@depup/mammoth 1.12.1-depup.0 → 1.12.3-depup.0

package/NEWS

@@ -1,3 +1,21 @@
+# 1.12.3
+
+* Avoid excessive backtracking when parsing an unterminated string with many
+  escape sequences. The previous behaviour would allow maliciously crafted
+  documents to cause a denial of service.
+
+  Note that it is still strongly recommended to process untrusted documents in
+  a separate thread with a timeout to avoid potential similar issues.
+
+* Handle complex field separator and end characters without corresponding start
+  characters.
+
+# 1.12.2
+
+* Avoid prototype pollution when reading the styles defined in a document. This
+  avoids an issue where a maliciously crafted document could be used to set
+  externalFileAccess to true.
+
 # 1.12.1
 
 * Fix: on Windows, when an image's content type includes a backslash in the

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/mammoth
 
 | Field | Value |
 |-------|-------|
-| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.12.1 |
-| Processed | 2026-08-09 |
+| Original | [mammoth](https://www.npmjs.com/package/mammoth) @ 1.12.3 |
+| Processed | 2026-09-12 |
 | Smoke test | passed |
 | Deps updated | 7 |
 
@@ -22,10 +22,10 @@ npm install @depup/mammoth
 
 | Dependency | From | To |
 |------------|------|-----|
-| @xmldom/xmldom | ^0.8.6 | ^0.9.10 |
-| argparse | ~1.0.3 | ^3.0.0 |
+| @xmldom/xmldom | ^0.8.6 | ^0.9.12 |
+| argparse | ~1.0.3 | ^3.0.2 |
 | bluebird | ~3.4.0 | ^3.7.2 |
-| jszip | ^3.7.1 | ^3.10.1 |
+| jszip | ^3.7.1 | ^3.10.2 |
 | path-is-absolute | ^1.0.0 | ^2.0.0 |
 | underscore | ^1.13.1 | ^1.13.8 |
 | xmlbuilder | ^10.0.0 | ^15.1.1 |

package/changes.json

@@ -2,11 +2,11 @@
   "bumped": {
     "@xmldom/xmldom": {
       "from": "^0.8.6",
-      "to": "^0.9.10"
+      "to": "^0.9.12"
     },
     "argparse": {
       "from": "~1.0.3",
-      "to": "^3.0.0"
+      "to": "^3.0.2"
     },
     "bluebird": {
       "from": "~3.4.0",
@@ -14,7 +14,7 @@
     },
     "jszip": {
       "from": "^3.7.1",
-      "to": "^3.10.1"
+      "to": "^3.10.2"
     },
     "path-is-absolute": {
       "from": "^1.0.0",
@@ -29,6 +29,6 @@
       "to": "^15.1.1"
     }
   },
-  "timestamp": "2026-08-09T16:09:15.209Z",
+  "timestamp": "2026-09-12T16:08:51.567Z",
   "totalUpdated": 7
 }

package/lib/document-to-html.js

@@ -42,7 +42,7 @@ function DocumentConversion(options, comments) {
     function convertToHtml(document) {
         var messages = [];
 
-        var html = elementToHtml(document, messages, {});
+        var html = elementToHtml(document, messages, Object.create(null));
 
         var deferredNodes = [];
         walkHtml(html, function(node) {
@@ -50,7 +50,7 @@ function DocumentConversion(options, comments) {
                 deferredNodes.push(node);
             }
         });
-        var deferredValues = {};
+        var deferredValues = Object.create(null);
         return promises.mapSeries(deferredNodes, function(deferred) {
             return deferred.value().then(function(value) {
                 deferredValues[deferred.id] = value;

package/lib/docx/body-reader.js

@@ -169,6 +169,12 @@ function BodyReader(options) {
             complexFieldStack.push({type: "begin", fldChar: element});
             currentInstrText = [];
         } else if (type === "end") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field end character without corresponding start character"
+                )]);
+            }
+
             var complexFieldEnd = complexFieldStack.pop();
             if (complexFieldEnd.type === "begin") {
                 complexFieldEnd = parseCurrentInstrText(complexFieldEnd);
@@ -179,6 +185,12 @@ function BodyReader(options) {
                 }));
             }
         } else if (type === "separate") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field separator character without corresponding start character"
+                )]);
+            }
+
             var complexFieldSeparate = complexFieldStack.pop();
             var complexField = parseCurrentInstrText(complexFieldSeparate);
             complexFieldStack.push(complexField);

package/lib/docx/content-types-reader.js

@@ -14,9 +14,9 @@ exports.defaultContentTypes = contentTypes({}, {});
 
