calcsheet 0.1.0

data/lib/calcsheet/format_detector.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "zip"
+require "zlib"
+require_relative "entry_name"
+require_relative "errors"
+require_relative "odf"
+require_relative "zip_directory"
+
+module Calcsheet
+  # Chooses the backend for a file from its content. The extension only breaks
+  # a tie between formats the content cannot tell apart.
+  #
+  # @api private
+  module FormatDetector
+    # The formats detection answers, and an explicit +format:+ may name.
+    FORMATS = %i[csv xlsx ods].freeze
+    # The first bytes of an OLE2 compound file: XLS, and encrypted XLSX.
+    OLE2_SIGNATURE = "\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1".b.freeze
+    # A zip archive starts with a local header, or with the end record when it is empty.
+    ZIP_SIGNATURES = [ ZipDirectory::LOCAL_SIGNATURE, ZipEndRecord::EOCD_SIGNATURE ].freeze
+    # The entry that makes a zip an XLSX workbook.
+    XLSX_ENTRY = "xl/workbook.xml"
+    # The extensions that break a tie between XLSX and ODS.
+    EXTENSIONS = { ".xlsx" => :xlsx, ".xlsm" => :xlsx, ".ods" => :ods }.freeze
+
+    module_function
+
+    # Detects the format of a seekable IO and rewinds it. Content that is neither OLE2 nor a zip archive is CSV,
+    # whatever it holds: only an unknown explicit +format+ raises for itself. Only the zip central directory and the
+    # start of the +mimetype+ entry are read, never a whole entry; the entry count is checked against
+    # +max_zip_entries+ from the end of central directory record, and the central directory by ZipDirectory, before
+    # rubyzip loads it.
+    #
+    # @param io [IO] a seekable binary IO, any position
+    # @param path [String, nil] the file name, used only to break a tie
+    # @param format [Symbol, String, nil] an explicit format, which wins over the content (Calcsheet.open passes none:
+    #   it skips detection itself)
+    # @param max_zip_entries [Integer, nil] the most entries a zip may have; nil for no limit
+    # @return [Symbol] +:csv+, +:xlsx+ or +:ods+
+    # @raise [UnsupportedFormatError] for an OLE2 file (XLS, an encrypted workbook), a zip that is neither XLSX nor ODS
+    #   or both without a telling extension, and an explicit +format+ not in FORMATS
+    # @raise [MalformedFileError] for a zip file whose central directory or mimetype entry cannot be read
+    # @raise [ZipBombError] with limit +:max_zip_entries+ when the zip has more entries
+    def detect(io, path: nil, format: nil, max_zip_entries: nil)
+      return explicit(format) unless format.nil?
+
+      io.seek(0, IO::SEEK_SET)
+      head = io.read(OLE2_SIGNATURE.bytesize)&.b.to_s
+      return raise_xls if head == OLE2_SIGNATURE
+      return :csv unless ZIP_SIGNATURES.any? { head.start_with?(_1) }
+
+      detect_zip(io, path, max_zip_entries)
+    ensure
+      io.seek(0, IO::SEEK_SET) if format.nil?
+    end
+
+    def explicit(format)
+      name = format.to_sym
+      return name if FORMATS.include?(name)
+
+      raise UnsupportedFormatError, "unsupported format #{name.inspect}; use :csv, :xlsx or :ods"
+    end
+
+    def raise_xls
+      raise UnsupportedFormatError,
+            "XLS (Excel 97-2003) files and encrypted or password-protected workbooks (OLE2) are not supported; " \
+            "save the file without a password as XLSX, ODS or CSV"
+    end
+
+    def detect_zip(io, path, max_entries)
+      archive, = ZipDirectory.open(io, max_entries: max_entries)
+      # Entries by the name ZipContainer finds them by; ZipDirectory refused names that are equal once normalized.
