@cj-tech-master/excelts 9.1.0 → 9.2.0

package/dist/browser/utils/crypto.js

@@ -0,0 +1,209 @@
+/**
+ * Cryptographic primitives — Node.js version.
+ *
+ * Uses `node:crypto` for maximum performance where possible.
+ * Pure JS fallbacks for operations where `node:crypto` would be inconvenient
+ * (e.g., AES-CBC with specific PDF padding semantics).
+ *
+ * The browser counterpart (`crypto.browser.ts`) provides the same API using
+ * pure JS implementations for synchronous ops and Web Crypto for async ops.
+ *
+ * Shared by: PDF (encryption/decryption), Archive (via re-export if needed),
+ * and digital signature infrastructure.
+ *
+ * @see FIPS 197 — AES
+ * @see FIPS 180-4 — SHA-256
+ * @see RFC 1321 — MD5
+ * @see RFC 2104 — HMAC
+ */
+import crypto from "node:crypto";
+// =============================================================================
+// SHA-256
+// =============================================================================
+/**
+ * SHA-256 hash function.
+ * @returns 32-byte digest
+ */
+export function sha256(input) {
+    return new Uint8Array(crypto.createHash("sha256").update(input).digest());
+}
+// =============================================================================
+// Generic hash
+// =============================================================================
+/**
+ * HMAC-SHA256 (RFC 2104).
+ * @returns 32-byte MAC
+ */
+export function hmacSha256(key, message) {
+    return new Uint8Array(crypto.createHmac("sha256", key).update(message).digest());
+}
+// =============================================================================
+// MD5
+// =============================================================================
+/**
+ * MD5 hash function (RFC 1321).
+ * @returns 16-byte digest
+ */
+export function md5(input) {
+    return new Uint8Array(crypto.createHash("md5").update(input).digest());
+}
+// =============================================================================
+// AES-CBC
+// =============================================================================
+/**
+ * AES-CBC encryption with PKCS#7 padding.
+ * Supports AES-128 (16-byte key) and AES-256 (32-byte key).
+ */
+export function aesCbcEncrypt(plaintext, key, iv) {
+    const algo = key.length === 16 ? "aes-128-cbc" : "aes-256-cbc";
+    const cipher = crypto.createCipheriv(algo, key, iv);
+    return new Uint8Array(Buffer.concat([cipher.update(plaintext), cipher.final()]));
+}
+/**
+ * AES-CBC decryption with PKCS#7 padding removal.
+ * Supports AES-128 (16-byte key) and AES-256 (32-byte key).
+ */
+export function aesCbcDecrypt(ciphertext, key, iv) {
+    const algo = key.length === 16 ? "aes-128-cbc" : "aes-256-cbc";
+    const decipher = crypto.createDecipheriv(algo, key, iv);
+    try {
+        return new Uint8Array(Buffer.concat([decipher.update(ciphertext), decipher.final()]));
+    }
+    catch {
+        // Invalid padding — return raw decrypted data without padding removal
+        // (matches pure JS behavior for NIST test vectors and PDF key derivation)
+        const decipher2 = crypto.createDecipheriv(algo, key, iv);
+        decipher2.setAutoPadding(false);
+        return new Uint8Array(Buffer.concat([decipher2.update(ciphertext), decipher2.final()]));
+    }
+}
+/**
+ * AES-CBC decryption WITHOUT PKCS#7 padding removal.
+ * Used for key derivation where the output length is known.
+ */
+export function aesCbcDecryptRaw(ciphertext, key, iv) {
+    const algo = key.length === 16 ? "aes-128-cbc" : "aes-256-cbc";
+    const decipher = crypto.createDecipheriv(algo, key, iv);
+    decipher.setAutoPadding(false);
+    return new Uint8Array(Buffer.concat([decipher.update(ciphertext), decipher.final()]));
+}
+/**
+ * AES-CBC encryption WITHOUT PKCS#7 padding.
+ * Used when the plaintext is already block-aligned.
+ *
+ * @throws if plaintext length is not a multiple of 16.
+ */
+export function aesCbcEncryptRaw(plaintext, key, iv) {
+    if (plaintext.length % 16 !== 0) {
+        throw new Error("aesCbcEncryptRaw: plaintext length must be a multiple of 16");
+    }
