#2014

docx: redlining validation accepts untracked tab and line-break changes

OpenCloneOfAlexopened 18d ago

Summary

The redlining validator accepts untracked insertion of a tab or line break inside an existing paragraph. Its text extraction concatenates w:t nodes and ignores w:tab/w:br, so visibly different text compares equal to the original. The full CLI can report "All validations PASSED!".

Tested at dbd4588f9e1033efb41dad4bef2f7947c8993d44 with Python 3.12.14, python-docx 1.2.0, lxml 6.1.3 and defusedxml 0.7.1.

Reproduction

  1. Create original.docx with python-docx containing a single paragraph whose single run is AlphaBeta.
  2. Make tab_edit.docx by rewriting only word/document.xml inside the ZIP. Replace:
<w:t>AlphaBeta</w:t>

with:

<w:t>Alpha</w:t><w:tab/><w:t>Beta</w:t>
  1. Do not add w:ins, w:del or any other tracked-change markup.
  2. Run from the repository root:
python -X utf8 skills/docx/scripts/office/validate.py tab_edit.docx --original original.docx --author Audit
  1. Repeat using w:br instead of w:tab, and compare the redlining validator's result. As controls, test an unchanged document and an untracked replacement of AlphaBeta with AlphaGamma.

Actual result

VariantText read by python-docxRedlining validator
UnchangedAlphaBetaTrue
Untracked word editAlphaGammaFalse
Untracked tabAlpha\tBetaTrue
Untracked line breakAlpha\nBetaTrue

The full CLI for the tab variant exits 0, reports unchanged paragraph count (1 → 1), and prints "All validations PASSED!".

Expected result

Reject untracked insertion of textual separators just as an untracked word edit is rejected. These changes are in the main document body, not in an excluded header/footer.

Cause and suggested correction

_extract_text_content only gathers w:t content and concatenates it. Both original and edited paragraphs therefore become AlphaBeta for comparison.

Use an ordered text-token representation that includes tab and line-break elements, and apply the same representation to comparison/change identification. Add unchanged, untracked separator, ordinary text edit, and correctly tracked separator controls. Identical validator copies exist in the pptx/xlsx office directories.

Scope and related reports

This demonstrates false assurance about tracking textual changes. It does not assert that the validator promises to detect every formatting difference. Native Word rendering was not tested; python-docx independently confirms the tab/newline changes.

The Windows diff-decoding reports #1707/#1726 concern a different failure path. Targeted public issue/PR review found no matching report for ignored textual separators.

Activity

0

No activity yet.