HTML input and external resources

Imported HTML is sanitized before becoming the editable document. Application-owned storage and other downstream HTML consumers must apply their own rendering rules.

Diagram showing sanitized HTML, explicit resource permissions, validated raster display and the choice to preserve references or embed authorized images.

Active content boundaries

Document scripts, handlers, active schemes and unsafe embedded content are removed or rejected. A restricted browser frame separates authored content from the trusted editing bootstrap. Internal image metadata supplied in authored markup is discarded. Export removes private rendering markers.

Resource policy

AllowExternalResources defaults to false. Preserving a URL or local path in authored HTML does not authorize loading it. Implicit local reads require an explicit existing file BaseUrl root and resolved path containment. A selected file or image URL is an explicit authorization. Implicit HTTPS-base fetching also requires external resources to be enabled; previously accepted explicit URL bytes can display offline without a new request.

Protocol-relative sources, javascript schemes and SVG data images are rejected. Body/image CSS retains safe raw declarations and quoted literals while rejecting active resource syntax. Native image bytes are bounded and actually decoded before use.

Limits and export

The default document limit is one million UTF-16 characters. Distinct image display sources are limited to 512; validated cached bytes are limited to 16 MiB. Body replacement retains the accepted head; complete replacement establishes a new document identity and history boundary. Display hydration changes neither content revision nor history and restores authored image/background sources in all exports.

Raster and paste boundaries

Document raster display uses validated data/blob transport. AllowExternalResources permits bounded native HTTPS BaseUrl hydration and supported trusted YouTube preview; it does not enable browser raw HTTPS raster or CSS image fetches. Explicit accepted URL bytes can remain available offline. During actual Office cleanup, PasteAsync durably embeds only approved cached or configured-base rasters and canonical operating-system temporary msohtmlclip raster references, unless local selection is disabled. This does not create persistent import grants. Quoted image-set(...) forms remain authored but blocked and unprojected; they are not included in print missing-resource reports.

External stylesheet links are excluded. Use HeaderStyleContent for bounded local document CSS. Changing Options.DefaultCssFileLinkNameAttribute is rejected instead of acknowledging an ineffective native setting.