@depup/mammoth 1.12.0-depup.54 → 1.12.2-depup.0

package/NEWS

@@ -1,3 +1,17 @@
+# 1.12.2
+
+* Avoid prototype pollution when reading the styles defined in a document. This
+  avoids an issue where a maliciously crafted document could be used to set
+  externalFileAccess to true.
+
+# 1.12.1
+
+* Fix: on Windows, when an image's content type includes a backslash in the
+  subpart, files may be written outside of the directory set by --output-dir.
+
+* Detect and ignore numbering levels that use numStyleLink to refer to
+  themselves.
+
 # 1.12.0
 
 * Handle hyperlinked wp:anchor and wp:inline elements.

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/mammoth
 
 | Field | Value |
 |-------|-------|
-| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.12.0 |
-| Processed | 2026-07-21 |
+| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.12.2 |
+| Processed | 2026-08-28 |
 | Smoke test | passed |
 | Deps updated | 7 |
 
@@ -22,8 +22,8 @@ npm install @depup/mammoth
 
 | Dependency | From | To |
 |------------|------|-----|
-| @xmldom/xmldom | ^0.8.6 | ^0.9.10 |
-| argparse | ~1.0.3 | ^3.0.0 |
+| @xmldom/xmldom | ^0.8.6 | ^0.9.12 |
+| argparse | ~1.0.3 | ^3.0.1 |
 | bluebird | ~3.4.0 | ^3.7.2 |
 | jszip | ^3.7.1 | ^3.10.1 |
 | path-is-absolute | ^1.0.0 | ^2.0.0 |

package/changes.json

@@ -2,11 +2,11 @@
   "bumped": {
     "@xmldom/xmldom": {
       "from": "^0.8.6",
-      "to": "^0.9.10"
+      "to": "^0.9.12"
     },
     "argparse": {
       "from": "~1.0.3",
-      "to": "^3.0.0"
+      "to": "^3.0.1"
     },
     "bluebird": {
       "from": "~3.4.0",
@@ -29,6 +29,6 @@
       "to": "^15.1.1"
     }
   },
-  "timestamp": "2026-07-21T17:17:25.871Z",
+  "timestamp": "2026-08-28T20:02:44.372Z",
   "totalUpdated": 7
 }

package/lib/document-to-html.js

@@ -42,7 +42,7 @@ function DocumentConversion(options, comments) {
     function convertToHtml(document) {
         var messages = [];
 
-        var html = elementToHtml(document, messages, {});
+        var html = elementToHtml(document, messages, Object.create(null));
 
         var deferredNodes = [];
         walkHtml(html, function(node) {
@@ -50,7 +50,7 @@ function DocumentConversion(options, comments) {
                 deferredNodes.push(node);
             }
         });
-        var deferredValues = {};
+        var deferredValues = Object.create(null);
         return promises.mapSeries(deferredNodes, function(deferred) {
             return deferred.value().then(function(value) {
                 deferredValues[deferred.id] = value;

package/lib/docx/content-types-reader.js

@@ -14,9 +14,9 @@ exports.defaultContentTypes = contentTypes({}, {});
 
 
 function readContentTypesFromXml(element) {
-    var extensionDefaults = {};
-    var overrides = {};
-    
+    var extensionDefaults = Object.create(null);
+    var overrides = Object.create(null);
+
     element.children.forEach(function(child) {
         if (child.name === "content-types:Default") {
             extensionDefaults[child.attributes.Extension] = child.attributes.ContentType;
@@ -41,7 +41,7 @@ function contentTypes(overrides, extensionDefaults) {
             } else {
                 var pathParts = path.split(".");
                 var extension = pathParts[pathParts.length - 1];
-                if (extensionDefaults.hasOwnProperty(extension)) {
+                if (Object.prototype.hasOwnProperty.call(extensionDefaults, extension)) {
                     return extensionDefaults[extension];
                 } else {
                     var fallback = fallbackContentTypes[extension.toLowerCase()];
@@ -54,5 +54,5 @@ function contentTypes(overrides, extensionDefaults) {
             }
         }
     };
-    
+
 }

