Two different canarytoken construct in MS Word template, why?

[fatwookie]

Hi!

I am trying to understand a bit more about the internals of the DOCX template available at templates/template.docx. In this template, there are two places where the canarytoken URLs are placed:

• one uses a INCLUDEPICTURE element in the footer2.xml file directly
• the other uses a <w:pict><v:shape><v:imagedata></v:shape></w:pict> construct.

AFAIK from the OOXML spec, you can use either one but you don't need both. Why is it both techniques are used in the template? Is this some sort of way to support older versions of Word?

Cheers, Vince

Location one footer2.xml:

<w:r>
<w:instrText xml:space="preserve"> INCLUDEPICTURE  "http://canarytokens.com/tags/REDACT" \d  \* MERGEFORMAT </w:instrText>
</w:r>

Location two in footer2.xml:

           <w:pict>
               <v:shape id="_x0000_i1025" type="#_x0000_t75" style="width:.75pt;height:.75pt">
                   <v:imagedata r:id="rId1" />
               </v:shape>
           </w:pict>

And the relevant Relationship definition in footer2.xml.rels:

<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">
    <Relationship Id="rId1"
        Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image"
        Target="http://canarytokens.com/tags/REDACTED"
        TargetMode="External" />
</Relationships>

[roberto-aldera]

Hi @fatwookie, that's correct, you can still get the token to fire with just one of those triggers, having both increases the chances of it firing here.