Skip to main content
Drupal is a registered trademark of Dries Buytaert
Release: Drupal 10.6.17 — Update released for Drupal core (10.6.17)! Release: Drupal 11.3.17 — Update released for Drupal core (11.3.17)! Release: Drupal 11.4.7 — Update released for Drupal core (11.4.7)! Release: AI (Artificial Intelligence) 1.3.14 — Minor update available for module ai (1.3.14). Release: AI (Artificial Intelligence) 1.4.9 — Minor update available for module ai (1.4.9). Release: Modeler API 1.1.7 — Minor update available for module modeler_api (1.1.7). Release: Field Validation 3.0.0-rc2 — New release candidate for module field_validation (3.0.0-rc2). Release: VWO 8.x-3.0 — Major update available for module vwo (8.x-3.0). Usage Milestone: Easy Email — Module easy_email crossed 10,000 active installs. Module Revived: Commerce Stripe 2.2.2 — Module commerce_stripe updated after 6 months of inactivity (2.2.2).

OOXML Sanitizer

No security coverage
View on drupal.org

Office Open XML files (Word, Excel, PowerPoint) store author, company, and custom properties inside the package. ExifTool cannot rewrite these zip-based formats, so that metadata often survives image/PDF sanitizers.

OOXML Sanitizer removes those document properties when a managed file is uploaded or replaced. No settings form: enable the module and it runs automatically.

What it strips

  • docProps/core.xml — creator, last modified by, and related Dublin Core fields
  • docProps/app.xml — application and company metadata
  • docProps/custom.xml — custom properties
  • Relationship entries in _rels/.rels that point at those parts

Supported extensions

docx, dotx, xlsx, xltx, pptx, potx

Legacy Word .doc (OLE) uploads are rejected. Save as .docx and upload that instead — the OLE format cannot be stripped the same way.

Requirements

  • Drupal 10.3 or 11
  • PHP 8.1+ with the zip and mbstring extensions
  • File module (Drupal core)

Installation

composer require drupal/ooxml_sanitizer
drush en ooxml_sanitizer -y

Limitations

This module only removes package-level document properties. It does not rewrite document body XML, comments, tracked changes, macros, or embedded files. Failed sanitization is logged on the ooxml_sanitizer watchdog channel.

Related modules

Use together with Metadata Sanitizer (ExifTool) if you also need to strip metadata from images and other formats ExifTool can write.

Depends on

Dependencies of the latest stable release

No dependencies recorded for this project.

Required by

Tracked projects that depend on this one

No tracked projects depend on this one yet.

Activity

Tracked releases
1
Tracked since
Sep 2026
Latest release
6 hours ago
Releases (12 mo)
1 ▲ from 0
Maintenance
Active

Releases

Version Type Core Release date
1.0.x-dev Dev 10–11 Sep 16, 2026