove,
    RemoveComments              = true,
    RemoveThreadedComments      = true,
    RemoveSharedWorkbookHistory = true,
    RemoveExternalConnections   = true
};

IList<WorkbookSanitizeResult> findings = workbook.Sanitize(options);

foreach (var f in findings)
    auditLog.Record($"{f.Type}: {f.Action}");

using var sanitizedStream = new MemoryStream();
workbook.SaveDocument(sanitizedStream, DocumentFormat.Xlsx);

using DevExpress.XtraRichEdit;
using DevExpress.Spreadsheet;

// Word — inspect then sanitize only what was found
var wordProcessor = new RichEditDocumentServer();
using var wordInputStream = new MemoryStream(File.ReadAllBytes("Submission.docm"));
wordProcessor.LoadDocument(wordInputStream,
    DevExpress.XtraRichEdit.DocumentFormat.Docm);

WordProcessingInspectResult wordInspect =
    wordProcessor.Inspect(WordProcessingInspectOptions.All);

Console.WriteLine($"Detected: {string.Join(", ", wordInspect.ContentTypes)}");

WordProcessingSanitizeOptions wordOptions = wordInspect.CreateSanitizeOptions();
var wordFindings = wordProcessor.Sanitize(wordOptions);

Console.WriteLine($"{wordFindings.Count} finding(s) removed.");

using var wordSanitizedStream = new MemoryStream();
wordProcessor.SaveDocument(wordSanitizedStream,
    DevExpress.XtraRichEdit.DocumentFormat.Docx);


// Excel — inspect then sanitize only what was found
using var workbook = new Workbook();
using var xlInputStream = new MemoryStream(File.ReadAllBytes("Sample.xlsm"));
workbook.LoadDocument(xlInputStream, DevExpress.Spreadsheet.DocumentFormat.Xlsm);

WorkbookInspectResult xlInspect = workbook.Inspect(WorkbookInspectOptions.All);

Console.WriteLine($"Detected: {string.Join(", ", xlInspect.ContentTypes)}");

WorkbookSanitizeOptions xlOptions = xlInspect.CreateSanitizeOptions();
var xlFindings = workbook.Sanitize(xlOptions);

foreach (var result in xlFindings)
    Console.WriteLine($"Content type: {result.Type}, Action taken: {result.Action}");

using var xlSanitizedStream = new MemoryStream();
workbook.SaveDocument(xlSanitizedStream, DevExpress.Spreadsheet.DocumentFormat.Xlsx);