xlsxrb 0.1.7 → 0.1.9

data/lib/xlsxrb/ooxml/crypto/agile.rb

@@ -0,0 +1,285 @@
+# frozen_string_literal: true
+
+# rbs_inline: enabled
+
+require "openssl"
+require "rexml/document"
+require "securerandom"
+
+module Xlsxrb
+  module Ooxml
+    module Crypto
+      # Implements Microsoft Office Agile Encryption specified in [MS-OFFCRYPTO] Section 2.3.4.
+      class Agile
+        BLOCK_KEY_VERIFIER_INPUT   = "\xfe\xa7\xd2\x76\x3b\x4b\x9e\x79".b.freeze
+        BLOCK_KEY_VERIFIER_VALUE   = "\xd7\xaa\x0f\x6d\x30\x61\x34\x4e".b.freeze
+        BLOCK_KEY_KEY              = "\x14\x6e\x0b\xe7\xab\xac\xd0\xd6".b.freeze
+        BLOCK_KEY_INTEGRITY_KEY    = "\x5f\xb2\xad\x01\x0c\xb9\xe1\xf6".b.freeze
+        BLOCK_KEY_INTEGRITY_VALUE  = "\xa0\x67\x7f\x02\xb2\x2c\x84\x33".b.freeze
+
+        SEGMENT_SIZE = 4096
+
+        class << self
+          # Decrypts an encrypted package given the EncryptionInfo stream data and EncryptedPackage stream data.
+          def decrypt(encryption_info_bytes, encrypted_package_bytes, password)
+            info = parse_encryption_info(encryption_info_bytes)
+            password_str = password.to_s
+
+            digest = digest_for(info[:hash_algorithm])
+            cipher_name = cipher_name_for(info[:cipher_algorithm], info[:key_bits])
+
+            # 1. Derive intermediate hash H_final from password and keyEncryptor salt
+            h_final = derive_h_final(digest, password_str, info[:encryptor_salt], info[:spin_count])
+
+            # 2. Verify password with verifier input and hash
+            key_bytes = info[:key_bits] / 8
+            k_ver_input = derive_key(digest, h_final, BLOCK_KEY_VERIFIER_INPUT, key_bytes)
+            verifier_input = aes_decrypt(cipher_name, k_ver_input, info[:encryptor_salt], info[:encrypted_verifier_hash_input])
+
+            expected_hash = digest.digest(verifier_input)
+
+            k_ver_val = derive_key(digest, h_final, BLOCK_KEY_VERIFIER_VALUE, key_bytes)
+            decrypted_hash = aes_decrypt(cipher_name, k_ver_val, info[:encryptor_salt], info[:encrypted_verifier_hash_value])
+
+            hash_size = info[:hash_size]
+            raise Xlsxrb::InvalidPasswordError, "Password verification failed" unless OpenSSL.secure_compare(decrypted_hash[0, hash_size], expected_hash[0, hash_size])
+
+            # 3. Decrypt package master key
+            k_key = derive_key(digest, h_final, BLOCK_KEY_KEY, key_bytes)
+            package_key = aes_decrypt(cipher_name, k_key, info[:encryptor_salt], info[:encrypted_key_value])[0, key_bytes]
+
+            # 4. Decrypt package stream
+            raise Xlsxrb::DecryptionError, "Encrypted package stream is too short" if encrypted_package_bytes.bytesize < 8
+
+            total_size = encrypted_package_bytes[0, 8].unpack1("Q<")
+            raise Xlsxrb::DecryptionError, "Encrypted package size is invalid or exceeds limits" if total_size.negative? || total_size > 0x400_000_000
+
+            encrypted_data = encrypted_package_bytes[8..] || "".b
+
+            pkg_cipher_name = cipher_name_for(info[:key_data_cipher_algorithm], info[:key_data_key_bits])
+            pkg_digest = digest_for(info[:key_data_hash_algorithm])
+            pkg_salt = info[:key_data_salt]
+
+            decrypted = +""
+            num_blocks = (encrypted_data.bytesize + SEGMENT_SIZE - 1) / SEGMENT_SIZE
+            num_blocks.times do |i|
+              chunk = encrypted_data[i * SEGMENT_SIZE, SEGMENT_SIZE]
+              break if chunk.nil? || chunk.empty?
+