package/lib/docx/numbering-xml.js

@@ -17,20 +17,29 @@ function Numbering(nums, abstractNums, styles) {
     );
 
     function findLevel(numId, level) {
+        return findLevelWithSeenNumIds(numId, level, Object.create(null));
+    }
+
+    function findLevelWithSeenNumIds(numId, level, seenNumIds) {
+        if (seenNumIds[numId]) {
+            return null;
+        }
+        seenNumIds[numId] = true;
+
         var num = nums[numId];
-        if (num) {
-            var abstractNum = abstractNums[num.abstractNumId];
-            if (!abstractNum) {
-                return null;
-            } else if (abstractNum.numStyleLink == null) {
-                return abstractNums[num.abstractNumId].levels[level];
-            } else {
-                var style = styles.findNumberingStyleById(abstractNum.numStyleLink);
-                return findLevel(style.numId, level);
-            }
-        } else {
+        if (!num) {
             return null;
         }
+
+        var abstractNum = abstractNums[num.abstractNumId];
+        if (!abstractNum) {
+            return null;
+        } else if (abstractNum.numStyleLink == null) {
+            return abstractNums[num.abstractNumId].levels[level];
+        } else {
+            var style = styles.findNumberingStyleById(abstractNum.numStyleLink);
+            return findLevelWithSeenNumIds(style.numId, level, seenNumIds);
+        }
     }
 
     function findLevelByParagraphStyleId(styleId) {
@@ -54,7 +63,7 @@ function readNumberingXml(root, options) {
 }
 
 function readAbstractNums(root) {
-    var abstractNums = {};
+    var abstractNums = Object.create(null);
     root.getElementsByTagName("w:abstractNum").forEach(function(element) {
         var id = element.attributes["w:abstractNumId"];
         abstractNums[id] = readAbstractNum(element);
@@ -63,7 +72,7 @@ function readAbstractNums(root) {
 }
 
 function readAbstractNum(element) {
-    var levels = {};
+    var levels = Object.create(null);
 
     // Some malformed documents define numbering levels without an index, and
     // reference the numbering using a w:numPr element without a w:ilvl child.
@@ -101,7 +110,7 @@ function readAbstractNum(element) {
 }
 
 function readNums(root) {
-    var nums = {};
+    var nums = Object.create(null);
     root.getElementsByTagName("w:num").forEach(function(element) {
         var numId = element.attributes["w:numId"];
         var abstractNumId = element.first("w:abstractNumId").attributes["w:val"];

package/lib/docx/relationships-reader.js

@@ -19,12 +19,12 @@ function readRelationships(element) {
 }
 
 function Relationships(relationships) {
-    var targetsByRelationshipId = {};
+    var targetsByRelationshipId = Object.create(null);
     relationships.forEach(function(relationship) {
         targetsByRelationshipId[relationship.relationshipId] = relationship.target;
     });
 
-    var targetsByType = {};
+    var targetsByType = Object.create(null);
     relationships.forEach(function(relationship) {
         if (!targetsByType[relationship.type]) {
             targetsByType[relationship.type] = [];

package/lib/docx/styles-reader.js

@@ -22,21 +22,32 @@ function Styles(paragraphStyles, characterStyles, tableStyles, numberingStyles)
 Styles.EMPTY = new Styles({}, {}, {}, {});
 
 function readStylesXml(root) {
-    var paragraphStyles = {};
-    var characterStyles = {};
-    var tableStyles = {};
-    var numberingStyles = {};
-
-    var styles = {
-        "paragraph": paragraphStyles,
-        "character": characterStyles,
-        "table": tableStyles,
-        "numbering": numberingStyles
-    };
+    var paragraphStyles = Object.create(null);
+    var characterStyles = Object.create(null);
+    var tableStyles = Object.create(null);
+    var numberingStyles = Object.create(null);
 
     root.getElementsByTagName("w:style").forEach(function(styleElement) {
         var style = readStyleElement(styleElement);
-        var styleSet = styles[style.type];
+        var styleSet;
+
+        switch (style.type) {
+        case "paragraph":
+            styleSet = paragraphStyles;
+            break;
+
+        case "character":
+            styleSet = characterStyles;
+            break;
+
+        case "table":
+            styleSet = tableStyles;
+            break;
+
+        case "numbering":
+            styleSet = numberingStyles;
+            break;
+        }
 
