哪些常见文档类型可以包含可执行代码？
我正在研究将所有文档与文档管理系统的可执行代码一起保存的请求的合理性。 这超出了将文件扩展名限制为简短列表并在保存文件之前通过诺顿防病毒软件运行文件的现有保护措施。
到目前为止 .doc(x)、.xls(x) 和.htm 都是常见的文档类型，我不能要求人们停止使用它们，并且其中可以包含可执行代码。
是否存在检查常见文档类型是否存在可执行代码的技术？
I'm working out the reasonability of a request to keep all documents with executable code of a document management system. This is above and beyond the existing protections restricting the file extensions to a short list and running the file by norton antivirus before we save it.
So far .doc(x), .xls(x), and .htm are all common document types that I can't demand people to stop using and that can have executable code in them.
Does the technology exist to check common document types for the existance of executable code?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不幸的是，这可能是一场失败的游戏。
如果您确实想将文档完全限制为不能包含可执行代码的文档，那么最好编译允许的文档类型列表，而不是可拒绝的文档类型。 总会有带有可执行代码的新文件格式，甚至是添加了可执行代码的旧格式的新版本（例如 Kevin 提到的 PDF）。
确保安全的唯一方法是编制允许的格式列表，并随着时间的推移进行维护。
Unfortunately, this might be a losing game.
If you really want to completely restrict documents to ones that cannot contain executable code, you are probably better off by compiling a list of allowable document types, instead of deniable document types. There will always be new file formats with executable code, and even new versions of old formats where they've added executable code (such as PDF, as mentioned by Kevin).
The only way to make this safe would be to compile a list of allowable formats, and maintain that over time.
请注意，查看器客户端程序中的安全漏洞（例如缓冲区溢出漏洞）可能会被滥用，导致文件格式中的可执行代码通常不具有此类功能。
Note that security vulnerabilities in the viewer client program, such as buffer-overflow vulnerabilities can by abused to cause executable code in a fileformat that does not normally have such a feature.
pdf就是其中之一。
pdf is one.