Investigation Report cannot be opened in Word

[campaign-explorer]

Problem symptom - MS Word errors:

'Word found unreadable content in " ". Do you want to recover the contents of this document? If you trust the source of this document, click Yes.'

'Word experienced an error trying to open the file. Try these suggestions ...'

Background:

• Fresh install of IRIS v2.4.22 on Ubuntu 24.04.2 LTS
• Template for Investigation Report used: https://docs.dfir-iris.org/2.4.20/operations/example_reports/iris_report_template.docx
• Case data populated, we have around 10 cases to start with as a demo

Steps to reproduce the problem:

web UI > Case > Generate report > [choose template] > Generate > [open file in MS Word]
web UI > Case > Switch Case > Generate report > Investigation Report > Generate > [open file in MS Word]

Is this related to DOCX generator at all as somehow maybe it outputs a corrupt document?
Or does anyone think this may be due to another component unrelated to Python's DOCX generator?

--

This issue originally stemmed from another error (attached) "Failed to generate the report...Generator can not find output directory", which I resolved by removing space characters from the Customer titles. Additionally I found others resolved the same error by following:
#4
&&
dfir-iris/iris-web#786

[campaign-explorer]

I've pinned down the issue to - images copied and pasted directly into case notes. They end up corrupting the generated .docx investigation reports. If images are uploaded into other folder sections of the case, the report generates without corruption, however images are needed to be part of cases for forensics purposes. It is very strange that they cannot seem to be part of case notes effectively. I believe this might be a limit by the DOCX Python module that's used to generate reports (I think).

[baonq-me]

Is there any updates ?

[ineldx]

As mentioned by @campaign-explorer, generating a DOCX case report when notes contain images produces a corrupted DOCX that Word/LibreOffice refuse to open.

A post-processing script named healfinal.py, made by "seconion" and distributed on IRIS' discord, patches the document by performing two distinct repairs linked to <w:p> nesting issue and media files written without an extension. The first one seems to reside in the IRIS-WEB "ImageHandler.py" script, and the latter in the docx-generator module.

Here's the postprocessing script of "seconion":

import sys
import os
from lxml import etree
from zipfile import ZipFile, ZIP_DEFLATED
from copy import deepcopy

NS = {
    'w': 'http://schemas.openxmlformats.org/wordprocessingml/2006/main',
    'wp': 'http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing',
    'r': 'http://schemas.openxmlformats.org/package/2006/relationships'
}

def repair_document_xml(xml_content):
    """Conservative XML repair with position tracking"""
    parser = etree.XMLParser(recover=True, remove_blank_text=True, resolve_entities=False)
    tree = etree.fromstring(xml_content, parser)
    
    bad_paras = reversed(tree.xpath('//w:p[.//w:p]', namespaces=NS))
    
    for para in bad_paras:
        parent = para.getparent()
        para_index = parent.index(para)
        
        new_children = []
        for elem in para.iterchildren():
            if elem.tag == '{http://schemas.openxmlformats.org/wordprocessingml/2006/main}p':
                new_children.extend(elem.iterchildren())
            else:
                new_children.append(elem)
        
        new_para = etree.Element(para.tag, attrib=para.attrib)
        for child in new_children:
            new_para.append(deepcopy(child))
        
        parent.insert(para_index, new_para)
        parent.remove(para)
    
    return etree.tostring(tree, encoding='UTF-8', xml_declaration=True)

def process_docx(input_docx):
    print(f"\nProcessing: {os.path.basename(input_docx)}")
    
    rename_map = {}  # {old_zip_path: new_zip_path}
    target_map = {}  # {old_target_path: new_target_path}
    fixed_xml = None
    fixed_rels = None

    with ZipFile(input_docx, 'r') as z_in:
        # 1. Media file renaming logic
        for item in z_in.infolist():
            if item.filename.startswith('word/media/') and item.filename.endswith('.'):
                old_path = item.filename
                new_path = f"{old_path}png"
                rename_map[old_path] = new_path
                
                old_target = os.path.relpath(old_path, 'word').replace('\\', '/')
                target_map[old_target] = f"{old_target}png"
                print(f"Found media to rename: {os.path.basename(old_path)} → {os.path.basename(new_path)}")

        # 2. Repair document.xml structure
        with z_in.open('word/document.xml') as doc_file:
            fixed_xml = repair_document_xml(doc_file.read())
        
        # 3. Update relationships
        rels_content = z_in.read('word/_rels/document.xml.rels')
        root = etree.fromstring(rels_content, etree.XMLParser(remove_blank_text=True))
        
        for rel in root.xpath('//r:Relationship', namespaces={'r': NS['r']}):
            target = rel.get('Target')
            if target in target_map:
                print(f"Updating relationship: {target} → {target_map[target]}")
                rel.set('Target', target_map[target])
        
        fixed_rels = etree.tostring(
            root, 
            pretty_print=True, 
            xml_declaration=True, 
            encoding='UTF-8',
            standalone=True
        )

        # 4. Create output file with all fixes
        output_docx = os.path.splitext(input_docx)[0] + '_fixed.docx'
        with ZipFile(output_docx, 'w', ZIP_DEFLATED) as z_out:
            for item in z_in.infolist():
                if item.filename in rename_map:
                    z_out.writestr(rename_map[item.filename], z_in.read(item.filename))
                elif item.filename == 'word/document.xml':
                    z_out.writestr(item, fixed_xml)
                elif item.filename == 'word/_rels/document.xml.rels':
                    z_out.writestr(item.filename, fixed_rels)
                else:
                    z_out.writestr(item, z_in.read(item.filename))

    print("\nSuccessfully processed:")
    print(f" - {len(rename_map)} media files renamed")
    print(f" - {len(target_map)} relationships updated")
    print(" - document.xml structure repaired")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python full_repair.py <input.docx>")
        sys.exit(1)
    
    try:
        process_docx(sys.argv[1])
        print("\nOperation completed successfully")
    except Exception as e:
        print(f"\nError: {str(e)}")
        sys.exit(1)

I'll try to make 2 PRs for both projects to fix their respective issues.

[campaign-explorer]

Thanks very much for your reply! I will test as soon as possible and advise back.