 
 function readContentTypesFromXml(element) {
-    var extensionDefaults = {};
-    var overrides = {};
-    
+    var extensionDefaults = Object.create(null);
+    var overrides = Object.create(null);
+
     element.children.forEach(function(child) {
         if (child.name === "content-types:Default") {
             extensionDefaults[child.attributes.Extension] = child.attributes.ContentType;
@@ -41,7 +41,7 @@ function contentTypes(overrides, extensionDefaults) {
             } else {
                 var pathParts = path.split(".");
                 var extension = pathParts[pathParts.length - 1];
-                if (extensionDefaults.hasOwnProperty(extension)) {
+                if (Object.prototype.hasOwnProperty.call(extensionDefaults, extension)) {
                     return extensionDefaults[extension];
                 } else {
                     var fallback = fallbackContentTypes[extension.toLowerCase()];
@@ -54,5 +54,5 @@ function contentTypes(overrides, extensionDefaults) {
             }
         }
     };
-    
+
 }

package/lib/docx/numbering-xml.js

@@ -17,7 +17,7 @@ function Numbering(nums, abstractNums, styles) {
     );
 
     function findLevel(numId, level) {
-        return findLevelWithSeenNumIds(numId, level, {});
+        return findLevelWithSeenNumIds(numId, level, Object.create(null));
     }
 
     function findLevelWithSeenNumIds(numId, level, seenNumIds) {
@@ -63,7 +63,7 @@ function readNumberingXml(root, options) {
 }
 
 function readAbstractNums(root) {
-    var abstractNums = {};
+    var abstractNums = Object.create(null);
     root.getElementsByTagName("w:abstractNum").forEach(function(element) {
         var id = element.attributes["w:abstractNumId"];
         abstractNums[id] = readAbstractNum(element);
@@ -72,7 +72,7 @@ function readAbstractNums(root) {
 }
 
 function readAbstractNum(element) {
-    var levels = {};
+    var levels = Object.create(null);
 
     // Some malformed documents define numbering levels without an index, and
     // reference the numbering using a w:numPr element without a w:ilvl child.
@@ -110,7 +110,7 @@ function readAbstractNum(element) {
 }
 
 function readNums(root) {
-    var nums = {};
+    var nums = Object.create(null);
     root.getElementsByTagName("w:num").forEach(function(element) {
         var numId = element.attributes["w:numId"];
         var abstractNumId = element.first("w:abstractNumId").attributes["w:val"];

package/lib/docx/relationships-reader.js

@@ -19,12 +19,12 @@ function readRelationships(element) {
 }
 
 function Relationships(relationships) {
-    var targetsByRelationshipId = {};
+    var targetsByRelationshipId = Object.create(null);
     relationships.forEach(function(relationship) {
         targetsByRelationshipId[relationship.relationshipId] = relationship.target;
     });
 
-    var targetsByType = {};
+    var targetsByType = Object.create(null);
     relationships.forEach(function(relationship) {
         if (!targetsByType[relationship.type]) {
             targetsByType[relationship.type] = [];

package/lib/docx/styles-reader.js

@@ -22,21 +22,32 @@ function Styles(paragraphStyles, characterStyles, tableStyles, numberingStyles)
 Styles.EMPTY = new Styles({}, {}, {}, {});
 
 function readStylesXml(root) {
-    var paragraphStyles = {};
-    var characterStyles = {};
-    var tableStyles = {};
-    var numberingStyles = {};
-
-    var styles = {
-        "paragraph": paragraphStyles,
-        "character": characterStyles,
-        "table": tableStyles,
-        "numbering": numberingStyles
-    };
+    var paragraphStyles = Object.create(null);
+    var characterStyles = Object.create(null);
+    var tableStyles = Object.create(null);
+    var numberingStyles = Object.create(null);
 
     root.getElementsByTagName("w:style").forEach(function(styleElement) {
         var style = readStyleElement(styleElement);
-        var styleSet = styles[style.type];
+        var styleSet;
+
+        switch (style.type) {
+        case "paragraph":
+            styleSet = paragraphStyles;
+            break;
+
+        case "character":
+            styleSet = characterStyles;
+            break;
+
+        case "table":
+            styleSet = tableStyles;
+            break;
+
+        case "numbering":
+            styleSet = numberingStyles;
+            break;
+        }
 
