Risk level

Description
Bounded whitespaces can be used to indent text.Note ScrubOption OfficeXMLFeatures must be set to scrub bounded spaces.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The ability to add arbitrary amounts of whitespace can cause problems with integrity protection mechanisms.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLBoundedSpaces

In C
SecureOptions_XMLBoundedSpaces

In C++
BFSecureOptions::XMLBoundedSpaces

In C#
SecureOptions.XMLBoundedSpaces

Risk level

Description
Each graphic image and shape in a document may include an optional piece of text that can be used in place of the image when viewing the document in a constrained environment.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
There is very limited risk associated with alternative text. However, since this text is only accessible through formatting options associated with the image, it may be overlooked during a visual review of the document prior to release.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.AlternativeText

In C
SecureOptions_AlternativeText

In C++
BFSecureOptions::AlternativeText

In C#
SecureOptions.AlternativeText

Risk level

Description
Apps for Office allow for integration of 3rd party applications into the Office applications using web technologies. There are two types of Web extensions; content and taskpane. Web extensions enable 3rd party applications to tightly integrate into Office using web based interfaces like JavaScript, HTML5, CSS3. A Web extension runs inside of a web page frame within Office. The web page is served by some web server and the page has access to the Office document object model allowing rich feature connections between document content and the 3rd party web app. Content extensions contribute to content directly within a frame of the document. Taskpane extensions enable user interactions that enhance the authoring process but don’t directly generate document content (for example a dictionary app).

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Apps for Office provides for an interaction between document content and a remote web server that opens a certain risk level regardless of the security strength employed to prevent intrusion.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.AppsForOffice

In C
SecureOptions_AppsForOffice

In C++
BFSecureOptions::AppsForOffice

In C#
SecureOptions.AppsForOffice

Risk level

Description
XML Comments are used to provide semantic information to the human reader.Note ScrubOption OfficeXMLFeatures must be set extract and scrub XML Comments.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Large XML comments can increase the file size and therefore increase processing time.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLComment

In C
SecureOptions_XMLComment

In C++
BFSecureOptions::XMLComment

In C#
SecureOptions.XMLComment

Risk level

Description
XML Processing instruction can be used to pass information to applications.Note ScrubOption OfficeXMLFeatures must be set to extract and scrub XMP Processing instruction.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
A stylesheet declaration may cause an application to look for an untrusted XSLT stylesheet to use for transformation of the following root element. A standard exists for associating style sheets with XML documents.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLPI

In C
SecureOptions_XMLPI

In C++
BFSecureOptions::XMLPI

In C#
SecureOptions.XMLPI

Risk level

Description
CDATA is defined as blocks of text that are not parsed by the parser, but are otherwise recognized as markup.Note ScrubOption OfficeXMLFeatures must be set to extract and scrub XML CDATA.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
XML CDATA is skipped by the parser.An attacker could escape certain characters in an XML document to hide unauthorized markup so that the document passes XML Schema validation.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLCDATA

In C
SecureOptions_XMLCDATA

In C++
BFSecureOptions::XMLCDATA

In C#
SecureOptions.XMLCDATA

Risk level

Description
CC stores a list of namespaces which has internal schema definitions.There are many namespace which can not map to whitelisted namespace list and thus has no schema definition within CC.These namespaces are flagged as unknown namespaces.Note ScrubOption OfficeXMLFeatures must be set to extract and scrub XML UnknownNamespace.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Unknown namespace are reduntant to the file.The risk involved are using namespace to pass some critical information outside the organisation.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLUnknownNamespace

In C
SecureOptions_XMLUnknownNamespace

In C++
BFSecureOptions::XMLUnknownNamespace

In C#
SecureOptions.XMLUnknownNamespace

Risk level

Description
CC would show if external entity references exist in the document and user can decide to remove them.Note ScrubOption OfficeXMLFeatures must be set to extract and scrub XML external entity.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
External entity reference are higly risky as user can point the reference to some system file where the document is being run.Scrubbing the document has high chances of making the output/scrubbed document corrupt.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLExternalEntity

In C
SecureOptions_XMLExternalEntity

In C++
BFSecureOptions::XMLExternalEntity

In C#
SecureOptions.XMLExternalEntity

Risk level

Description
When using prefixes in XML, a namespace for the prefix must be defined.XML namespace prefix are used to avoid name conflict in XML.Note ScrubOption OfficeXMLFeatures must be set to rename namespace prefix.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
XML Namespace prefix can be of any value therefore namespace prefix can contain sensitive information. Hence it is recommended to rename namespace prefixes to neutral prefixes.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLRenameNamespacePrefix

In C
SecureOptions_XMLRenameNamespacePrefix

In C++
BFSecureOptions::XMLRenameNamespacePrefix

In C#
SecureOptions.XMLRenameNamespacePrefix

Risk level

Description
A XML can have multiple namespaces defined which are not being used.Note ScrubOption OfficeXMLFeatures must be set to extract and scrub XML unused namespaces.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
XML Namespace can be of any value therefore namespace can contain sensitive information. Hence it is recommended to remove unused namespaces.

Applies to
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above

In Java
SecureOptions.XMLUnusedNamespaces

In C
SecureOptions_XMLUnusedNamespaces

In C++
BFSecureOptions::XMLUnusedNamespaces

In C#
SecureOptions.XMLUnusedNamespaces

Risk level

Description
Microsoft PowerPoint supports linking to audio and video files using the 'Insert > Movies and Sounds > Movie from File' and 'Insert > Movies and Sounds > Sound from File' commands. Use of this feature results in storing a potentially sensitive link to a local or network file path. Note that this type of path can also be removed only when it is considered sensitive using the Sensitive Content Links target .

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The storage of an external local or network file path caused by linking to audio and video files exposes an organization to multiple risks. The first risk is that sensitive information may be contained in the directory hierarchy exposed by the path. For example, the directory structure may use a taxonomy that includes information such as a client’s name or identifier. The second risk is that the path information can provide a view into the corporate network topology. This opens an organization to a network intrusion risk. While this risk is mitigated by proper network security, it remains a social engineering threat by providing confidential information to hackers attempting to infiltrate a corporate network. The social engineering risk is elevated when path information is combined with other sensitive data like valid user names, email addresses, and email subject lines.

Applies to
Microsoft PowerPoint 97 thru 2003
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.AudioVideoFilePaths

In C
SecureOptions_AudioVideoFilePaths

In C++
BFSecureOptions::AudioVideoFilePaths

In C#
SecureOptions.AudioVideoFilePaths

Risk level

Description
Up to the last 10 authors that saved the document are stored in an area of the document that is inaccessible using the Word application. In Word 97 and Word 2000 this information also contains the paths where the document was saved and may include sensitive user logon or network share information.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The saving of the author history within Microsoft Word documents poses several risks including exposure of personal information, local or network paths, and an audit trail of previous revisions. Personal information will typically include the user names associated with the last 10 revisions of the document. Local or network paths will identify where each revision was saved, opening the risks associated with exposing file paths. The combination of user names and file paths provides an audit trail of previous revisions that may not be desirable. The risk associated with exposing this information often depends on the type of document being considered and the potential reviewers of the document. For example, documents that may be targets of legal discovery and documents that may be published to the web pose a higher risk than other documents.

Applies to
Microsoft Word 97 thru 2003

In Java
SecureOptions.AuthorHistory

In C
SecureOptions_AuthorHistory

In C++
BFSecureOptions::AuthorHistory

In C#
SecureOptions.AuthorHistory

Associated options

The following options affect the behavior of the Author History target.

AuthorHistoryContainsPaths

The hidden author history contains the last 10 fully qualified path names where the document was saved.

AuthorHistoryContainsShares

The hidden author history contains network share names. This information can provide dangerous insight into an organization's internal network.