+              iv = pkg_digest.digest(pkg_salt + [i].pack("V"))[0, 16]
+              decrypted << aes_decrypt_block(pkg_cipher_name, package_key, iv, chunk)
+            end
+
+            decrypted[0, total_size] || "".b
+          end
+
+          # Encrypts a plain zip payload with the given password into EncryptionInfo and EncryptedPackage streams.
+          def encrypt(plain_bytes, password)
+            password_str = password.to_s
+            spin_count = 100_000
+            key_bits = 256
+            key_bytes = key_bits / 8
+            hash_algorithm = "SHA512"
+            cipher_algorithm = "AES"
+            cipher_chaining = "ChainingModeCBC"
+            hash_size = 64
+            block_size = 16
+
+            digest = digest_for(hash_algorithm)
+            cipher_name = "aes-256-cbc"
+
+            encryptor_salt = SecureRandom.random_bytes(16)
+            key_data_salt = SecureRandom.random_bytes(16)
+            package_key = SecureRandom.random_bytes(key_bytes)
+            verifier_input = SecureRandom.random_bytes(16)
+
+            # Derive intermediate hash H_final
+            h_final = derive_h_final(digest, password_str, encryptor_salt, spin_count)
+
+            # Encrypt verifier input
+            k_ver_input = derive_key(digest, h_final, BLOCK_KEY_VERIFIER_INPUT, key_bytes)
+            encrypted_verifier_input = aes_encrypt(cipher_name, k_ver_input, encryptor_salt, verifier_input)
+
+            # Encrypt verifier hash value
+            expected_hash = digest.digest(verifier_input)
+            k_ver_val = derive_key(digest, h_final, BLOCK_KEY_VERIFIER_VALUE, key_bytes)
+            encrypted_verifier_val = aes_encrypt(cipher_name, k_ver_val, encryptor_salt, expected_hash)
+
+            # Encrypt package master key
+            k_key = derive_key(digest, h_final, BLOCK_KEY_KEY, key_bytes)
+            encrypted_key_value = aes_encrypt(cipher_name, k_key, encryptor_salt, package_key)
+
+            # Encrypt plain package data in 4096-byte segments
+            encrypted_package_stream = +""
+            encrypted_package_stream << [plain_bytes.bytesize].pack("Q<")
+
+            num_blocks = (plain_bytes.bytesize + SEGMENT_SIZE - 1) / SEGMENT_SIZE
+            num_blocks.times do |i|
+              chunk = plain_bytes[i * SEGMENT_SIZE, SEGMENT_SIZE] || "".b
+              # Pad last chunk to multiple of block_size if necessary
+              if (chunk.bytesize % block_size) != 0
+                pad_len = block_size - (chunk.bytesize % block_size)
+                chunk += ("\x00".b * pad_len)
+              end
+
+              iv = digest.digest(key_data_salt + [i].pack("V"))[0, 16]
+              encrypted_package_stream << aes_encrypt_block(cipher_name, package_key, iv, chunk)
+            end
+
+            # Data integrity HMAC
+            hmac_key = SecureRandom.random_bytes(64)
+            hmac_value = OpenSSL::HMAC.digest(hash_algorithm, hmac_key, plain_bytes)
+
+            k_integ_key = derive_key(digest, h_final, BLOCK_KEY_INTEGRITY_KEY, key_bytes)
+            encrypted_hmac_key = aes_encrypt(cipher_name, k_integ_key, encryptor_salt, hmac_key)
+
+            k_integ_val = derive_key(digest, h_final, BLOCK_KEY_INTEGRITY_VALUE, key_bytes)
+            encrypted_hmac_val = aes_encrypt(cipher_name, k_integ_val, encryptor_salt, hmac_value)
+
+            # Build EncryptionInfo XML
+            xml = <<~XML
