xlsxrb 0.1.5 → 0.1.6

data/lib/xlsxrb/ooxml/zip_reader.rb

@@ -13,11 +13,13 @@ module Xlsxrb
     class ZipReader
       LOCAL_HEADER_SIG = "PK\x03\x04".b
       MAX_UNCOMPRESSED_SIZE = 500 * 1024 * 1024 # 500MB per file limit
+      attr_accessor :max_uncompressed_size
 
       # Opens a ZIP from a file path or IO and yields the reader.
-      def self.open(source)
+      #: (untyped source, ?max_uncompressed_size: Integer) ?{ (ZipReader) -> untyped } -> (ZipReader | untyped)
+      def self.open(source, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE)
         io = source.is_a?(String) ? File.open(source, "rb") : source
-        reader = new(io)
+        reader = new(io, max_uncompressed_size: max_uncompressed_size)
         if block_given?
           begin
             yield reader
@@ -29,8 +31,10 @@ module Xlsxrb
         end
       end
 
-      def initialize(io)
+      #: (untyped io, ?max_uncompressed_size: Integer) -> void
+      def initialize(io, max_uncompressed_size: MAX_UNCOMPRESSED_SIZE)
         @io = io
+        @max_uncompressed_size = max_uncompressed_size
         @entries = nil
       end
 
@@ -60,8 +64,6 @@ module Xlsxrb
       end
 
       def parse_entries
-        result = {}
-
         io = if @io.is_a?(StringIO) || (@io.respond_to?(:read) && @io.respond_to?(:seek) && @io.respond_to?(:pos))
                @io
              elsif @io.respond_to?(:each) || @io.is_a?(Enumerator)
@@ -79,9 +81,21 @@ module Xlsxrb
         first_sig = io.read(4)
         raise ArgumentError, "Invalid magic number: Expected a valid ZIP/XLSX file format (PK\\x03\\x04)" unless first_sig == LOCAL_HEADER_SIG
 
+        # Try parsing via Central Directory first (standard and handles Data Descriptors perfectly)
+        cd_result = parse_from_central_directory(io)
+        if cd_result && !cd_result.empty?
+          if io.is_a?(Tempfile)
+            io.close
+            io.unlink
+          end
+          return cd_result
+        end
+
         io.seek(-4, IO::SEEK_CUR) if io.respond_to?(:seek)
         io = StringIO.new(first_sig + io.read.b) unless io.respond_to?(:seek)
 
+        result = {}
+
         loop do
           sig = io.read(4)
           break unless sig == LOCAL_HEADER_SIG
@@ -101,11 +115,11 @@ module Xlsxrb
           has_data_descriptor = gp_flag.anybits?(0x08)
 
           if has_data_descriptor && compressed_size.zero?
-            raw, = find_data_descriptor_stream(io, method)
+            entry_data, = find_data_descriptor_stream(io, method)
           else
             raw = io.read(compressed_size)
+            entry_data = decompress(raw, method)
           end
-          entry_data = decompress(raw, method)
           result[entry_name] = entry_data unless entry_name.end_with?("/")
         end
 
