This project is not covered by Drupal’s security advisory policy.
Office Open XML files (Word, Excel, PowerPoint) store author, company, and custom properties inside the package. ExifTool cannot rewrite these zip-based formats, so that metadata often survives image/PDF sanitizers.
OOXML Sanitizer removes those document properties when a managed file is uploaded or replaced. No settings form: enable the module and it runs automatically.
What it strips
docProps/core.xml— creator, last modified by, and related Dublin Core fieldsdocProps/app.xml— application and company metadatadocProps/custom.xml— custom properties- Relationship entries in
_rels/.relsthat point at those parts
Supported extensions
docx, dotx, xlsx, xltx, pptx, potx
Legacy Word .doc (OLE) uploads are rejected. Save as .docx and upload that instead — the OLE format cannot be stripped the same way.
Requirements
- Drupal 10.3 or 11
- PHP 8.1+ with the
zipandmbstringextensions - File module (Drupal core)
Installation
composer require drupal/ooxml_sanitizer drush en ooxml_sanitizer -y
Limitations
This module only removes package-level document properties. It does not rewrite document body XML, comments, tracked changes, macros, or embedded files. Failed sanitization is logged on the ooxml_sanitizer watchdog channel.
Related modules
Use together with Metadata Sanitizer (ExifTool) if you also need to strip metadata from images and other formats ExifTool can write.
Project information
- Project categories: Media, Security
- Created by slava1999 on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