+      files = archive.entries.reject(&:directory?).to_h { |entry| [ EntryName.normalize(entry.name), entry ] }
+      candidates = []
+      candidates << :xlsx if files.key?(XLSX_ENTRY)
+      candidates << :ods if ods_mimetype?(files[Odf::MIMETYPE_ENTRY])
+      return candidates.first if candidates.size == 1
+
+      by_extension = EXTENSIONS[File.extname(path.to_s).downcase]
+      return by_extension if candidates.size > 1 && candidates.include?(by_extension)
+
+      raise UnsupportedFormatError, unsupported_zip_message(candidates)
+    rescue Calcsheet::Error
+      raise
+    rescue StandardError => error
+      # Any error of rubyzip reading the mimetype entry is a damaged archive.
+      raise MalformedFileError, "the zip archive cannot be read: #{error.message}"
+    end
+
+    def ods_mimetype?(entry)
+      return false unless entry
+
+      # Two bytes more than the media type: a trailing line break (CR LF) is tolerated, as strip removes it, and a
+      # longer content still compares unequal, without reading the whole entry.
+      entry.get_input_stream { |stream| stream.read(Odf::MIMETYPE.bytesize + 2).to_s.strip } == Odf::MIMETYPE
+    end
+
+    def unsupported_zip_message(candidates)
+      if candidates.empty?
+        "the zip archive is neither an XLSX workbook nor an ODS spreadsheet"
+      else
+        "the zip archive looks like both XLSX and ODS and the file name does not say which"
+      end
+    end
+
+    private_class_method :explicit, :raise_xls, :detect_zip, :ods_mimetype?, :unsupported_zip_message
+  end
+end

data/lib/calcsheet/formula_protection.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Calcsheet
+  # CSV formula protection: a spreadsheet opening a CSV evaluates a field that starts with "=", "+", "-", "@", a
+  # tab or a carriage return as a formula, so the CSV writer puts a "'" before such text (+formula_protection+), and
+  # the CSV reader removes that "'" again with +strip_formula_prefix: true+.
+  #
+  # @api private
+  module FormulaProtection
+    # The first characters that make a spreadsheet evaluate a field (OWASP CSV injection).
+    TRIGGERS = [ "=", "+", "-", "@", "\t", "\r" ].freeze
+    # A text that starts with a trigger.
+    START = Regexp.new("\\A[#{Regexp.escape(TRIGGERS.join)}]")
+
+    module_function
+
+    # @param text [String]
+    # @return [String] +text+ with a "'" before it when it starts with a trigger; +text+ itself otherwise
+    def protect(text)
+      START.match?(text) ? "'#{text}" : text
+    end
+
+    # @param text [String]
+    # @return [String] +text+ without the "'" #protect adds; +text+ itself otherwise
+    def unprotect(text)
+      return text unless text.start_with?("'") && TRIGGERS.include?(text[1])
+
+      text.byteslice(1, text.bytesize - 1)
+    end
+  end
+end

data/lib/calcsheet/grid.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Calcsheet
+  # The size of a worksheet, the same in Excel (since 2007) and LibreOffice: the readers refuse content beyond it,
+  # the writers continue in a new sheet at MAX_ROWS and refuse more than MAX_COLUMNS columns.
+  #
+  # @api private
+  module Grid
+    # The rows of a sheet, 2**20.
+    MAX_ROWS = 1_048_576
+    # The columns of a sheet, 2**14: A to XFD.
+    MAX_COLUMNS = 16_384
+    # The 0-based index of the last column, and its letters.
+    LAST_COLUMN_INDEX = MAX_COLUMNS - 1
+    LAST_COLUMN = "XFD"
+    # The characters of an Excel cell, counted as UTF-16 code units: a character beyond the Basic Multilingual Plane
+    # counts twice.
+    MAX_CELL_CHARACTERS = 32_767
+  end
+end

data/lib/calcsheet/header_keys.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "bigdecimal"
+require_relative "column_letter"
+require_relative "decimal_text"
+
+module Calcsheet
+  # Header texts as names: the matching rule of the column schema and the keys of rows read without a schema.
