Security Threat Model

Asset Definition & Scope

Component: EPPlus (.NET Open XML Spreadsheet Library, AppSheet fork)
Repository: Git-on-Borg (https://gnocchi-internal.googlesource.com/third_party/epplus, branch main)
Scope: Shared .NET library providing server-side reading, parsing, generation, manipulation, and formula evaluation of Microsoft Excel OpenXML (.xlsx, .xlsm) spreadsheets within AppSheet backend services.

1P OSS: No (Third-party open-source library maintained as an internal customized fork for Google AppSheet)
1P Proprietary Shipped Software: No (Server-side shared library bundled into AppSheet backend services)
High-Risk Code Surface: Yes (Complex file format parsing including ZIP archive extraction, XML document/stream deserialization, XPath queries, cell store indexing, and formula lexical analysis/expression evaluation)
Perimeter Exposure: Yes (Indirectly exposed to the public Internet via AppSheet application endpoints processing end-user and customer spreadsheet uploads)
Data Sensitivity: High (Parses and generates customer spreadsheet data containing confidential business data, PII, financial figures, and application schemas)
Untrusted Input Handling: Yes (Processes untrusted Excel files, compressed ZIP archives, XML parts, cell definitions, formatting rules, and user-supplied formulas)
Business Value: Core dependency for AppSheet's spreadsheet integration and data source connectors; security defects (XXE, Zip Slip, formula injection, or DoS) could lead to service disruption, customer data exposure, or server compromise.

Focus on XML External Entity (XXE) and XML Entity Expansion (Billion Laughs / XML bomb) vulnerabilities across all XmlDocument, XmlReader, and XPath operations (e.g., verify that XmlReaderSettings.ProhibitDtd = true / DtdProcessing.Prohibit and XmlResolver = null are strictly enforced across XmlHelper.cs, ZipPackage.cs, ExcelStyles.cs, ExcelWorksheets.cs, and table/drawing components).
Focus on archive extraction safety in ZipPackage.cs (ZipArchive handling) for Zip Slip path traversal vulnerabilities (e.g., handling malformed entry full names or URI paths containing ../), uncompressed size limits, and zip bomb resource exhaustion.
Focus on the formula parsing and execution engine (FormulaParsing/FormulaParser.cs, ExpressionGraph, LexicalAnalysis) for recursive stack overflow, unhandled exceptions, denial-of-service via circular references, or unintended method invocation.
Focus on memory exhaustion, integer overflows, or unchecked allocations in CellStore.cs when processing large row/column indices or sparse matrices crafted to cause OutOfMemory errors.
Focus on CSV / formula injection risks when writing cell contents or formatting export outputs.

Entry Point	Type	Trusted?	Validation
`ExcelPackage(Stream)` / `ExcelPackage(FileInfo)`	API Constructor / File Input	No	Validates stream existence; delegates archive decompression to `ZipPackage`
`ZipPackage(Stream)`	Archive Decompressor	No	Checks for `[content_types].xml` and relationship parts; reads entry streams into byte arrays
`XmlHelper.LoadXmlSafe(XmlDocument, Stream)`	XML Deserialization	No	Configures `XmlReaderSettings.ProhibitDtd = true` before loading into `XmlDocument`
`FormulaParser.Parse(string)` / `ExcelRangeBase.Calculate()`	Formula Engine	No	Lexical tokenization and expression graph evaluation of formula strings
`ExcelWorksheet.Cells[...]` / `CellStore`	Data Ingestion	No	Range address parsing, dimension bounding, and cell value type mapping

Authentication: None at library level. Authentication is assumed to be handled upstream by AppSheet API gateways and services before passing document streams.
Authorization: None at library level. Access control to spreadsheet data is enforced by AppSheet application authorization layers.
Implicit trust: The library assumes memory allocations and execution timeouts are constrained by the host process container/sandbox, but must guard against internal crashes or excessive resource consumption.
Boundary crossings: Public customer uploads $\rightarrow$ AppSheet service frontend $\rightarrow$ AppSheet backend worker $\rightarrow$ EPPlus parsing engine $\rightarrow$ AppSheet in-memory data structures.

Data Type	Source	Destination	Protection
Customer	External File	AppSheet Memory /	In-memory
: Spreadsheet : Upload / Data : `CellStore` : processing; :
: Content : Source : : protected by host :
: : : : sandbox and TLS :
: : : : transport :
Spreadsheet	Excel File Parts	Formula Parsing	Evaluated in
: Formulas & : : Engine : memory; restricted :
: Macros : : : to supported :
: : : : spreadsheet :
: : : : function library :
Office Document	OpenXML	`OfficeProperties`	Parsed into
: Metadata : Properties : object : strongly-typed :
: : : : metadata :
: : : : properties :

Action	Location	Guard
File Read / Stream	`ExcelPackage.Load` /	Validates stream integrity
: Ingestion : `ZipPackage.ZipPackage` : :
File Write /	`ExcelPackage.Save` /	File system permissions of
: Serialization : `ExcelPackage.SaveAs` : running process :
XML Deserialization	`XmlHelper.LoadXmlSafe`	DTD prohibition settings

XML Parser Hardening: Verify all XML loading routines across the library consistently use safe XmlReader settings prohibiting DTD processing and external entity resolution.
Zip Slip & Path Traversal: Review ZipPackage.cs part URI parsing and relationship mapping (ReadRelation) to ensure no arbitrary path escapes occur during package part extraction.
Formula Engine Resilience: Audit FormulaParsing components for recursive evaluation depth limits, CPU consumption attacks, and safe handling of malformed formulas.
Memory Allocation Limits: Inspect CellStore.cs and worksheet data structures for defensive memory allocation bounds when handling massive or maliciously sparse spreadsheets.