OOXML Sanitizer

Office Open XML files (Word, Excel, PowerPoint) store author, company, and custom properties inside the package. ExifTool cannot rewrite these zip-based formats, so that metadata often survives image/PDF sanitizers.

OOXML Sanitizer removes those document properties when a managed file is uploaded or replaced. No settings form: enable the module and it runs automatically.

What it strips

• docProps/core.xml — creator, last modified by, and related Dublin Core fields
• docProps/app.xml — application and company metadata
• docProps/custom.xml — custom properties
• Relationship entries in _rels/.rels that point at those parts

Supported extensions

docx, dotx, xlsx, xltx, pptx, potx

Legacy Word .doc (OLE) uploads are rejected. Save as .docx and upload that instead — the OLE format cannot be stripped the same way.

Requirements

• Drupal 10.3 or 11
• PHP 8.1+ with the zip and mbstring extensions
• File module (Drupal core)

Installation

composer require drupal/ooxml_sanitizer
drush en ooxml_sanitizer -y

Limitations

This module only removes package-level document properties. It does not rewrite document body XML, comments, tracked changes, macros, or embedded files. Failed sanitization is logged on the ooxml_sanitizer watchdog channel.

Related modules

Use together with Metadata Sanitizer (ExifTool) if you also need to strip metadata from images and other formats ExifTool can write.