+  #
+  # @api private
+  module HeaderKeys
+    # One whitespace character at a time: a run matched as /[[:space:]]+/ costs memory in proportion to its length.
+    SPACE = /[[:space:]]/
+    # A character that is not whitespace, searched for from either end by #strip.
+    NON_SPACE = /[^[:space:]]/
+
+    module_function
+
+    # The rule shared by every comparison of header names.
+    # @return [String] downcased, with all whitespace removed; nil gives ""
+    def normalize(value)
+      text(value).gsub(SPACE, "").downcase
+    end
+
+    # The text of a header cell: a decimal as its plain digits ("2.5", "10"), not BigDecimal#to_s ("0.25e1").
+    # @return [String]
+    def text(value)
+      value.is_a?(BigDecimal) ? DecimalText.plain(value) : value.to_s
+    end
+
+    # @param header_values [Array] the cells of the header row
+    # @return [Array<String>] one unique key per cell: the text stripped of whitespace, Unicode whitespace included
+    #   as for #normalize (original case), the column letter for a blank cell, and "Name (2)", "Name (3)"... for
+    #   repeats, counted by occurrence of the stripped text
+    def build(header_values)
+      stripped = header_values.map { |value| strip(text(value)) }
+      texts = stripped.each_with_index.map { |text, index| text.empty? ? ColumnLetter.from_index(index) : text }
+      reserved = stripped.reject(&:empty?).to_set
+      occurrences = Hash.new(0)
+      # The suffix after the last one given to each text: every suffix below it is taken, by a header or an earlier
+      # key, and stays taken, so the next search starts there and each suffix is tried once overall.
+      next_counter = {}
+      used = Set.new
+
+      texts.map do |text|
+        occurrences[text] += 1
+        key = text
+        if occurrences[text] > 1
+          counter = [ occurrences[text], next_counter[text] || 0 ].max
+          counter += 1 while used.include?(key = "#{text} (#{counter})") || reserved.include?(key)
+          next_counter[text] = counter + 1
+        end
+        used << key
+        key
+      end
+    end
+
+    # The text without the whitespace at its ends, found by searching for a character that is not whitespace: an
+    # anchored run such as /\A[[:space:]]+/ costs memory in proportion to its length.
+    def strip(text)
+      first = text.index(NON_SPACE) or return ""
+      last = text.rindex(NON_SPACE)
+      first.zero? && last == text.length - 1 ? text : text[first..last]
+    end
+  end
+end

data/lib/calcsheet/limited_inflater.rb

@@ -0,0 +1,326 @@
+# frozen_string_literal: true
+
+require "zlib"
+require_relative "entry_name"
+
+module Calcsheet
+  # A read-only, IO-like view of one zip entry that inflates lazily in bounded
+  # steps and counts the bytes it actually produces, never trusting the sizes of
+  # the central directory. Obtained from ZipContainer#stream.
+  #
+  # The bytes handed out are checked against +max_compression_ratio+ times the
+  # compressed size the central directory declares, or the +compression_ratio_floor+
+  # when that is more, and against the container's +max_uncompressed_size+, shared by
+  # every stream and read of the container. An entry declared with compressed size 0
+  # may thus inflate only up to the floor (without a floor its first byte exceeds the
+  # ratio), and a deflated one is read for a single input chunk of INPUT_CHUNK_SIZE
+  # bytes: a deflate stream that does not end within it is truncated.
+  # The CRC-32 is verified when the entry has been inflated to its end; a mismatch
+  # is raised by the read that would hand out the last byte (or report the end),
+  # so a consumer that reads everything never receives damaged data silently.
+  #
+  # Supported methods, which are the ones Ox's SAX parser uses on an object that
+  # is not a File or a StringIO: +readpartial(maxlen)+ (raises EOFError at the end)
+  # and +read(length = nil, outbuf = nil)+ (+nil+ at the end for a positive length).
+  # Also +eof?+ and +close+. +gets+, +getc+, +each_line+ and seeking are not
+  # supported.
