There is a security issue that the OPC relationships mechanism allows a kind of obfuscation that can hide virus or malware or unexpected objects from casual view and detection.. In particular, this is where objects with a .bin extension can be renamed to any other extension, such as .jpg or .txt, and potentially passed through a production process undetected. However, DIS29600 does not specify a macro mechanism or Active X controls. Consequently it is difficult to add extra protection.

Add text to such as the following: "It is a requirement of this standard that dynamic extension mechanisms such as scripting languages and macro mechanisms must use, for the executable parts and their "file extension", the application/ content type tree, and must not use any of the application/ content types defined in this standard or file extensions belonging to other content types."

Part 2, s8.1.2

te

Proposed Disposition of DIS 29500 Comment AU-0009 (Modified: 2007-12-08) Agreed; while the file extension itself has no relevance in and OPC package without the content type being declared, it is useful to state that parts added must declare the correct content type. The following text will be added to Part 1, §9.1.9, page 17, after line 26: It is a requirement of this standard that dynamic extension mechanisms, such as scripting languages and macro mechanisms, shall use, for the executable parts, the correct content types, and shall not use any of the content types already defined in this standard.