@cj-tech-master/excelts 9.4.2 → 9.5.0

package/dist/cjs/modules/word/encryption.js

@@ -0,0 +1,282 @@
+"use strict";
+/**
+ * DOCX Agile Encryption (MS-OFFCRYPTO)
+ *
+ * Implements ECMA-376 Agile Encryption (used by Office 2010+) for encrypted
+ * DOCX files. Encrypted DOCX files use the CFB (Compound File Binary) format
+ * to wrap the ZIP content.
+ *
+ * This module provides:
+ * - Password-based encryption/decryption of DOCX content
+ * - EncryptionInfo XML generation/parsing
+ *
+ * Note: A full implementation requires a CFB container reader/writer for the
+ * outer compound document format. For now, we expose primitives that can be
+ * combined with an external CFB library if needed.
+ *
+ * References:
+ *   - MS-OFFCRYPTO: Office Document Cryptography Structure
+ *   - ECMA-376 Part 3: Markup Compatibility and Extensibility
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGILE_BLOCK_KEYS = void 0;
+exports.isEncryptedDocx = isEncryptedDocx;
+exports.deriveEncryptionKey = deriveEncryptionKey;
+exports.verifyPassword = verifyPassword;
+exports.decryptPackage = decryptPackage;
+exports.parseEncryptionInfoXml = parseEncryptionInfoXml;
+const internal_utils_1 = require("./internal-utils");
+/** Detect whether a buffer is an encrypted Office document (CFB format). */
+function isEncryptedDocx(buffer) {
+    // CFB signature: D0CF11E0A1B11AE1
+    if (buffer.length < 8) {
+        return false;
+    }
+    return (buffer[0] === 0xd0 &&
+        buffer[1] === 0xcf &&
+        buffer[2] === 0x11 &&
+        buffer[3] === 0xe0 &&
+        buffer[4] === 0xa1 &&
+        buffer[5] === 0xb1 &&
+        buffer[6] === 0x1a &&
+        buffer[7] === 0xe1);
+}
+/**
+ * Derive an encryption key from a password using the agile encryption KDF.
+ *
+ * Per MS-OFFCRYPTO 2.3.4.11:
+ *   H_0 = H(salt + password)
+ *   H_i = H(iterator + H_{i-1})  for i = 0..spinCount-1
+ *   H_final = H(H_{spinCount} + blockKey)
+ *   Key = first keySize bytes of H_final
+ */
+async function deriveEncryptionKey(password, info, blockKey) {
+    const pwdBytes = stringToUtf16LE(password);
+    const hash = mapHashName(info.hashAlgorithm);
+    // H_0 = H(salt + password)
+    let h = await sha(hash, concat(info.keySalt, pwdBytes));
+    // Iterate: H_i = H(iterator (4 bytes LE) + H_{i-1})
+    for (let i = 0; i < info.spinCount; i++) {
+        const iter = new Uint8Array(4);
+        new DataView(iter.buffer).setUint32(0, i, true);
+        h = await sha(hash, concat(iter, h));
+    }
+    // Final: H_final = H(H + blockKey)
+    const final = await sha(hash, concat(h, blockKey));
+    // Truncate to keySize
+    const keyBytes = info.keyBits / 8;
+    return final.slice(0, keyBytes);
+}
+/** Block keys as defined in MS-OFFCRYPTO 2.3.4.13. */
+exports.AGILE_BLOCK_KEYS = {
+    /** For encrypting verifier hash input. */
+    verifierHashInput: new Uint8Array([0xfe, 0xa7, 0xd2, 0x76, 0x3b, 0x4b, 0x9e, 0x79]),
+    /** For encrypting verifier hash value. */
+    verifierHashValue: new Uint8Array([0xd7, 0xaa, 0x0f, 0x6d, 0x30, 0x61, 0x34, 0x4e]),
+    /** For encrypting the main key. */
+    encryptedKey: new Uint8Array([0x14, 0x6e, 0x0b, 0xe7, 0xab, 0xac, 0xd0, 0xd6]),
+    /** For data integrity HMAC key. */
+    dataIntegrityKey: new Uint8Array([0x5f, 0xb2, 0xad, 0x01, 0x0c, 0xb9, 0xe1, 0xf6]),
+    /** For data integrity HMAC value. */
+    dataIntegrityValue: new Uint8Array([0xa0, 0x67, 0x7f, 0x02, 0xb2, 0x2c, 0x84, 0x33])
+};
+/**
+ * Verify a password against the encryption info.