Risk level

Description
The PDF file format allows a clipping path to be established that limits the region of the page affected by painting operations including text drawing. The page boundary inherently establishes the initial clipping region and it can be adjusted from there as needed. This target detects the existence of text that is drawn outside the current clipping region and is therefore not visible.

Default behavior
Discovers but does not scrub the target

Risk
Text drawn outside the current clipping region is not visible when displayed by viewing applications. This may occur for a variety of reasons and may result in the unintentional disclosure of information. For example, spreadsheet cells that have wrapping turned off, and presentations with text boxes moved off slide, may result in clipped text when printed to PDF.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.ClippedText

In C
SecureOptions_ClippedText

In C++
BFSecureOptions::ClippedText

In C#
SecureOptions.ClippedText

Risk level

Description
The font color of some document text closely matches the background color of the text resulting in text that is not visible in the authoring application. This feature targets the more common ways to obfuscate text by setting the text color to match a solid background color and includes consideration for numerous cases where the background is inherited from underlying objects. Complex backgrounds that include underlying images, objects, shapes, and transparency may inadvertantly generate false positives and false negatives.

Default behavior
Discovers but does not scrub the target

Risk
Making a font color closely match the background color can result in certain text being obfuscated to casual readers of a document. This may occur accidentally or be used as means to hide text at various points in the document life cycle and may result in the unintentional disclosure of information.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above
Adobe Acrobat (PDF)

In Java
SecureOptions.ColorObfuscatedText

In C
SecureOptions_ColorObfuscatedText

In C++
BFSecureOptions::ColorObfuscatedText

In C#
SecureOptions.ColorObfuscatedText

Associated options

The following options affect the behavior of the Color Obfuscated Text target.

ColorObfuscatedTextRemediation

Option that effects how remediation of color obfuscated text is performed.

Risk level

Description
Microsoft Office supports adding user comments to a document through the 'Insert > Comment' command. Comments often contain private or sensitive information.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Document comments may be used to expand upon or clarify visible content and pose low risk when used in this manner. However, comments are also often used for internal commentary and collaboration. In this form they can expose sensitive discussions, and if released, may represent a leak of information that was not intended. The severity of the threat is highly dependent on the content of the comments.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above
Microsoft Excel 2007 and above binary
Microsoft Word 2007 and above

In Java
SecureOptions.Comments

In C
SecureOptions_Comments

In C++
BFSecureOptions::Comments

In C#
SecureOptions.Comments

Risk level

Description
Content properties are viewable in Office using the 'File > Properties > Contents' command. They are document properties that provide a view into some of the content within the document. These properties include: Title and Headings in Word documents, Sheet Names and Named Ranges in Excel documents, and Fonts Used, Design Template, and Slide Titles in PowerPoint documents.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Content properties, for the most part, represent little or no risk since they primarily mirror some visible content from the document. An exception to this rule occurs when an Office document is encrypted but the content properties remain accessible. This hole in the Office encryption feature has been closed in recent versions. However, patching the application will not address existing documents unless they are loaded and resaved by the updated application.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.ContentProperties

In C
SecureOptions_ContentProperties

In C++
BFSecureOptions::ContentProperties

In C#
SecureOptions.ContentProperties

Risk level

Description
Custom document properties can be created using the 'File > Properties > Custom' command. They may include user defined properties or application generated properties. Custom properties include: Checked by, Client, Date completed, Department, Destination, Disposition, Division, Document number, Editor, Forward to, Group, Language, Mailstop, Matter, Office, Owner, Project, Publisher, Purpose, Received from, Recorded by, Recorded date, Reference, Source, Status, Telephone number, Typist, and all other user defined properties and application generated properties.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The risk associated with custom properties varies according to their use. Custom properties are often used by software applications to associate metadata with a document. For example, content management systems may use custom properties to assist document categorization and facilitate tracking the document lifecycle. Custom properties are also used by individual users to assist in categorization or carry additional information about the document. Depending on the implementation this information may range from innocuous to highly sensitive.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above
Adobe Acrobat (PDF)

In Java
SecureOptions.CustomProperties

In C
SecureOptions_CustomProperties

In C++
BFSecureOptions::CustomProperties

In C#
SecureOptions.CustomProperties

Risk level

Description
Custom XML data added to the document through various means

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Arbirary XML could contain almost any information. This is most likely a problem in cases where a malicious user is attempting to hide information inside a document.

In Word 2007 the XML Structure feature allows XML-like information to be included inline with the text of the document.

Some tools (including Microsoft SharePoint) add additional information to Office 2007 and above documents using CustomXMLParts.

In Word 2003 the XML Structure feature allows XML tags to be included inline with the text of the document.

Office Binary files may contain an additional storage named MsoDataStore that includes custom xml parts for the purpose of round tripping custom xml with new versions of Office.

Office Binary files may contain an additional storage named MsoDataStore that includes custom xml parts for the purpose of round tripping custom xml with new versions of Office.

Office Binary files may contain an additional storage named MsoDataStore that includes custom xml parts for the purpose of round tripping custom xml with new versions of Office.

Applies to
Microsoft Word 2007 and above
Microsoft Office 2007 and above
Microsoft Word 2003
Microsoft Excel 97 thru 2003
Microsoft Word 97 thru 2003
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.CustomXML

In C
SecureOptions_CustomXML

In C++
BFSecureOptions::CustomXML

In C#
SecureOptions.CustomXML

Risk level

Description
Microsoft Office supports powerful connectivity to databases that results in database connection and query information being stored in Office documents. This information may include a path or URL to a database server, the database username, database password and SQL query strings, all of which can be highly sensitive information.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The use of database queries to bring external data into Excel is a powerful feature that comes with several serious security risks. Specifically, this feature creates the potential that unauthorized users will be able to independently query a sensitive database at will. In order to allow the query to be updated, whether user initiated or automatic, the document retains the database query parameters. This information may include a file path or URL reference to the database server, SQL query strings that identify the requested data, and the password required to access the database. A file path to the database server opens all of the security threats associated with exposing file paths. SQL query strings can be used to infer the structure of the database. Storing the database password in the Office document is an option the user may choose when creating the query. This option is often activated in order to avoid having to re-enter the password each time the data is updated. This information opens an organization to SQL injection attacks. Proper network security may prevent any external access to the database server but this provides little peace of mind in the event of a network security breach. Internal access, however, may represent an even greater threat since the recipients of the sensitive information are likely behind the firewall but possibly prohibited from accessing the database. Consider an example where the finance department distributes a spreadsheet that at face value simply includes a list of employees by department, but buried within the underlying query lies all the information required to access an employee database filled with confidential data. Extreme caution should be used when releasing spreadsheets that contain database queries.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 97 thru 2003
Microsoft Excel 2007 and above

In Java
SecureOptions.DatabaseQueries

In C
SecureOptions_DatabaseQueries

In C++
BFSecureOptions::DatabaseQueries

In C#
SecureOptions.DatabaseQueries

Description
Defines the behavior of a ScrubOption that has the value of DEFAULT. Setting this option to DEFAULT itself has the same effect as setting it to NONE.

Default behavior
Discovers but does not scrub the target

Applies to
All formats

In Java
SecureOptions.DefaultScrubBehavior

In C
SecureOptions_DefaultScrubBehavior

In C++
BFSecureOptions::DefaultScrubBehavior

In C#
SecureOptions.DefaultScrubBehavior

Risk level

Description
Document variables are named pieces of data that can be attached to PowerPoint documents.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Document variables carry the risk of exposing sensitive information that was not intended to be distributed with the document. These variables are typically added to a document by 3rd party Office add-ins and serve the purpose of supporting features of the add-in across multiple edits of the document by saving data into the document. This data is often harmless programming state information but can be any data and can also be attached to and retrieved from the document using visual basic programming.

Document variables can be added to Microsoft PowerPoint files using visual basic code to attach name/value pairs to the document, slides, or specific shapes. Depending on usage, this information may include sensitive textual content that is not intended to be released with the document. This data is not readily accessible to the user from the application interface.

