Expand description
Format detection by content sniffing.
The file extension is a hint and is never consulted here. A .jpg that is really a
PDF must be handled as a PDF or refused outright; handing it to the JPEG handler would
produce a confident success message about a file that was never touched
(docs/ARCHITECTURE.md §1, docs/THREAT_MODEL.md §5.4). Detection therefore takes bytes
and nothing else — there is deliberately no way to pass it a path.
Detection is itself a hostile-input parser: it is the one piece of code that sees every
byte of every file the user feeds in, including files no handler will ever accept. It
reads through [crate::bytes::Reader] for the same reason the handlers do.
§Why this is hand-written rather than a dependency
file-format and infer were both evaluated (docs/ARCHITECTURE.md §4). Phase 1 needed
to discriminate exactly four supported formats plus a short list of formats worth naming
in a refusal, which is under a hundred lines of magic-number matching. Taking a crate with
broad magic tables for that would add supply-chain surface (ADR-0008) to save very little.
Phase 2 brought the ambiguity that comment anticipated, and it turned out not to be the kind
a magic table solves. .docx, .xlsx, .pptx, and every OpenDocument file share one magic
number, because they are all ZIP archives. Telling them apart means opening the container and
reading the content type the package declares for its own main part — which no magic-number
crate does either, and which the ZIP layer this crate already owns does directly
(ADR-0027, ADR-0028).
§Why detection opens the container
It would be cheaper to search the raw bytes for word/document.xml and be done. That is
also how a file gets routed to the wrong handler: the string appears verbatim in any archive
that merely contains a Word document, and an attacker can put it in a comment. Reading the
declared content type is the format’s own answer to “what is this”, and it costs one central
directory walk and one small inflate.
Enums§
- Format
- A format strypt has a handler for.
Functions§
- detect
- Identify
databy content.