@file-viewer/renderer-signature 3.0.0

package/dist/structured/zipPreflight.js

@@ -0,0 +1,173 @@
+const CENTRAL_DIRECTORY_SIGNATURE = 0x02014b50;
+const END_OF_CENTRAL_DIRECTORY_SIGNATURE = 0x06054b50;
+const LOCAL_FILE_HEADER_SIGNATURE = 0x04034b50;
+const DATA_DESCRIPTOR_SIGNATURE = 0x08074b50;
+const DATA_DESCRIPTOR_FLAG = 0x0008;
+const ZIP64_SENTINEL_16 = 0xffff;
+const ZIP64_SENTINEL_32 = 0xffffffff;
+const assertZip = (condition, message) => {
+    if (!condition)
+        throw new Error(`Unsafe ASiC ZIP: ${message}`);
+};
+const decodeName = (bytes, utf8) => {
+    const name = new TextDecoder(utf8 ? 'utf-8' : 'windows-1252', { fatal: true })
+        .decode(bytes)
+        .normalize('NFC');
+    assertZip(!Array.from(name).some((character) => {
+        const codePoint = character.codePointAt(0);
+        return codePoint === 0x7f || codePoint < 0x20;
+    }), 'entry name contains control characters.');
+    assertZip(!name.includes('\\'), 'backslash paths are rejected.');
+    assertZip(!name.startsWith('/') && !/^[A-Za-z]:/u.test(name), 'absolute entry paths are rejected.');
+    const segments = name.split('/').filter(Boolean);
+    assertZip(segments.length > 0, 'empty entry name.');
+    assertZip(segments.every((segment) => segment !== '.' && segment !== '..'), 'entry path traversal is rejected.');
+    return name;
+};
+const locateEndRecord = (view) => {
+    const minimum = Math.max(0, view.byteLength - 65557);
+    for (let offset = view.byteLength - 22; offset >= minimum; offset -= 1) {
+        if (view.getUint32(offset, true) === END_OF_CENTRAL_DIRECTORY_SIGNATURE)
+            return offset;
+    }
+    throw new Error('Unsafe ASiC ZIP: end-of-central-directory record is missing.');
+};
+const equalBytes = (left, right) => {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    let mismatch = 0;
+    for (let index = 0; index < left.byteLength; index += 1) {
+        mismatch |= left[index] ^ right[index];
+    }
+    return mismatch === 0;
+};
+export const inspectZipCentralDirectory = (input, limits) => {
+    const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+    assertZip(bytes.byteLength > 0 && bytes.byteLength <= limits.maxContainerBytes, `container exceeds ${limits.maxContainerBytes} bytes.`);
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const eocd = locateEndRecord(view);
+    const diskNumber = view.getUint16(eocd + 4, true);
+    const centralDisk = view.getUint16(eocd + 6, true);
+    const diskEntries = view.getUint16(eocd + 8, true);
+    const totalEntries = view.getUint16(eocd + 10, true);
+    const centralSize = view.getUint32(eocd + 12, true);
+    const centralOffset = view.getUint32(eocd + 16, true);
+    const commentLength = view.getUint16(eocd + 20, true);
+    assertZip(eocd + 22 + commentLength === bytes.byteLength, 'trailing bytes after the ZIP end record are rejected.');
+    assertZip(diskNumber === 0 && centralDisk === 0 && diskEntries === totalEntries, 'multi-disk ZIP archives are rejected.');
+    assertZip(totalEntries !== ZIP64_SENTINEL_16 &&
+        centralSize !== ZIP64_SENTINEL_32 &&
+        centralOffset !== ZIP64_SENTINEL_32, 'ZIP64 archives are not accepted by this bounded preview path.');
+    assertZip(totalEntries > 0 && totalEntries <= limits.maxEntries, `entry count exceeds ${limits.maxEntries}.`);
+    assertZip(centralOffset + centralSize === eocd, 'central-directory bounds are inconsistent.');
+    const entries = [];
+    const physicalRanges = [];
+    const normalizedNames = new Set();
+    let totalUncompressedBytes = 0;
+    let cursor = centralOffset;
+    for (let index = 0; index < totalEntries; index += 1) {
+        assertZip(cursor + 46 <= eocd && view.getUint32(cursor, true) === CENTRAL_DIRECTORY_SIGNATURE, 'central-directory entry is malformed.');
+        const flags = view.getUint16(cursor + 8, true);
+        const compressionMethod = view.getUint16(cursor + 10, true);
+        const crc32 = view.getUint32(cursor + 16, true);
+        const compressedSize = view.getUint32(cursor + 20, true);
+        const uncompressedSize = view.getUint32(cursor + 24, true);
+        const nameLength = view.getUint16(cursor + 28, true);
+        const extraLength = view.getUint16(cursor + 30, true);
+        const entryCommentLength = view.getUint16(cursor + 32, true);
+        const diskStart = view.getUint16(cursor + 34, true);
+        const externalAttributes = view.getUint32(cursor + 38, true);
+        const localHeaderOffset = view.getUint32(cursor + 42, true);
+        const next = cursor + 46 + nameLength + extraLength + entryCommentLength;
+        assertZip(next <= eocd, 'central-directory entry exceeds its boundary.');
+        assertZip((flags & 0x0001) === 0, 'encrypted entries are rejected.');
+        assertZip(compressionMethod === 0 || compressionMethod === 8, `compression method ${compressionMethod} is unsupported.`);
+        assertZip(compressedSize !== ZIP64_SENTINEL_32 &&
+            uncompressedSize !== ZIP64_SENTINEL_32 &&
+            localHeaderOffset !== ZIP64_SENTINEL_32 &&
+            diskStart !== ZIP64_SENTINEL_16, 'ZIP64 entry fields are rejected.');
+        assertZip(diskStart === 0, 'multi-disk entries are rejected.');
+        const nameBytes = bytes.subarray(cursor + 46, cursor + 46 + nameLength);
+        assertZip(nameBytes.byteLength <= limits.maxPathBytes, `entry path exceeds ${limits.maxPathBytes} bytes.`);
+        const name = decodeName(nameBytes, (flags & 0x0800) !== 0);
+        const collisionKey = name.toLocaleLowerCase('en-US');