+              <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+              <encryption xmlns="http://schemas.microsoft.com/office/2006/encryption" xmlns:p="http://schemas.microsoft.com/office/2006/keyEncryptor/password" xmlns:c="http://schemas.microsoft.com/office/2006/keyEncryptor/certificate">
+                <keyData saltSize="#{key_data_salt.bytesize}" blockSize="#{block_size}" keyBits="#{key_bits}" hashSize="#{hash_size}" cipherAlgorithm="#{cipher_algorithm}" cipherChaining="#{cipher_chaining}" hashAlgorithm="#{hash_algorithm}" saltValue="#{[key_data_salt].pack("m0")}"/>
+                <dataIntegrity encryptedHmacKey="#{[encrypted_hmac_key].pack("m0")}" encryptedHmacValue="#{[encrypted_hmac_val].pack("m0")}"/>
+                <keyEncryptors>
+                  <keyEncryptor uri="http://schemas.microsoft.com/office/2006/keyEncryptor/password">
+                    <p:encryptedKey spinCount="#{spin_count}" saltSize="#{encryptor_salt.bytesize}" blockSize="#{block_size}" keyBits="#{key_bits}" hashSize="#{hash_size}" cipherAlgorithm="#{cipher_algorithm}" cipherChaining="#{cipher_chaining}" hashAlgorithm="#{hash_algorithm}" saltValue="#{[encryptor_salt].pack("m0")}" encryptedVerifierHashInput="#{[encrypted_verifier_input].pack("m0")}" encryptedVerifierHashValue="#{[encrypted_verifier_val].pack("m0")}" encryptedKeyValue="#{[encrypted_key_value].pack("m0")}"/>
+                  </keyEncryptor>
+                </keyEncryptors>
+              </encryption>
+            XML
+
+            # EncryptionInfo stream header: versionMajor=4, versionMinor=4, flags=0x40
+            info_stream = [4, 4, 0x40].pack("vvV") + xml.b
+
+            {
+              "EncryptionInfo" => info_stream,
+              "EncryptedPackage" => encrypted_package_stream
+            }
+          end
+
+          private
+
+          def parse_encryption_info(bytes)
+            raise Xlsxrb::DecryptionError, "EncryptionInfo stream is too short" if bytes.bytesize < 8
+
+            major, minor, = bytes[0, 8].unpack("vvV")
+            raise Xlsxrb::DecryptionError, "Unsupported encryption version #{major}.#{minor}" unless major == 4 && minor == 4
+
+            xml_str = bytes[8..] || ""
+            begin
+              doc = REXML::Document.new(xml_str)
+            rescue StandardError => e
+              raise Xlsxrb::DecryptionError, "Malformed EncryptionInfo XML: #{e.message}"
+            end
+
+            root = doc.root
+            raise Xlsxrb::DecryptionError, "Invalid EncryptionInfo XML" unless root
+
+            key_data = root.elements["keyData"]
+            key_encryptor = root.elements["keyEncryptors/keyEncryptor/encryptedKey"] || root.elements["keyEncryptors/keyEncryptor/*"]
+            raise Xlsxrb::DecryptionError, "Missing keyEncryptor element" unless key_encryptor
+
+            spin_count = key_encryptor.attributes["spinCount"]&.to_i || 100_000
+            raise Xlsxrb::DecryptionError, "spinCount out of allowed bounds: #{spin_count}" if spin_count.negative? || spin_count > 10_000_000
+
+            key_attrs = key_data&.attributes
+            {
+              key_data_salt: key_attrs&.[]("saltValue").to_s.unpack1("m0") || "".b,
+              key_data_hash_algorithm: key_attrs&.[]("hashAlgorithm") || "SHA512",
+              key_data_cipher_algorithm: key_attrs&.[]("cipherAlgorithm") || "AES",
+              key_data_key_bits: key_attrs&.[]("keyBits")&.to_i || 256,
+              key_data_block_size: key_attrs&.[]("blockSize")&.to_i || 16,
+
+              spin_count: spin_count,
