@doccloak/core 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to `@doccloak/core` are documented here. The format is
 based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the
 project follows [Semantic Versioning](https://semver.org/).
 
+## [0.12.1] - 2026-09-24
+
+First run of the real-file corpus job (LibreOffice-generated docx, doc and
+xlsx) on CI after 0.12.0 was published. One reader/writer gap and three test
+expectations came out of it; no published API changed.
+
+### Fixed
+
+- **xlsx: identifiers stored as numbers (T176, minimal).** A PESEL, phone or
+  account number typed into a cell is a numeric `<v>`. Numbers of seven or
+  more digits are now part of the extracted text, and a replaced numeric cell
+  is written as an inline string cell without its formula, so Excel opens
+  the workbook without repair. Shorter numbers (amounts, counts, date
+  serials) are left alone.
+
+### Tests
+
+- Corpus assertions distinguish consented parts (OLE ObjectPool and Macros
+  storages in .doc reported by `inspectDoc`; embedded parts in docx/xlsx
+  reported by the readers) from the rest of the package, and account for
+  occurrences inside tracked deletions that `acceptTrackedChanges` drops.
+- A .doc whose PII sits only in frames or text boxes re-parses clean but
+  placeholder-free (the legacy writer overwrites those stories in place);
+  the suite checks for surviving needles instead of a placeholder count.
+- Timing tests guard linearity with budgets that tolerate shared CI runners.
+- Part-name inventory refreshed from the LibreOffice corpus.
+
 ## [0.12.0] - 2026-09-24
 
 Security remediation release (audit `SECURITY_REPORT-2026-09.md`, plan

package/dist/dom/xlsx.js

@@ -56,6 +56,46 @@ function sharedStringUnits(xmlDoc) {
     }
     return units;
 }
+/** A cell number that can be an identifier: an integer of seven or more digits. */
+const NUMERIC_IDENTIFIER = /^[+-]?\d{7,}$/;
+/** What SpreadsheetML accepts as a numeric <v>. */
+const NUMERIC_VALUE = /^[+-]?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?$/;
+/**
+ * After replacement, a numeric cell whose <v> no longer holds a number
+ * (it now carries a placeholder) would make Excel repair the workbook. Turn
+ * it into an inline string cell and drop its formula, which would otherwise
+ * recompute the original number (T176).
+ */
+function normalizeReplacedNumericCells(xmlDoc) {
+    for (const cell of elementsByLocalName(xmlDoc, OOXML_NS.ss, 'c')) {
+        const type = cell.getAttribute('t');
+        if (type !== null && type !== 'n')
+            continue;
+        let v = null;
+        let f = null;
+        for (let c = 0; c < cell.children.length; c++) {
+            const child = cell.children[c];
+            if (isSpreadsheetEl(child, 'v'))
+                v = child;
+            else if (isSpreadsheetEl(child, 'f'))
+                f = child;
+        }
+        if (!v)
+            continue;
+        const text = v.textContent ?? '';
+        if (text.length === 0 || NUMERIC_VALUE.test(text))
+            continue;
+        cell.setAttribute('t', 'inlineStr');
+        if (f)
+            cell.removeChild(f);
+        const is = xmlDoc.createElementNS(cell.namespaceURI, 'is');
+        const t = xmlDoc.createElementNS(cell.namespaceURI, 't');
+        t.setAttribute('xml:space', 'preserve');
+        t.textContent = text;
+        is.appendChild(t);
+        cell.replaceChild(is, v);
+    }
+}
 const HEADER_FOOTER_NAMES = new Set([
     'oddHeader', 'oddFooter', 'evenHeader', 'evenFooter', 'firstHeader', 'firstFooter',
 ]);
@@ -85,6 +125,19 @@ function worksheetUnits(xmlDoc) {
                         units.push([child]);
                 }
             }
+            else if (type === null || type === 'n') {
+                // Numeric cells (T176): a PESEL, phone or account number typed into
+                // a cell is stored as a number. Values of at least seven digits are
+                // extracted so the detectors see them; a replaced cell is turned
+                // into an inline string on write (normalizeReplacedNumericCells).
+                // Shorter numbers (amounts, counts, dates as serials) are not
+                // identifiers and stay out of the text.
+                for (let c = 0; c < el.children.length; c++) {
+                    const child = el.children[c];
+                    if (isSpreadsheetEl(child, 'v') && NUMERIC_IDENTIFIER.test(child.textContent ?? ''))
+                        units.push([child]);
+                }
+            }
         }
         else if (HEADER_FOOTER_NAMES.has(el.localName)) {
             units.push([el]);
@@ -311,6 +364,8 @@ export async function writeAnonymizedXlsxWithReport(extraction, replacements, va
     applyTextReplacements(extraction.textNodes, replacements);
     const contentPaths = new Set();
     for (const part of extraction.contentParts) {
+        if (/^xl\/worksheets\//.test(part.path))
+            normalizeReplacedNumericCells(part.xmlDoc);
         sanitizeXlsxPart(part.xmlDoc, valueReplacements);
         writeXmlPart(extraction.zip, part.path, part.xmlDoc);
         contentPaths.add(part.path);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doccloak/core",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Environment-agnostic document anonymization engine for the DocCloak ecosystem.",
   "license": "Apache-2.0",
   "author": "Witold Lojek",