+ *
+ * @returns True if password is correct.
+ */
+async function verifyPassword(password, info) {
+    try {
+        // Derive verifier hash input key
+        const verifierInputKey = await deriveEncryptionKey(password, info, exports.AGILE_BLOCK_KEYS.verifierHashInput);
+        // Decrypt the verifier hash input
+        const verifierInput = await aesCbcDecrypt(info.encryptedVerifierHashInput, verifierInputKey, info.keySalt);
+        // Hash the verifier input
+        const hashAlg = mapHashName(info.hashAlgorithm);
+        const computedHash = await sha(hashAlg, verifierInput);
+        // Derive verifier hash value key
+        const verifierValueKey = await deriveEncryptionKey(password, info, exports.AGILE_BLOCK_KEYS.verifierHashValue);
+        // Decrypt the verifier hash value
+        const expectedHash = await aesCbcDecrypt(info.encryptedVerifierHashValue, verifierValueKey, info.keySalt);
+        // Compare (truncate to hashSize in case of padding)
+        return bytesEqual(computedHash.slice(0, info.hashSize), expectedHash.slice(0, info.hashSize));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Decrypt the package data using the password.
+ *
+ * @param encryptedPackage - The EncryptedPackage stream from CFB.
+ * @param info - Agile encryption parameters.
+ * @param password - The user password.
+ * @returns The decrypted (unencrypted) package bytes.
+ */
+async function decryptPackage(encryptedPackage, info, password) {
+    // Derive key encryption key
+    const keyEncryptionKey = await deriveEncryptionKey(password, info, exports.AGILE_BLOCK_KEYS.encryptedKey);
+    // Decrypt the actual package key
+    const packageKey = await aesCbcDecrypt(info.encryptedKeyValue, keyEncryptionKey, info.keySalt);
+    // First 8 bytes are the total decrypted size (uint64 LE)
+    const totalSizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
+    const totalSize = Number(totalSizeView.getBigUint64(0, true));
+    // Decrypt in 4096-byte segments
+    const segmentSize = 4096;
+    const encData = encryptedPackage.slice(8);
+    const segments = [];
+    const segCount = Math.ceil(encData.length / segmentSize);
+    for (let i = 0; i < segCount; i++) {
+        const segStart = i * segmentSize;
+        const segEnd = Math.min(segStart + segmentSize, encData.length);
+        const segData = encData.slice(segStart, segEnd);
+        // Segment IV is hash(salt + segment_index_LE)
+        const idxBytes = new Uint8Array(4);
+        new DataView(idxBytes.buffer).setUint32(0, i, true);
+        const segIv = (await sha(mapHashName(info.hashAlgorithm), concat(info.keySalt, idxBytes))).slice(0, info.blockSize);
+        const decSeg = await aesCbcDecrypt(segData, packageKey, segIv);
+        segments.push(decSeg);
+    }
+    // Concatenate and truncate to total size
+    const result = new Uint8Array(totalSize);
+    let offset = 0;
+    for (const seg of segments) {
+        const copyLen = Math.min(seg.length, totalSize - offset);
+        result.set(seg.slice(0, copyLen), offset);
+        offset += copyLen;
+        if (offset >= totalSize) {
+            break;
+        }
+    }
+    return result;
+}
+// =============================================================================
+// Internal Crypto Helpers (use Web Crypto API)
+// =============================================================================
+function mapHashName(name) {
+    const map = {
+        SHA1: "SHA-1",
+        SHA256: "SHA-256",
+        SHA384: "SHA-384",
+        SHA512: "SHA-512"
+    };
+    return map[name] ?? "SHA-512";
+}
+async function sha(algorithm, data) {
+    const buf = await crypto.subtle.digest(algorithm, toBuffer(data));
+    return new Uint8Array(buf);
+}
+async function aesCbcDecrypt(data, key, iv) {
+    const cryptoKey = await crypto.subtle.importKey("raw", toBuffer(key), { name: "AES-CBC", length: key.length * 8 }, false, ["decrypt"]);
+    // Ensure IV is 16 bytes (pad with zeros if needed, truncate if longer)
+    const iv16 = new Uint8Array(16);
+    iv16.set(iv.slice(0, 16));
+    // NOTE: AES-CBC in Web Crypto expects PKCS#7 padding. Agile encryption
+    // uses zero-padding for the last block.