Applies to
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.DocumentVariables

In C
SecureOptions_DocumentVariables

In C++
BFSecureOptions::DocumentVariables

In C#
SecureOptions.DocumentVariables

Risk level

Description
The Office embedded object feature (Insert > Object..) allows embedding an object into the document that is created and served by another application. The resulting object data may then contain any of the hidden and sensitive data issues found in the serving application. Adobe PDF documents may include attached documents through the embedded files feature of the PDF format. Files embedded in a PDF document are detected under this analysis option.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Office applications leverage embeddings to seamlessly work with each other as well as with other applications to create compound documents. Including a spreadsheet table in a Word document or a chart in a presentation is common and useful. In order for any application to allow an embedding to be edited in its native application, the primary document includes a complete copy of the application data associated with the object. This data is in addition to the graphic rendition of the object that is used for display and printing. It is in this data that security risks can be found. Any security threat that has been identified in documents created by an application can also manifest itself when that application serves an embedding. An additional security concern has been found to exist when using embeddings within documents that have been encrypted using the Office security options. Surprisingly, embedded objects are not encrypted along with the primary document. For example, if an Excel chart is added to a Word document that is then encrypted using Word’s security options, the chart and the entire supporting spreadsheet will be left unencrypted within the Word document. Scrubbing embeddings will remove the ability to make further edits to the embedding while maintaining the most recent graphic rendition of the object. Adobe PDF documents include a feature defined as embedded files that are detected with this option. Files embedded within a PDF document carry a risk because they can also be automatically launched via actions that can be attached to form fields and other automated actions.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 97 thru 2003
Microsoft Excel 2007 and above
Microsoft Excel 2007 and above binary
Microsoft PowerPoint 97 thru 2003
Microsoft PowerPoint 2007 and above
Adobe Acrobat (PDF)

In Java
SecureOptions.EmbeddedObjects

In C
SecureOptions_EmbeddedObjects

In C++
BFSecureOptions::EmbeddedObjects

In C#
SecureOptions.EmbeddedObjects

Risk level

Description
The document is encrypted and most analysis and scrubbing requests cannot be accomplished. This is distinguished from ScrubOptions.WeakProtectionin that it cannot be easily circumvented short of brute force or dictionary based password attacks. However, using the Microsoft Office encryption feature (Tools > Options > Security > Password to open) does not encrypt the entire document, potentially leaving document properties and embeddings into Word and Excel unencrypted. Both Office and PDF documents can be encrypted with a default password. Clean Content will test the default password and decrypt the document when used on PowerPoint and PDF documents.

Default behavior
Discovers but does not scrub the target

Risk
Encrypting documents using the Microsoft Office security options can provide a strong level of security against unauthorized access to documents. However, this form of encryption does not always safeguard the entire content of the document. Specifically, document properties and embeddings can remain unencrypted leaving the unsuspecting author vulnerable to unexpected information exposure. Additionally, issues with the Office encryption implementation have been published and reported to Microsoft. It can be expected that Microsoft will continue to address any holes in this area with patch releases to some versions of Office. It can also be expected that existing documents and non-patched versions of Office will continue to propagate these problems. The security threat posed by partially encrypted and poorly encrypted documents is based heavily on the document content and can range from low to very high.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above
Adobe Acrobat (PDF)

In Java
SecureOptions.Encryption

In C
SecureOptions_Encryption

In C++
BFSecureOptions::Encryption

In C#
SecureOptions.Encryption

Risk level

Description
Indicates the Excel workbook contains a relational data source and corresponding connection information to other data sources. Office Excel 2013 introduced the Data Model extension to allow integrating data from multiple tables, effectively building a relational data source inside an Excel workbook. The data model leverages a binary stream that stores a tabular data model of all data that has been imported into the data model. It also includes the definition of each data source, including connection information required for external data sources (connection strings and potentially passwords), as well as relationships between tables, user-defined hierarchical relationships between columns, and calculated columns that are a function of existing columns. Scrubbing of this data is not supported due to the complexities of disconnecting dependencies from tables, queries, pivot tables. Detection is provided to allow the risk to be surfaced and reviewed.

Default behavior
Discovers but does not scrub the target

Risk
This Excel data model provides a rich mechanism for building a relational database inside an excel file for use within sheets to produce tables, pivot tables, and pivot charts. However, it carries substantial risk in that large quantities of data and connection information can be persisted in an Excel file that may not be desirable to release even though filtered use of that data within the spreadsheet is acceptable to release.

Applies to
Microsoft Excel 2007 and above

In Java
SecureOptions.ExcelDataModel

In C
SecureOptions_ExcelDataModel

In C++
BFSecureOptions::ExcelDataModel

In C#
SecureOptions.ExcelDataModel

Risk level

Description
The Extreme Cells target indicates that ranges of spreadsheet cells within the document are located an extreme distance from other cell ranges. The definition of an extreme cell range can be controlled by setting two options; Extreme Cell Horizontal Gap Allowance and Extreme Cell Vertcal Gap Allowance.

Default behavior
Discovers but does not scrub the target

Risk
Extreme cell content may not be readily visible to casual readers of a document. This may occur accidentally or be used as a means to hide text at various points in the document life cycle and may result in the unintentional disclosure of information.

Applies to
Microsoft Excel 97 thru 2003
Microsoft Excel 2007 and above

In Java
SecureOptions.ExtremeCells

In C
SecureOptions_ExtremeCells

In C++
BFSecureOptions::ExtremeCells

In C#
SecureOptions.ExtremeCells

Associated options

The following options affect the behavior of the Extreme Cells target.

ExtremeCellHorizontalGapAllowance

This option defines the maximum number of columns allowed between two cell ranges before they are treated as being two non-contiguous cell ranges. When an otherwise contiguous block of cells are separated by a greater number of columns they may be treated as extreme cells during analysis.

ExtremeCellVerticalGapAllowance

This option defines the maximum number of rows allowed between two cell ranges before they are treated as being two non-contiguous cell ranges. When an otherwise contiguous block of cells are separated by a greater number of rows they may be treated as extreme cells during analysis.

Risk level

Description
The Extreme Indenting target indicates that indent, margin, gutter or other settings could result in text that is off the page or outside a table or column. Such text will not display or print. Note that the existence of the Extreme Indenting target does not guarantee that text is hidden; only that text may be hidden.

Default behavior
Discovers but does not scrub the target

Risk
Moving text into positions where it is not visible to casual readers of a document. This may occur accidentally or be used as a means to hide text at various points in the document life cycle and may result in the unintentional disclosure of information.

Applies to
Microsoft Word 2007 and above
Microsoft Word 97 thru 2003

In Java
SecureOptions.ExtremeIndenting

In C
SecureOptions_ExtremeIndenting

In C++
BFSecureOptions::ExtremeIndenting

In C#
SecureOptions.ExtremeIndenting

Risk level

Description
The Extreme Objects target identifies embedded, linked, and graphic objects that have been positioned in such a way that a majority of the object may fall outside the reasonable viewing area when viewed or printed in the authoring application. This may include objects positioned outside the slide or speaker note frame in PowerPoint, and in an extreme cell range in Excel documents. Extreme objects are reported but modifications can only be made upon author review in the authoring application.

Default behavior
Discovers but does not scrub the target

Risk
Extreme objects may not be readily visible to casual readers of a document. This may occur accidentally or be used as a means to hide embeddings at various points in the document life cycle and may result in the unintentional disclosure of information.

Objects embedded into Excel spreadsheets may be considered extreme if the object is bound to cells that are located in an extreme cell range as defined by the Extreme Cells target. Note that such an object will trigger both an Extreme Object and an Extreme Cell notification.

