Configuring NITF and NSIF protection

Glasswall Halo protects NITF (National Imagery Transmission Format) and NSIF (NATO Secondary Imagery Format) files with Glasswall Genesis. You control that protection through the optional extendedFormatSettings section of a content management policy, by setting the action Genesis takes for each rule. This page explains the section, lists every rule with its default action and describes the default behavior you will see in protected files.

The section is managed through the Policy management API and the dynamic policy of a CDR request. It does not appear in the Halo Portal in this release. For the policy endpoints and the three ways to apply a policy, see Define content management policies.

The default

A newly created or reset policy carries an empty policy tree:

"extendedFormatSettings": {
  "version": 1,
  "policy": {}
}

An empty tree, or no extendedFormatSettings section at all, means Genesis applies its own default action to every rule. The default for each rule is listed in the NITF rule reference.

Example

Each entry under rules names a rule, by its name or its ID, and gives the one action it takes. Every rule you do not name keeps its default.

"extendedFormatSettings": {
  "version": 1,
  "policy": {
    "cdr": {
      "globals": {},
      "overrides": {
        "nitf": {
          "rules": {
            "originator-name-disclosure": "report",
            "originator-phone-disclosure": "report",
            "gw-7NHJA9B": "report",
            "image-subheader-unaccounted-bytes": "remove"
          }
        }
      }
    }
  }
}

This policy keeps the originator name and phone fields and the file title, which Genesis would otherwise overwrite, and removes surplus bytes from image subheaders, which Genesis would otherwise only report. The empty globals object is required in this release whenever cdr is present.

Settings reference

Envelope

Setting	Type	Default	Effect
version	integer	1	The version of the section's shape. Always 1 in this release.
policy	object	{}	The Genesis policy tree. Halo hands it to Genesis unchanged. Empty means Genesis defaults.

Policy tree

Setting	Where	Effect
cdr	policy	The Glasswall CDR (Content Disarm and Reconstruction) decisions. This is the only section Halo enforces.
globals	policy.cdr	Required whenever cdr is present. May be an empty object, as in the example.
overrides	policy.cdr	Per-format settings, keyed by format. The format keys are nitf for the NITF or NSIF file itself, and jpeg, jpeg2000, emf, wmf, h264, h265 and sidd for the content embedded in it. Any other key is rejected when the policy is saved.
rules	overrides.<format>	The action for individual rules, keyed by rule name or rule ID. The value is one action, written as a string. The rule must offer the action you name, or the policy fails when Genesis loads it.

The section also accepts scope-wide settings, such as compliance and per-content-type actions, under globals and under each override. They are not covered in this release.

Actions

Action	Effect
report	Record the finding in the analysis report and deliver the file with the content unchanged.
reveal	Make hidden content visible. No NITF rule offers this action in this release.
replace	Overwrite the content with a safe value, for example spaces or a default.
remove	Remove the content and correct the lengths that described it.
reject	Block the file. The file is not delivered and the report gives the reason. Every rule offers this action.
omit	Do not run the rule. Nothing is reported and nothing is changed.

Setting null for a rule is the same as leaving it out.

How a rule's action is decided

A rule takes the action its rules entry names. Without an entry it takes its default. A rule that offers only reject, such as image-subheader-length-mismatch, cannot be changed, and a policy naming another action for it is rejected when Genesis loads it. Where several rules act on the same field, they run in order and the last one sets the final value.

Default behavior you will see in output

Some rules change a field on every protected file, and some fields are handled in ways that cannot be configured.

• Originator name and phone (ONAME, OPHONE) are overwritten with spaces on every protected file. Set originator-name-disclosure and originator-phone-disclosure to report to keep them.
• File title, text segment titles and graphic names (FTITLE, TXTITL, SNAME) are replaced because they can carry sensitive free text. Set file-title-disclosure, text-title-disclosure or graphic-name-disclosure to report to keep them.
• Encryption flag (ENCRYP) is never rewritten. A file whose flag is set to anything other than 0 is blocked, because clearing it would deliver a file that claims to be unencrypted while carrying the original bytes. To take delivery of such a file, set encryption-flag-invalid and encryption-flag-segment-invalid to report. A blank flag is treated as unset, and its departure from the numeric character set is reported by header-numeric-charset-invalid.
• Image sync (ISYNC) is overwritten with zero and the file is delivered. Set image-sync-invalid to reject to block such a file instead.
• Reserved segment count (NUMX) blocks the file when it is not 000. Set label-segment-count-out-of-range to replace to have it overwritten and the file delivered, or to report to deliver the file unchanged.
• Copy numbers (FSCOP, FSCPYS) are overwritten with 00000 on every protected file by copy-numbers-non-default. Because the block decision reads the corrected output, that overwrite also satisfies copy-numbers-not-integer, so a reject on that rule only takes effect where the overwrite is suppressed. To block on non-default copy numbers, set copy-numbers-non-default itself to reject.
• Image subheader length. Where an image subheader's fields need more space than the declared length provides, image-subheader-length-mismatch blocks the file, and that cannot be changed. Where the declared length exceeds the fields, image-subheader-unaccounted-bytes reports the surplus by default. Setting it to remove deletes the surplus and corrects the subheader and file lengths, which shortens the file. Some producers pad subheaders, so the reporting default is recommended unless the surplus must go.
• Compressed images, CGM graphics and SIDD segments are handed to the matching embedded format by the rules compressed-image-present, cgm-content-present and des-data-present. Setting one of them to report delivers that content uninspected.
• Output integrity. After protection, Genesis re-reads every output file and refuses to deliver one it can no longer parse as valid NITF. This check cannot be turned off.
• SIDD and other XML segments. A SIDD segment that cannot be protected blocks the whole file with the reason unsupported-variant, and this is not configurable. A non-SIDD XML segment such as SICD is blocked by unsupported-xml-des, which you can downgrade to report to pass the segment through uninspected.

Choosing a non-modifying action such as report or reject for a rule turns off the replacement that rule owns, so the field is delivered as it arrived.

Declassification fields and the classification text field

The declass-fields-present rule clears the declassification fields when the element is unclassified or declares no declassification type, following the Inspection and Sanitization Guidance. The guidance groups six fields for this purpose: the declassification type, date and exemption, the downgrade indicator and its date and the classification text field (xSCLTX).

Genesis clears the first five and filters the sixth rather than clearing it. The classification text field is where a file records dissemination caveats when the control-and-handling field holds CH, and where codeword and releasability overflow is held. A blank declassification type is the specification's default, so clearing the field on that basis would strip caveats from classified products that simply never declared a declassification scheme.