+  #
+  # Once a limit or damage error has been raised the stream raises it again on
+  # every later read.
+  #
+  # With +max_cell_bytes+, the inflated bytes are also an XML part whose texts and tags (the bytes between two
+  # "<") may be at most 6 times +max_cell_bytes+ plus 64 KiB long: Ox buffers a text or a tag whole before its
+  # handler sees it, so a single huge one would otherwise cost its size in memory, twice. Six bytes of XML are the
+  # most one character of text takes ("&quot;"), 64 KiB room for the tags, whose namespace declarations can be
+  # long. The check costs two byte searches per inflated piece (TokenBound). A stream that a byte scanner passes over
+  # before the parser reads it (ZipContainer#stream with +bound_tokens: false+) leaves the check to the TokenBound of
+  # what is handed to the parser (StreamRemainder).
+  #
+  # @api private
+  class LimitedInflater
+    # Raised for a text or a tag longer than the bound of +max_cell_bytes+; the parsers add the position of the cell.
+    class TokenTooLong < MalformedFileError
+      # @return [Integer] the max_cell_bytes the bound comes from
+      attr_reader :max_cell_bytes
+
+      def initialize(message, max_cell_bytes:)
+        super(message)
+        @max_cell_bytes = max_cell_bytes
+      end
+    end
+
+    # Bounds the bytes between two "<" of the pieces of an XML stream, in order: 6 times +max_cell_bytes+ plus
+    # 64 KiB (see LimitedInflater).
+    class TokenBound
+      # Bytes of XML per byte of text, and the room for tags, of the bound on the bytes between two "<".
+      TOKEN_BYTES_PER_TEXT_BYTE = 6
+      TAG_ALLOWANCE = 65_536
+
+      # @param name [String] the entry name as messages show it
+      # @param max_cell_bytes [Integer]
+      def initialize(name, max_cell_bytes)
+        @name = name
+        @max_cell_bytes = max_cell_bytes
+        @max = max_cell_bytes * TOKEN_BYTES_PER_TEXT_BYTE + TAG_ALLOWANCE
+        # The bytes after the last "<" seen so far, in this piece and the ones before it: the run still open.
+        @token = 0
+      end
+
+      # Counts the next piece of the stream.
+      # @raise [TokenTooLong] when a text or a tag is longer than the bound
+      def check(piece)
+        # A piece no longer than the bound holds no run longer than it between two "<": only the bytes before its
+        # first "<" and after its last one can make one, with the pieces around it.
+        return check_each(piece) if piece.bytesize > @max
+
+        first = piece.byteindex("<")
+        if first.nil?
+          @token += piece.bytesize
+        else
+          @token += first
+          too_long if @token > @max
+          @token = piece.bytesize - piece.byterindex("<") - 1
+        end
+        too_long if @token > @max
+      end
+
+      private
+
+      # Every run of a piece longer than the bound.
+      def check_each(piece)
+        from = 0
+        while (found = piece.byteindex("<", from))
+          @token += found - from
+          too_long if @token > @max
+          @token = 0
+          from = found + 1
+        end
+        @token += piece.bytesize - from
+        too_long if @token > @max
+      end
+
+      def too_long
+        raise TokenTooLong.new("entry #{@name}: a text or a tag is longer than #{@max} bytes, more than " \
+                               "max_cell_bytes (#{@max_cell_bytes} bytes) allows", max_cell_bytes: @max_cell_bytes)
+      end
+    end
+
+    # The compressed bytes read and inflated at a time.
+    INPUT_CHUNK_SIZE = 4 * 1024
+    # The fewest consumed bytes at the front of the buffer that #take drops: it drops them once they are at least
+    # this many and at least half of the buffer. A buffer consumed in full is reset whatever its size.
+    COMPACT_THRESHOLD = 64 * 1024
+    # The compression methods supported: stored and deflated.