+        assertZip(!normalizedNames.has(collisionKey), `duplicate or case-colliding entry ${name}.`);
+        normalizedNames.add(collisionKey);
+        const unixMode = externalAttributes >>> 16;
+        assertZip((unixMode & 0xf000) !== 0xa000, `symbolic link ${name} is rejected.`);
+        const directory = name.endsWith('/') || (externalAttributes & 0x10) !== 0;
+        if (!directory) {
+            assertZip(uncompressedSize <= limits.maxEntryBytes, `entry ${name} exceeds ${limits.maxEntryBytes} bytes.`);
+            assertZip(compressedSize > 0 || uncompressedSize === 0, `entry ${name} has an impossible compressed size.`);
+            if (compressedSize > 0) {
+                assertZip(uncompressedSize / compressedSize <= limits.maxCompressionRatio, `entry ${name} exceeds compression ratio ${limits.maxCompressionRatio}.`);
+            }
+            totalUncompressedBytes += uncompressedSize;
+            assertZip(Number.isSafeInteger(totalUncompressedBytes) &&
+                totalUncompressedBytes <= limits.maxTotalUncompressedBytes, `uncompressed total exceeds ${limits.maxTotalUncompressedBytes} bytes.`);
+        }
+        assertZip(localHeaderOffset + 30 <= centralOffset &&
+            view.getUint32(localHeaderOffset, true) === LOCAL_FILE_HEADER_SIGNATURE, `local header for ${name} is invalid.`);
+        const localFlags = view.getUint16(localHeaderOffset + 6, true);
+        const localCompressionMethod = view.getUint16(localHeaderOffset + 8, true);
+        const localCrc32 = view.getUint32(localHeaderOffset + 14, true);
+        const localCompressedSize = view.getUint32(localHeaderOffset + 18, true);
+        const localUncompressedSize = view.getUint32(localHeaderOffset + 22, true);
+        const localNameLength = view.getUint16(localHeaderOffset + 26, true);
+        const localExtraLength = view.getUint16(localHeaderOffset + 28, true);
+        assertZip(localFlags === flags, `local and central flags differ for ${name}.`);
+        assertZip(localCompressionMethod === compressionMethod, `local and central compression methods differ for ${name}.`);
+        assertZip(localCompressedSize !== ZIP64_SENTINEL_32 && localUncompressedSize !== ZIP64_SENTINEL_32, `local ZIP64 size fields are rejected for ${name}.`);
+        const localNameStart = localHeaderOffset + 30;
+        const localNameEnd = localNameStart + localNameLength;
+        const dataStart = localNameEnd + localExtraLength;
+        assertZip(localNameEnd <= centralOffset && dataStart <= centralOffset, `local header fields for ${name} escape the data section.`);
+        assertZip(localNameLength <= limits.maxPathBytes, `local entry path for ${name} exceeds ${limits.maxPathBytes} bytes.`);
+        const localNameBytes = bytes.subarray(localNameStart, localNameEnd);
+        assertZip(equalBytes(localNameBytes, nameBytes), `local and central entry names differ for ${name}.`);
+        const usesDataDescriptor = (flags & DATA_DESCRIPTOR_FLAG) !== 0;
+        if (usesDataDescriptor) {
+            assertZip((localCrc32 === 0 || localCrc32 === crc32) &&
+                (localCompressedSize === 0 || localCompressedSize === compressedSize) &&
+                (localUncompressedSize === 0 || localUncompressedSize === uncompressedSize), `local placeholder fields conflict with the central directory for ${name}.`);
+        }
+        else {
+            assertZip(localCrc32 === crc32 &&
+                localCompressedSize === compressedSize &&
+                localUncompressedSize === uncompressedSize, `local CRC or size fields differ from the central directory for ${name}.`);
+        }
+        const dataEnd = dataStart + compressedSize;
+        assertZip(dataEnd <= centralOffset, `compressed data for ${name} escapes the data section.`);
+        let recordEnd = dataEnd;
+        if (usesDataDescriptor) {
+            let descriptorStart = dataEnd;
+            assertZip(descriptorStart + 12 <= centralOffset, `data descriptor for ${name} is truncated.`);
+            if (view.getUint32(descriptorStart, true) === DATA_DESCRIPTOR_SIGNATURE) {
+                descriptorStart += 4;
+                assertZip(descriptorStart + 12 <= centralOffset, `signed data descriptor for ${name} is truncated.`);
+            }
+            assertZip(view.getUint32(descriptorStart, true) === crc32 &&
+                view.getUint32(descriptorStart + 4, true) === compressedSize &&
+                view.getUint32(descriptorStart + 8, true) === uncompressedSize, `data descriptor differs from the central directory for ${name}.`);
+            recordEnd = descriptorStart + 12;
+        }
+        physicalRanges.push({ name, start: localHeaderOffset, end: recordEnd });
+        entries.push({
+            name,
+            compressedSize,
+            uncompressedSize,
+            compressionMethod: compressionMethod,
+            localHeaderOffset,
+            directory
+        });
+        cursor = next;
+    }
+    assertZip(cursor === eocd, 'central-directory size does not match parsed entries.');
+    physicalRanges.sort((left, right) => left.start - right.start || left.end - right.end);
+    for (let index = 1; index < physicalRanges.length; index += 1) {
+        const previous = physicalRanges[index - 1];
+        const current = physicalRanges[index];
+        assertZip(previous.end <= current.start, `local record ranges overlap between ${previous.name} and ${current.name}.`);
+    }
+    return { entries, totalUncompressedBytes };
+};

