T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wfp_core.py:147- Finding
Office Documents Are Opened Through COM Without Explicitly Disabling Active Content
- Content
View full analysis
Vulnerability Details
File Location:
scripts/wfp_core.py:147-157,scripts/wfp_core.py:670-674, andscripts/wfp_core.py:688-706
Vulnerability Type: Unsafe processing of untrusted Office documents
Risk Level: MediumVulnerable Code
python try: self.com_app = win32com.client.DispatchEx('KWPS.Application') self._log(" > 已成功连接到WPS。") except Exception: try: self.com_app = win32com.client.DispatchEx('Word.Application') self._log(" > 已成功连接到Word。") except Exception as e: raise RuntimeError(f"未能启动WPS或Word，请确保已安装。错误: {e}") try: self.com_app.Visible = False except Exception: pass try: self.com_app.DisplayAlerts = False except Exception: passpython doc_com = None try: doc_com = app.Documents.Open(os.path.abspath(input_path), ReadOnly=1) doc_com.SaveAs2(os.path.abspath(temp_docx_path), FileFormat=12) finally: if doc_com is not None: doc_com.Close()python try: app = self._get_wps_app() doc_com = app.Documents.Open(os.path.abspath(docx_path)) doc_com.TrackRevisions = False self._log(" > 已关闭修订追踪。") if doc_com.Revisions.Count > 0: doc_com.AcceptAllRevisions() self._log(" > 已接受文档副本中的所有修订。") doc_com.Content.ListFormat.ConvertNumbersToText() self._log(" > 已将副本中的自动编号转换为文本。") if doc_com.Revisions.Count > 0: doc_com.AcceptAllRevisions() doc_com.TrackRevisions = False doc_com.Save()Technical Analysis
On Windows, the formatter creates an invisible WPS or Microsoft Word COM instance and opens user-supplied Office documents. It disables visible alerts but does not explicitly configure the application to force-disable macros or other active content before opening the files.
Opening a document as read-only only restricts document modification; it is not an active-content security boun ...[truncated 1653 chars]
- Remediation
View remediation
Remediation Suggestions
- Before opening any document, set the Office automation security policy to force-disable macros, such as Microsoft Office's
AutomationSecurityforce-disable mode. - Record the previous automation security value and restore it when processing finishes, including all exception paths.
- Apply the security setting before the first
Documents.Opencall, not after opening the document. - If equivalent protection cannot be confirmed for WPS, reject untrusted macro-capable inputs or process them through an isolated conversion environment.
- Prefer sandboxed LibreOffice conversion for untrusted legacy files, using a dedicated temporary profile and an operating-system sandbox with restricted filesystem and network access.
- Consider rejecting macro-enabled formats and documents containing active content unless the user explicitly opts in after receiving a warning.
- Add Windows integration tests that verify automation security is configured before every COM document-open operation.
- Before opening any document, set the Office automation security policy to force-disable macros, such as Microsoft Office's