Objects embedded into Excel spreadsheets may be considered extreme if the object is bound to cells that are located in an extreme cell range as defined by the Extreme Cells target. Note that such an object will trigger both an Extreme Object and an Extreme Cell notification.

Objects embedded into PowerPoint presentations may be considered extreme if 50% of the bounding rectangle of the embedding is positioned outside of the slide or speaker note frame.

Objects embedded into PowerPoint presentations may be considered extreme if 50% of the bounding rectangle of the embedding is positioned outside of the slide or speaker note frame.

Applies to
Microsoft Excel 97 thru 2003
Microsoft Excel 2007 and above
Microsoft PowerPoint 97 thru 2003
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.ExtremeObjects

In C
SecureOptions_ExtremeObjects

In C++
BFSecureOptions::ExtremeObjects

In C#
SecureOptions.ExtremeObjects

Risk level

Description
The fast save feature in Microsoft Word and PowerPoint is set using the 'Tools > Options > Save > Allow fast saves' command. When fast save is activated deleted text and data can remain in the file even though it is no longer visible or accessible from within the application. Adobe PDF documents may also include earlier revisions of nearly any type of content through the Incremental Update feature of the file format.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The fast save feature of Microsoft Word and PowerPoint is designed to decrease the time required to save a document to disk. This is accomplished by attaching changes to the end of the existing document rather than completely rewriting the modified document. Unfortunately, this will result in leaving deleted text and data in the document long after it was apparently removed by the user. This creates the risk of exposing the previous state of a document to recipients. A second risk is that this feature of Office can be used to transfer confidential information through documents in a way that will circumvent most content filtering technologies. The occurrence of this feature in Word documents is low because the Fast Save option was turned off by default with the release of Office 2000, though upgrading Office in place may maintain the state of this option. This risk remains a threat in existing, pre-Office 2000 Word documents. This feature is still on by default as of the current release of Microsoft PowerPoint. As a result, it is common for PowerPoint documents to include multiple prior versions. This is particularly concerning when considering the frequency with which pre-existing presentations are modified for a slightly different audience. Imagine the risk of distributing a sales presentation to one prospect that was given earlier to another prospect, knowing that the prior version is buried somewhere in the file. Adobe PDF documents include a similar feature known as Incremental Updates that is detected under this option due to its similarity to fast save.

The fast save feature is enabled by default in Word 97, enabled by default in Word 2000 if it was upgraded from Word 97 and disabled by default in new installations of Word 2000 and above. It can be enabled by the user in all versions of Word.

The fast save feature is enabled by default in all versions of PowerPoint and results in many versions of modified slides remaining in the file.

The incremental update feature of Adobe PDF may be implemented by PDF generation tools that make modifications to an existing PDF document.

Applies to
Microsoft Word 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Adobe Acrobat (PDF)

In Java
SecureOptions.FastSaveData

In C
SecureOptions_FastSaveData

In C++
BFSecureOptions::FastSaveData

In C#
SecureOptions.FastSaveData

Risk level

Description
Headers and footers in documents, spreadsheets and presentations. When this option is set to Scrub, the scrubbing behavior may be modified using the HeadersFootersSearch, HeadersFootersBehaviorand HeadersFootersReplaceoptions.

Default behavior
Discovers but does not scrub the target

Risk
Some organizations may include tracking, authoring, status or other information in headers and footers than should not be shared with outside parties.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above
Microsoft Excel 2007 and above binary
Microsoft PowerPoint 97 thru 2003
Microsoft Excel 97 thru 2003

In Java
SecureOptions.HeadersFooters

In C
SecureOptions_HeadersFooters

In C++
BFSecureOptions::HeadersFooters

In C#
SecureOptions.HeadersFooters

Associated options

The following options affect the behavior of the Headers and Footers target.

HeadersFootersSearch

This option is a list of regular expressions that will be used to test the text of each header or footer. When the first match is found the behavior defined by the corresponding item in the HeadersFootersBehaviorlist is executed against that header or footer. If no match is found the header or footer will be scrubbed in its entirety. This option is only valid if the HeadersFootersscrub target is set to Scrub. If this option is set, both the HeadersFootersBehaviorand HeadersFootersReplacelists must be set and the lengths of all three lists must be the same.

HeadersFootersBehavior

This option is a list of behaviors to perform that maps one to one with the regular expressions in the HeadersFootersSearchlist. See the HeadersFootersSearchoption for more details. If the behavior is Replace, the corresponding item in the HeadersFootersReplacelist will be used as the replacement text.

HeadersFootersReplace

This option is a list of strings that maps one to one with the behaviors in the HeadersFootersBehaviorlist. A given item is ignored (and may be null or a empty string) unless associated item in the HeadersFootersBehaviorlist is set to Replace.

Risk level

Description
Spreadsheet rows, columns, or worksheets that have been hidden. Hidden cells may contain sensitive data that requires user review prior to release. Hidden cells can be identified during analysis and can be made visible by setting the Unhide Hidden Cells option. Hidden cells are not deleted or cleared when cleaned since they may be required to resolve references from visible cells.

Default behavior
Discovers but does not scrub the target

Risk
It is common for spreadsheets to include entire columns, rows, or even sheets of data that are hidden from view. This is often done to prevent recipients from accessing sensitive information. The hidden data might be necessary in order to support a less sensitive calculation or chart. For example, a sheet of employee salaries may support a chart that shows relative salary expense by department. The salary data is sensitive but the chart is not. Unfortunately, simply hiding the cells does not safeguard access to the data since recipients can simply unhide the cells. Using sheet protection with a password is a common approach to prevent recipients from accessing hidden cells. However, this safeguard is a weak form of protection because the feature does not encrypt the underlying hidden data and can be easily disabled by hacking a few bytes in the file. Workbook and file level security options with passwords can be used to prevent modifications and encrypt the underlying data thus providing stronger security. Consequently, hiding cells within unencrypted documents should never be considered a secure method of preventing unauthorized access to those cells. Due to the fact that hidden cells may support visible cell calculations, removing hidden cells requires modification by the user directly within the application.

Applies to
Microsoft Excel 97 thru 2003
Microsoft Excel 2007 and above

In Java
SecureOptions.HiddenCells

In C
SecureOptions_HiddenCells

In C++
BFSecureOptions::HiddenCells

In C#
SecureOptions.HiddenCells

Risk level

Description
The PowerPoint hidden slide feature (Slide Show > Hide Slide) allows individual slides to be hidden during the slide show and printing of the presentation. Hidden slides may contain information that is not intended for general release.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Hidden slides are often used to tailor a presentation to a particular audience or to adjust a presentation to meet a required time allotment. In many cases, exposing the hidden slides does not represent any type of privacy or security concern. In some cases, however, the hidden slide may contain data not intended for the target audience, creating a risk of leaking sensitive information. Any presentation that contains hidden slides should be reviewed prior to distribution in order to determine whether the slide should be removed.

Applies to
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.HiddenSlides

In C
SecureOptions_HiddenSlides

In C++
BFSecureOptions::HiddenSlides

In C#
SecureOptions.HiddenSlides

Risk level

Description
Text that has been intentionally hidden (Format > Font... > Font > Hidden) by the user may contain sensitive information that should be reviewed or removed before distributing the document.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The use of hidden text exposes the author to unintended information disclosure. Hidden text may be used for internal commentary, temporary display and print removal, or as a method of deleting text so that it can be later retrieved if desired. It is less common to find hidden text that provides intended useful content because this is usually done with comments. Releasing documents that contain hidden text to third parties is considered a high security risk when not first reviewed by the author.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above

In Java
SecureOptions.HiddenText

In C
SecureOptions_HiddenText

In C++
BFSecureOptions::HiddenText

In C#
SecureOptions.HiddenText

Risk level

Description
Microsoft substantially changed the Excel format between Excel 95 and Excel 97. In order to maintain backwards compatbility with Excel 95 it was possible to store both versions of the file inside the XLS document. This target detects and optionally scrubs the 'Book' stream that hodls the Excel 95 version of the workbooks.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The 'Book' stream in a Hybrid Excel document essentially holds a duplicate copy of the workbooks found in an Excel document. Scrubbing this stream will remove any risk associated with the content in this stream. Clean Content does not scrub the contents of the Book stream based on specific targets but instead allows the entire stream to be removed with this target.

