Allow external hyperlinks in the upload gauntlet (keep every other external target blocked)#6
Merged
Merged
Conversation
…ternal target blocked The hostile-file gauntlet rejected every relationship with TargetMode="External", but a plain Word hyperlink is exactly such a relationship. That bounced any contract containing a clickable URL with "...targets an external resource", even though a hyperlink is inert until a human clicks it and never causes a network fetch when the document is parsed or opened. Narrow the rejection to an allowlist: permit external targets only for the /hyperlink relationship type; external images, subdocuments, attached templates, and OLE links (all of which Word resolves on open) stay rejected. This preserves the documented "no network fetch at parse time" guarantee while unblocking the ubiquitous benign case. Input-side only — the redline output scan is untouched and stays strict. Tests: an external hyperlink is now accepted; an external image is still rejected (allowlist is narrow, not a blanket relaxation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The hostile-file upload gauntlet rejected every relationship with
TargetMode="External". A plain Word hyperlink is exactly such a relationship, so any contract containing a clickable URL was bounced with:A hyperlink is inert until a human clicks it and never causes a network fetch when the document is parsed or opened, so this control was over-broad relative to its own documented intent ("nothing in the document is permitted to cause a network fetch at parse time").
Fix
Narrow the rejection to an allowlist: permit external targets only for the
/hyperlinkrelationship type. External images (SSRF / NTLM-hash leak on open), subdocuments, attached templates, and OLE links — all of which Word resolves on open — stay rejected. Input-side only; the redline output scan is untouched and stays strict. Corpus ingestion (same gauntlet) is covered.Tests
docs/threat-model.mdupdated to document the exception and why it preserves the parse-time-fetch guarantee.🤖 Generated with Claude Code