Release note · August 1, 2026

A Word file can assemble itself from outside the package

By SybilGambleyyu · DocFence 0.7.0

An external relationship is not one thing. A hyperlink is usually just a destination for a reader. But Word can also keep an attached template, a master-document subdocument, or a frameset source outside the package. Those are document dependencies: stored references that can shape, supplement, or substitute what a user works with.

DocFence 0.7.0 makes that distinction review-visible without turning a CI report into a path or URL leak. It reports six aggregate counts only: anchors and relationships for attached templates, subdocuments, and frame sources. Targets, relationship IDs, part paths, frame names, and fingerprints stay private.

Three standardized paths beyond the package

OOXML defines a Document Template relationship from a Word Settings part. The settings markup contains w:attachedTemplate; the relationship supplies the external location. Microsoft’s Word implementation notes say it obtains the template path by evaluating that relationship ID.

A master document has a different contract. Its main document can hold w:subDoc anchors that point to externally located subdocuments. OOXML describes this as a way to work with a document as separately editable pieces—useful for a book organized as chapters, but important to make explicit at a controlled handoff.

Framesets add a third path. A linked Web Settings part can contain frames whose w:sourceFileName points to external WordprocessingML packages. These formats are uncommon today, but an uncommon, standardized external assembly mechanism is exactly the kind of state that should not disappear into a generic relationship counter.

Strict where the format is strict

DocFence recognizes the conventional and Strict OOXML relationship forms. It discovers Settings and Web Settings parts from either the main or glossary document, while keeping Word’s conventional word/settings.xml location as a compatibility fallback.

For each recognized dependency family, the direct anchor must name the expected relationship type with TargetMode="External". A malformed relationship or anchor fails closed instead of becoming an ambiguous diff. A recognized external relationship is still counted when no current anchor references it: stale state still carries a target worth reviewing.

This is stored-state evidence, not an Office runtime. DocFence does not retrieve a template, open a subdocument, resolve a frameset, render external content, authenticate to a target, or determine whether a target is benign. That matters especially for templates: MITRE ATT&CK T1221 documents template injection as an abuse of document template references.

Choose “none” or “no change”

A clean-handoff policy can reject all recognized external document dependency state:

rules:
  require_no_external_document_dependencies: true

This emits DFP025 whenever one of the six counts is nonzero. For an approved template workflow that intentionally retains a dependency, compare against a controlled baseline instead:

rules:
  no_external_document_dependency_changes: true

This emits DFP026 when the private dependency inventory changes. Relationship-ID rewrites alone remain quiet. For a Web Settings part that carries frame dependency state, DocFence fingerprints the full part privately, so an otherwise easy-to-miss source or layout change is still review-visible without printing it.

What was tested

The release tests conventional and Strict OOXML, settings linked through a glossary document, attached-template, subdocument, and frame-source anchors, residual relationships with no anchor, target changes, relationship-ID renumbering, malformed type and target-mode state, policy findings, JSON/Markdown/SARIF output, and redaction markers.

I also reconstructed and profiled the unpacked DOCX representation in the open-source XJTU thesis Office template. DocFence reports one attached-template anchor and one attached-template relationship without reproducing its target.

The wheel and source archive were independently rebuilt twice from the release commit with SOURCE_DATE_EPOCH; both artifact pairs were byte-identical. The public release contains the wheel, source archive, and SHA-256 manifest. I downloaded those assets, verified the checksums, installed the wheel in a fresh environment, and repeated the external-package profile.

Use the release

python -m pip install https://github.com/SybilGambleyyu/docfence/releases/download/v0.7.0/docfence-0.7.0-py3-none-any.whl

docfence profile template.docx --format markdown
docfence check approved.docx candidate.docx --policy docfence.yml --format sarif --output docfence.sarif

The complete contract is in the policy reference and threat model. DocFence is local, bounded evidence about stored OOXML state—not a network monitor or a rendering verdict. It is MIT-licensed and available on GitHub. For the preceding data-binding boundary, read Visible Word content can have an invisible source of truth.