Configuration Management

Content Management policies are a set of content management switches that can be applied to a particular file type.

The content management switch is used to identify a file element type and associated action.

The content management setting specifies the action to be carried out by Glasswall for a particular content management switch. Each content management switch can be set to one of three settings:

• Allow - The Glasswall Embedded Engine processes any associated file element types and they remain in the regenerated file. The associated structure is logged in the Analysis report as an Allowed Item.

• Disallow - If any of the associated file element types are identified in the file, the Glasswall Embedded Engine identifies the file as being non-conforming and the file will not be regenerated. The associated structure is logged in the Analysis report as an Issue Item.

• Sanitise - If any of the associated file element types are identified in the file, the Glasswall Embedded Engine removes them from the regenerated document. The associated structure is logged in the Analysis report as a Sanitisation Item.

Content Management Reporting

The following sections show how content that is under the control of a content management switch is presented in the XML Analysis report, depending on the content switch setting.

Allow

This is an excerpt from the XML report for a Word (.doc) Binary file, which contains metadata. The content management switch metadata has been set to allow.

    <gw:Camera cameraName="wordConfig">
    <gw:ContentSwitch>
        <gw:ContentName>metadata</gw:ContentName>
        <gw:ContentValue>allow</gw:ContentValue>
    </gw:ContentSwitch>
    ...
    <gw:AllowedItems itemCount="1">
        <gw:AllowedItem>
            <gw:TechnicalDescription>Metadata detected in #05SummaryInformation</gw:TechnicalDescription>
            <gw:InstanceCount>1</gw:InstanceCount>
            <gw:TotalSizeInBytes>4096</gw:TotalSizeInBytes>
        </gw:AllowedItem>
    </gw:AllowedItems>

Disallow

This is an excerpt from the XML report for a Word (.doc) Binary file which has metadata inside it. The content management switch metadata has been set to disallow. In Protect Mode, this would cause the file to be marked as non-conforming.

    <gw:Camera cameraName = "wordConfig">
    <gw:ContentSwitch>
        <gw:ContentName>metadata</gw:ContentName>
        <gw:ContentValue>disallow</gw:ContentValue>
    </gw:ContentSwitch>
    ...
    <gw:IssueItem>
        <gw:TechnicalDescription> Metadata detected in #05SummaryInformation</gw:TechnicalDescription>
        <gw:IssueId>96</gw:IssueId>
        <gw:InstanceCount>1</gw:InstanceCount>
        <gw:RiskLevel>Medium</gw:RiskLevel>
    </gw:IssueItem>

Sanitise

This is an excerpt from the XML report for a Word (.doc) Binary file which has metadata inside it. The content management switch metadata has been set to sanitise. In Protect Mode, this would result in the metadata being removed from the regenerated file.

    <gw:Camera cameraName = "wordConfig">
    <gw:ContentSwitch>
        <gw:ContentName>metadata</gw:ContentName>
        <gw:ContentValue>sanitise</gw:ContentValue>
    </gw:ContentSwitch>
    ...
    <gw:SanitisationItem>
        <gw:TechnicalDescription>Metadata detected in #05SummaryInformation</<gw:TechnicalDescription>
        <gw:InstanceCount>1</gw:InstanceCount>
        <gw:TotalSizeInBytes>4096</gw:TotalSizeInBytes>
    </gw:SanitisationItem>

Content Management Policies

These are the available content management policies:

Note: The xlsConfig, pptConfig and wordConfig content management policies cover both Office Open XML and Office Binary file types.

The available content management switches and applicable file types are shown in the table below:

File Types With Content Management Switches (Example)

<?xml version="1.0" encoding="UTF-8"?>
<config>

    <pdfConfig>    
        <acroform>sanitise</acroform>
        <metadata>sanitise</metadata>
        <javascript>sanitise</javascript>
        <actions_all>sanitise</actions_all>
        <embedded_files>sanitise</embedded_files>
        <embedded_images>sanitise</embedded_images>
        <internal_hyperlinks>sanitise</internal_hyperlinks>
        <external_hyperlinks>sanitise</external_hyperlinks>
	    <digital_signatures>sanitise</digital_signatures>
	    <value_outside_reasonable_limits>sanitise</value_outside_reasonable_limits>
    </pdfConfig>
  
