xlsx/encryption-envelope-detection

Metadata

XPath assertions

Render assertions

No render assertions declared.

Manifest (expanded)

{
  "$schema": "../manifest.schema.json",
  "id": "xlsx/encryption-envelope-detection",
  "title": "Encryption envelope detection (OLE compound file)",
  "format": "xlsx",
  "category": "packaging",
  "summary": "Detect an ECMA-376 Part 2 Annex K encrypted .xlsx by its OLE Compound File signature.",
  "roles": [
    "authoring"
  ],
  "spec": {
    "source": "ecma-376-5-part-2",
    "clause": "Annex K",
    "notes": "Sibling of docx/encryption-envelope-detection for xlsx. Same 8-byte OLE magic at offset 0 regardless of inner format. The committed fixture is a 512-byte OLE-header stub (identical to the docx version; detection happens at byte 0 before format sniffing). A fully-encrypted real .xlsx requires MS-OFFCRYPTO AES-CBC authoring and is deferred."
  },
  "fixtures": {
    "machine": "xlsx/encryption-envelope-detection"
  },
  "assertions": [
    {
      "id": "ole-compound-file-magic",
      "kind": "magic_bytes",
      "offset": 0,
      "must": "equal",
      "value": "D0 CF 11 E0 A1 B1 1A E1"
    }
  ]
}