Applies to
Microsoft Excel 97 thru 2003

In Java
SecureOptions.HybridExcel9597BookStream

In C
SecureOptions_HybridExcel9597BookStream

In C++
BFSecureOptions::HybridExcel9597BookStream

In C#
SecureOptions.HybridExcel9597BookStream

Risk level

Description
Many applications that use XML formats, especially Microsoft's Office, do not strictly follow the XML format's schema when writing out documents. This target indicates that one or more invalid elements have been found and ignored.

Default behavior
Discovers but does not scrub the target

Risk
Invalid elements pose two problems. First they may contain extra hidden data that is not visible to the user in the application. Second, although Office itself might open the document, other readers such as viewers on smartphones, search engines, etc. may not be able to process the document.

In Java
SecureOptions.InvalidXML

In C
SecureOptions_InvalidXML

In C++
BFSecureOptions::InvalidXML

In C#
SecureOptions.InvalidXML

Risk level

Description
Many applications that use XML formats, especially Microsoft's Office, have situations where any element may appear or an particular namespace may be ignored. This target indicates that such an element is in a namespace that is not known and can therefore cannot be validated.

Default behavior
Discovers but does not scrub the target

Risk
Unknown elements are a risk only if intentional hiding and disclosure of data is concern.

In Java
SecureOptions.UnknownXML

In C
SecureOptions_UnknownXML

In C++
BFSecureOptions::UnknownXML

In C#
SecureOptions.UnknownXML

Risk level

Description
The Office linked object feature (Insert > Object...) allows linking to an external file that is managed and rendered by another application. These links can expose local and network path information.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Office applications enable the primary document to include references to external documents that are then rendered directly into the primary document. Using this feature stores a file path or URL to the external document within the primary document. This is done to allow automatic updates to the primary document that incorporate changes to the linked document and to allow direct authoring of the external document within the primary document framework. The existence of path information that supports this feature opens an organization to network intrusion and social engineering risks. Removing the link information can be done without affecting the most recent rendering of the linked object.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above
Microsoft PowerPoint 2007 and above
Microsoft Excel 2007 and above
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.LinkedObjects

In C
SecureOptions_LinkedObjects

In C++
BFSecureOptions::LinkedObjects

In C#
SecureOptions.LinkedObjects

Risk level

Description
Microsoft Office includes support for Visual Basic and can be used to create everything from simple macros to data entry forms to full blown applications. Visual Basic can also be used to create macro viruses that travel with documents. Adobe PDF documents may contain code in the form of Java Script.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The risk associated with macros and code being present within inbound documents is a well known virus threat. The risk associated with outbound documents includes the unintended redistribution of viruses and the potential disclosure of sensitive information contained within an otherwise valid macro. Information disclosure can come in the form of user names, code comments, and potentially confidential approaches to programmatically accessing corporate resources. Macros and code are often used to support the document creation process but are not intended or desired in the final version of the document. In other examples, macros and code provide important and useful functions to the recipient as might be the case with controls and forms. Determining the risk associated with releasing documents that contain macros and code typically requires user review.

Adobe PDF documents may contain code in the form of Java Script.

Applies to
Microsoft Word 97 thru 2003
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft Excel 2007 and above binary
Microsoft PowerPoint 2007 and above
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003
Adobe Acrobat (PDF)

In Java
SecureOptions.MacrosAndCode

In C
SecureOptions_MacrosAndCode

In C++
BFSecureOptions::MacrosAndCode

In C#
SecureOptions.MacrosAndCode

Risk level

Description
Meeting minutes can be attached to PowerPoint documents with the PowerPoint Meeting Minder feature and are typically associated with an action item list. The action item list is included in the presentation as part of a slide or series of slides. The associated minutes are accessible only through the Meeting Minder user interface.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Meeting minutes may be unexpectedly released with a presentation because the minutes are not displayed as part of any slide but instead require manual review of the Meeting Minder minutes and may therefore be overlooked during review.

Applies to
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.MeetingMinutes

In C
SecureOptions_MeetingMinutes

In C++
BFSecureOptions::MeetingMinutes

In C#
SecureOptions.MeetingMinutes

Risk level

Description
The Office GUID property is a document property created by versions of Microsoft Office prior to the release of Office 2000. This globally unique identifier (GUID) can be used to identify the computer from which the document originated.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Documents containing the Office GUID property expose an organization or individual to the risk of losing anonymity. The Office GUID property can be used to uniquely identify the machine on which a document originated. It can also be used to determine if multiple documents originated on the same machine. This property is no longer stored in Office documents as of the release of Office 2000 and is consequently now considered a low risk element. Archived documents and documents created with older versions of Office are still at risk of this disclosure.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.OfficeGUIDProperty

In C
SecureOptions_OfficeGUIDProperty

In C++
BFSecureOptions::OfficeGUIDProperty

In C#
SecureOptions.OfficeGUIDProperty

Risk level

Description
This target identifies the existence of parts that are not referenced or required by the document. When this target is set to Analyze and the OfficeXMLPartValidation option is enabled, the extracted output will contain a Collection element of type OfficeXMLPartDisclosureRisks that includes each rogue part using an OfficeXMLPartRisk element that provides further information about the part. Parts of this type are always removed when the OfficeXMLPartValidation option is enabled.

Default behavior
Discovers but does not scrub the target

Risk
Rogue parts are not referenced by any other part and are not required in the document under the Open Packaging Conventions. This part represents a serious disclosure risk and is always automatically removed during a Clean Content scrub process. This type of part can occur due to intentional hiding of additional files into an Office ZIP container or due to the use of the 'trash' feature of the Open Packaging Conventions.

Applies to
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.OfficeXMLRogueParts

In C
SecureOptions_OfficeXMLRogueParts

In C++
BFSecureOptions::OfficeXMLRogueParts

In C#
SecureOptions.OfficeXMLRogueParts

Risk level

Description
This target identifies the existence of parts that may represent a disclosure risk if the offending part is not further inspected by human or machine review. When this target is set to Analyze and the OfficeXMLPartValidation option is enabled, the extracted output will contain a Collection element of type OfficeXMLPartDisclosureRisks that includes each unexpected part using an OfficeXMLPartRisk element that provides further information about the part.

Default behavior
Discovers but does not scrub the target

Risk
Unexpected parts are part that are referenced in a context that Clean Content does not understand and therefore the part could not be analyzed. This type of part is not removed by the scrubbing process because doing so may break the document structure. This part can represent either an intentional disclosure risk or be a valid part that Clean Content does not yet process.

Applies to
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.OfficeXMLUnexpectedParts

In C
SecureOptions_OfficeXMLUnexpectedParts

In C++
BFSecureOptions::OfficeXMLUnexpectedParts

In C#
SecureOptions.OfficeXMLUnexpectedParts

Risk level

Description
This target identifies the existence of parts that may represent a disclosure risk if the offending part is not scrubbed from the document or further inspected by human or machine review. When this target is set to Analyze and the OfficeXMLPartValidation option is enabled, the extracted output will contain a Collection element of type OfficeXMLPartDisclosureRisks that includes each unanalyzed part using an OfficeXMLPartRisk element that provides further information about the part.

Default behavior
Discovers but does not scrub the target

Risk
Unanalyzed Parts are used an expected and valid context that is understood by Clean Content but the part data is not analyzed by Clean Content. This type of part may happen with binary and certain custom xml parts. Some, like the printer settings part, may be removed during a scrub process under a particular scrub target. Others, like embedded font parts, may require external analysis to determine the level of risk.