+    STORED = 0
+    DEFLATED = 8
+
+    # @param io [IO] the seekable archive; the stream seeks it before each read
+    # @param entry [Zip::Entry] the central directory entry
+    # @param data_offset [Integer] the position of the first byte of compressed data
+    # @param container [ZipContainer] charged for every inflated byte
+    # @param max_ratio [Numeric, nil] the compression ratio limit, +nil+ for none
+    # @param ratio_floor [Integer] the bytes the entry may inflate to whatever its ratio
+    # @param max_cell_bytes [Integer, nil] bounds the bytes between two "<"; nil for no bound
+    def initialize(io:, entry:, data_offset:, container:, max_ratio:, ratio_floor: 0, max_cell_bytes: nil)
+      @io = io
+      # The name as messages show it, inspected and cut (EntryName.show): the untrusted archive gives it.
+      @name = EntryName.show(entry.name)
+      @method = entry.compression_method
+      @compressed_size = entry.compressed_size
+      @expected_crc = entry.crc
+      @position = data_offset
+      # The compressed data is read only up to the declared size. A deflated entry declared with size 0 can only
+      # be a lie: it is read for one input chunk, and inflates at most to the floor (without a floor, its first
+      # inflated byte is a bomb).
+      @input_left = @method == DEFLATED && @compressed_size.zero? ? INPUT_CHUNK_SIZE : @compressed_size
+      @container = container
+      @max_ratio = max_ratio
+      @max_inflated = max_ratio && [ max_ratio * @compressed_size, ratio_floor ].max
+      @buffer = "".b
+      @offset = 0
+      @inflated = 0
+      @crc = 0
+      @finished = false
+      @failure = nil
+      @crc_mismatch = false
+      @inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS) if @method == DEFLATED
+      @tokens = max_cell_bytes && TokenBound.new(@name, max_cell_bytes)
+    end
+
+    # @param length [Integer, nil] bytes wanted; +nil+ reads to the end
+    # @param outbuf [String, nil] receives the result when given
+    # @return [String, nil] up to +length+ bytes; +nil+ at the end of the entry for a positive +length+
+    # @raise [ZipBombError] when a limit is exceeded
+    # @raise [MalformedFileError] for damaged compressed data or a CRC mismatch
+    def read(length = nil, outbuf = nil)
+      raise ArgumentError, "negative length #{length} given" if length&.negative?
+
+      guarded do
+        fill(length)
+        data = take(length)
+        verify_end
+        outbuf&.replace(data)
+        next nil if data.empty? && length&.positive?
+
+        outbuf || data
+      end
+    end
+
+    # @param maxlen [Integer] the most bytes to return
+    # @param outbuf [String, nil] receives the result when given
+    # @return [String] at least one byte (none for a +maxlen+ of 0)
+    # @raise [EOFError] at the end of the entry
+    # @raise [ZipBombError] when a limit is exceeded
+    # @raise [MalformedFileError] for damaged compressed data or a CRC mismatch
+    def readpartial(maxlen, outbuf = nil)
+      raise ArgumentError, "negative length #{maxlen} given" if maxlen.negative?
+
+      guarded do
+        step while available.zero? && !@finished
+        raise EOFError, "end of file reached" if available.zero? && maxlen.positive?
+
+        data = take(maxlen)
+        verify_end
+        outbuf ? outbuf.replace(data) : data
+      end
+    end
+
+    # @return [Boolean] whether every byte has been handed out (inflating on to find out)
+    # @raise [ZipBombError] when a limit is exceeded
+    # @raise [MalformedFileError] for damaged compressed data or a CRC mismatch
+    def eof?
+      guarded do
+        step while available.zero? && !@finished
+        verify_end
+        available.zero?
+      end
+    end
+
+    # Releases the inflater. Idempotent; further reads see an empty entry.
+    def close
+      @inflater.close if @inflater && !@inflater.closed?
