Systems and methods for protecting document files from macro threats

1. A computer-implemented method for protecting document files from macro threats, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a document file that contains an embedded macro;

locating an event-driven programming language module that stores the embedded macro for the document file;

cleaning the event-driven programming language module by:

categorizing a portion of the event-driven programming language module as constituting a procedure;

categorizing another portion of the event-driven programming language module as constituting a variable definition as distinct from the procedure;

selectively editing the embedded macro within the event-driven programming language module by performing at least one of removing and cleaning the portion of the event-driven programming language module categorized as the procedure while retaining, within the event-driven programming language module, the other portion of the event-driven programming language module categorized as the variable definition as distinct from the procedure.

2. The method of claim 1 , wherein the document file is formatted based on a compound file binary format.

3. The method of claim 2 , wherein:

the document file comprises at least one of a word processing document and a spreadsheet document;

the event-driven programming language module comprises a sub-tree of a main compound file binary format tree.

4. The method of claim 2 , wherein:

the document file comprises a presentation program document;

the event-driven programming language module is stored in an event-driven programming language project storage record within a presentation program stream.

5. The method of claim 1 , wherein the document file is formatted based on an open extensible markup language format.

6. The method of claim 5 , wherein:

the event-driven programming language module is stored in a compound file binary format file;

a relationship file identifies a relationship between the event-driven programming language module and the compound file binary format file.

7. The method of claim 1 , wherein cleaning the event-driven programming language module comprises identifying a directory stream within an event-driven programming language storage of the event-driven programming language module.

8. The method of claim 7 , wherein cleaning the event-driven programming language module comprises:

decompressing the directory stream;

parsing the directory stream to locate a plurality of module streams identified by the directory stream.

9. The method of claim 8 , wherein cleaning the event-driven programming language module comprises, for each of the plurality of module streams:

decompressing event-driven programming language code of the module stream;

modifying code lines by removing code lines that contain procedure definitions;

compressing the modified code lines;

storing the compressed modified code lines in the module stream.

10. The method of claim 1 , wherein cleaning the event-driven programming language module comprises deleting a performance cache shadow data structure comprising an array of bytes that forms an implementation-specific and version-dependent performance cache for a project containing the event-driven programming language module.

11. A system for protecting document files from macro threats, the system comprising:

an identification module, stored in memory, that identifies a document file that contains an embedded macro;

a location module, stored in memory, that locates an event-driven programming language module that stores the embedded macro for the document file;

a cleaning module, stored in memory, that cleans the event-driven programming language module by:

categorizing a portion of the event-driven programming language module as constituting a procedure;

categorizing another portion of the event-driven programming language module as constituting a variable definition as distinct from the procedure;

selectively editing the embedded macro within the event-driven programming language module by performing at least one of removing and cleaning the portion of the event-driven programming language module categorized as the procedure while retaining, within the event-driven programming language module, the other portion of the event-driven programming language module categorized as the variable definition as distinct from the procedure;

at least one processor configured to execute the identification module, the location module, and the cleaning module.

12. The system of claim 11 , wherein the document file is formatted based on a compound file binary format.

13. The system of claim 12 , wherein:

the document file comprises at least one of a word processing document and a spreadsheet document;

the event-driven programming language module comprises a sub-tree of a main compound file binary format tree.

14. The system of claim 12 , wherein:

the document file comprises a presentation program document;

the event-driven programming language module is stored in an event-driven programming language project storage record within a presentation program stream.

15. The system of claim 11 , wherein the document file is formatted based on an open extensible markup language format.

16. The system of claim 15 , wherein:

the event-driven programming language module is stored in a compound file binary format file;

a relationship file identifies a relationship between the event-driven programming language module and the compound file binary format file.

17. The system of claim 11 , wherein the cleaning module cleans the event-driven programming language module by identifying a directory stream within an event-driven programming language storage of the event-driven programming language module.

18. The system of claim 17 , wherein the cleaning module cleans the event-driven programming language module at least in part by:

decompressing the directory stream;

parsing the directory stream to locate a plurality of module streams identified by the directory stream.

19. The system of claim 18 , wherein the cleaning module cleans the event-driven programming language module, for each of the plurality of module streams, at least in part by:

decompressing event-driven programming language code of the module stream;

modifying code lines by removing code lines that contain procedure definitions;

compressing the modified code lines;

storing the compressed modified code lines in the module stream.

20. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a document file that contains an embedded macro;

locate an event-driven programming language module that stores the embedded macro for the document file;

clean the event-driven programming language module by:

categorizing a portion of the event-driven programming language module as constituting a procedure;

categorizing another portion of the event-driven programming language module as constituting a variable definition as distinct from the procedure;

selectively editing the embedded macro within the event-driven programming language module by performing at least one of removing and cleaning the portion of the event-driven programming language module categorized as the procedure while retaining, within the event-driven programming language module, the other portion of the event-driven programming language module categorized as the variable definition as distinct from the procedure.