         // Per 17.7.4.17 style (Style Definition) of ECMA-376 4th edition Part 1:
         //

package/lib/images.js

@@ -29,3 +29,9 @@ exports.dataUri = imgElement(function(element) {
         };
     });
 });
+
+function imageFilenameExtension(image) {
+    return image.contentType.split(/\/|\\/)[1];
+}
+
+exports.imageFilenameExtension = imageFilenameExtension;

package/lib/main.js

@@ -13,22 +13,22 @@ function main(argv) {
     var outputDir = argv.output_dir;
     var outputFormat = argv.output_format;
     var styleMapPath = argv.style_map;
-    
+
     readStyleMap(styleMapPath).then(function(styleMap) {
         var options = {
             styleMap: styleMap,
             outputFormat: outputFormat
         };
-        
+
         if (outputDir) {
             var basename = path.basename(docxPath, ".docx");
             outputPath = path.join(outputDir, basename + ".html");
             var imageIndex = 0;
             options.convertImage = images.imgElement(function(element) {
                 imageIndex++;
-                var extension = element.contentType.split("/")[1];
-                var filename = imageIndex + "." + extension;
-                
+                var extension = images.imageFilenameExtension(element);
+                var filename = imageIndex + (extension === undefined ? "" : "." + extension);
+
                 return element.read().then(function(imageBuffer) {
                     var imagePath = path.join(outputDir, filename);
                     return promises.nfcall(fs.writeFile, imagePath, imageBuffer);
@@ -37,16 +37,16 @@ function main(argv) {
                 });
             });
         }
-        
+
         return mammoth.convert({path: docxPath}, options)
             .then(function(result) {
                 result.messages.forEach(function(message) {
                     process.stderr.write(message.message);
                     process.stderr.write("\n");
                 });
-                
+
                 var outputStream = outputPath ? fs.createWriteStream(outputPath) : process.stdout;
-                
+
                 outputStream.write(result.value);
             });
     }).done();

package/lib/style-reader.js

@@ -257,7 +257,7 @@ function htmlPathRule() {
         capture(freshRule),
         capture(separatorRule)
     ).map(function(tagName, attributesList, fresh, separator) {
-        var attributes = {};
+        var attributes = Object.create(null);
         var options = {};
         attributesList.forEach(function(attribute) {
             if (attribute.append && attributes[attribute.name]) {

package/lib/styles/html-paths.js

@@ -38,7 +38,7 @@ function element(tagName, attributes, options) {
 }
 
 function Element(tagName, attributes, options) {
-    var tagNames = {};
+    var tagNames = Object.create(null);
     if (_.isArray(tagName)) {
         tagName.forEach(function(tagName) {
             tagNames[tagName] = true;
@@ -47,7 +47,7 @@ function Element(tagName, attributes, options) {
     } else {
         tagNames[tagName] = true;
     }
-    
+
     this.tagName = tagName;
     this.tagNames = tagNames;
     this.attributes = attributes || {};

package/lib/xml/reader.js

@@ -42,7 +42,7 @@ function readString(xmlString, namespaceMap) {
             }
         });
 
-        var convertedAttributes = {};
+        var convertedAttributes = Object.create(null);
         _.forEach(element.attributes, function(attribute) {
             convertedAttributes[convertName(attribute)] = attribute.value;
         });

package/mammoth.browser.js

@@ -25,7 +25,7 @@
 // Module: lop@0.4.2
 // License: BSD-2-Clause
 //
-// Module: mammoth@1.12.0
+// Module: mammoth@1.12.2
 // License: BSD-2-Clause
 //
 // Module: option@0.2.4
@@ -115,7 +115,7 @@ function DocumentConversion(options, comments) {
     function convertToHtml(document) {
         var messages = [];
 