The filter keeps only the formatted values the guidance defines for the field, and only when the field that declares the overflow agrees:

• A CW_ codeword overflow, when the codewords field ends in +.
• An RL_ releasability overflow, when the releasability field ends in +.
• CH_ caveats or SIC: indicator codes, when the control-and-handling field holds CH.
• Either "CANNOT BE EXPRESSED IN SUBHEADER" declaration.

Everything else in the field is cleared. In practice this means dissemination caveats survive processing, free text in the field is still removed and a field holding a caveat followed by free text is rewritten to the caveat alone. classification-text-disclosure reports the original content before processing.

To have the declassification fields reported instead of cleared, set declass-fields-present to report. Setting classification-text-disclosure to reject blocks any file whose classification text field carries content, because it is a presence check with no replacement available.

Embedded content

A NITF or NSIF file can carry images, graphics and video that Genesis inspects with the format's own rules. You set their actions in the same way, under overrides.<format>.rules, where the format is jpeg, jpeg2000, emf, wmf, h264, h265 or sidd. Every rule for these formats, with its default action, is listed in NITF and NSIF embedded content rules.

These settings apply only to content inside a NITF or NSIF file. A standalone file of one of these formats is not processed by Genesis. Where the Glasswall Embedded Engine supports the format, it is configured through contentManagementFlags instead.

Validation and errors

Halo checks the cdr section against the settings and values Genesis accepts before it stores a policy or accepts a request.

• An unknown setting or a value outside the allowed set is rejected with error code 4004 and a message naming the path to the setting at fault.
• A cdr section without globals is rejected with error code 4004.
• An overrides key that is not one of the eight formats is rejected when the policy is saved.
• Rule names are not checked by Halo. A name Genesis does not recognize, or an action the rule does not offer, is found when Genesis loads the policy. Every NITF or NSIF file submitted under that policy is then errored with the reason GenesisPolicyInvalid until the policy is corrected.
• The policy is read for every request, so a change takes effect for the next submission without redeploying or restarting Halo.

NITF rule reference

Every rule Genesis applies to the NITF structure, grouped by the part of the file it checks. Target a rule under rules by its name or its ID. reject is offered by every rule and is not repeated in the Configurable actions column. Compliance lists the sources that back the rule: spec is the format specification, isg is the NSA Inspection and Sanitization Guidance, cve is a published vulnerability, gw is Glasswall research. Impact is the rule's change tier.

allowed-character-sets-size

If any byte in a file header field falls outside the declared character set, it may indicate data hiding, corruption or an attack vector. Fields using BCS-A, BCS-N, BCS-N PI and ECS-A each have specific allowed byte ranges defined by the NITF specification.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
file-datetime-charset-invalid	gw-KBZF59J	Detect BCS-N fields containing characters other than digits, plus, minus, period or slash	reject	report omit	spec; isg; gw	functional
file-header-fields-charset-invalid	gw-MJ1JYW4	Detect BCS-A fields containing bytes outside the range 0x20-0x7E	reject	report omit	spec; isg; gw	functional
header-length-charset-invalid	gw-77NRM2F	Detect a file length or header length field containing characters other than digits	reject	report omit	spec; isg; gw	functional
header-numeric-charset-invalid	gw-D5RH2V3	Detect a complexity level, copy number or encryption field with characters other than digits	report	report omit	spec; isg; gw	functional
header-text-fields-charset-invalid	gw-VBGAZ4P	Detect ECS-A fields containing bytes outside the ranges 0x20-0x7E or 0xA0-0xFF	reject	report omit	spec; isg; gw	functional

band-representation

Inconsistent band representation descriptors may indicate a manipulated file designed to hide content in bands that standard viewers ignore.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
band-count-inconsistent	gw-62P1GAJ	Detect a band count (NBANDS/XBANDS) inconsistency: NBANDS outside 0-9, or XBANDS missing when NBANDS is 0	reject	report omit	spec; isg; gw	functional
band-representation-invalid	gw-B33PP90	Detect band representation (IREPBANDn) values inconsistent with IREP	reject	report omit	spec; isg; gw	functional
band-subcategory-invalid	gw-YA9NG6W	Detect band subcategory (ISUBCATn) values inconsistent with ICAT and IREP (Table 5.13-8)	reject	report omit	spec; isg; gw	functional
lookup-table-embedded-file	gw-H0HJXKX	Detect a file signature embedded in a band lookup table's entries	reject	report omit	isg; gw	functional
lookup-table-size-invalid	gw-988T966	Detect a band lookup table whose declared size is outside what the spec permits	reject	report omit	spec; isg; gw	functional

classification

Invalid classification values or missing classification system codes may indicate manipulation or cause mishandling of classified information. Security classification fields may contain sensitive information about classification handling and releasability.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
classification-level-inconsistent	gw-TX2K4D9	Detect a segment classification that exceeds the file header classification (U < R < C < S < T)	reject	report omit	spec; isg; gw	functional
classification-level-invalid	gw-E2HB506	Detect an xSCLAS value other than T, S, C, R or U in the file header or any segment subheader	reject	report omit	spec; isg; gw	functional
classification-system-bare-country-invalid	gw-ZCFM2D6	Detect an xSCLSY bare country code that is neither valid a priori (uppercase A-Z only) nor ad hoc (letters and digits) format	reject	report omit	spec; isg; gw	functional
classification-system-conditional-invalid	gw-VRBP79T	Detect an xSCLSY of spaces when xSCLAS is T/S/C/R (classified)	reject	report omit	spec; isg; gw	functional
classification-system-country-invalid	gw-P9RVRXR	Detect an xSCLSY that is not a valid 2-byte country code (uppercase A-Z), special code (XN/XF/YY/UU) or spaces when unclassified	reject	report omit	spec; isg; gw	functional
classification-text-country-invalid	gw-YX23VPP	Detect an xSCLTX fully specified country code URN with invalid concept-type, authority, encoding, baseline or code components	reject	report omit	spec; isg; gw	functional
codewords-disclosure	gw-W7SFNG0	Detect codewords (xSCODE) carrying content the conformance check does not constrain	report	report omit	isg; gw	functional
codewords-invalid	gw-5BGEHYE	Detect an xSCODE that is not spaces, ISM-IN-TRE-, ISM-IN-FHDR or space-separated codewords of printable characters	reject	report omit	spec; isg; gw	functional
control-handling-invalid	gw-EH9AHWG	Detect an xSCTLH that is neither spaces nor 2 BCS-A printable characters	reject	report omit	spec; isg; gw	functional
control-handling-marking-conflict	gw-8HVEZYX	Detect an xSCTLH of CH while xSCODE stores the markings externally	report	report omit	spec; gw	functional
control-handling-overflow-missing	gw-KSHF9Z2	Detect an xSCTLH of CH whose xSCLTX is not a CH_ or SIC: code overflow	report	report omit	spec; gw	functional
releasing-instructions-invalid	gw-06P0AXY	Detect an xSREL that is not spaces, hash-fill or space-separated bare country codes (2-3 uppercase A-Z chars, 20th char may be +)	reject	report omit	spec; isg; gw	functional
segment-codewords-undeclared	gw-JA5C7JV	Detect codewords in a segment subheader that the file header does not declare	report	report omit	gw	functional
segment-control-handling-undeclared	gw-TC4KJXP	Detect control and handling markings in a segment subheader that the file header does not declare	report	report omit	gw	functional
segment-releasability-undeclared	gw-1DFE95G	Detect releasing instructions in a segment subheader that the file header does not declare	report	report omit	gw	functional