+    try {
+        const result = await crypto.subtle.decrypt({ name: "AES-CBC", iv: toBuffer(iv16) }, cryptoKey, toBuffer(data));
+        return new Uint8Array(result);
+    }
+    catch {
+        return manualAesCbcDecrypt(data, key, iv16);
+    }
+}
+async function manualAesCbcDecrypt(data, key, iv) {
+    const blockSize = 16;
+    if (data.length % blockSize !== 0) {
+        throw new Error("Data length must be a multiple of block size");
+    }
+    const cryptoKey = await crypto.subtle.importKey("raw", toBuffer(key), { name: "AES-CBC", length: key.length * 8 }, false, ["decrypt"]);
+    const result = new Uint8Array(data.length);
+    let prev = iv;
+    for (let i = 0; i < data.length; i += blockSize) {
+        const block = data.slice(i, i + blockSize);
+        const tempCipher = concat(block, new Uint8Array(blockSize));
+        try {
+            const dec = await crypto.subtle.decrypt({ name: "AES-CBC", iv: toBuffer(new Uint8Array(16)) }, cryptoKey, toBuffer(tempCipher));
+            const decBlock = new Uint8Array(dec).slice(0, blockSize);
+            // XOR with previous block
+            for (let j = 0; j < blockSize; j++) {
+                result[i + j] = decBlock[j] ^ prev[j];
+            }
+            prev = block;
+        }
+        catch (e) {
+            throw new Error("AES decryption failed: " + e.message);
+        }
+    }
+    return result;
+}
+/** Convert Uint8Array to a fresh ArrayBuffer (for strict crypto.subtle typing). */
+function toBuffer(arr) {
+    const buf = new ArrayBuffer(arr.length);
+    new Uint8Array(buf).set(arr);
+    return buf;
+}
+function concat(a, b) {
+    const result = new Uint8Array(a.length + b.length);
+    result.set(a, 0);
+    result.set(b, a.length);
+    return result;
+}
+function stringToUtf16LE(s) {
+    const buf = new Uint8Array(s.length * 2);
+    for (let i = 0; i < s.length; i++) {
+        const code = s.charCodeAt(i);
+        buf[i * 2] = code & 0xff;
+        buf[i * 2 + 1] = (code >> 8) & 0xff;
+    }
+    return buf;
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+// =============================================================================
+// EncryptionInfo XML Parser
+// =============================================================================
+/**
+ * Parse an EncryptionInfo XML stream from a CFB-wrapped encrypted DOCX.
+ *
+ * This is the UTF-8 XML part after the 8-byte version/flags header.
+ *
+ * @param xmlStr - The EncryptionInfo XML content.
+ * @returns Parsed agile encryption info.
+ */
+function parseEncryptionInfoXml(xmlStr) {
+    // Simple regex-based extraction for the key <keyEncryptors><keyEncryptor>... element
+    const keyDataMatch = /<keyData\s([^/]*?)\/>/.exec(xmlStr);
+    const pwdEncryptorMatch = /<p:encryptedKey\s([^/]*?)\/>/.exec(xmlStr);
+    if (!keyDataMatch || !pwdEncryptorMatch) {
+        throw new Error("Invalid EncryptionInfo XML - missing keyData or encryptedKey");
+    }
+    const pwdData = parseAttrs(pwdEncryptorMatch[1]);
+    return {
+        cipherAlgorithm: "AES",
+        cipherChaining: "ChainingModeCBC",
+        keyBits: parseInt(pwdData.keyBits ?? "256"),
+        hashAlgorithm: (pwdData.hashAlgorithm ?? "SHA512"),
+        hashSize: parseInt(pwdData.hashSize ?? "64"),
+        spinCount: parseInt(pwdData.spinCount ?? "100000"),
+        keySalt: (0, internal_utils_1.base64ToBytes)(pwdData.saltValue ?? ""),
+        encryptedVerifierHashInput: (0, internal_utils_1.base64ToBytes)(pwdData.encryptedVerifierHashInput ?? ""),
+        encryptedVerifierHashValue: (0, internal_utils_1.base64ToBytes)(pwdData.encryptedVerifierHashValue ?? ""),
+        encryptedKeyValue: (0, internal_utils_1.base64ToBytes)(pwdData.encryptedKeyValue ?? ""),
+        blockSize: parseInt(pwdData.blockSize ?? "16")
+    };
+}
+function parseAttrs(str) {
+    const attrs = {};
+    const re = /(\w+)="([^"]*)"/g;
+    let match;
+    while ((match = re.exec(str)) !== null) {
+        attrs[match[1]] = match[2];
+    }
+    return attrs;
+}

package/dist/cjs/modules/word/errors.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * DOCX module error types.