+    const algo = key.length === 16 ? "aes-128-cbc" : "aes-256-cbc";
+    const cipher = crypto.createCipheriv(algo, key, iv);
+    cipher.setAutoPadding(false);
+    return new Uint8Array(Buffer.concat([cipher.update(plaintext), cipher.final()]));
+}
+/**
+ * AES-ECB encryption of a single 16-byte block (no padding, no IV).
+ */
+export function aesEcbEncrypt(block, key) {
+    const algo = key.length === 16 ? "aes-128-ecb" : "aes-256-ecb";
+    const cipher = crypto.createCipheriv(algo, key, null);
+    cipher.setAutoPadding(false);
+    return new Uint8Array(Buffer.concat([cipher.update(block), cipher.final()]));
+}
+// =============================================================================
+// RC4 (legacy)
+// =============================================================================
+/**
+ * RC4 stream cipher.
+ * @deprecated Only used for reading legacy encrypted PDFs.
+ */
+export function rc4(key, data) {
+    // Node's crypto doesn't expose RC4 in modern versions, use pure JS
+    const s = new Uint8Array(256);
+    for (let i = 0; i < 256; i++) {
+        s[i] = i;
+    }
+    let j = 0;
+    for (let i = 0; i < 256; i++) {
+        j = (j + s[i] + key[i % key.length]) & 0xff;
+        [s[i], s[j]] = [s[j], s[i]];
+    }
+    const result = new Uint8Array(data.length);
+    let ii = 0;
+    let jj = 0;
+    for (let k = 0; k < data.length; k++) {
+        ii = (ii + 1) & 0xff;
+        jj = (jj + s[ii]) & 0xff;
+        [s[ii], s[jj]] = [s[jj], s[ii]];
+        result[k] = data[k] ^ s[(s[ii] + s[jj]) & 0xff];
+    }
+    return result;
+}
+// =============================================================================
+// Random bytes
+// =============================================================================
+/**
+ * Generate cryptographically secure random bytes.
+ */
+export function randomBytes(length) {
+    return new Uint8Array(crypto.randomBytes(length));
+}
+// =============================================================================
+// Generic hash
+// =============================================================================
+/**
+ * Compute a hash digest using any algorithm supported by the platform.
+ *
+ * @param algorithm - Hash algorithm name (e.g., "SHA-256", "SHA-512", "SHA-1", "MD5").
+ *   Normalized internally: hyphens removed, lowercased.
+ * @param data - Data to hash
+ * @returns The digest bytes
+ */
+export function hash(algorithm, data) {
+    const algo = algorithm.toLowerCase().replace(/-/g, "");
+    return new Uint8Array(crypto.createHash(algo).update(data).digest());
+}
+/**
+ * Async version of `hash()` — same behavior, but returns a Promise for API
+ * parity with the browser version.
+ */
+export async function hashAsync(algorithm, data) {
+    return hash(algorithm, data);
+}
+// =============================================================================
+// RSA signature operations (async — for digital signatures)
+// =============================================================================
+/**
+ * Verify an RSA PKCS#1 v1.5 signature.
+ *
+ * @param publicKeyDer - DER-encoded SubjectPublicKeyInfo
+ * @param signature - The signature bytes
+ * @param data - The signed data (will be hashed with SHA-256)
+ */
+export async function rsaVerify(publicKeyDer, signature, data) {
+    const key = crypto.createPublicKey({
+        key: Buffer.from(publicKeyDer),
+        format: "der",
+        type: "spki"
+    });
+    const verifier = crypto.createVerify("SHA256");
+    verifier.update(data);
+    return verifier.verify(key, signature);
+}
+/**
+ * Create an RSA PKCS#1 v1.5 signature.
+ *
+ * @param privateKeyDer - DER-encoded PKCS#8 private key
+ * @param data - The data to sign (will be hashed with SHA-256)
+ */
+export async function rsaSign(privateKeyDer, data) {
+    const key = crypto.createPrivateKey({
+        key: Buffer.from(privateKeyDer),
+        format: "der",
+        type: "pkcs8"
+    });
+    const signer = crypto.createSign("SHA256");
+    signer.update(data);
+    return new Uint8Array(signer.sign(key));
+}