         // Per 17.7.4.17 style (Style Definition) of ECMA-376 4th edition Part 1:
         //

package/lib/style-reader.js

@@ -257,7 +257,7 @@ function htmlPathRule() {
         capture(freshRule),
         capture(separatorRule)
     ).map(function(tagName, attributesList, fresh, separator) {
-        var attributes = {};
+        var attributes = Object.create(null);
         var options = {};
         attributesList.forEach(function(attribute) {
             if (attribute.append && attributes[attribute.name]) {

package/lib/styles/html-paths.js

@@ -38,7 +38,7 @@ function element(tagName, attributes, options) {
 }
 
 function Element(tagName, attributes, options) {
-    var tagNames = {};
+    var tagNames = Object.create(null);
     if (_.isArray(tagName)) {
         tagName.forEach(function(tagName) {
             tagNames[tagName] = true;
@@ -47,7 +47,7 @@ function Element(tagName, attributes, options) {
     } else {
         tagNames[tagName] = true;
     }
-    
+
     this.tagName = tagName;
     this.tagNames = tagNames;
     this.attributes = attributes || {};

package/lib/styles/parser/tokeniser.js

@@ -3,7 +3,7 @@ var RegexTokeniser = lop.RegexTokeniser;
 
 exports.tokenise = tokenise;
 
-var stringPrefix = "'((?:\\\\.|[^'])*)";
+var stringPrefix = "'((?:\\\\(?:.|$)|[^'\\\\])*)";
 
 function tokenise(string) {
     var identifierCharacter = "(?:[a-zA-Z\\-_]|\\\\.)";

package/lib/xml/reader.js

@@ -42,7 +42,7 @@ function readString(xmlString, namespaceMap) {
             }
         });
 
-        var convertedAttributes = {};
+        var convertedAttributes = Object.create(null);
         _.forEach(element.attributes, function(attribute) {
             convertedAttributes[convertName(attribute)] = attribute.value;
         });

package/mammoth.browser.js

@@ -25,7 +25,7 @@
 // Module: lop@0.4.2
 // License: BSD-2-Clause
 //
-// Module: mammoth@1.12.1
+// Module: mammoth@1.12.3
 // License: BSD-2-Clause
 //
 // Module: option@0.2.4
@@ -115,7 +115,7 @@ function DocumentConversion(options, comments) {
     function convertToHtml(document) {
         var messages = [];
 
-        var html = elementToHtml(document, messages, {});
+        var html = elementToHtml(document, messages, Object.create(null));
 
         var deferredNodes = [];
         walkHtml(html, function(node) {
@@ -123,7 +123,7 @@ function DocumentConversion(options, comments) {
                 deferredNodes.push(node);
             }
         });
-        var deferredValues = {};
+        var deferredValues = Object.create(null);
         return promises.mapSeries(deferredNodes, function(deferred) {
             return deferred.value().then(function(value) {
                 deferredValues[deferred.id] = value;
@@ -971,6 +971,12 @@ function BodyReader(options) {
             complexFieldStack.push({type: "begin", fldChar: element});
             currentInstrText = [];
         } else if (type === "end") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field end character without corresponding start character"
+                )]);
+            }
+
             var complexFieldEnd = complexFieldStack.pop();
             if (complexFieldEnd.type === "begin") {
                 complexFieldEnd = parseCurrentInstrText(complexFieldEnd);
@@ -981,6 +987,12 @@ function BodyReader(options) {
                 }));
             }
         } else if (type === "separate") {
+            if (complexFieldStack.length === 0) {
+                return emptyResultWithMessages([warning(
+                    "Ignoring complex field separator character without corresponding start character"
+                )]);
+            }
+
             var complexFieldSeparate = complexFieldStack.pop();
             var complexField = parseCurrentInstrText(complexFieldSeparate);
             complexFieldStack.push(complexField);
@@ -1649,9 +1661,9 @@ exports.defaultContentTypes = contentTypes({}, {});
 
 
 function readContentTypesFromXml(element) {
-    var extensionDefaults = {};
-    var overrides = {};
-    
+    var extensionDefaults = Object.create(null);
+    var overrides = Object.create(null);
+
     element.children.forEach(function(child) {
         if (child.name === "content-types:Default") {
             extensionDefaults[child.attributes.Extension] = child.attributes.ContentType;
@@ -1676,7 +1688,7 @@ function contentTypes(overrides, extensionDefaults) {
             } else {
                 var pathParts = path.split(".");
                 var extension = pathParts[pathParts.length - 1];
-                if (extensionDefaults.hasOwnProperty(extension)) {
+                if (Object.prototype.hasOwnProperty.call(extensionDefaults, extension)) {
                     return extensionDefaults[extension];
                 } else {
                     var fallback = fallbackContentTypes[extension.toLowerCase()];
@@ -1689,7 +1701,7 @@ function contentTypes(overrides, extensionDefaults) {
             }
         }
     };
-    
+
 }
 