classification-authority

Invalid classification authority fields may indicate file manipulation or cause improper attribution of classification decisions. Classification authority field may contain personally identifiable information about the classifying official.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
authority-type-invalid	gw-BH8SF9K	Detect an xSCATP other than O, D, M or space	reject	report omit	spec; isg; gw	functional
classification-authority-disclosure	gw-EZ337WV	Detect classification authority (xSCAUT) carrying free text that requires review	report	report omit	isg; gw	functional
classification-reason-invalid	gw-HTW43F6	Detect an xSCRSN other than A-H, M, N or space	reject	report omit	spec; isg; gw	functional
copy-number-inconsistent	gw-VS8J12T	Detect a file copy number (FSCOP) greater than the file number of copies (FSCPYS)	reject	report omit	spec; isg; gw	functional
security-source-date-invalid	gw-93KG1R2	Detect an xSSRDT that is neither a valid CCYYMMDD nor all spaces	reject	report omit	spec; isg; gw	functional

data-extension-segment

DES subheader fields may contain forged data. DE must be 'DE', DESID must be printable and DESVER must be valid.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
des-body-opaque	gw-KZ1JQSM	Detect a non-SIDD DES carrying an opaque, uninspectable body	report	report replace omit	isg; gw	functional
des-body-smuggling-signal	gw-6V4DAZG	Detect a non-SIDD DES body (DESDATA/DESSHF) carrying a content-smuggling signal	report	report replace omit	spec; isg; gw	functional
des-data-embedded-file	gw-FFK1XHH	Detect Data Extension Segment data carrying an embedded file signature other than markup	reject	report omit	spec; isg; gw	functional
des-data-embedded-markup	gw-PHN7MJV	Detect Data Extension Segment data carrying an embedded XML or HTML signature	report	report omit	isg; gw	functional
des-data-entropy-suspicious	gw-AS5VX71	Detect DES data with anomalously high entropy indicating hidden or encrypted content	report	report omit	spec; isg; gw	functional
des-data-null-padding	gw-15MB867	Detect DES data carrying null padding that may conceal hidden content	report	report omit	spec; isg; gw	functional
des-data-present	gw-C63HQ8A	Detect SIDD (Sensor Independent Derived Data) DES segments (DESID 'XML_DATA_CONTENT' with SIDD subspec) whose embedded XML requires sub-camera inspection	replace	replace report omit	isg; gw	functional
des-data-printable-ratio-suspicious	gw-6QV26WK	Detect DES data with an anomalous printable-character ratio	report	report omit	spec; isg; gw	functional
des-id-invalid	gw-DVR7GTC	Detect a DES identifier (DESID) containing non-BCS-A bytes	report	report omit	spec; isg; gw	functional
des-identifier-spoofed	gw-QRQM2BN	Detect a DES identifier (DESID) impersonating a dedicated-handler identifier through non-conformant padding	reject	report omit	spec; gw	functional
des-name-collision-set	gw-SXAC10Y	Detect XML element names chosen to share a hash value, degrading a consumer's lookup	report	report omit	spec; isg; gw	structural
des-subheader-length-mismatch	gw-8285Q3F	Detect a DES subheader length (LDSH) that disagrees with the length DESSHL implies	reject	report omit	spec; isg; gw	functional
des-type-invalid	gw-3B8RZ5S	Detect a DES subheader file part type (DE) other than 'DE'	report	report omit	spec; isg; gw	functional
des-unregistered	gw-GP8DGJ5	Detect a DES identifier (DESID) that is not registered in the NTB FV-CP register	report	report omit	spec; isg; gw	functional
des-user-header-field-invalid	gw-CAZQ6YD	Detect an XML DES user-defined subheader subfield that violates its declared type or range	report	report omit	spec; gw	functional
des-user-header-length-invalid	gw-TWEAMEM	Detect an XML DES user-defined subheader length that is not a defined inclusion stage	report	report omit	spec; gw	functional
des-version-invalid	gw-H3SJZT6	Detect a DES version (DESVER) that is not a valid 2-digit version number (01-99)	report	report omit	spec; isg; gw	functional
multiple-sidd-des	gw-WY5HYF6	Detect a container declaring more than one SIDD XML data extension segment	report	report omit	isg; gw	functional
streaming-des-field-unsupported	gw-39QNDBX	Detect a STREAMING_FILE_HEADER present in any DES DESID field	reject	report omit	spec; isg; gw	functional
unsupported-xml-des	gw-NTFXDES	Detect an XML_DATA_CONTENT / SIDD_XML DES whose XML root is not a SIDD namespace (an unsupported variant such as SICD that the SIDD sub-camera cannot inspect or remediate)	reject	report omit	isg; gw	functional

declassification

Invalid declassification fields may indicate file manipulation or cause mishandling of declassification schedules. Classification text may contain sensitive information about classification reasoning and authority.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
classification-text-disclosure	gw-J0N4J9J	Detect classification text (xSCLTX) carrying free text that requires review	report	report omit	isg; gw	functional
declass-date-conditional-invalid	gw-9PJZBJ4	Detect an xSDCDT of spaces when xSDCTP is DD or DE	reject	report omit	spec; isg; gw	functional
declass-date-format-invalid	gw-64DJ90Q	Detect an xSDCDT that is neither a valid CCYYMMDD nor all spaces	reject	report omit	spec; isg; gw	functional
declass-exemption-invalid	gw-JN916GM	Detect an xSDCXM that is not a valid exemption code when xSDCTP is X(space)	reject	report omit	spec; isg; gw	functional
declass-fields-present	gw-Y605Q6J	Detect declassification fields (FSDCTP, FSDCDT) populated when classification is U or the declassification type is not implemented	replace	replace report omit	isg; gw	functional
declass-type-invalid	gw-0B1ZGMN	Detect an xSDCTP other than DD, DE, GD, GE, O(space), X(space) or spaces	reject	report omit	spec; isg; gw	functional
downgrade-date-conditional-invalid	gw-C209SXH	Detect an xSDGDT that is not a valid CCYYMMDD when xSDG is S/C/R	reject	report omit	spec; isg; gw	functional
downgrade-invalid	gw-5J4ZJJX	Detect an xSDG other than S, C, R or space	reject	report omit	spec; isg; gw	functional
downgrade-level-inconsistent	gw-516Q559	Detect an xSDG naming a classification at or above xSCLAS	reject	report omit	spec; isg; gw	functional
downgrade-without-declass-type	gw-Y5TG33S	Detect an xSDG populated while xSDCTP is neither GD nor GE	reject	report omit	spec; isg; gw	functional