+              encryptor_salt: key_encryptor.attributes["saltValue"].to_s.unpack1("m0") || "".b,
+              hash_algorithm: key_encryptor.attributes["hashAlgorithm"] || "SHA512",
+              cipher_algorithm: key_encryptor.attributes["cipherAlgorithm"] || "AES",
+              key_bits: key_encryptor.attributes["keyBits"]&.to_i || 256,
+              hash_size: key_encryptor.attributes["hashSize"]&.to_i || 64,
+              encrypted_verifier_hash_input: key_encryptor.attributes["encryptedVerifierHashInput"].to_s.unpack1("m0") || "".b,
+              encrypted_verifier_hash_value: key_encryptor.attributes["encryptedVerifierHashValue"].to_s.unpack1("m0") || "".b,
+              encrypted_key_value: key_encryptor.attributes["encryptedKeyValue"].to_s.unpack1("m0") || "".b
+            }
+          end
+
+          def digest_for(name)
+            case name.to_s.upcase.gsub(/[^A-Z0-9]/, "")
+            when "SHA512" then OpenSSL::Digest.new("SHA512")
+            when "SHA384" then OpenSSL::Digest.new("SHA384")
+            when "SHA256" then OpenSSL::Digest.new("SHA256")
+            when "SHA1"   then OpenSSL::Digest.new("SHA1")
+            else
+              raise Xlsxrb::DecryptionError, "Unsupported hash algorithm: #{name}"
+            end
+          end
+
+          def cipher_name_for(algo, key_bits)
+            case algo.to_s.upcase
+            when "AES"
+              "aes-#{key_bits}-cbc"
+            else
+              raise Xlsxrb::DecryptionError, "Unsupported cipher algorithm: #{algo}"
+            end
+          end
+
+          def derive_h_final(digest, password, salt, spin_count)
+            pw_utf16 = password.encode("UTF-16LE").b
+            h = digest.digest(salt + pw_utf16)
+
+            spin_count.times do |i|
+              h = digest.digest([i].pack("V") + h)
+            end
+            h
+          end
+
+          def derive_key(digest, h_final, block_key, key_bytes)
+            digest.digest(h_final + block_key)[0, key_bytes]
+          end
+
+          def aes_decrypt(cipher_name, key, init_vector, data)
+            cipher = OpenSSL::Cipher.new(cipher_name)
+            cipher.decrypt
+            cipher.key = key
+            cipher.iv = init_vector[0, 16]
+            cipher.padding = 0
+            cipher.update(data) + cipher.final
+          end
+
+          def aes_encrypt(cipher_name, key, init_vector, data)
+            cipher = OpenSSL::Cipher.new(cipher_name)
+            cipher.encrypt
+            cipher.key = key
+            cipher.iv = init_vector[0, 16]
+            cipher.padding = 0
+            # Ensure data is multiple of 16 bytes
+            if (data.bytesize % 16) != 0
+              pad_len = 16 - (data.bytesize % 16)
+              data += ("\x00".b * pad_len)
+            end
+            cipher.update(data) + cipher.final
+          end
+
+          def aes_decrypt_block(cipher_name, key, init_vector, data)
+            cipher = OpenSSL::Cipher.new(cipher_name)
+            cipher.decrypt
+            cipher.key = key
+            cipher.iv = init_vector[0, 16]
+            cipher.padding = 0
+            cipher.update(data) + cipher.final
+          end
+
+          def aes_encrypt_block(cipher_name, key, init_vector, data)
+            cipher = OpenSSL::Cipher.new(cipher_name)
+            cipher.encrypt
+            cipher.key = key
+            cipher.iv = init_vector[0, 16]
+            cipher.padding = 0
+            cipher.update(data) + cipher.final
+          end
+        end
+      end
+    end
+  end
+end