+ *
+ * All DOCX-related errors extend DocxError.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DocxUnsupportedFeatureError = exports.DocxInvalidStructureError = exports.DocxMissingPartError = exports.DocxWriteError = exports.DocxParseError = exports.DocxError = exports.getRootCause = exports.getErrorChain = exports.errorToJSON = exports.suppressUnhandledRejection = exports.toError = exports.createLinkedAbortController = exports.throwIfAborted = exports.isAbortError = exports.createAbortError = exports.AbortError = void 0;
+exports.isDocxError = isDocxError;
+const errors_1 = require("../../utils/errors.js");
+// Re-export common utilities from base
+var errors_2 = require("../../utils/errors.js");
+Object.defineProperty(exports, "AbortError", { enumerable: true, get: function () { return errors_2.AbortError; } });
+Object.defineProperty(exports, "createAbortError", { enumerable: true, get: function () { return errors_2.createAbortError; } });
+Object.defineProperty(exports, "isAbortError", { enumerable: true, get: function () { return errors_2.isAbortError; } });
+Object.defineProperty(exports, "throwIfAborted", { enumerable: true, get: function () { return errors_2.throwIfAborted; } });
+Object.defineProperty(exports, "createLinkedAbortController", { enumerable: true, get: function () { return errors_2.createLinkedAbortController; } });
+Object.defineProperty(exports, "toError", { enumerable: true, get: function () { return errors_2.toError; } });
+Object.defineProperty(exports, "suppressUnhandledRejection", { enumerable: true, get: function () { return errors_2.suppressUnhandledRejection; } });
+Object.defineProperty(exports, "errorToJSON", { enumerable: true, get: function () { return errors_2.errorToJSON; } });
+Object.defineProperty(exports, "getErrorChain", { enumerable: true, get: function () { return errors_2.getErrorChain; } });
+Object.defineProperty(exports, "getRootCause", { enumerable: true, get: function () { return errors_2.getRootCause; } });
+/**
+ * Base class for all DOCX-related errors.
+ */
+class DocxError extends errors_1.BaseError {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "DocxError";
+    }
+}
+exports.DocxError = DocxError;
+/**
+ * Check if an error is a DOCX error.
+ */
+function isDocxError(err) {
+    return err instanceof DocxError;
+}
+/**
+ * Error thrown when DOCX parsing fails.
+ */
+class DocxParseError extends DocxError {
+    constructor() {
+        super(...arguments);
+        this.name = "DocxParseError";
+    }
+}
+exports.DocxParseError = DocxParseError;
+/**
+ * Error thrown when DOCX generation/writing fails.
+ */
+class DocxWriteError extends DocxError {
+    constructor() {
+        super(...arguments);
+        this.name = "DocxWriteError";
+    }
+}
+exports.DocxWriteError = DocxWriteError;
+/**
+ * Error thrown when a required DOCX part is missing.
+ */
+class DocxMissingPartError extends DocxParseError {
+    constructor(partPath) {
+        super(`Required DOCX part not found: ${partPath}`);
+        this.name = "DocxMissingPartError";
+    }
+}
+exports.DocxMissingPartError = DocxMissingPartError;
+/**
+ * Error thrown when document structure is invalid.
+ */
+class DocxInvalidStructureError extends DocxParseError {
+    constructor() {
+        super(...arguments);
+        this.name = "DocxInvalidStructureError";
+    }
+}
+exports.DocxInvalidStructureError = DocxInvalidStructureError;
+/**
+ * Error thrown when an unsupported feature is encountered during parsing.