encryption

Encrypted NITF files cannot be inspected or protected. ENCRYP is defined in the file header (offset 296) and in the Image, Graphic and Text subheaders only; MIL-STD-2500C tables A-8 and A-9 give the DES and RES subheaders no such field. A populated value other than 0 declares the payload to be ciphertext and the file is rejected, since clearing the flag would not decrypt the content and would deliver a file declaring itself unencrypted while carrying the original bytes. An all-spaces field declares nothing and is treated as unset; its departure from BCS-N PI is reported by header-numeric-charset-invalid.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
encryption-flag-invalid	gw-T5C81WM	Detect a file header encryption flag (ENCRYP) declaring the payload encrypted	reject	report omit	spec; isg; gw	functional
encryption-flag-segment-invalid	gw-GHXDFVA	Detect an encryption flag (ENCRYP) declaring an Image, Graphic or Text payload encrypted	reject	report omit	spec; isg; gw	functional

extended-header-data

The Extended Header Data fields (XHDL, XHDLOFL, XHD) allow additional TRE data in the file header. Invalid length values or overflow references to non-existent DES segments can hide data or cause incorrect parsing. Extended Header Data (XHD) may contain TRE data with sensitive or classified information that requires external filtering before release.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
ext-header-length-out-of-range	gw-XF0T67K	Detect an extended header data length (XHDL) that is neither 0 nor within 3-99999	reject	report omit	spec; isg; gw	functional
ext-header-overflow-invalid	gw-RM0YJJQ	Detect an extended header overflow reference (XHDLOFL) that does not reference a valid DES segment	reject	report omit	spec; isg; gw	functional
ext-header-present	gw-K3K2J3Y	Detect extended header (XHD) TRE data that may carry sensitive information	report	report omit	isg; gw	functional

file-length-and-header-length

Data can be appended to NITF files by manipulating the FL field to be smaller than the actual file size. Mismatched header length values may indicate malicious modification of the file structure. Applications rely on FL and HL being accurate for correct parsing.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
complexity-level-size-exceeded	gw-ZZGFZ82	Detect a file size (FL) exceeding the maximum allowed by the declared complexity level (CLEVEL) per Table G-1	report	report omit	spec; isg; gw	functional
file-length-mismatch	gw-HYP7KVG	Detect a file length (FL) that does not match the actual file size	reject	report omit	spec; isg; gw	functional
file-length-out-of-range	gw-VG7SDKE	Detect a file length (FL) outside the allowed range (388 to 999999999998)	reject	report omit	spec; isg; gw	functional
header-length-mismatch	gw-A2C0B97	Detect a header length (HL) that does not match the computed header length (skipped when HL is 999999, streaming mode)	reject	report omit	spec; isg; gw	functional
header-length-out-of-range	gw-QY07JKC	Detect a header length (HL) outside the allowed range (388 to 999999)	reject	report omit	spec; isg; gw	functional

graphic-cgm-structure

CGM graphic data may contain malformed element streams, reserved element classes or security-sensitive Escape (class 6) and Application Data (class 7) elements that can carry arbitrary vendor-specific operations or payloads.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
cgm-content-present	gw-CGMEMB3	Detect graphic segments carrying WMF / EMF metafile data whose content requires sub-camera inspection	replace	replace report omit	isg; gw	functional
cgm-structure-invalid	gw-VZ7D0W5	Detect a CGM element stream with a structural-integrity fault, missing delimiter or security-sensitive element	reject	report omit	spec; isg; gw	functional

graphic-extended-data

SXSHDL defines the size of extended subheader data in graphic segments. Values of 1 or 2 are invalid (must be 0 or 3-99999). Manipulated lengths can cause parsers to read incorrect data. SXSHD TRE data may contain sensitive information that requires external filtering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
graphic-ext-header-disclosure	gw-64JA1PW	Detect graphic extended-subheader (SXSHD) TRE free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
graphic-ext-header-length-invalid	gw-C903W2A	Detect a graphic extended-subheader data length (SXSHDL) that is neither 0 nor 3-99999 in any graphic subheader	report	report omit	spec; isg; gw	functional

graphic-subheader

Graphic subheader fields may contain forged or hidden data. SY must be 'SY', SFMT must be 'C' and SSTRUCT must be all zeros. SID and SNAME may disclose sensitive identification information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
graphic-format-structure-non-default	gw-JA74Q9R	Detect a graphic format (SFMT) other than 'C' (CGM) or a structure (SSTRUCT) other than 13 zeros	replace	replace report omit	spec; isg; gw	functional
graphic-id-name-disclosure	gw-8A9BJZ3	Detect graphic identifier (SID) and name (SNAME) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
graphic-name-disclosure	gw-853KZBR	Detect a graphic name (SNAME) that may carry sensitive information	replace	replace report omit	isg; gw	visual
graphic-partition-invalid	gw-BE2E2K6	Detect a graphic subheader file part type (SY) other than 'SY'	report	report omit	spec; isg; gw	functional