 },{}],8:[function(require,module,exports){
@@ -2002,7 +2014,7 @@ function Numbering(nums, abstractNums, styles) {
     );
 
     function findLevel(numId, level) {
-        return findLevelWithSeenNumIds(numId, level, {});
+        return findLevelWithSeenNumIds(numId, level, Object.create(null));
     }
 
     function findLevelWithSeenNumIds(numId, level, seenNumIds) {
@@ -2048,7 +2060,7 @@ function readNumberingXml(root, options) {
 }
 
 function readAbstractNums(root) {
-    var abstractNums = {};
+    var abstractNums = Object.create(null);
     root.getElementsByTagName("w:abstractNum").forEach(function(element) {
         var id = element.attributes["w:abstractNumId"];
         abstractNums[id] = readAbstractNum(element);
@@ -2057,7 +2069,7 @@ function readAbstractNums(root) {
 }
 
 function readAbstractNum(element) {
-    var levels = {};
+    var levels = Object.create(null);
 
     // Some malformed documents define numbering levels without an index, and
     // reference the numbering using a w:numPr element without a w:ilvl child.
@@ -2095,7 +2107,7 @@ function readAbstractNum(element) {
 }
 
 function readNums(root) {
-    var nums = {};
+    var nums = Object.create(null);
     root.getElementsByTagName("w:num").forEach(function(element) {
         var numId = element.attributes["w:numId"];
         var abstractNumId = element.first("w:abstractNumId").attributes["w:val"];
@@ -2201,12 +2213,12 @@ function readRelationships(element) {
 }
 
 function Relationships(relationships) {
-    var targetsByRelationshipId = {};
+    var targetsByRelationshipId = Object.create(null);
     relationships.forEach(function(relationship) {
         targetsByRelationshipId[relationship.relationshipId] = relationship.target;
     });
 
-    var targetsByType = {};
+    var targetsByType = Object.create(null);
     relationships.forEach(function(relationship) {
         if (!targetsByType[relationship.type]) {
             targetsByType[relationship.type] = [];
@@ -2326,21 +2338,32 @@ function Styles(paragraphStyles, characterStyles, tableStyles, numberingStyles)
 Styles.EMPTY = new Styles({}, {}, {}, {});
 
 function readStylesXml(root) {
-    var paragraphStyles = {};
-    var characterStyles = {};
-    var tableStyles = {};
-    var numberingStyles = {};
-
-    var styles = {
-        "paragraph": paragraphStyles,
-        "character": characterStyles,
-        "table": tableStyles,
-        "numbering": numberingStyles
-    };
+    var paragraphStyles = Object.create(null);
+    var characterStyles = Object.create(null);
+    var tableStyles = Object.create(null);
+    var numberingStyles = Object.create(null);
 
     root.getElementsByTagName("w:style").forEach(function(styleElement) {
         var style = readStyleElement(styleElement);
-        var styleSet = styles[style.type];
+        var styleSet;
+
+        switch (style.type) {
+        case "paragraph":
+            styleSet = paragraphStyles;
+            break;
+
+        case "character":
+            styleSet = characterStyles;
+            break;
+
+        case "table":
+            styleSet = tableStyles;
+            break;
+
+        case "numbering":
+            styleSet = numberingStyles;
+            break;
+        }
 
         // Per 17.7.4.17 style (Style Definition) of ECMA-376 4th edition Part 1:
         //
@@ -3259,7 +3282,7 @@ function htmlPathRule() {
         capture(freshRule),
         capture(separatorRule)
     ).map(function(tagName, attributesList, fresh, separator) {
-        var attributes = {};
+        var attributes = Object.create(null);
         var options = {};
         attributesList.forEach(function(attribute) {
             if (attribute.append && attributes[attribute.name]) {
@@ -3509,7 +3532,7 @@ function element(tagName, attributes, options) {
 }
 
 function Element(tagName, attributes, options) {
-    var tagNames = {};
+    var tagNames = Object.create(null);
     if (_.isArray(tagName)) {
         tagName.forEach(function(tagName) {
             tagNames[tagName] = true;
@@ -3518,7 +3541,7 @@ function Element(tagName, attributes, options) {
     } else {
         tagNames[tagName] = true;
     }
-    
+
     this.tagName = tagName;
     this.tagNames = tagNames;
     this.attributes = attributes || {};
@@ -3551,7 +3574,7 @@ var RegexTokeniser = lop.RegexTokeniser;
 
 exports.tokenise = tokenise;
 
-var stringPrefix = "'((?:\\\\.|[^'])*)";
+var stringPrefix = "'((?:\\\\(?:.|$)|[^'\\\\])*)";
 
 function tokenise(string) {
     var identifierCharacter = "(?:[a-zA-Z\\-_]|\\\\.)";
@@ -4123,7 +4146,7 @@ function readString(xmlString, namespaceMap) {
             }
         });
 
-        var convertedAttributes = {};
+        var convertedAttributes = Object.create(null);
         _.forEach(element.attributes, function(attribute) {
             convertedAttributes[convertName(attribute)] = attribute.value;
         });