The Excel export currently does not strip external_path from attachment metadata.
Current flow:
threema/media/export.py sets external_paththreema/normalize.py stores it in attachment.metadatarender/excel_builder.py sanitizes some path fields, but not external_path
Reproduced
A minimal workbook built with:
attachment.metadata = {"external_path": "C:/Users/secret/_EXTERNAL_DATA/secret.png"}
still contained that exact path inside the generated workbook XML.
Problem
This can leak local absolute paths and user/environment information into the Excel export.
Expected
external_path should be removed from Excel metadata output just like other absolute local path fields.
The Excel export currently does not strip
external_pathfrom attachment metadata.Current flow:
threema/media/export.pysetsexternal_paththreema/normalize.pystores it inattachment.metadatarender/excel_builder.pysanitizes some path fields, but notexternal_pathReproduced
A minimal workbook built with:
attachment.metadata = {"external_path": "C:/Users/secret/_EXTERNAL_DATA/secret.png"}
still contained that exact path inside the generated workbook XML.
Problem
This can leak local absolute paths and user/environment information into the Excel export.
Expected
external_pathshould be removed from Excel metadata output just like other absolute local path fields.