header-first-119-bytes

Based on experimentation with uncertified NITF viewers, it appears the only field required to be accurate is the File Profile Name, which should be "NITF". The next bytes of this header portion do not appear to have a significant impact on the file when opening it, so they could contain hidden data or malicious content. The Complexity Level signals to the application the complexity of the file and the requirements necessary to process the file; manipulation of this field may impact the ability for NITF files to be processed by certain applications. Uncertified applications should not be used to process or render NITF files as they can create and/or persist non-compliant NITF files. The NITF header contains the fields Originator's Name, Originator's Phone Number, Originating Station ID and the File Title. All of these fields could contain sensitive information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
complexity-level-invalid	gw-NCTA52A	Detect a CLEVEL that does not evaluate to 03, 05, 06, 07, 09, 51, 54 or 57 (any other value is non-compliant; values 51, 54 and 57 imply the file uses the Motion Imagery Extension (MIE4NITF); Table G-1 in JBP 2024.1 covers additional constraints on subsequent constructs based on the value of CLEVEL)	reject	report omit	spec; isg; gw	functional
copy-numbers-non-default	gw-HMWEEN3	Detect a file copy number (FSCOP) / file number of copies (FSCPYS) carrying non-default copy-tracking values	replace	replace report omit	isg; gw	functional
copy-numbers-not-integer	gw-06RZ9KC	Detect a file copy number (FSCOP) or file number of copies (FSCPYS) that is not a positive integer	reject	report omit	spec; isg; gw	functional
file-datetime-cross-segment-invalid	gw-7JAT2XP	Detect a file date/time (FDT) earlier than an image (IDATIM) or text (TXTDT) date/time	reject	report omit	spec; isg; gw	functional
file-datetime-invalid	gw-EF4XAH4	Detect a date field (FDT) that is not in the correct UTC format of CCYYMMDDhhmmss	reject	report omit	spec; isg; gw	functional
file-header-invalid	gw-YGWDXM2	Detect a file profile name (FHDR) other than NITF or NSIF in the first 4 bytes	reject	report omit	spec; isg; gw	functional
file-title-disclosure	gw-7NHJA9B	Detect a file title (FTITLE) that may carry sensitive free text	replace	replace report omit	isg; gw	visual
nitf-file-version-invalid	gw-WT6EGQ3	Detect a file version (FVER) other than 02.10 when the file profile name (FHDR) is NITF	reject	report omit	spec; isg; gw	functional
nsif-file-version-invalid	gw-RW8EGH5	Detect a file version (FVER) other than 01.01 or 01.00 when the file profile name (FHDR) is NSIF	reject	report omit	spec; isg; gw	functional
originator-fields-disclosure	gw-31ANKNT	Detect originator name (ONAME), phone (OPHONE), station ID (OSTAID) and file title (FTITLE) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
standard-type-invalid	gw-6RP2YBG	Detect a standard type (STYPE) field other than "BF01"	reject	report replace omit	spec; isg; gw	functional

image-block-structure

Block structure inconsistency (NBPR*NPPBH < NCOLS or NBPC*NPPBV < NROWS) causes downstream decoders to miscalculate buffer sizes, potentially leading to heap buffer overflow or under-read.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
block-cols-mismatch	gw-B4ESDK9	Detect vertical block coverage (NBPC * NPPBV) less than the image height (NROWS)	report	report omit	spec; isg; gw	functional
block-count-mismatch	gw-Q4XHWNK	Detect a number of blocks per row (NBPR) or per column (NBPC) below 1	report	report omit	spec; isg; gw	functional
block-rows-mismatch	gw-KY9HQSY	Detect horizontal block coverage (NBPR * NPPBH) less than the image width (NCOLS)	report	report omit	spec; isg; gw	functional

image-comments

Image comments (ICOM fields) may contain hidden data via non-printable characters. Each ICOM must consist of BCS-A printable characters (0x20-0x7E). Image comments may contain sensitive information that requires external filtering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-comment-charset-invalid	gw-6JG38N8	Detect an image comment (ICOM) containing characters other than BCS-A printable (0x20-0x7E)	report	report omit	spec; isg; gw	functional
image-comment-disclosure	gw-DNXMCC0	Detect image comment (ICOM) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional

image-compression

Invalid compression codes, missing mask tables or malformed COMRAT values may indicate a manipulated image or trigger codec vulnerabilities.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
codestream-trailing-data-present	gw-C36XZW6	Detect data appended after the JPEG 2000 codestream EOC	replace	replace report omit	spec; gw	structural
compressed-geometry-mismatch	gw-W70TCXD	Detect a compressed image whose codestream declares a different picture than its subheader	reject	report omit	spec; isg; gw	functional
compressed-image-present	gw-NTFEMB5	Detect compressed image segments (IC in C3, M3, C5, M5, C8, M8) whose pixel data requires sub-camera inspection	replace	replace report omit	isg; gw	visual
compression-code-invalid	gw-FWSZF1Z	Detect an image compression code (IC) that is not a permitted value	reject	report omit	spec; isg; gw	functional
compression-codec-unsupported	gw-K4WQ2M8	Detect an image segment whose compression code (IC) is a compressed codec Genesis has no sub-camera to inspect (e.g. C1 bi-level, C4 vector quantization); the codestream cannot be made safe, so protect fails closed rather than blanking the pixels while reporting clean	reject	report omit	spec; gw	functional
compression-mask-table-present	gw-9Q07H96	Detect a masked image compression (IC) without a readable mask table header	report	report omit	spec; isg; gw	functional
compression-rate-invalid	gw-10QM4WE	Detect a compression rate (COMRAT) that is malformed when present	report	report omit	spec; isg; gw	functional
decompressed-size-excessive	gw-3KX9WQ2	Detect a zlib-compressed image declaring or expanding to more pixel data than the safe limit	reject	report omit	spec; gw	functional
mask-table-structure-invalid	gw-FGA40PE	Detect an image mask table header field outside the values the spec permits it	reject	report omit	spec; isg; gw	functional
mask-table-unaccounted-bytes	gw-ACMSSTN	Detect an image mask table declaring image data beyond the fields that describe it	remove	remove report omit	spec; isg; gw	structural
pixel-data-surplus	gw-AWEP9PN	Detect an uncompressed image segment carrying more data than its declared pixel array holds	replace	replace report omit	spec; isg; gw	structural
uncompressed-data-length-invalid	gw-797K7EK	Detect uncompressed (NC/NM) image data shorter than its stored blocks can occupy	reject	report omit	spec; isg; gw	functional

image-dimensions

Extreme NROWS or NCOLS values can cause integer overflow in dimension*band*bitdepth calculations, leading to heap buffer overflow or excessive memory allocation (DoS). NROWS=0 or NCOLS=0 can cause division-by-zero in stride calculations.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-cols-out-of-range	gw-KM2D0K2	Detect a number of image columns (NCOLS) below 1 or above the configured maximum (default 65535)	reject	report omit	spec; isg; gw	functional
image-rows-out-of-range	gw-40ESGTZ	Detect a number of image rows (NROWS) below 1 or above the configured maximum (default 65535)	reject	report omit	spec; isg; gw	functional