+      @finished = true
+      @buffer = "".b
+      @offset = 0
+      nil
+    end
+
+    private
+
+    def guarded
+      raise @failure if @failure
+
+      yield
+    rescue ZipBombError, MalformedFileError, UnsupportedFormatError => error
+      @failure = error
+      raise
+    end
+
+    def fill(length)
+      step while !@finished && (length.nil? || available < length)
+    end
+
+    def available
+      @buffer.bytesize - @offset
+    end
+
+    # Hands out up to +length+ buffered bytes by moving an offset, so that many small reads of a large buffer
+    # stay linear; the consumed prefix is dropped once it is large and at least half of the buffer, and a buffer
+    # consumed in full is reset at once.
+    def take(length)
+      count = length.nil? ? available : [ length, available ].min
+      data = @buffer.byteslice(@offset, count)
+      @offset += count
+      if @offset == @buffer.bytesize
+        @buffer = "".b
+        @offset = 0
+      elsif @offset >= COMPACT_THRESHOLD && @offset * 2 >= @buffer.bytesize
+        @buffer = @buffer.byteslice(@offset..)
+        @offset = 0
+      end
+      data
+    end
+
+    # Reads one chunk of compressed data and inflates it into the buffer.
+    def step
+      case @method
+      when STORED then step_stored
+      when DEFLATED then step_deflated
+      else raise UnsupportedFormatError, "entry #{@name} uses compression method #{@method}, which is not supported"
+      end
+    rescue Zlib::Error => error
+      raise MalformedFileError, "entry #{@name} cannot be inflated: #{error.message}"
+    end
+
+    def step_stored
+      return finish if @input_left <= 0
+
+      emit(read_input(INPUT_CHUNK_SIZE))
+    end
+
+    def step_deflated
+      @inflater.inflate(read_input(INPUT_CHUNK_SIZE)) { |piece| emit(piece) }
+      # Zlib keeps the end of the output of a chunk that inflates to much more than its buffer (a long run): with
+      # the input exhausted, flushing hands it out, in pieces of the same size.
+      flush_deflated if @input_left.zero? && !@inflater.finished?
+      finish if @inflater.finished?
+    end
+
+    def flush_deflated
+      @inflater.inflate(nil) { |piece| emit(piece) }
+    rescue Zlib::BufError
+      raise MalformedFileError, "entry #{@name} is truncated: the compressed data ends early"
+    end
+
+    def read_input(length)
+      length = [ length, @input_left ].min
+      @io.seek(@position, IO::SEEK_SET)
+      data = length.positive? ? @io.read(length) : nil
+      raise MalformedFileError, "entry #{@name} is truncated: the compressed data ends early" if data.nil? || data.empty?
+
+      @position += data.bytesize
+      @input_left -= data.bytesize
+      data
+    end
+
+    # Counts, checks and buffers a piece of inflated data.
+    def emit(piece)
+      @inflated += piece.bytesize
+      check_ratio
+      @container.charge(piece.bytesize)
+      @tokens&.check(piece)
+      @crc = Zlib.crc32(piece, @crc)
+      @buffer << piece
+    end
+
+    def check_ratio
+      return if @max_inflated.nil? || @inflated <= @max_inflated
+
+      raise ZipBombError.new(limit: :max_compression_ratio, max: @max_ratio,
+                             actual: (@inflated.to_f / [ @compressed_size, 1 ].max).ceil)
+    end
+
+    def finish
+      @finished = true
+      consumed = @inflater&.total_in
+      @inflater&.close
+      check_compressed_size(consumed)
+      @crc_mismatch = @crc != @expected_crc
+    end
+
+    # A deflate stream must end exactly where the central directory says its data ends.
+    def check_compressed_size(consumed)
+      return if consumed.nil? || @compressed_size.zero? || consumed == @compressed_size
+
+      raise MalformedFileError, "entry #{@name} is damaged: the compressed data is #{consumed} bytes, " \
+                                "the central directory says #{@compressed_size}"
+    end
+
+    # Raises the CRC mismatch once everything inflated has been handed out.
+    def verify_end
+      return unless @crc_mismatch && available.zero?
