Possible incorrect file signature for XLS

[guardrex]

Hello - Working your code into our File Upload example updates on https://github.com/aspnet/AspNetCore.Docs/issues/10214. You have the format signature for XLS (.xls) as ...

0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1, 0x09, 0x08, 0x10, 0x00, 0x00, 0x06, 0x05, 0x00, 0xFD, 0xFF, 0xFF, 0xFF

... but that doesn't seem to match an XLS file.

@Rutix suggested ...

0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1

... but that's the same signature as a DOC (.doc) file.

I'll go with @Rutix's suggestion until I hear back: Are you able to determine a specific XLS (.xls) signature.

If I come across one in my research, I'll post it to this issue.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 2e0cf62c-d3c0-152e-5367-b81c1e7aae05
• Version Independent ID: f379469d-7ab1-5520-b398-e69e4183921b
• Content: Input Validation - Microsoft Threat Modeling Tool - Azure
• Content Source: articles/security/azure-security-threat-modeling-tool-input-validation.md
• Service: security
• GitHub Login: @jegeib
• Microsoft Alias: jegeib

[guardrex]

Thus far, determined that that sig is a general "MS Office Document." It also applies to other Office products of that era (97/2003).

[EDIT] ... and it looks like the latter Office is the same across the board: 0x50, 0x4B, 0x03, 0x04.

[SaurabhSharma-MSFT]

@guardrex Thanks for your feedback! We will investigate and update as appropriate.

[Rutix]

@SaurabhSharma-MSFT If you want I can provide a XLS file which doesn't satisfy 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1, 0x09, 0x08, 0x10, 0x00, 0x00, 0x06, 0x05, 0x00, 0xFD, 0xFF, 0xFF, 0xFF

This breaks down to: 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1 which indicates it's a microsoft office document. 0x09, 0x08, 0x10, 0x00, 0x00, 0x06, 0x05, 0x00 at offset 512 bytes indicates spreadsheet subheader 1 0xFD, 0xFF, 0xFF, 0xFF at offset 512 bytes I would assume indicates spreadsheet subheader 2 but it's missing the last byte namely 0x10

[SaurabhSharma-MSFT]

@guardrex @Rutix Thanks for the feedback ! I have assigned this issue to content author to investigate and update the document as appropriate.