image-filter-condition

IFC values other than 'N' indicate filtered image data. Parsers that do not support the declared filter will misinterpret the image data, potentially causing incorrect rendering or buffer errors. IMFLT carries filter parameters that could be weaponized if non-standard.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-filter-condition-invalid	gw-YMQBZJ2	Detect an image filter condition (IFC) other than 'N' (no filtering applied)	report	report omit	spec; isg; gw	functional
image-filter-invalid	gw-QV0EAKJ	Detect an image filter (IMFLT) other than spaces when the image filter condition (IFC) is 'N'	report	report omit	spec; isg; gw	functional

image-location-magnification

An attacker could place an unattached image at a non-zero ILOC offset where standard viewers would not display it, hiding content outside the visible CCS origin.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-location-invalid	gw-5YXKN8G	Detect an unattached image placed away from the CCS origin, or an attached image extending beyond its parent segment's bounds (off-canvas data-hiding risk)	replace	replace report omit	spec; isg; gw	functional
image-magnification-non-default	gw-6YNK7GV	Detect an image magnification (IMAG) other than the default 1.0	replace	replace report omit	spec; isg; gw	functional

image-mode

Invalid IMODE values or IMODE/IC mismatches may indicate a manipulated file designed to confuse image rendering or exploit codec-specific behavior.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-mode-compression-mismatch	gw-C2GACCA	Detect an image mode (IMODE) inconsistent with the compression code (IC)	reject	report omit	spec; isg; gw	functional
image-mode-invalid	gw-1GRMF8Z	Detect an image mode (IMODE) that is not a permitted value	reject	report omit	spec; isg; gw	functional

image-segment

Image subheader fields may contain forged or hidden data. IM must be 'IM', IDATIM must be valid and TGTID must contain valid identifiers. TGTID, IID1 and IID2 may disclose sensitive targeting or identification information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-datetime-cross-segment-invalid	gw-Y44FCVQ	Detect an image date/time (IDATIM) later than the file date/time (FDT)	report	report omit	spec; isg; gw	functional
image-datetime-invalid	gw-W6N587P	Detect an image date/time (IDATIM) that is not a valid CCYYMMDDhhmmss datetime	report	report omit	spec; isg; gw	functional
image-id-disclosure	gw-EX0KMNE	Detect target identifier (TGTID) and image identifiers (IID1, IID2) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
image-partition-invalid	gw-2WVT86N	Detect an image subheader file part type (IM) other than 'IM'	report	report omit	spec; isg; gw	functional
image-subheader-length-mismatch	gw-JQDKW2V	Detect an image subheader whose fields do not fit the declared length (LISH)	reject	—	spec; isg; gw	functional
image-subheader-unaccounted-bytes	gw-B75TX7B	Detect bytes inside an image subheader that no declared field accounts for	report	report remove omit	spec; isg; gw	structural
target-id-invalid	gw-NWNFZ76	Detect a target identifier (TGTID) with an invalid target identifier or country code	report	report omit	spec; isg; gw	functional

image-source-size-location

Invalid pixel type, representation or category values may indicate a manipulated or non-compliant image subheader. ISORCE and IGEOLO may disclose sensor identity or geographic targeting information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
actual-bit-depth-invalid	gw-KA2W92Q	Detect actual bits per pixel (ABPP) inconsistent with the actual image data bit depth	reject	report omit	spec; isg; gw	functional
bit-depth-invalid	gw-7K9Z0ZD	Detect a number of bits per pixel (NBPP) inconsistent with the actual image data bit depth and compression	reject	report omit	spec; isg; gw	functional
geographic-coordinates-invalid	gw-VXQRRV1	Detect a geographic location (IGEOLO) that contradicts the coordinate system ICORDS declares	reject	report omit	spec; isg; gw	functional
image-category-invalid	gw-1YMK6RN	Detect an image category (ICAT) that is not a permitted Table A-3 value	reject	report omit	spec; isg; gw	functional
image-representation-invalid	gw-T1VE0Y1	Detect an image representation (IREP) that is not a permitted value	report	report omit	spec; isg; gw	functional
image-source-location-disclosure	gw-W8NHN03	Detect image source (ISORCE) and geographic location (IGEOLO) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
pixel-justification-invalid	gw-BVD1FYD	Detect a pixel justification (PJUST) that is not a permitted value	report	report omit	spec; isg; gw	functional
pixel-type-invalid	gw-SPFHVNE	Detect a pixel value type (PVTYPE) that is not a permitted value	reject	report omit	spec; isg; gw	functional

image-sync

ISYNC is a reserved field that must always be 0. A non-zero value may indicate data hiding in the reserved field or a corrupted/manipulated file structure.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
image-sync-invalid	gw-QCA9R7Q	Detect a reserved image sync field (ISYNC) other than 0	replace	replace report omit	spec; isg; gw	functional

metadata-text

Metadata text is operator-authored and rendered by downstream consumers, so a script literal or injection sequence hidden there runs where the imagery is displayed. Canonicalization defeats a cloak that splits the literal with an invisible code point.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
metadata-injection-sequence	gw-828D9X3	Detect a template, expression or SQL injection metacharacter sequence in metadata text	report	report omit	cve; gw	functional
text-active-content-present	gw-VE1TPVM	Detect active or executable content in text data or subheader free text	reject	report omit	spec; isg; gw	functional
text-zero-width-character-present	gw-Z2EB4B2	Detect an invisible or zero-width Unicode code point in text or subheader free text	report	report omit	gw; analogy	functional

originator-information

The Originator's Name and Phone Number fields may contain values that do not match an approved whitelist or expected pattern, potentially indicating data hiding or substitution.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
originator-name-disclosure	gw-NA9EM24	Detect originator name (ONAME) free-text content that may carry sensitive information	replace	replace report omit	spec; isg; gw	functional
originator-phone-disclosure	gw-C2RBSSP	Detect originator phone (OPHONE) free-text content that may carry sensitive information	replace	replace report omit	spec; isg; gw	functional

overflow-des

Overflow DES segments must have valid DESID='TRE_OVERFLOW' and DESOFLW pointing to a valid overflow source. Overflow DES data contains TRE content that may disclose sensitive information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
overflow-des-data-disclosure	gw-H41BH5J	Detect overflow DES TRE free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
overflow-des-id-invalid	gw-FS84P3G	Detect an overflow DES identifier (DESID) other than 'TRE_OVERFLOW'	report	report omit	spec; isg; gw	functional
overflow-des-target-invalid	gw-K9RCTBC	Detect an overflow DES source identifier (DESOFLW) that is invalid	report	report omit	spec; isg; gw	functional
overflow-des-type-invalid	gw-1RPYRFN	Detect an overflow DES subheader file part type (DE) other than 'DE'	report	report omit	spec; isg; gw	functional