data/lib/xlsxrb/ooxml/crypto/standard.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+# rbs_inline: enabled
+
+require "openssl"
+require "securerandom"
+
+module Xlsxrb
+  module Ooxml
+    module Crypto
+      # Implements Microsoft Office Standard Encryption specified in [MS-OFFCRYPTO] Section 2.3.6.
+      class Standard
+        CSP_NAME = "Microsoft Enhanced RSA and AES Cryptographic Provider\x00".encode("UTF-16LE").b.freeze
+        ITERATION_COUNT = 50_000
+
+        class << self
+          # Decrypts a Standard-encrypted package.
+          def decrypt(encryption_info_bytes, encrypted_package_bytes, password)
+            salt, encrypted_verifier, verifier_hash_size, encrypted_verifier_hash = parse_encryption_info(encryption_info_bytes)
+            password_str = password.to_s
+
+            # Derive key K
+            k = derive_key(password_str, salt)
+
+            # Verify password
+            verifier = aes_ecb_decrypt(k, encrypted_verifier)
+            expected_hash = OpenSSL::Digest::SHA1.digest(verifier)
+
+            decrypted_hash = aes_ecb_decrypt(k, encrypted_verifier_hash)[0, verifier_hash_size]
+            raise Xlsxrb::InvalidPasswordError, "Standard encryption password verification failed" unless OpenSSL.secure_compare(decrypted_hash, expected_hash)
+
+            # Decrypt package stream
+            raise Xlsxrb::DecryptionError, "Encrypted package stream is too short" if encrypted_package_bytes.bytesize < 8
+
+            total_size = encrypted_package_bytes[0, 8].unpack1("Q<")
+            raise Xlsxrb::DecryptionError, "Encrypted package size is invalid or exceeds limits" if total_size.negative? || total_size > 0x400_000_000
+
+            encrypted_data = encrypted_package_bytes[8..] || "".b
+
+            decrypted = aes_ecb_decrypt(k, encrypted_data)
+            decrypted[0, total_size] || "".b
+          end
+
+          # Encrypts plain zip data into Standard Encryption streams.
+          def encrypt(plain_bytes, password)
+            password_str = password.to_s
+            salt = SecureRandom.random_bytes(16)
+            verifier = SecureRandom.random_bytes(16)
+
+            # Derive key K
+            k = derive_key(password_str, salt)
+
+            # Encrypt verifier
+            encrypted_verifier = aes_ecb_encrypt(k, verifier)
+
+            # Encrypt verifier hash
+            verifier_hash = OpenSSL::Digest::SHA1.digest(verifier)
+            padded_hash = verifier_hash.ljust(32, "\x00".b)
+            encrypted_verifier_hash = aes_ecb_encrypt(k, padded_hash)
+
+            # Build EncryptionInfo Stream
+            header_size = 32 + CSP_NAME.bytesize
+            info_stream = +""
+            # Version & Flags: vMajor=3, vMinor=2, Flags=0x24 (CryptoAPI AES-128)
+            info_stream << [3, 2, 0x24].pack("vvV")
+            # EncryptionHeader
+            info_stream << [header_size].pack("V")
+            info_stream << [0x24, 0, 0x0000660E, 0x00008004, 128, 0x00000018, 0, 0].pack("V8")
+            info_stream << CSP_NAME
+            # EncryptionVerifier
+            info_stream << [16].pack("V") # Salt size
+            info_stream << salt
+            info_stream << encrypted_verifier # 16 bytes
+            info_stream << [20].pack("V") # Verifier hash size (SHA-1 = 20)
+            info_stream << encrypted_verifier_hash # 32 bytes
+
+            # Build EncryptedPackage Stream
+            padded_plain = plain_bytes
+            padded_plain = padded_plain.ljust(padded_plain.bytesize + 16 - (padded_plain.bytesize % 16), "\x00".b) if (padded_plain.bytesize % 16) != 0
+
+            encrypted_pkg_data = aes_ecb_encrypt(k, padded_plain)
+            pkg_stream = [plain_bytes.bytesize].pack("Q<") + encrypted_pkg_data
+
+            {
+              "EncryptionInfo" => info_stream,
+              "EncryptedPackage" => pkg_stream
+            }
+          end
+
+          private
+
+          def parse_encryption_info(bytes)
+            raise Xlsxrb::DecryptionError, "EncryptionInfo stream too short" if bytes.bytesize < 40
+
+            major, minor, = bytes[0, 8].unpack("vvV")
+            raise Xlsxrb::DecryptionError, "Unsupported standard encryption version #{major}.#{minor}" unless [2, 3, 4].include?(major) && minor == 2
+
+            header_size = bytes[8, 4].unpack1("V") || 0
+            verifier_offset = 12 + header_size
+            raise Xlsxrb::DecryptionError, "EncryptionInfo header offset out of bounds" if verifier_offset + 56 > bytes.bytesize
+
+            salt_size = bytes[verifier_offset, 4].unpack1("V") || 0
+            raise Xlsxrb::DecryptionError, "Invalid salt size in Standard encryption" if salt_size > 64 || (verifier_offset + 4 + salt_size + 48) > bytes.bytesize
+
+            salt = bytes[verifier_offset + 4, salt_size]
+            encrypted_verifier = bytes[verifier_offset + 4 + salt_size, 16]
+
+            hash_size_offset = verifier_offset + 4 + salt_size + 16
+            verifier_hash_size = bytes[hash_size_offset, 4].unpack1("V") || 0
+            encrypted_verifier_hash = bytes[hash_size_offset + 4, 32]
+
+            [salt, encrypted_verifier, verifier_hash_size, encrypted_verifier_hash]
+          end
+
+          def derive_key(password, salt, block_num = 0)
+            pw_utf16 = password.encode("UTF-16LE").b
+            h = OpenSSL::Digest::SHA1.digest(salt + pw_utf16)
+
+            ITERATION_COUNT.times do |i|
+              h = OpenSSL::Digest::SHA1.digest([i].pack("V") + h)
+            end
+
+            x = OpenSSL::Digest::SHA1.digest(h + [block_num].pack("V"))
+            buf1 = x.ljust(64, "\x00".b).bytes.map { |b| b ^ 0x36 }.pack("C*")
+            k1 = OpenSSL::Digest::SHA1.digest(buf1)
+
+            buf2 = x.ljust(64, "\x00".b).bytes.map { |b| b ^ 0x5C }.pack("C*")
+            k2 = OpenSSL::Digest::SHA1.digest(buf2)
+
+            (k1 + k2)[0, 16]
+          end
+
+          def aes_ecb_encrypt(key, data)
+            cipher = OpenSSL::Cipher.new("aes-128-ecb")
+            cipher.encrypt
+            cipher.key = key
+            cipher.padding = 0
+            cipher.update(data) + cipher.final
+          end
+
+          def aes_ecb_decrypt(key, data)
+            cipher = OpenSSL::Cipher.new("aes-128-ecb")
+            cipher.decrypt
+            cipher.key = key
+            cipher.padding = 0
+            cipher.update(data) + cipher.final
+          end
+        end
+      end
+    end
+  end
+end

