Microsoft Word / Quarantine / xattr

I have a Xojo Web app which uploads files. I have an rsync script which copies them from the server to another computer (both running MacOS 12.6).

I have an Applescript which opens the file in Microsoft Word.

The first time I do this, I get this dialog:

Once I grant acess, the file will open normally.

I thought this might be a quarantine flag, and it is, but it appears like it’s a reverse quarantine!

Before opening the document, there are no quarantine flags.

However, after I give Word permission to open the document, an extended attribute is set:

$ xattr -l *

Document...3766748-2022-11-03T15-51-51.docx: com.apple.quarantine: 0082;6364101d;Microsoft Word;

If I remove it (using xattr -rc * ) then I have to give permission again.

Is this a macOS behavior? Is this Word? Is there any way to prevent this?

Weird, does the file permissions give your user account read and write access?

Is there a Sandbox Lite xattr? “com.apple.macl”, these are disgusting little buggers.

Interesting, thanks @Sam_Rowlands

If I create a new document in Microsoft Word and save it, I get these flags:

-rw-r--r--@ 1 user  staff  11656 Nov  3 18:42 test.docx
	com.apple.FinderInfo	   32 
	com.apple.lastuseddate#PS	   16 
	com.apple.macl	   72 
	com.apple.metadata:_kMDItemUserTags	   42 
	com.apple.metadata:kMDLabel_usknl5lhwg3fkxd2i4ym4i4xd4	   89 
	com.apple.quarantine	   29

When I use rsync to copy the files from the other server, there are zero flags:


-rw-r--r--  1 user  staff  46326 Nov  3 16:51 Document-3766748-2022-11-03T16-51-51.docx

I had thought that quarantine flags were set when you downloaded something unsafe, so I was surprised to see the flag seems to behave reversed.

Maybe the enclosing folder permissions are wonky?

Me too. So this is weird. The fact that rsync’d files don’t include any attribs is not surprising, because it rsync has to copy the attribs and then write them to the file on t’other Mac.

I don’t think it’s the enclosing folder permissions, but I’ll admit, I really don’t know what’s causing this issue. I would suggest checking the MS forums as it feels like a weird MS issue to me, but it makes no sense.