@@ -117,36 +131,107 @@ module Xlsxrb
         result
       end
 
+      def parse_from_central_directory(io)
+        return nil unless io.respond_to?(:seek) && io.respond_to?(:pos)
+
+        io.seek(0, IO::SEEK_END)
+        file_size = io.pos
+        return nil if file_size < 22
+
+        max_search = [file_size, 65_557].min
+        search_offset = file_size - max_search
+        io.seek(search_offset, IO::SEEK_SET)
+        search_buf = io.read(max_search)
+        return nil unless search_buf
+
+        eocd_index = search_buf.rindex("PK\x05\x06")
+        return nil unless eocd_index
+
+        eocd_pos = search_offset + eocd_index
+        io.seek(eocd_pos + 4, IO::SEEK_SET)
+        eocd_data = io.read(18)
+        return nil unless eocd_data && eocd_data.bytesize == 18
+
+        _disk_num, _cd_disk, _disk_entries, total_entries, _cd_size, cd_offset, _comment_len = eocd_data.unpack("vvvvVVv")
+        return nil if cd_offset > file_size
+
+        io.seek(cd_offset, IO::SEEK_SET)
+        result = {}
+
+        total_entries.times do
+          sig = io.read(4)
+          break unless sig == "PK\x01\x02"
+
+          cd_header = io.read(42)
+          break unless cd_header && cd_header.bytesize == 42
+
+          _v_made, _v_need, _gp, method, _time, _date, _crc, csize, _usize, nlen, elen, clen, _dnum, _iattr, _eattr, offset = cd_header.unpack("vvvvvvVVVvvvvvVV")
+          entry_name = io.read(nlen).force_encoding("UTF-8")
+          io.read(elen + clen)
+
+          next if entry_name.end_with?("/")
+
+          current_cd_pos = io.pos
+
+          io.seek(offset, IO::SEEK_SET)
+          local_sig = io.read(4)
+          next unless local_sig == LOCAL_HEADER_SIG
+
+          local_header = io.read(26)
+          next unless local_header && local_header.bytesize == 26
+
+          local_nlen = local_header[22, 2].unpack1("v")
+          local_elen = local_header[24, 2].unpack1("v")
+          io.seek(offset + 30 + local_nlen + local_elen, IO::SEEK_SET)
+
+          raw = io.read(csize)
+          entry_data = decompress(raw, method)
+          result[entry_name] = entry_data
+
+          io.seek(current_cd_pos, IO::SEEK_SET)
+        end
+
+        result
+      rescue ArgumentError => e
+        raise e
+      rescue StandardError
+        nil
+      end
+
       def find_data_descriptor_stream(io, method)
         if method == 8
           inflater = Zlib::Inflate.new(-Zlib::MAX_WBITS)
           result = +""
-          consumed = 0
           chunk_size = 4096
           begin
-            while (chunk = io.read(chunk_size))
+            while !inflater.finished? && (chunk = io.read(chunk_size))
               break if chunk.empty?
 
               inflated = inflater.inflate(chunk)
-              raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{MAX_UNCOMPRESSED_SIZE} bytes" if result.bytesize + inflated.bytesize > MAX_UNCOMPRESSED_SIZE
+              limit = @max_uncompressed_size || MAX_UNCOMPRESSED_SIZE
+              raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit
 
               result << inflated
-              consumed += chunk.bytesize
             end
           rescue Zlib::BufError, Zlib::DataError
             # Inflation ended
           ensure
-            consumed -= inflater.avail_in
+            remaining_bytes = inflater.avail_in
             inflater.close
           end
 
-          io.seek(-inflater.avail_in, IO::SEEK_CUR) if io.respond_to?(:seek)
+          io.seek(-remaining_bytes, IO::SEEK_CUR) if io.respond_to?(:seek) && remaining_bytes.positive?
 
           desc_sig = io.read(4)
-          io.seek(-4, IO::SEEK_CUR) unless desc_sig == [0x50, 0x4B, 0x07, 0x08].pack("C4")
-          io.read(12)
+          if desc_sig == [0x50, 0x4B, 0x07, 0x08].pack("C4")
+            io.read(12)
+          elsif desc_sig == [0x50, 0x4B, 0x03, 0x04].pack("C4") || desc_sig == [0x50, 0x4B, 0x01, 0x02].pack("C4")
+            io.seek(-4, IO::SEEK_CUR) if io.respond_to?(:seek)
+          elsif desc_sig
+            io.read(8)
+          end
 