data/lib/xlsxrb/ooxml/crypto.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+# rbs_inline: enabled
+
+require_relative "cfb"
+require_relative "crypto/agile"
+require_relative "crypto/standard"
+
+module Xlsxrb
+  module Ooxml
+    # High-level encryption and decryption facade for [MS-OFFCRYPTO] Excel document protection.
+    module Crypto
+      class << self
+        # Checks if the binary data is an encrypted Compound File Binary package.
+        def encrypted?(data)
+          return false unless Cfb::Reader.cfb?(data)
+
+          begin
+            reader = Cfb::Reader.new(data)
+            reader.stream_names.any? { |n| n.casecmp?("EncryptionInfo") }
+          rescue StandardError
+            false
+          end
+        end
+
+        # Decrypts an encrypted XLSX (CFB) package with the given password.
+        def decrypt(cfb_data, password)
+          raise Xlsxrb::EncryptedFileError, "Password is required to decrypt this file" if password.nil? || password.to_s.empty?
+
+          reader = Cfb::Reader.new(cfb_data)
+          encryption_info = reader.read_stream("EncryptionInfo")
+          encrypted_package = reader.read_stream("EncryptedPackage")
+
+          raise Xlsxrb::DecryptionError, "Missing EncryptionInfo or EncryptedPackage stream" if encryption_info.nil? || encrypted_package.nil?
+
+          major, minor = encryption_info[0, 4].unpack("vv")
+          if major == 4 && minor == 4
+            Agile.decrypt(encryption_info, encrypted_package, password)
+          elsif minor == 2
+            Standard.decrypt(encryption_info, encrypted_package, password)
+          else
+            raise Xlsxrb::DecryptionError, "Unsupported encryption version #{major}.#{minor}"
+          end
+        end
+
+        # Encrypts a plain ZIP payload with the given password into an encrypted CFB package.
+        def encrypt(plain_zip_data, password, mode: :standard)
+          return plain_zip_data if password.nil? || password.to_s.empty?
+
+          streams = if mode == :agile
+                      Agile.encrypt(plain_zip_data, password)
+                    else
+                      Standard.encrypt(plain_zip_data, password)
+                    end
+          Cfb::Writer.write(streams)
+        end
+      end
+    end
+  end
+end

