Add a DisableImageFunctionDownloads property (default false) to ExcelCalculationOption that lets a host application disable the network download performed by the IMAGE() function during formula calculation.
When true, IMAGE() does not call the configured IHttpsService — even if one is set on ExcelPackageSettings.ImageFunctionService — and returns a #NAME? error instead, consistent with the existing behavior when no service is configured. Images already present in the workbook are unaffected.
This gives host applications a single explicit switch to turn off IMAGE() network access without having to supply a custom IHttpsService, which was previously the only way to do so.
Background: Follows a security report regarding outbound requests from IMAGE() when calculating untrusted workbooks (see Security considerations when calculating formulas). Classified as a hardening/discoverability improvement rather than a vulnerability.
Acceptance criteria:
- Property exists on
ExcelCalculationOption and defaults to false (no behavior change out of the box).
- With
true and a service configured, IMAGE() performs no download and returns #NAME?.
- Default behavior is unchanged.
Add a
DisableImageFunctionDownloadsproperty (defaultfalse) toExcelCalculationOptionthat lets a host application disable the network download performed by theIMAGE()function during formula calculation.When
true,IMAGE()does not call the configuredIHttpsService— even if one is set onExcelPackageSettings.ImageFunctionService— and returns a#NAME?error instead, consistent with the existing behavior when no service is configured. Images already present in the workbook are unaffected.This gives host applications a single explicit switch to turn off
IMAGE()network access without having to supply a customIHttpsService, which was previously the only way to do so.Background: Follows a security report regarding outbound requests from
IMAGE()when calculating untrusted workbooks (see Security considerations when calculating formulas). Classified as a hardening/discoverability improvement rather than a vulnerability.Acceptance criteria:
ExcelCalculationOptionand defaults tofalse(no behavior change out of the box).trueand a service configured,IMAGE()performs no download and returns#NAME?.