Applies to
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.OfficeXMLUnanalyzedParts

In C
SecureOptions_OfficeXMLUnanalyzedParts

In C++
BFSecureOptions::OfficeXMLUnanalyzedParts

In C#
SecureOptions.OfficeXMLUnanalyzedParts

Risk level

Description
This target identifies the existence of parts that may represent a disclosure risk if the offending part is not scrubbed from the document or further inspected by human or machine review. When this target is set to Analyze and the OfficeXMLPartValidation option is enabled, the extracted output will contain a Collection element of type OfficeXMLPartDisclosureRisks that includes each Alternate Content Choice part using an OfficeXMLPartRisk element that provides further information about the part.

Default behavior
Discovers but does not scrub the target

Risk
The Office Open XML specification includes an extension that allows portions of document content to be defined in multiple forms. This type of part is one that is referenced from within the Choice context of an Alternate Content block. The Clean Content scrub process is designed to always remove the Choice portion of AlternateContent and retain the Fallback portion. This type of part is considered a disclosure risk only because it is not always accessible to human review from the authoring application.

Applies to
Microsoft Word 2007 and above
Microsoft Excel 2007 and above
Microsoft PowerPoint 2007 and above

In Java
SecureOptions.OfficeXMLAlternateContentParts

In C
SecureOptions_OfficeXMLAlternateContentParts

In C++
BFSecureOptions::OfficeXMLAlternateContentParts

In C#
SecureOptions.OfficeXMLAlternateContentParts

Risk level

Description
Outlook properties are custom document properties that may be added by Microsoft Outlook to Office documents when they are sent as attachments. These properties include the author, email address, subject of the email, and review cycle identifiers associated with the attachment.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Microsoft Outlook practice of adding email metadata properties into Office attachments can result in unintended and sensitive information disclosure. The property metadata may include the sender’s email address, email display name, routing identifiers, and the subject line of the email message to which the document was attached. Disclosing this information to the recipient of the email message does not represent a direct threat because the recipient receives most of this information from the email headers by default. However, inserting this information into the attached documents without any user intervention or awareness allows this information to continue to travel with the document well beyond the initial email recipient. If the document is subsequently published to the web it will publicly expose a valid email address, the associated user display name, and a valid related email subject line. The dangers of this release of information can range from simple embarrassment to confidential leaks and, at minimum, present spammers with additional opportunity.

Applies to
Microsoft Word 97 thru 2003
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.OutlookProperties

In C
SecureOptions_OutlookProperties

In C++
BFSecureOptions::OutlookProperties

In C#
SecureOptions.OutlookProperties

Risk level

Description
The Overlapped Objects target identifies embedded, linked, and graphic objects that have been covered by another object thus obscuring some portion of the underlying object. At least 50% of an object must be covered to be treated as overlapped. Overlapped objects are reported but modifications can only be made upon author review in the authoring application.

Default behavior
Discovers but does not scrub the target

Risk
Overlapped objects may not be readily visible to casual readers of a document. This may occur accidentally or be used as a means to hide embeddings at various points in the document life cycle and may result in the unintentional disclosure of information.

Applies to
Microsoft Excel 2007 and above
Microsoft Excel 97 thru 2003
Microsoft PowerPoint 2007 and above
Microsoft PowerPoint 97 thru 2003

In Java
SecureOptions.OverlappedObjects

In C
SecureOptions_OverlappedObjects

In C++
BFSecureOptions::OverlappedObjects

In C#
SecureOptions.OverlappedObjects

Risk level

Description
Text may be covered by graphics elements that are drawn after the text operations. This target detects specific use cases where that may occur including rectangles and thick lines that are a known source of poor PDF text redaction. Detection of overlapped text is limited to specific use cases due to the complexity of the transparent imaging model. However, the common cases associated with poor text redaction are covered.

Default behavior
Discovers but does not scrub the target

Risk
Overlapped text is not visible when displayed by viewing applications. This may occur for a variety of reasons and may result in the unintentional disclosure of information. There have been many cases of poorly redacted PDF documents that have a black rectangle covering text that cannnot be seen but is still accessible through copy and paste operations.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.OverlappedText

In C
SecureOptions_OverlappedText

In C++
BFSecureOptions::OverlappedText

In C#
SecureOptions.OverlappedText

Risk level

Description
The PDF format supports a set of interactive features called actions. Example actions include jumping to a particular destination in a document, thread, or URI location, launching an external file, playing a sound or movie, importing or submitting form data, executing JavaScript code, and numerous other interactive features. Actions can be associated with outline items, annotations, form fields, pages, or the document as a whole and can be triggered based on specific user or document interactions like opening the document, viewing a page, or selecting an outline item. Each triggering event can execute one or more actions in sequence. Each type of action is given its own scrub target while this target is provided to cover all actions in a single target.

Default behavior
Discovers but does not scrub the target

Risk
Each type of action poses a particular type of risk. Some, like launching a file or executing JavaScript can be very risky while others like jumping a page in the document have minimal risk. The risk associated with each individual action is covered under the action specific target.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFActions

In C
SecureOptions_PDFActions

In C++
BFSecureOptions::PDFActions

In C#
SecureOptions.PDFActions

Sub-targets

The following targets are sub-targets of the PDF Actions target.

PDF GoTo Actions

Risk level

Description
The GoTo action can be executed from a variety of triggering events and causes the Viewer software to change the current view of the document to specific location within the document.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The GoTo action poses minimal risks since it simply describes a destination location in the current document.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFGoToActions

In C
SecureOptions_PDFGoToActions

In C++
BFSecureOptions::PDFGoToActions

In C#
SecureOptions.PDFGoToActions

PDF GoToR Actions

Risk level

Description
The GoToR (Go to remote location) action can be executed from a variety of triggering events and causes the Viewer software to change the current view to a specific location in another PDF file.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The GoToR action poses two types of risk. First, the description of the PDF file to load is stored as a file specification that can disclose network share information. Second, the action may launch an unsanitized external PDF file that may pose any of the many security risks associated with PDF documents.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFGoToRActions

In C
SecureOptions_PDFGoToRActions

In C++
BFSecureOptions::PDFGoToRActions

In C#
SecureOptions.PDFGoToRActions

PDF GoToE Actions

Risk level

Description
The GoToE (Go to remote location) action can be executed from a variety of triggering events and causes the Viewer software to change the current view to a specific location in another PDF file that is embedded in this or another PDF file..

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The GoToE action poses two types of risk. First, the embedding to load can be located in another PDF file as a file specification that can disclose network share information. Second, the action may launch an unsanitized external or embedded PDF file that may pose any of the many security risks associated with PDF documents.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFGoToEActions

In C
SecureOptions_PDFGoToEActions

In C++
BFSecureOptions::PDFGoToEActions

In C#
SecureOptions.PDFGoToEActions

PDF Launch Actions

Risk level

Description
The Launch action can be executed from a variety of triggering events and causes the Viewer software to launch an application or open or print a document.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The launch action is a very risky for multiple reasons. First, it executes an external application that may result in a data attack risk. Second, it stores the location of the application or document to launch as a file specfication or platform specific commands resulting in a data disclosure risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFLaunchActions

In C
SecureOptions_PDFLaunchActions

In C++
BFSecureOptions::PDFLaunchActions

In C#
SecureOptions.PDFLaunchActions

PDF Thread Actions

Risk level

Description
The Thread action can be executed from a variety of triggering events and causes the Viewer software to change the current view of the document to specific location in an article thread within the document.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
A thread action, similar to the GoTo action, poses minimal risks since it simply describes a destination location in the current document.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFThreadActions

In C
SecureOptions_PDFThreadActions

In C++
BFSecureOptions::PDFThreadActions

In C#
SecureOptions.PDFThreadActions

PDF URI Actions

Risk level

Description
The URI action can be executed from a variety of triggering events and causes the Viewer software to resolve and open a resource described by a Uniform Resource Identifier.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The URI action can be executed due to a user interaction like clicking on a hyperlink or be atuomatically activated when a document is opened or combined with other actions in a sequence. This action can lead to a malicious PDF launching a URI that is an exploit or site containing an exploit, resulting in a data attack risk. Since the URI can reference a network share there is also a risk of data disclosure.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFURIActions

In C
SecureOptions_PDFURIActions

In C++
BFSecureOptions::PDFURIActions

In C#
SecureOptions.PDFURIActions

PDF Sound Actions

Risk level

Description
The Sound action can be executed from a variety of triggering events and causes the Viewer software to play the associated sound object.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Sound action can be used to initiate a data attack in a malformed PDF by leveraging an exploit in the player software. The stream associated with sounds may also contain author or source information that represents a data disclosure risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFSoundActions

In C
SecureOptions_PDFSoundActions

In C++
BFSecureOptions::PDFSoundActions

In C#
SecureOptions.PDFSoundActions

PDF Movie Actions

Risk level

Description
The Movie action can be executed from a variety of triggering events and causes the Viewer software to play the associated movie object that is stored as an external file.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Movie action can be used to initiate a data attack in a malformed PDF by leveraging an exploit in the player software. Since the location of the movie is described as a file specification and can reference a network share there is also a risk of data disclosure. There is also a risk of intential data disclosure because the action may only play a clip from a larger movie while leaving the remainder of the movie hidden from view but still accessible.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFMovieActions

In C
SecureOptions_PDFMovieActions

In C++
BFSecureOptions::PDFMovieActions

In C#
SecureOptions.PDFMovieActions

PDF Hide Actions

Risk level

Description
The Hide action can be executed from a variety of triggering events and causes the Viewer software to change the visibility of annotations and form fields.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Hide action represents a significant data hiding risk because it can hide the existence of annotations and form fields.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFHideActions

In C
SecureOptions_PDFHideActions

In C++
BFSecureOptions::PDFHideActions

In C#
SecureOptions.PDFHideActions

PDF Named Actions

Risk level

Description
The Named action can be executed from a variety of triggering events and causes the Viewer software to change the current view of the document to a specific named location in the current document. The supported named locations include NextPage, PrevPage, FirstPage, LastPage.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Named action generally represents minimal risk because it simply describes a predefined destination location in the current document. However, the specification allows for the use of non-portable named locations that may pose a minor risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFNamedActions

In C
SecureOptions_PDFNamedActions

In C++
BFSecureOptions::PDFNamedActions

In C#
SecureOptions.PDFNamedActions

PDF Set OCG State Actions

Risk level

Description
The Set OCG State action can be executed from a variety of triggering events and sets the state of one or morel optional content groups.Optional content refers to sections of content in a PDF document that can be selectively viewed or hidden. Optional content features are typically seen in interactive PDF documents like CAD drawings or Maps.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Set OCG State represents a risk because it can dynamically cause portions of documents to be hidden form view.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFSetOCGStateActions

In C
SecureOptions_PDFSetOCGStateActions

In C++
BFSecureOptions::PDFSetOCGStateActions

In C#
SecureOptions.PDFSetOCGStateActions

PDF Rendition Actions

Risk level

Description
The Rendition action can be executed from a variety of triggering events and controls the playback of multimedia content. The rendition action was introduced in PDF 1.5 to allow a far richer mechanism to control multimedia playback than supported by the earlier release Movie and Sound actions. Rendition actions can make use of extensive options to describe the location and sequence of multimedia content, the player to be used, allow for JavaScript execution to further control the playback, as well as many other parameters. Rendition actions are closely tied to a Screen annotation that specifies the region of a page where media clips are played.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Rendition action can be used to initiate a data attack in a malformed PDF by leveraging an exploit in the player software. Since the location of the media can be described as a file specification and can reference a network share there is also a risk of data disclosure. There is also a risk of unintential data disclosure because the action may only play a clip from a larger movie while leaving the remainder of the movie hidden from view but still accessible. Lastly, since a Rendition action can cause the execution of JavaScript it carries all of the risks associated with JavaScript execution.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFRenditionActions

In C
SecureOptions_PDFRenditionActions

In C++
BFSecureOptions::PDFRenditionActions

In C#
SecureOptions.PDFRenditionActions

PDF GoTo3D View Actions

Risk level

Description
The GoTo3D View action can be executed from a variety of triggering events and controls the view of a 3D annotation. PDF supports a rich collection of features to define and view three-dimensional objects, such as those used by CAD software. This action targets a 3D annotation and can change how the 3D artwork appears to the user by setting parameters such as lighting, rendering, and projection that control the virtual camera illustrating the 3D artwork.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The GoTo3D View action can modify the view of 3D artwork and thus presents a hidden data risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFGoTo3DViewActions

In C
SecureOptions_PDFGoTo3DViewActions

In C++
BFSecureOptions::PDFGoTo3DViewActions

In C#
SecureOptions.PDFGoTo3DViewActions

PDF Rich Media Actions

Risk level

Description
The Rich Media action can be executed from a variety of triggering events and identifies a rich media annotation and specifies a command to be sent to that annotation handler.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Rich media such as SWF content includes numerous risk in the area of data attach. These risks are extended by the ability to send commands to the rich media handler through a Rich Media ation.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFRichMediaActions

In C
SecureOptions_PDFRichMediaActions

In C++
BFSecureOptions::PDFRichMediaActions

In C#
SecureOptions.PDFRichMediaActions

PDF JavaScript Actions

Risk level

Description
The JavaScript action can be executed from a variety of triggering events and causes Javascript code to be executed by the Java interpreter supported by the PDF Viewer. This is often used to dynamically control the view of a PDF document, particularly forms.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The execution of JavaScript found with a PDF document presents a significant data risk attack and has become one of the most common methods of delivering exploits. Note that developers of PDF malware have gone to great extremes to hide dangerous JavaScript inside PDF documents in ways that are not easily detected by scanning filters.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFJavaScriptActions

In C
SecureOptions_PDFJavaScriptActions

In C++
BFSecureOptions::PDFJavaScriptActions

In C#
SecureOptions.PDFJavaScriptActions

PDF Submit Form Actions

Risk level

Description
The Submit Form action can be executed from a variety of triggering events and transmits the names and values of selected form fields to a specified URL (uniform resource locator).

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Submit Form action presents a risk because it initiates the exchange of information with a remote server. The name of the server poses a data disclosure risk and if the PDF document or the server is malicious it presents a data attack risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFSubmitFormActions

In C
SecureOptions_PDFSubmitFormActions

In C++
BFSecureOptions::PDFSubmitFormActions

In C#
SecureOptions.PDFSubmitFormActions

PDF Reset Form Actions

Risk level

Description
The Reset Form action resets a selected set of interactive form fields causing their current values to return to a default value. It can be executed from a variety of triggering events.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Reset From action can be used to hide the currently stored values of certain form fields by resetting them upon document open. The values themselves would no longer be visible but are remain accessible.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFResetFormActions

In C
SecureOptions_PDFResetFormActions

In C++
BFSecureOptions::PDFResetFormActions

In C#
SecureOptions.PDFResetFormActions

PDF Import Data Actions

Risk level

Description
The Import Data action imports Forms Data Format (FDF), XFSD, or XML into the interactive form fields of the PDF document and can be executed from a variety of triggering events.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Import Data action present the risk of introducing new content from an external file that may not have been sanitized. This data may be sensitive or malicious presenting a data disclosure risk. The name of the external file may also present a data disclosure risk. It is also possible that the imported data presents a data attack risk if not formatted properly.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFImportDataActions

In C
SecureOptions_PDFImportDataActions

In C++
BFSecureOptions::PDFImportDataActions

In C#
SecureOptions.PDFImportDataActions

PDF Transition Actions

Risk level

Description
The Transition action is used in a sequence of actions to define transition appearances during the sequence. It can be executed from a variety of triggering events.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The Transition action can control the display of a document and presents some risk that normally visible data appears hidden when executed in a specified sequence.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFTransitionActions

In C
SecureOptions_PDFTransitionActions

In C++
BFSecureOptions::PDFTransitionActions

In C#
SecureOptions.PDFTransitionActions

PDF Unknown Actions

Risk level

Description
Clean Content supports scrub targets for all PDF actions defined through Version 1.7 and the supplement to ISO 32000. Any PDF action that is not in the list of supported action is treated as an Unknown action. The most likely occurrence of an Unknown action is either due to an PDF file specification update supporting new actions or due to an attempt to create a custom action.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
An Unknown action presents a data disclosure risk because the action structures may be used to store any sort of data.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFUnknownActions

In C
SecureOptions_PDFUnknownActions

In C++
BFSecureOptions::PDFUnknownActions

In C#
SecureOptions.PDFUnknownActions

Risk level

Description
Alternate images are additional versions of an image that may be used by readers though there is no clear description on when or why.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFAlternateImages

In C
SecureOptions_PDFAlternateImages

In C++
BFSecureOptions::PDFAlternateImages

In C#
SecureOptions.PDFAlternateImages

Risk level

Description
Postscript objects embedded inside PDF documents. These objects are no longer recommended to be included in PDF documents.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFDeprecatedPostscriptObjects

In C
SecureOptions_PDFDeprecatedPostscriptObjects

In C++
BFSecureOptions::PDFDeprecatedPostscriptObjects

In C#
SecureOptions.PDFDeprecatedPostscriptObjects

Risk level

Description
Alternate Presentations allow a PDF document to be viewed in a slide show like manner. PDF 1.4 allowed a page to be viewed for a specified duration before moving into an automatic or user enabled page transition phase. PDF 1.5 allowed for a more extensive, JavaScript driven, alternate presentation rendering. This PDF feature is seldom used and has ben deprecated by ISO 32000-1. This target addresses both forms.

Default behavior
Discovers but does not scrub the target

Risk
Alternate presentations carry some risk because they can be used to hide data from the user by presenting only a subset, or even a completely different rendering, of the documents content. This can be done through transition effects, using an alternate image of a page, or even ignoring pages found in the document.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFAlternatePresentations

In C
SecureOptions_PDFAlternatePresentations

In C++
BFSecureOptions::PDFAlternatePresentations

In C#
SecureOptions.PDFAlternatePresentations

Risk level

Description
The PDF file format supports storing private data in PDF documents to allow extended functionality to be created by an application. This data is stored in the Page-Piece dictionary construct described in the PDF Reference manual. For example, it is common for applications such as Adobe Illustrator and Adobe Photoshop to store additional data using this feature. The Embedded Search Index feature supported by Adobe Acrobat is also enabled using this approach.The PDF Private Application Data target provides a general target for detecting and removing any private application data found in PDF documents that leverage the PieceInfo entry to store a Page-Piece construct.

Default behavior
Discovers but does not scrub the target

Risk
Private Application Data can contain any data that a PDF application chooses to store in a PDF document. Examples include document properties, application specific metadata, and an embedded search index that may include a private form of every word in a document. It creates a significant risk of unintended data disclosure.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFPrivateApplicationData

In C
SecureOptions_PDFPrivateApplicationData

In C++
BFSecureOptions::PDFPrivateApplicationData

In C#
SecureOptions.PDFPrivateApplicationData

Sub-targets

The following targets are sub-targets of the PDF Private Application Data target.

PDF Embedded Search Index

Risk level

Description
Adobe Acrobat supports an option to embed a search index into a PDF document. The search index makes user searches faster, particularly in large documents. This index is a private data structure supported by Adobe and may retain content from previous versions of the document. This scrub target is a child of the more general PDF Private Application Data target in order to allow this target to be scrubbed while leaving other private application data if desired.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
The PDF Embedded Search Index is private application data used by Adobe Acrobat. Since the index may not always be up to date it may retain content from a previous version of the document.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFEmbeddedSearchIndex

In C
SecureOptions_PDFEmbeddedSearchIndex

In C++
BFSecureOptions::PDFEmbeddedSearchIndex

In C#
SecureOptions.PDFEmbeddedSearchIndex

PDF Other Private Application Data

Risk level

Description
The PDF file format supports storing private data in PDF documents to allow extended functionality to be created by an application. This scrub target specifically addresses private application data other than the Embedded Search Index private application data. The Embedded Search Index data is addressed by a specific target in order to provide explicit control over that use case.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Private Application Data can contain any data that a PDF application chooses to store in a PDF document. Examples include document properties, application specific metadata, and an embedded search index that may include a private form of every word in a document. It creates a significant risk of unintended data disclosure.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFOtherPrivateApplicationData

In C
SecureOptions_PDFOtherPrivateApplicationData

In C++
BFSecureOptions::PDFOtherPrivateApplicationData

In C#
SecureOptions.PDFOtherPrivateApplicationData

Risk level

Description
The PDF file format supports creating information from web or local files using a method called Web Capture. Content can be retrieved from the referenced external files, either once or through additional updates. The original web capture information is maintained in the PDF file.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Web capture information includes references to web based URL's or local file references that may represent a data disclosure risk.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFWebCaptureInformation

In C
SecureOptions_PDFWebCaptureInformation

In C++
BFSecureOptions::PDFWebCaptureInformation

In C#
SecureOptions.PDFWebCaptureInformation

Risk level

Description
The PDF file format supports including information that describes the existence of any content that may result in unexpected rendering of a document. This information is commonly included in documents that also include a document certification signature. It can be used by PDF applications to determine the trustworthiness of a document. The information primarily indicates the use of certain PDF features like JavaScript, Launching, URI's, multimedia objects, and the like that may result in a document that will render differently in different environments.

Default behavior
Discovers but does not scrub the target

Risk
There is very little risk to this information with the exception that it may be inaccurate, particularly if left in a document across multiple modifications by applications that do not keep it up to date. This can result in unworthy trust of the document content.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFLegalAttestation

In C
SecureOptions_PDFLegalAttestation

In C++
BFSecureOptions::PDFLegalAttestation

In C#
SecureOptions.PDFLegalAttestation

Risk level

Description
Digital signatures are used to authenticate the identity of the author and the contents of the document and may come in three forms. Digital signatures can be used for approval signatures, modifications and detection prevention, and to enable usage rights that are not available without the required signature.

Default behavior
Discovers but does not scrub the target

Risk
Signatures may contain information that is not viewable, introducing hidden data risk. Signatures may also reveal the identity of the author and this might be undesirable in certain environments. Scrubbing a document will almost certainly invalidate any digital signatures. Note that it is common for the use of digital signatures to be accompanied by password protected encryption that may prevent cleansing of the document entirely.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFDigitalSignatures

In C
SecureOptions_PDFDigitalSignatures

In C++
BFSecureOptions::PDFDigitalSignatures

In C#
SecureOptions.PDFDigitalSignatures

Risk level

Description
Thumbnail images are typically used to provide a representation of each page in a PDF document that allows viewers to quickly render an image of each page. They can also be associated with an external file reference. Thumbnails have been deprecated from use in PDF as of ISO 32000-1 and can safely be scrubbed from files.

Default behavior
Uses the value of the DefaultScrubBehavior option

Risk
Thumbnail images can be used to hide data from the user since they are often ignored by viewing technology in favor of regenerating an image when required.

Applies to
Adobe Acrobat (PDF)

In Java
SecureOptions.PDFThumbnailImages

In C
SecureOptions_PDFThumbnailImages

In C++
BFSecureOptions::PDFThumbnailImages

In C#
SecureOptions.PDFThumbnailImages

Risk level