-          [result, consumed]
+          [result, 0]
         else
           [io.read(0), 0]
         end
@@ -168,19 +253,20 @@ module Xlsxrb
         chunk_size = 32_768
         offset = 0
         raw_len = raw.bytesize
+        limit = @max_uncompressed_size || MAX_UNCOMPRESSED_SIZE
 
         begin
           while offset < raw_len
             chunk = raw.byteslice(offset, chunk_size)
             inflated = inflater.inflate(chunk)
-            raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{MAX_UNCOMPRESSED_SIZE} bytes" if result.bytesize + inflated.bytesize > MAX_UNCOMPRESSED_SIZE
+            raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit
 
             result << inflated
             offset += chunk_size
           end
           # Finish inflation
           inflated = inflater.finish
-          raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{MAX_UNCOMPRESSED_SIZE} bytes" if result.bytesize + inflated.bytesize > MAX_UNCOMPRESSED_SIZE
+          raise ArgumentError, "ZIP bomb detected: Uncompressed size exceeds #{limit} bytes" if result.bytesize + inflated.bytesize > limit
 
           result << inflated
         ensure

data/lib/xlsxrb/ooxml/zip_writer.rb

@@ -28,6 +28,8 @@ module Xlsxrb
         @io = io
         @entries = []
         @closed = false
+        @bytes_written = 0
+        @seekable = determine_seekable
       end
 
       # Add a file entry with string content.
@@ -51,17 +53,22 @@ module Xlsxrb
       def start_entry(path)
         raise "ZipWriter is closed" if @closed
 
+        entry_offset = @bytes_written
+        gp_flag = @seekable ? 0 : 0x0008
+
         @current_entry = {
           path: path,
-          offset: @io.is_a?(StringIO) ? @io.pos : @io.tell,
+          offset: entry_offset,
           deflater: Zlib::Deflate.new(Zlib::DEFAULT_COMPRESSION, -Zlib::MAX_WBITS),
           crc: Zlib.crc32,
           uncompressed_size: 0,
-          compressed_size: 0
+          compressed_size: 0,
+          gp_flag: gp_flag,
+          seekable: @seekable
         }
 
-        # Write a placeholder local header (will be patched later if IO supports seek)
-        write_local_header(path, 0, 0, 0)
+        # Write local header (if unseekable, sizes/crc are 0 and bit 3 is set)
+        write_local_header(path, 0, 0, 0, gp_flag: gp_flag)
       end
 
       def write_data(str)
@@ -74,7 +81,7 @@ module Xlsxrb
         @current_entry[:uncompressed_size] += bytes.bytesize
         compressed = @current_entry[:deflater].deflate(bytes, Zlib::SYNC_FLUSH)
         @current_entry[:compressed_size] += compressed.bytesize
-        @io.write(compressed)
+        write_bytes(compressed)
       end
 
       def finish_entry
@@ -86,17 +93,21 @@ module Xlsxrb
         # Flush remaining deflate data
         remaining = entry[:deflater].finish
         entry[:compressed_size] += remaining.bytesize
-        @io.write(remaining)
+        write_bytes(remaining)
         entry[:deflater].close
 
         final_crc = entry[:crc] & 0xFFFFFFFF
 
-        # Patch the local header if seekable
-        current_pos = @io.is_a?(StringIO) ? @io.pos : @io.tell
-        if @io.respond_to?(:seek)
+        if entry[:seekable]
+          # Patch the local header if seekable
+          current_pos = @io.is_a?(StringIO) ? @io.pos : @io.tell
           @io.seek(entry[:offset])
-          write_local_header(entry[:path], final_crc, entry[:compressed_size], entry[:uncompressed_size])
+          write_local_header(entry[:path], final_crc, entry[:compressed_size], entry[:uncompressed_size], gp_flag: 0, count_bytes: false)
           @io.seek(current_pos)
+        else
+          # Write Data Descriptor (signature 0x08074b50 + crc32 + comp_size + uncomp_size)
+          descriptor = [0x08074B50, final_crc, entry[:compressed_size], entry[:uncompressed_size]].pack("VVVV")
+          write_bytes(descriptor)
         end
 