+
+      raise MalformedFileError, "entry #{@name} is damaged: CRC mismatch"
+    end
+  end
+end

data/lib/calcsheet/merge_check.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative "header_keys"
+
+module Calcsheet
+  # Whether sheets can be read as one, as Book#merge_check returns it: every non-empty sheet must have the header of
+  # the first one, after the normalization used for mapping by name (HeaderKeys.normalize), trailing blank header
+  # cells ignored.
+  #
+  # @attr_reader sheet_count [Integer] the sheets checked, empty ones included
+  # @attr_reader mismatches [Array<Hash>] { sheet:, expected:, actual: } per differing sheet, with the header values
+  #   of the first non-empty sheet and of the differing one (frozen)
+  MergeCheck = Data.define(:sheet_count, :mismatches) do
+    # @api private
+    # @param headers [Array<Array(String, Array)>] sheet name and header values (nil for an empty sheet)
+    # @return [MergeCheck]
+    def self.of(headers)
+      present = headers.reject { |_name, values| values.nil? }
+      expected = present.first&.last
+      wanted = normalize(expected)
+      mismatches = present.drop(1).filter_map do |name, values|
+        { sheet: name, expected: expected, actual: values } unless normalize(values) == wanted
+      end
+      new(sheet_count: headers.size, mismatches: mismatches.freeze)
+    end
+
+    # @api private
+    # @param values [Array, nil] header values
+    # @return [Array<String>] the normalized names, without the trailing blank ones
+    def self.normalize(values)
+      names = Array(values).map { |value| HeaderKeys.normalize(value) }
+      names.pop while names.last == ""
+      names
+    end
+
+    # @return [Boolean] whether no sheet differs
+    def mergeable?
+      mismatches.empty?
+    end
+  end
+end

data/lib/calcsheet/odf.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "grid"
+
+module Calcsheet
+  # What the ODS reader, the ODS writer and the format detector share of the OpenDocument format.
+  #
+  # @api private
+  module Odf
+    # The media type of a spreadsheet, the content of its first entry, +mimetype+.
+    MIMETYPE = "application/vnd.oasis.opendocument.spreadsheet"
+    # The name of that entry.
+    MIMETYPE_ENTRY = "mimetype"
+    # The URI of each namespace, by its conventional prefix. The reader finds a document's own prefixes from these
+    # URIs (Readers::Ods::Scanner); the writer declares them with these prefixes.
+    NAMESPACES = {
+      office: "urn:oasis:names:tc:opendocument:xmlns:office:1.0",
+      style: "urn:oasis:names:tc:opendocument:xmlns:style:1.0",
+      text: "urn:oasis:names:tc:opendocument:xmlns:text:1.0",
+      table: "urn:oasis:names:tc:opendocument:xmlns:table:1.0",
+      fo: "urn:oasis:names:tc:opendocument:xmlns:xsl-fo-compatible:1.0",
+      number: "urn:oasis:names:tc:opendocument:xmlns:datastyle:1.0",
+      config: "urn:oasis:names:tc:opendocument:xmlns:config:1.0",
+      calcext: "urn:org:documentfoundation:names:experimental:calc:xmlns:calcext:1.0",
+      ooo: "http://openoffice.org/2004/office"
+    }.freeze
+    # The spaces of a cell's text:s elements: the reader takes at most these, so that a few bytes
+    # (<text:s text:c="999999999"/>) cannot expand into a huge text, and the writer writes a longer run of spaces as
+    # several text:s. As many as an Excel cell holds characters.
+    MAX_SPACES = Grid::MAX_CELL_CHARACTERS
+
+    module_function
+
+    # @param prefix [String] a namespace prefix of the document; "" for the default namespace
+    # @return [String] what comes before a local name: "prefix:", or "" for the default namespace
+    def qualifier(prefix)
+      prefix.empty? ? "" : "#{prefix}:"
+    end
+
+    # @return [String] the qualified name of +local+ in the namespace of +prefix+
+    def qualified(prefix, local)
+      "#{qualifier(prefix)}#{local}"
+    end
+  end
+end