    <wordConfig>
        <macros>sanitise</macros>
        <metadata>sanitise</metadata>
        <embedded_files>sanitise</embedded_files>
	    <embedded_images>sanitise</embedded_images>
        <review_comments>sanitise</review_comments>
        <internal_hyperlinks>sanitise</internal_hyperlinks>
        <external_hyperlinks>sanitise</external_hyperlinks>
        <dynamic_data_exchange>sanitise</dynamic_data_exchange>
        <tracked_changes>sanitise</tracked_changes>
        <hidden_data>sanitise</hidden_data>
    </wordConfig>
  
    <pptConfig>
        <macros>sanitise</macros>
        <metadata>sanitise</metadata>
        <embedded_files>sanitise</embedded_files>
	    <embedded_images>sanitise</embedded_images>
        <review_comments>sanitise</review_comments>
        <internal_hyperlinks>sanitise</internal_hyperlinks>
        <external_hyperlinks>sanitise</external_hyperlinks>
        <hidden_data>sanitise</hidden_data>
    </pptConfig>
  
    <xlsConfig>
        <macros>sanitise</macros>
        <metadata>sanitise</metadata>
        <embedded_files>sanitise</embedded_files>
	    <embedded_images>sanitise</embedded_images>
        <review_comments>sanitise</review_comments>
        <internal_hyperlinks>sanitise</internal_hyperlinks>
        <external_hyperlinks>sanitise</external_hyperlinks>
        <dynamic_data_exchange>sanitise</dynamic_data_exchange>
	    <connections>sanitise</connections>
        <tracked_changes>sanitise</tracked_changes>
        <hidden_data>sanitise</hidden_data>
    </xlsConfig> 
  
    <tiffConfig>
        <geotiff>sanitise</geotiff>
    </tiffConfig>
  
    <webpConfig>
        <metadata>sanitise</metadata>
    </webpConfig>
   
    <svgConfig>
        <scripts>sanitise</scripts>
        <foreign_objects>sanitise</foreign_objects>
        <hyperlinks>sanitise</hyperlinks>
    </svgConfig>
    
    <jpegConfig>
        <jfif>sanitise</jfif>
    </jpegConfig>

</config>

File Types Without Content Management Policies

There are a number of supported file types that do not currently have content management policies. For these file types, Glasswall will automatically remove content deemed risky, and report the action as a remedy item. This content includes unrecognised embedded data and metadata.

The common supported file types under this category include:

• Image types
  • GIF
  • PNG
  • EMF
  • WMF
• Audio and Video types

Content Management "sysConfig" Switches

The sysConfig switches control the overall behaviour of the Embedded Engine in various ways that don't fall under Content Management.

linux_memory_limit - Technical Details

This option controls a limit on the memory used by the process. This limit is enforced for the duration of a call to GW2RunSession, and does not apply outside of this API call.

The value is specified in GiB, integers only. The value '0' for this option means 'no limit'. This is the default.

It applies only to Linux-based platforms. On other platforms, this option has no effect.

When the limit is reached, the process will print an error message to stderr and terminate. The exit code seen after termination is platform dependent, but will be consistent with application termination by SIGABRT.

The limit is imposed on the peak Resident Set Size (RSS), which is the amount of physical memory the process consumes.

session_timeout - Technical Details

This options controls a limit on the amount of time a call to GW2RunSession can last. It does not apply outside of this API call.

The value is specified in minutes, integers only. The value '0' for this option means 'no timeout', meaning GW2RunSession will continue for as long as required. The default value is '60', giving a failsafe timeout of one hour.

When the timeout is reached before GW2RunSession completes, the process will print an error message to stderr and terminate. The exit code seen after termination is platform dependent, but will be consistent with application termination by SIGABRT

Subsequent calls to GW2RunSession begin their own timer.

Content Management "sysConfig" Switches (Example)

<?xml version="1.0" encoding="UTF-8"?>
<config>
  <sysConfig>
    <interchange_type>sisl</interchange_type>
    <interchange_pretty>false</interchange_pretty>
    <interchange_best_compression>false</interchange_best_compression>
    <export_embedded_images>true</export_embedded_images>
    <enable_hash_sha256>true</enable_hash_sha256>
    <linux_memory_limit>0</linux_memory_limit>
    <session_timeout>60</session_timeout>
    <enable_xml_streaming>false</enable_xml_streaming>
    <enable_sisl_streaming>false</enable_sisl_streaming>
    <enable_ooxml_tracked_changes>false</enable_ooxml_tracked_changes>
    <enable_ooxml_hidden_data>false</enable_ooxml_hidden_data>
  </sysConfig>    
</config>

Learn more

About Embedded Engine
API Functions
File Type Specifications
License Management
OS Features Compatibility
Policy Management
Supported File Types
Supported Operating Systems