-        var html = elementToHtml(document, messages, {});
+        var html = elementToHtml(document, messages, Object.create(null));
 
         var deferredNodes = [];
         walkHtml(html, function(node) {
@@ -123,7 +123,7 @@ function DocumentConversion(options, comments) {
                 deferredNodes.push(node);
             }
         });
-        var deferredValues = {};
+        var deferredValues = Object.create(null);
         return promises.mapSeries(deferredNodes, function(deferred) {
             return deferred.value().then(function(value) {
                 deferredValues[deferred.id] = value;
@@ -1649,9 +1649,9 @@ exports.defaultContentTypes = contentTypes({}, {});
 
 
 function readContentTypesFromXml(element) {
-    var extensionDefaults = {};
-    var overrides = {};
-    
+    var extensionDefaults = Object.create(null);
+    var overrides = Object.create(null);
+
     element.children.forEach(function(child) {
         if (child.name === "content-types:Default") {
             extensionDefaults[child.attributes.Extension] = child.attributes.ContentType;
@@ -1676,7 +1676,7 @@ function contentTypes(overrides, extensionDefaults) {
             } else {
                 var pathParts = path.split(".");
                 var extension = pathParts[pathParts.length - 1];
-                if (extensionDefaults.hasOwnProperty(extension)) {
+                if (Object.prototype.hasOwnProperty.call(extensionDefaults, extension)) {
                     return extensionDefaults[extension];
                 } else {
                     var fallback = fallbackContentTypes[extension.toLowerCase()];
@@ -1689,7 +1689,7 @@ function contentTypes(overrides, extensionDefaults) {
             }
         }
     };
-    
+
 }
 
 },{}],8:[function(require,module,exports){
@@ -2002,19 +2002,28 @@ function Numbering(nums, abstractNums, styles) {
     );
 
     function findLevel(numId, level) {
+        return findLevelWithSeenNumIds(numId, level, Object.create(null));
+    }
+
+    function findLevelWithSeenNumIds(numId, level, seenNumIds) {
+        if (seenNumIds[numId]) {
+            return null;
+        }
+        seenNumIds[numId] = true;
+
         var num = nums[numId];
-        if (num) {
-            var abstractNum = abstractNums[num.abstractNumId];
-            if (!abstractNum) {
-                return null;
-            } else if (abstractNum.numStyleLink == null) {
-                return abstractNums[num.abstractNumId].levels[level];
-            } else {
-                var style = styles.findNumberingStyleById(abstractNum.numStyleLink);
-                return findLevel(style.numId, level);
-            }
-        } else {
+        if (!num) {
+            return null;
+        }
+
+        var abstractNum = abstractNums[num.abstractNumId];
+        if (!abstractNum) {
             return null;
+        } else if (abstractNum.numStyleLink == null) {
+            return abstractNums[num.abstractNumId].levels[level];
+        } else {
+            var style = styles.findNumberingStyleById(abstractNum.numStyleLink);
+            return findLevelWithSeenNumIds(style.numId, level, seenNumIds);
         }
     }
 
@@ -2039,7 +2048,7 @@ function readNumberingXml(root, options) {
 }
 
 function readAbstractNums(root) {
-    var abstractNums = {};
+    var abstractNums = Object.create(null);
     root.getElementsByTagName("w:abstractNum").forEach(function(element) {
         var id = element.attributes["w:abstractNumId"];
         abstractNums[id] = readAbstractNum(element);
@@ -2048,7 +2057,7 @@ function readAbstractNums(root) {
 }
 
 function readAbstractNum(element) {
-    var levels = {};
+    var levels = Object.create(null);
 
