XLSX file appears as XML in Box Securlet DLP Incidents

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

You notice the Box Securlet DLP Incidents may incorrectly identify .xlsx files as XML files when those files are being processed by automated scripts. This issue typically occurs when a script or application performs multiple save operations to a directory that is actively synchronized by Box Drive. Because .xlsx files are structured as compressed ZIP archives, they are only recognized as valid Excel files once the file-writing process is fully complete and properly formed.

Cause

The issue is caused by a race condition between a file-writing script and the Box Drive synchronization client.

• Multiple Writes: Scripts using libraries like openpyxl often rewrite the entire ZIP archive each time .save() is called.
• Sync Race Condition: Box Drive detects a file change during these intermediate save iterations and attempts to sync the file immediately.
• Incomplete Metadata: During each save operation, there is a brief window where the file is a partially written ZIP archive without the necessary Excel metadata. If Box syncs the file during this window, the DLP incident captures the file in its intermediate, unformed state, often resulting in it being identified as XML.

Resolution

To resolve this issue, modify the automated script to avoid saving intermediate file versions directly into a synchronized folder.

• Save to a Local Temporary Path: Configure the script to save the .xlsx file to a local, non-synced temporary directory (e.g., C:\Temp or /tmp) during its execution and all save iterations.
• Final Move/Copy: Only copy or move the file to the Box-synced folder once the script has fully completed its processing and the final .save() operation is successful.