[dolfim-ibm]

DOCX and XLSX files go to python-docx / openpyxl, which load the package members into memory; on the ordinary path there was no check of the decompressed member sizes. The EPUB backend read the container, package document and content documents in full.

Changes

• New docling/backend/utils/archive_limits.py: ArchiveLimits, a declared-size check that runs before any member is read, and a bounded member read. A file over a limit fails to load with ArchiveLimitError (a DocumentLoadError).
• DOCX: every package is checked in load_msword_file before the relationship scan and python-docx; the Strict and fragment-only rewrites use the same limits.
• XLSX: the package is checked before load_workbook; bounded reads for comment, drawing and image members (_MAX_DRAWING_BYTES / _MAX_IMAGE_BYTES are now applied).
• EPUB: bounded reads for container, OPF and spine documents, and a declared-size check of the spine documents on open, with the existing EpubBackendOptions limits.
• New max_file_bytes (128 MiB), max_total_bytes (512 MiB), max_member_count (10,000) on MsWordBackendOptions and MsExcelBackendOptions, documented in the advanced options page and the usage skill.

Behavior changes

• The previous DOCX rewrite limits (512 MiB per member, 2 GiB in total) are replaced by the new options, and an oversized package raises ArchiveLimitError instead of SecurityError.
• An EPUB content document over the limit now fails the conversion instead of being skipped.

Tests

• tests/test_backend_archive_limits.py: oversized members are rejected for Path and stream input before decompression (peak memory checked), converter reports the limit, total/count limits, and helper behaviour.
• Existing DOCX, XLSX and EPUB suites and ground-truth tests pass.

[github-actions]

✅ DCO Check Passed

Thanks @dolfim-ibm, all your commits are properly signed off. 🎉

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?(!)?:

[github-actions]

AI triage (advisory)

Checked commit e313362eaa. The analysis read the diff only. It did not run code from this pull request.

The PR adds ArchiveLimits, check_archive_limits and read_member in archive_limits.py. They check the declared decompressed sizes of DOCX, XLSX and EPUB archives, and they cap member reads. The PR adds max_file_bytes, max_total_bytes and max_member_count to MsWordBackendOptions and MsExcelBackendOptions. An oversized file now fails with ArchiveLimitError.

CI safety: no concern found. A maintainer must still approve CI.

2 related pull request(s) in the same code

PR	State	Signal	Assessment
#4716	open	changes the same code	related: Both PRs change msword_backend.py, backend_options.py and advanced_options.md. PR 4716 adds opt-in conversion of embedded Office objects. This PR adds archive size limits. The edits do not conflict in purpose.
#4958	open	changes the same code	related: Both PRs change msword_backend.py and test_backend_msword.py. PR 4958 hides hidden text from the default export. This PR limits archive sizes. The two fixes are independent.

_{The ai:* labels are advisory. They do not approve CI and they do not add tests:full. A new push runs this check again.}

[codecov]

Codecov Report

❌ Patch coverage is 86.95652% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
docling/backend/msexcel_backend.py	75.00%	6 Missing ⚠️
docling/backend/epub_backend.py	76.47%	3 Missing and 1 partial ⚠️
docling/backend/msword_backend.py	88.00%	2 Missing and 1 partial ⚠️
docling/backend/utils/archive_limits.py	95.34%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!