3

I'm in the process of writing an Excel add-on using the Excel Javascript API.

I'm wondering about three things:

  1. If the add-on is running on desktop Excel, then can the add-on interact with the file-system of the local machine?
  2. If the add-on is running on desktop Excel, can it make system calls? I'm looking to move some files around, and maybe call some installed packages.
  3. Finally, can the add-on send sheet data (or even the entire sheet) to an external API? More generally, can the add-on send arbitrary data to a some server?

If you're feeling generous with information, it'd be awesome to understand which of these capabilities are possible with the VSTO Add-ins as well.

Thanks in advance for the help - it's greatly appreciated!

Nate Rush
  • 360
  • 2
  • 14
  • My understanding is that "Office Add-ins are hosted in an iframe that runs using the HTML5 sandbox attribute" [1] in which case, I'm not sure any of the above are possible! [1] https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/privacy-and-security – Nate Rush Mar 24 '20 at 16:53
  • In which case, what is possible with VSTO add-ins? – Nate Rush Mar 24 '20 at 16:53

2 Answers2

3

I don't know about VSTO add-ins, but for web add-ins that use the Office JavaScript library:

  1. No. The add-in is a web application running in what is, in effect, a browser embedded in Excel. For security reasons, web apps cannot access the device's file system (except for certain constrained actions, such as saving cookies).
  2. No. Same as #1, web apps aren't allowed to do this.
  3. Yes, the web app can call out to any endpoint on the Internet and send data. You can, for example, read Excel data and pass it as the payload in a call to a REST API.
Rick Kirkham
  • 9,038
  • 1
  • 14
  • 32
-1

I would assume that YES the Plugin has full read access minimally to the entire Filesystem being as though Excel has access to the entire filesystem, the way to limit this would be to restrict what folder can be accessed within the JavaScript.

A Plug Running within excel definitely has write access, thus I know that you can create the new file in a new location, and I believe will relative certainty that YES you will be able to move rather than copy and delete.

I am a bit confused as to how this could be accomplished, as API's are consumed by Webservices, if you were to then store the data then yes another API Could be created to do what you are wanting but if that is the case why not just use the Webservice itself to do what you are requesting rather than Create another API as that doesn't make sense unless you are going to call it again by an outside computer, but none the less it would still have to be created from storing the results of the initial API call as to create a secondary API.

Dawid Pura
  • 991
  • 9
  • 32
Aaron Lax
  • 1
  • 1
  • The above answer adds a lot of context; because its an Excel Javascript Addin, it actually is almost entirely sandboxed! – Nate Rush Apr 15 '20 at 02:59