data/lib/xlsxrb/ooxml/worksheet_parser.rb

@@ -515,17 +515,17 @@ module Xlsxrb
           row_end = xml.index("</row>", tag_end + 1)
           break unless row_end
 
-          row_source = { part: part_name, row: row_index }
-          cells = fast_parse_cells_direct(xml, tag_end + 1, row_end, shared_strings, row_source)
-
-          row_obj = Elements::Row.new(
+          { part: part_name, row: row_index }
+          row_obj = StreamRow.new(
             index: row_index,
-            cells: cells,
+            xml_bytes: xml,
+            from: tag_end + 1,
+            to: row_end,
+            shared_strings: shared_strings,
             height: attrs[:height],
             hidden: attrs[:hidden] || false,
             custom_height: attrs[:custom_height] || false,
-            outline_level: attrs[:outline_level],
-            errors: Elements::EMPTY_ERRORS
+            outline_level: attrs[:outline_level]
           )
           block.call(row_obj)
 
@@ -537,7 +537,13 @@ module Xlsxrb
 
       def self.fast_parse_cells_direct(xml, from, to, shared_strings, row_source)
         cells = []
+        fast_scan_cells_direct(xml, from, to, shared_strings, row_source) { |c| cells << c }
+        cells
+      end
+
+      def self.fast_scan_cells_direct(xml, from, to, shared_strings, row_source, &block)
         pos = from
+        cell_count = 0
 
         while pos < to
           c_start = xml.index("<c", pos)
@@ -589,7 +595,6 @@ module Xlsxrb
 
                 row_idx = (row_idx * 10) + (cb - 48)
                 ai += 1
-
               end
               row_idx -= 1
               ai += 1 if xml.getbyte(ai) == 34
@@ -619,7 +624,6 @@ module Xlsxrb
 
                 style_index = (style_index * 10) + (cb - 48)
                 ai += 1
-
               end
               ai += 1 if xml.getbyte(ai) == 34
             else
@@ -629,13 +633,15 @@ module Xlsxrb
 
           # Self-closing <c ... />
           if xml.getbyte(c_tag_end - 1) == 47
-            cells << Elements::Cell.new(
+            cell_obj = Elements::Cell.new(
               row_index: row_idx || row_source[:row],
-              column_index: col_idx || cells.size,
+              column_index: col_idx || cell_count,
               value: nil,
               style_index: style_index,
               errors: Elements::EMPTY_ERRORS
             )
+            cell_count += 1
+            block.call(cell_obj)
             pos = c_tag_end + 1
             next
           end
@@ -721,19 +727,19 @@ module Xlsxrb
           end
 
           val_to_use = inline_str || value
-          cells << Elements::Cell.new(
+          cell_obj = Elements::Cell.new(
             row_index: row_idx || row_source[:row],
-            column_index: col_idx || cells.size,
+            column_index: col_idx || cell_count,
             value: val_to_use,
             formula: formula,
             style_index: style_index,
             errors: Elements::EMPTY_ERRORS
           )
+          cell_count += 1
+          block.call(cell_obj)
 
           pos = c_end + 4
         end
-
-        cells
       end
 
       private_class_method :fast_parse_cells_direct