polyglot-signature

A file that is simultaneously valid NITF and a valid second format (DICOM at offset 128, UEFI GPT at 512, ISO 9660 at 32769) is a parser-differential vector: a downstream tool that sniffs the second format processes attacker-chosen content the NITF pipeline never inspected.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
polyglot-signature-present	gw-NY8D1MT	Detect a foreign container signature at a fixed file offset that overlays the NITF structure	report	report omit	gw	functional

segment-data

Segment data may contain hidden or malicious content that requires content review outside the format-specific remediator. An uncompressed pixel array is preserved byte for byte, so a foreign file signature placed at its start is delivered unless it is detected there. Unknown segment types that do not match the expected file part type (IM, SY, TE, DE, RE) must be rejected.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
pixel-data-embedded-file	gw-162J4ZM	Detect an embedded file signature at the start of uncompressed image pixel data	replace	replace report omit	spec; isg; gw	visual
pixel-data-embedded-markup	gw-7FWQEKM	Detect an embedded XML or HTML signature at the start of uncompressed image pixel data	replace	replace report omit	isg; gw	visual
segment-data-embedded-file	gw-ZMNWKTC	Detect an embedded file signature at the start of graphic or text segment data	report	report replace omit	spec; isg; gw	visual
segment-data-embedded-markup	gw-H6W4X6C	Detect an embedded XML or HTML signature at the start of graphic or text segment data	report	report replace omit	isg; gw	visual
segment-data-opaque-payload	gw-GG0HWSN	Detect non-image segment payloads (TE, DE, RE) that may carry hidden data or sensitive content	report	report omit	isg; gw	functional
unknown-segment-type	gw-G42ARYV	Detect segments with unknown file part types	reject	report omit	spec; isg; gw	functional

segment-display-level

Display and attachment levels define how image, graphic and text segments are layered when the file is rendered. A duplicate, dangling or cyclic reference can hide a segment behind another, place it where a viewer never draws it or stall a viewer that follows the chain.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
attachment-level-cyclic	gw-9F8HQBE	Detect a cycle in the display/attachment-level graph (a segment chain that attaches back onto itself)	reject	report omit	spec; isg; gw	functional
attachment-level-invalid	gw-4VQ31EH	Detect a non-zero attachment level (IALVL, SALVL, TXTALVL) that does not reference a valid display level (IDLVL or SDLVL)	replace	replace report omit	spec; isg; gw	functional
display-level-not-unique	gw-D2GJW1A	Detect duplicate display levels (IDLVL, SDLVL) across the file	replace	replace report omit	spec; isg; gw	functional

segment-information

The segment information table defines the structure of the entire NITF file. Manipulated segment counts or lengths can hide data, cause buffer overflows or trick parsers into reading incorrect regions. Validating these values is critical for file integrity.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
des-count-out-of-range	gw-P6MXYZH	Detect a number of DES segments (NUMDES) outside the range 0-999	reject	report omit	spec; isg; gw	functional
graphic-segment-count-out-of-range	gw-H2Z4P6B	Detect a number of graphic segments (NUMS) outside the range 0-999	reject	report omit	spec; isg; gw	functional
image-segment-count-out-of-range	gw-VVM4X5M	Detect a number of image segments (NUMI) outside the range 0-999	reject	report omit	spec; isg; gw	functional
label-segment-count-out-of-range	gw-PJ18YHJ	Detect a reserved segment count (NUMX) that is not 0	reject	report replace omit	spec; isg; gw	functional
res-count-out-of-range	gw-ZB2NZSH	Detect a number of RES segments (NUMRES) outside the range 0-999	reject	report omit	spec; isg; gw	functional
res-count-unsupported	gw-3PRW7T5	Detect NUMRES not equal to 000—Reserved Extension Segments are precluded per JBP 2024.1	reject	report omit	spec; isg; gw	functional
segment-alignment-invalid	gw-QVD8RQ8	Detect a segment whose subheader + data length does not align with the next segment start	reject	report omit	spec; isg; gw	functional
segment-length-out-of-range	gw-7RA51QB	Detect segment subheader or data lengths outside the allowed ranges	reject	report omit	spec; isg; gw	functional
segment-location-invalid	gw-KV5CQ80	Detect a segment that does not exist at the correct file offset with the expected file part type	reject	report omit	spec; isg; gw	functional
segment-pair-count-invalid	gw-924XPR7	Detect segment length pair counts that do not match the declared segment counts	reject	report omit	spec; isg; gw	functional
segment-table-unreconciled	gw-4CMRV84	Detect a segment length table that does not reconcile with the declared file length (FL)	reject	report omit	spec; isg; gw	functional
text-segment-count-out-of-range	gw-CYYH9HB	Detect a number of text segments (NUMT) outside the range 0-999	reject	report omit	spec; isg; gw	functional

tagged-record-extension-fields

A value crafted inside an allowlisted TRE (out-of-range coefficient, NaN, non-enumerated code or an encoding-armored / injected byte) can ride through the structural TRE checks. Per-field schema validation of the high-value cataloged TREs detects poisoned values and neutralizes them in place where a safe default exists.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
geolob-field-values	gw-DNASAXB	Detect an out-of-range or malformed geo coordinate value inside a GEOLOB TRE	report	report	spec; gw	functional
geopsb-field-values	gw-1JS23K1	Detect a non-enumerated coordinate-system value inside a GEOPSB TRE	replace	replace report	spec; gw	functional
geopsb-text-charset	gw-D2PKCX5	Detect a non-printable or injected byte inside a GEOPSB text TRE	replace	replace report	spec; gw	functional
histoa-field-values	gw-3C7X2M9	Detect an out-of-range numeric field value inside a HISTOA TRE	replace	replace report	spec; gw	functional
histoa-text-charset	gw-ECXMYRE	Detect a non-printable or injected byte inside a HISTOA text TRE	replace	replace report	spec; gw	functional
ichipb-field-values	gw-1HFN5GM	Detect an out-of-range, NaN or non-enumerated field value inside an ICHIPB TRE	replace	replace report	spec; gw	functional
piaimc-field-values	gw-63D4KT0	Detect an out-of-range numeric field value inside a PIAIMC TRE	replace	replace report	spec; gw	functional
piaimc-text-charset	gw-JFJZNXY	Detect a non-printable or injected byte inside a PIAIMC text TRE	replace	replace report	spec; gw	functional
pixmta-text-charset	gw-1T9MJH6	Detect a non-printable or injected byte inside a PIXMTA text TRE	replace	replace report	spec; gw	functional