package/dist/cjs/modules/archive/compression/crc32.js

@@ -85,7 +85,7 @@ function ensureZlibSync() {
         return;
     }
     try {
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        // oxlint-disable-next-line typescript/no-require-imports
         _zlib = require("zlib");
         _zlibInitStarted = true;
     }

package/dist/cjs/modules/archive/crypto/aes.js

@@ -16,8 +16,6 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AES_PASSWORD_VERIFY_LENGTH = exports.AES_AUTH_CODE_LENGTH = exports.AES_STRENGTH_FROM_BYTE = exports.AES_STRENGTH_BYTE = exports.AES_KEY_LENGTH = exports.AES_SALT_LENGTH = exports.AES_EXTRA_FIELD_ID = exports.COMPRESSION_METHOD_AES = exports.AES_VERSION_AE1 = exports.AES_VERSION_AE2 = exports.AES_VENDOR_ID = void 0;
-exports.getRandomValues = getRandomValues;
-exports.randomBytes = randomBytes;
 exports.aesDerive = aesDerive;
 exports.aesComputeHmac = aesComputeHmac;
 exports.aesCtr = aesCtr;
@@ -30,6 +28,7 @@ exports.aesCheckPasswordOnly = aesCheckPasswordOnly;
 exports.aesVerifyPassword = aesCheckPasswordOnly;
 exports.aesCheckSignature = aesCheckSignature;
 const binary_1 = require("../../../utils/binary.js");
+const crypto_1 = require("../../../utils/crypto.js");
 const text_1 = require("../shared/text.js");
 /**
  * AES vendor ID for WinZip format.
@@ -100,26 +99,6 @@ function getWebCrypto() {
     }
     throw new Error("Web Crypto API not available");
 }
-/**
- * Get crypto.getRandomValues (works in both Node.js and browsers).
- */
-function getRandomValues(array) {
-    if (typeof globalThis.crypto?.getRandomValues !== "undefined") {
-        // Uint8Array's buffer type (ArrayBufferLike) is wider than what the TS lib
-        // definition of getRandomValues expects (ArrayBuffer). The cast is safe
-        // because getRandomValues fills the view in-place regardless of buffer type.
-        globalThis.crypto.getRandomValues(array);
-        return array;
-    }
-    throw new Error("crypto.getRandomValues not available");
-}
-/**
- * Generate random bytes.
- */
-function randomBytes(length) {
-    const bytes = new Uint8Array(length);
-    return getRandomValues(bytes);
-}
 /**
  * Derive AES keys from password using PBKDF2.
  *
@@ -329,7 +308,7 @@ async function aesDecrypt(encryptedData, password, keyStrength) {
 async function aesEncrypt(data, password, keyStrength) {
     const saltLen = exports.AES_SALT_LENGTH[keyStrength];
     // Generate random salt
-    const salt = randomBytes(saltLen);
+    const salt = (0, crypto_1.randomBytes)(saltLen);
     // Derive keys
     const keys = await aesDerive(password, salt, keyStrength);
     // Encrypt data

package/dist/cjs/modules/archive/crypto/index.js

@@ -42,7 +42,9 @@ Object.defineProperty(exports, "aesEncrypt", { enumerable: true, get: function (
 Object.defineProperty(exports, "aesEncryptedSize", { enumerable: true, get: function () { return aes_1.aesEncryptedSize; } });
 Object.defineProperty(exports, "aesVerifyPassword", { enumerable: true, get: function () { return aes_1.aesVerifyPassword; } });
 Object.defineProperty(exports, "buildAesExtraField", { enumerable: true, get: function () { return aes_1.buildAesExtraField; } });
-Object.defineProperty(exports, "randomBytes", { enumerable: true, get: function () { return aes_1.randomBytes; } });
+// Random bytes — from shared @utils/crypto
+var crypto_1 = require("../../../utils/crypto.js");
+Object.defineProperty(exports, "randomBytes", { enumerable: true, get: function () { return crypto_1.randomBytes; } });
 // Types
 var types_1 = require("./types");
 Object.defineProperty(exports, "getEncryptionMethodName", { enumerable: true, get: function () { return types_1.getEncryptionMethodName; } });