     // Some malformed documents define numbering levels without an index, and
     // reference the numbering using a w:numPr element without a w:ilvl child.
@@ -2086,7 +2095,7 @@ function readAbstractNum(element) {
 }
 
 function readNums(root) {
-    var nums = {};
+    var nums = Object.create(null);
     root.getElementsByTagName("w:num").forEach(function(element) {
         var numId = element.attributes["w:numId"];
         var abstractNumId = element.first("w:abstractNumId").attributes["w:val"];
@@ -2192,12 +2201,12 @@ function readRelationships(element) {
 }
 
 function Relationships(relationships) {
-    var targetsByRelationshipId = {};
+    var targetsByRelationshipId = Object.create(null);
     relationships.forEach(function(relationship) {
         targetsByRelationshipId[relationship.relationshipId] = relationship.target;
     });
 
-    var targetsByType = {};
+    var targetsByType = Object.create(null);
     relationships.forEach(function(relationship) {
         if (!targetsByType[relationship.type]) {
             targetsByType[relationship.type] = [];
@@ -2317,21 +2326,32 @@ function Styles(paragraphStyles, characterStyles, tableStyles, numberingStyles)
 Styles.EMPTY = new Styles({}, {}, {}, {});
 
 function readStylesXml(root) {
-    var paragraphStyles = {};
-    var characterStyles = {};
-    var tableStyles = {};
-    var numberingStyles = {};
-
-    var styles = {
-        "paragraph": paragraphStyles,
-        "character": characterStyles,
-        "table": tableStyles,
-        "numbering": numberingStyles
-    };
+    var paragraphStyles = Object.create(null);
+    var characterStyles = Object.create(null);
+    var tableStyles = Object.create(null);
+    var numberingStyles = Object.create(null);
 
     root.getElementsByTagName("w:style").forEach(function(styleElement) {
         var style = readStyleElement(styleElement);
-        var styleSet = styles[style.type];
+        var styleSet;
+
+        switch (style.type) {
+        case "paragraph":
+            styleSet = paragraphStyles;
+            break;
+
+        case "character":
+            styleSet = characterStyles;
+            break;
+
+        case "table":
+            styleSet = tableStyles;
+            break;
+
+        case "numbering":
+            styleSet = numberingStyles;
+            break;
+        }
 
         // Per 17.7.4.17 style (Style Definition) of ECMA-376 4th edition Part 1:
         //
@@ -2626,6 +2646,12 @@ exports.dataUri = imgElement(function(element) {
     });
 });
 
+function imageFilenameExtension(image) {
+    return image.contentType.split(/\/|\\/)[1];
+}
+
+exports.imageFilenameExtension = imageFilenameExtension;
+
 },{"./html":18,"./promises":23,"underscore":102}],21:[function(require,module,exports){
 (function (Buffer){
 var _ = require("underscore");
@@ -3244,7 +3270,7 @@ function htmlPathRule() {
         capture(freshRule),
         capture(separatorRule)
     ).map(function(tagName, attributesList, fresh, separator) {
-        var attributes = {};
+        var attributes = Object.create(null);
         var options = {};
         attributesList.forEach(function(attribute) {
             if (attribute.append && attributes[attribute.name]) {
@@ -3494,7 +3520,7 @@ function element(tagName, attributes, options) {
 }
 
 function Element(tagName, attributes, options) {
-    var tagNames = {};
+    var tagNames = Object.create(null);
     if (_.isArray(tagName)) {
         tagName.forEach(function(tagName) {
             tagNames[tagName] = true;
@@ -3503,7 +3529,7 @@ function Element(tagName, attributes, options) {
     } else {
         tagNames[tagName] = true;
     }
-    
+
     this.tagName = tagName;
     this.tagNames = tagNames;
     this.attributes = attributes || {};
@@ -4108,7 +4134,7 @@ function readString(xmlString, namespaceMap) {
             }
         });
 
-        var convertedAttributes = {};
+        var convertedAttributes = Object.create(null);
         _.forEach(element.attributes, function(attribute) {
             convertedAttributes[convertName(attribute)] = attribute.value;
         });