Embedded objects we could not open

doc.uninspected-embedded-object

A disclosure, not an accusation: a legacy .doc holds an object inside it that this engine did not open, so "nothing found" is not standing in for "nothing looked at".

How the text is hidden

Insert → Object → Create from File puts a whole other file inside a Word document. It lands in the ObjectPool storage of the compound file, one storage per object, in one of two shapes. Either the inner file is wrapped in an \x01Ole10Native stream, or — for Insert → Object → Microsoft Word Document — the inner document's own streams (WordDocument, 1Table, Data) are written straight into the object's storage, with no file anywhere in the container. Concealment one level down is still concealment: a document whose body reads clean can carry a hidden instruction inside an embedded object.

Why a model still reads it

The embedding is a container question, not a concealment technique. A consumer that unpacks the document, or a model handed the extracted contents of an embedded file, reads what is inside it; an engine that walks only the outer body reports the file clean. This finding is what the engine says about the objects it did not manage to open.

What we do about it

docEmbeddedObjects walks the ObjectPool children. Where an \x01Ole10Native stream is present, the wrapped file's start is found by scanning a bounded prefix (MAX_SIGNATURE_OFFSET) for a known magic — compound file, zip, %PDF-, {\rtf — because real producers do not agree with the MS-OLEDS layout. A storage holding a WordDocument stream is rebuilt into a standalone compound file by buildCfb and handed to the same recursive analysis an embedded file gets, so its findings arrive with location.part naming the path. Everything not opened is collected with a per-object reason and emitted as ONE finding: technique doc.uninspected-embedded-object, family disclosure, severity informational, action disclosed, with the object paths and reasons in the excerpt. A disclosure does not move the verdict and does withhold certification.

How often it fires

Not measured. We publish a rate only where one has been measured against a named corpus of the right format, and no figure exists for this technique yet. Absence means unknown — never low.

what this does not catch

Several things are named rather than read, each recorded in the code. At most MAX_EMBEDDED_OBJECTS storages are opened; beyond that the object is disclosed with an embedded-object-limit reason. A payload whose signature sits past the bounded scan window is not recursed into, and there is a test asserting it is still disclosed. The rebuild path is gated on a WordDocument stream, so a storage described as an embedded workbook or presentation is named rather than rebuilt. A storage nested inside a rebuilt embedded document is not carried into the rebuilt file — buildCfb writes a flat set of streams — and is disclosed by name unless it is empty. A storage too large to rebuild falls back to disclosure. Nesting beyond MAX_EMBED_DEPTH is disclosed rather than followed.

Check your own file

Three commands: a key, credit, a verdict.

Start with the API