+ */
+class DocxUnsupportedFeatureError extends DocxError {
+    constructor(feature) {
+        super(`Unsupported DOCX feature: ${feature}`);
+        this.name = "DocxUnsupportedFeatureError";
+    }
+}
+exports.DocxUnsupportedFeatureError = DocxUnsupportedFeatureError;

package/dist/cjs/modules/word/font-obfuscation.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * DOCX Font Obfuscation (ODTTF format)
+ *
+ * Per ECMA-376 Part 3, Section 4, embedded TrueType fonts may be obfuscated by
+ * XOR-ing the first 32 bytes of the font file with a 16-byte GUID repeated twice.
+ *
+ * The GUID in the w:fontKey attribute is in the form "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}"
+ * but bytes are applied in a specific order derived from the GUID.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deobfuscateFont = deobfuscateFont;
+exports.obfuscateFont = obfuscateFont;
+exports.generateFontKey = generateFontKey;
+/** Parse a GUID string "{8-4-4-4-12}" into 16 bytes in obfuscation-apply order. */
+function parseGuid(guid) {
+    // Strip braces
+    const hex = guid.replace(/[{}]/g, "").replace(/-/g, "");
+    if (hex.length !== 32) {
+        throw new Error(`Invalid GUID: ${guid}`);
+    }
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i++) {
+        bytes[i] = parseInt(hex.substring(i * 2, i * 2 + 2), 16);
+    }
+    // Per spec: apply bytes in reverse order within each GUID segment.
+    // GUID layout: 4-2-2-2-6 bytes. Segments 0-2 are reversed, segments 3-4 stay.
+    const reordered = new Uint8Array(16);
+    // Segment 1 (bytes 0-3, reversed)
+    reordered[0] = bytes[3];
+    reordered[1] = bytes[2];
+    reordered[2] = bytes[1];
+    reordered[3] = bytes[0];
+    // Segment 2 (bytes 4-5, reversed)
+    reordered[4] = bytes[5];
+    reordered[5] = bytes[4];
+    // Segment 3 (bytes 6-7, reversed)
+    reordered[6] = bytes[7];
+    reordered[7] = bytes[6];
+    // Segments 4-5 (bytes 8-15, kept as-is)
+    for (let i = 8; i < 16; i++) {
+        reordered[i] = bytes[i];
+    }
+    return reordered;
+}
+/**
+ * Deobfuscate ODTTF font data to raw TTF/OTF.
+ *
+ * @param data - The obfuscated font data (first 32 bytes are obfuscated).
+ * @param fontKey - The GUID from w:fontKey attribute.
+ * @returns The deobfuscated font data (new buffer).
+ */
+function deobfuscateFont(data, fontKey) {
+    const keyBytes = parseGuid(fontKey);
+    const result = new Uint8Array(data.length);
+    result.set(data);
+    // XOR first 32 bytes with the GUID bytes twice (16 + 16)
+    for (let i = 0; i < 32 && i < data.length; i++) {
+        result[i] = data[i] ^ keyBytes[i % 16];
+    }
+    return result;
+}
+/**
+ * Obfuscate a raw TTF/OTF font to ODTTF format.
+ *
+ * @param data - The raw font data.
+ * @param fontKey - The GUID to use for obfuscation (also stored in w:fontKey).
+ * @returns The obfuscated font data (new buffer).
+ */
+function obfuscateFont(data, fontKey) {
+    // Obfuscation is symmetric with deobfuscation (XOR)
+    return deobfuscateFont(data, fontKey);
+}
+/**
+ * Generate a new random GUID suitable for w:fontKey.
+ *
+ * @returns A GUID string in the form "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}"
+ */
+function generateFontKey() {
+    // Use crypto.getRandomValues (available in both Node and browser)
+    const bytes = new Uint8Array(16);
+    crypto.getRandomValues(bytes);
+    // RFC 4122 v4 UUID: set version and variant bits
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = Array.from(bytes, b => b.toString(16).padStart(2, "0")).join("");
+    return `{${hex.substring(0, 8)}-${hex.substring(8, 12)}-${hex.substring(12, 16)}-${hex.substring(16, 20)}-${hex.substring(20, 32)}}`;
+}