open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

docs(readme): drop .xlsx from known gaps (covered in 2h)

Browse source
This commit is contained in:
Kjell Tore Guttormsen 2026-07-07 07:41:00 +02:00
commit 31166d0af0
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
README.md
View file

@ -128,14 +128,15 @@ that a green scan means safe content:
inbox showcase (`tests/test_okf_inbox_uploads.py` + `tests/inbox_frontend.py`, a inbox showcase (`tests/test_okf_inbox_uploads.py` + `tests/inbox_frontend.py`, a
dev-scoped demonstration whose `python-docx`/`python-pptx` parsers live in the dev-scoped demonstration whose `python-docx`/`python-pptx` parsers live in the
`[dev]` extra, never core `dependencies`) reads `.txt`/`.md`/`.csv`/`.docx`/ `[dev]` extra, never core `dependencies`) reads `.txt`/`.md`/`.csv`/`.docx`/
`.pptx`, folders and `.zip`, materializes them into an OKF bundle, then guards `.pptx`/`.xlsx`, folders and `.zip`, materializes them into an OKF bundle, then
it. What survives text extraction is **out of scope**: VBA/macros guards it. What survives text extraction is **out of scope**: VBA/macros
(`.docm`/`.xlsm`/`.pptm`), OLE / embedded objects, image-embedded instructions (`.docm`/`.xlsm`/`.pptm`), OLE / embedded objects, image-embedded instructions
needing OCR, font/render steganography, and encrypted / password-protected files needing OCR, font/render steganography, and encrypted / password-protected files
— the binary layer needs a separate scanner. The front-end owns the container — the binary layer needs a separate scanner. The front-end owns the container
threats it *can* see (zip-slip → path gate, zip-bomb → size cap, symlink threats it *can* see (zip-slip → path gate, zip-bomb → size cap, symlink
refusal, CSV formula-lead cells). Known gaps: `.xlsx` (openpyxl) and `.pdf` refusal, CSV/XLSX formula-lead cells). Known gaps: `.pdf` extraction, and the
extraction, and the numeric `-`/`+` CSV false positive. numeric `-`/`+` CSV false positive (an XLSX numeric cell is typed, so it does not
trip the gate).
- **Lexicon findings are deduplicated by pattern id** — `count=1` and the first - **Lexicon findings are deduplicated by pattern id** — `count=1` and the first
offset are reported, so the same class matched across several channels/variants offset are reported, so the same class matched across several channels/variants
collapses to one finding at its first location. This keeps reports readable, but collapses to one finding at its first location. This keeps reports readable, but