         @entries << {
@@ -104,7 +115,8 @@ module Xlsxrb
           crc32: final_crc,
           compressed_size: entry[:compressed_size],
           uncompressed_size: entry[:uncompressed_size],
-          offset: entry[:offset]
+          offset: entry[:offset],
+          gp_flag: entry[:gp_flag]
         }
       end
 
@@ -114,28 +126,47 @@ module Xlsxrb
         finish_entry if @current_entry
 
         @closed = true
-        cd_offset = @io.is_a?(StringIO) ? @io.pos : @io.tell
+        cd_offset = @bytes_written
         cd_size = write_central_directory
         write_end_of_central_directory(cd_offset, cd_size)
       end
 
       private
 
+      def determine_seekable
+        return true if @io.is_a?(StringIO)
+        return false unless @io.respond_to?(:seek) && @io.respond_to?(:tell)
+
+        begin
+          @io.tell
+          true
+        rescue SystemCallError, IOError
+          false
+        end
+      end
+
+      def write_bytes(data)
+        return if data.nil? || data.empty?
+
+        @io.write(data)
+        @bytes_written += data.bytesize
+      end
+
       def write_raw_entry(path, content_bytes)
         crc = Zlib.crc32(content_bytes) & 0xFFFFFFFF
         compressed = deflate(content_bytes)
+        offset = @bytes_written
 
-        offset = @io.is_a?(StringIO) ? @io.pos : @io.tell
-
-        write_local_header(path, crc, compressed.bytesize, content_bytes.bytesize)
-        @io.write(compressed)
+        write_local_header(path, crc, compressed.bytesize, content_bytes.bytesize, gp_flag: 0)
+        write_bytes(compressed)
 
         @entries << {
           path: path,
           crc32: crc,
           compressed_size: compressed.bytesize,
           uncompressed_size: content_bytes.bytesize,
-          offset: offset
+          offset: offset,
+          gp_flag: 0
         }
       end
 
@@ -148,12 +179,12 @@ module Xlsxrb
         end
       end
 
-      def write_local_header(path, crc, compressed_size, uncompressed_size)
+      def write_local_header(path, crc, compressed_size, uncompressed_size, gp_flag: 0, count_bytes: true)
         name_bytes = path.encode("UTF-8").b
         header = [
           0x04034B50,        # local file header signature
           20,                # version needed (2.0)
-          0,                 # general purpose bit flag
+          gp_flag,           # general purpose bit flag (0x0008 if data descriptor follows)
           8,                 # compression method (deflate)
           0,                 # last mod file time
           33,                # last mod file date
@@ -163,8 +194,14 @@ module Xlsxrb
           name_bytes.bytesize,
           0                  # extra field length
         ].pack("VvvvvvVVVvv")
-        @io.write(header)
-        @io.write(name_bytes)
+
+        if count_bytes
+          write_bytes(header)
+          write_bytes(name_bytes)
+        else
+          @io.write(header)
+          @io.write(name_bytes)
+        end
       end
 
       def write_central_directory
@@ -175,7 +212,7 @@ module Xlsxrb
             0x02014B50,        # central directory file header signature
             20,                # version made by
             20,                # version needed
-            0,                 # general purpose bit flag
+            entry[:gp_flag] || 0, # general purpose bit flag
             8,                 # compression method
             0,                 # last mod file time
             33,                # last mod file date
@@ -190,8 +227,9 @@ module Xlsxrb
             0,                 # external file attributes
             entry[:offset]     # relative offset of local header
           ].pack("VvvvvvvVVVvvvvvVV")
-          @io.write(header)
-          @io.write(name_bytes)
+
+          write_bytes(header)
+          write_bytes(name_bytes)
           size += header.bytesize + name_bytes.bytesize
         end
         size
@@ -208,7 +246,7 @@ module Xlsxrb
           cd_offset,           # offset of central directory
           0                    # comment length
         ].pack("VvvvvVVv")
-        @io.write(eocd)
+        write_bytes(eocd)
       end
     end
   end