tagged-record-extensions

TRE tags must be printable BCS-A, lengths must be accurate and data must be within bounds across all TRE locations. TRE data may contain sensitive information not visible in standard metadata.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
character-run-excessive	gw-2HB5DQB	Detect a run of one repeated character long enough to stall a backtracking pattern	report	report omit	spec; isg; gw	structural
tre-aggregate-size-anomalous	gw-FBMY2H5	Detect total TRE data occupying an anomalous proportion of the file size	report	report omit	spec; isg; gw	functional
tre-data-disclosure	gw-KMVWYCC	Detect TRE free-text data that may carry sensitive information	report	report omit	spec; isg; gw	functional
tre-data-embedded-file	gw-8BKEYSV	Detect TRE data carrying an embedded file signature other than markup	reject	report omit	spec; isg; gw	functional
tre-data-embedded-markup	gw-PF1DTAR	Detect TRE data carrying an embedded XML or HTML signature	report	report omit	isg; gw	functional
tre-data-entropy-suspicious	gw-0W2B11Q	Detect TRE data with anomalously high entropy indicating hidden or encrypted content	report	report omit	spec; isg; gw	functional
tre-data-null-padding	gw-T640VA3	Detect TRE data carrying null padding that may conceal hidden content	report	report omit	spec; isg; gw	functional
tre-data-printable-ratio-suspicious	gw-C8MGAZK	Detect TRE data with an anomalous printable-character ratio	report	report omit	spec; isg; gw	functional
tre-length-inaccurate	gw-5DAB279	Detect a TRE length (TREL) that is not a valid 5-digit length or whose data is not accessible	reject	report omit	spec; isg; gw	functional
tre-overflow-chain-invalid	gw-C4B0HH3	Detect TRE_OVERFLOW DES segments whose TREs do not match their declared source	reject	report omit	spec; isg; gw	functional
tre-overflow-incoherent	gw-8GF24AD	Detect TRE_OVERFLOW DES DESOFLW/DESITEM that do not match the source segment overflow pointers	reject	report omit	spec; isg; gw	functional
tre-phantom-present	gw-AABN1H8	Detect phantom TRE areas not accounted for by declared TRE lengths	reject	report omit	spec; isg; gw	functional
tre-size-anomalous	gw-E75FJ68	Detect a TRE length (TREL) that is anomalously large for its tag	report	report omit	spec; isg; gw	functional
tre-tag-collision-set	gw-8PECSVH	Detect extension tags chosen to share a hash value, degrading a consumer's lookup	report	report omit	spec; isg; gw	structural
tre-tag-duplicate	gw-5QJC8TS	Detect duplicate TRE tags within a segment	reject	report omit	spec; isg; gw	functional
tre-tag-format-invalid	gw-ZQ4GZYE	Detect a TRE tag (TRETAG) that is not 6 BCS-A printable characters in any TRE location	reject	report omit	spec; isg; gw	functional
tre-tag-not-allowlisted	gw-XM5SE2Z	Detect TRE tags outside the allowlist of known-good CETAG values	report	report omit	spec; isg; gw	functional
tre-tag-unregistered	gw-77WEJXH	Detect TREs whose CETAG values are not in the known-good catalog (STDI-0002, STDI-0006, NGA.STND.0044, MIL-PRF-89034, NSGPDD, BPJ2K01)	report	report omit	spec; isg; gw	functional

text-extended-data

TXSHDL defines the size of extended subheader data in text segments. Values of 1 or 2 are invalid (must be 0 or 3-99999). Manipulated lengths can cause parsers to read incorrect data. TXSHD TRE data may contain sensitive information that requires external filtering.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
text-ext-header-disclosure	gw-2QMW37E	Detect text extended-subheader (TXSHD) TRE free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional
text-ext-header-length-invalid	gw-PEJB863	Detect a text extended-subheader data length (TXSHDL) that is invalid	reject	report omit	spec; isg; gw	functional

text-format

Invalid text format or mismatched character encoding may hide data or enable attacks.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
text-data-charset-invalid	gw-5HHFX05	Detect malformed, control or non-text bytes in TXTDATA inconsistent with the declared TXTFMT charset	reject	report omit	spec; isg; gw	functional
text-data-charset-superset	gw-CHS7PB2	Detect well-formed characters in TXTDATA outside the declared TXTFMT charset (e.g. UTF-8 text in a BCS/ECS segment)	report	report omit	spec; isg; gw	functional
text-format-invalid	gw-91ADGNH	Detect a text format (TXTFMT) other than the allowed values MTF, STA, UT1 or U8S	reject	report omit	spec; isg; gw	functional

text-subheader

Text subheader fields may contain forged or hidden data. TE must be 'TE', TXTDT must be a valid datetime not after FDT. TXTITL may disclose sensitive identification information.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
text-datetime-cross-segment-invalid	gw-9RV3DZ6	Detect a text date/time (TXTDT) later than the file date/time (FDT)	report	report omit	spec; isg; gw	functional
text-datetime-invalid	gw-DKSFKAR	Detect a text date/time (TXTDT) that is not a valid CCYYMMDDhhmmss datetime or all hyphens	replace	replace report omit	spec; isg; gw	functional
text-id-non-default	gw-0BH7NP0	Detect a text segment identifier (TEXTID) carrying a non-default or potentially sensitive value	replace	replace report omit	isg; gw	visual
text-partition-invalid	gw-30Q5AB1	Detect a text subheader file part type (TE) other than 'TE'	report	report omit	spec; isg; gw	functional
text-title-disclosure	gw-R71BZDJ	Detect a text segment title (TXTITL) that may carry sensitive free text	replace	replace report omit	isg; gw	visual
text-title-free-text-disclosure	gw-ADBEXYT	Detect text segment title (TXTITL) free-text content that may carry sensitive information	report	report omit	spec; isg; gw	functional

user-defined-header

The User Defined Header Data fields (UDHDL, UDHOFL, UDHD) allow TRE data in the file header. Invalid length values or overflow references to non-existent DES segments can hide data or cause incorrect parsing. User Defined Header Data (UDHD) may contain TRE data with sensitive or classified information that requires external filtering before release.

Rule	ID	Detects	Default	Configurable actions	Compliance	Impact
user-header-length-out-of-range	gw-NQGGPB0	Detect a user-defined header data length (UDHDL) that is neither 0 nor within 3-99999	report	report omit	spec; isg; gw	functional
user-header-overflow-invalid	gw-2JWSKX0	Detect a user-defined header overflow reference (UDHOFL) that does not reference a valid DES segment	report	report omit	spec; isg; gw	functional
user-header-present	gw-KD9JWG8	Detect user-defined header (UDHD) TRE data that may carry sensitive information	report	report omit	isg; gw	functional

Related pages

• Define content management policies
• NITF and NSIF embedded content rules
• Policy management API
• Supported file types
• Archive support