package/dist/workerProtocol.d.ts

@@ -0,0 +1,40 @@
+import type { OpenPgpInspectionResult, OpenPgpVerificationResult, OpenPgpWorkerError, SignatureParseLimits } from './openpgp/types.js';
+export type SignatureWorkerRequest = {
+    id: string;
+    type: 'classify';
+    input: ArrayBuffer;
+    limits: SignatureParseLimits;
+} | {
+    id: string;
+    type: 'inspect';
+    input: ArrayBuffer;
+    publicKeys: ArrayBuffer[];
+    limits: SignatureParseLimits;
+} | {
+    id: string;
+    type: 'verify-detached';
+    content: ArrayBuffer;
+    signature: ArrayBuffer;
+    publicKeys: ArrayBuffer[];
+    limits: SignatureParseLimits;
+};
+export type SignatureWorkerResponse = {
+    id: string;
+    ok: true;
+    type: 'classify';
+    result: OpenPgpInspectionResult;
+} | {
+    id: string;
+    ok: true;
+    type: 'inspect';
+    result: OpenPgpInspectionResult;
+} | {
+    id: string;
+    ok: true;
+    type: 'verify-detached';
+    result: OpenPgpVerificationResult;
+} | {
+    id: string;
+    ok: false;
+    error: OpenPgpWorkerError;
+};

package/dist/workerProtocol.js

@@ -0,0 +1 @@
+export {};

package/file-viewer.capability.json

@@ -0,0 +1,56 @@
+{
+  "$schema": "../../../ecosystem/capability-manifest.schema.json",
+  "schemaVersion": 1,
+  "id": "signature",
+  "packageName": "@file-viewer/renderer-signature",
+  "activation": {
+    "kind": "renderer-export",
+    "import": "@file-viewer/renderer-signature",
+    "export": "signatureRenderer"
+  },
+  "rendererIds": ["signature"],
+  "formats": [
+    "p7m",
+    "p7s",
+    "p7c",
+    "p7b",
+    "pkcs7",
+    "cms",
+    "cmsc",
+    "tsd",
+    "tst",
+    "tsq",
+    "tsr",
+    "asics",
+    "scs",
+    "asice",
+    "sce",
+    "ers",
+    "asc",
+    "sig",
+    "pgp",
+    "gpg",
+    "jws"
+  ],
+  "assets": {
+    "rendererIds": []
+  },
+  "license": {
+    "spdx": "Apache-2.0",
+    "policy": "permissive",
+    "notices": [
+      {
+        "packageName": "rPGP / pgp",
+        "spdx": "MIT OR Apache-2.0",
+        "notice": "Pinned at 0.20.0 and compiled to a lazy Web Worker/WASM module; exact transitive versions are locked in rust/Cargo.lock."
+      },
+      {
+        "packageName": "JSZip",
+        "spdx": "MIT OR GPL-3.0-or-later",
+        "notice": "Pinned at 3.10.1 and used under its MIT license after a bounded ZIP central-directory preflight."
+      }
+    ]
+  },
+  "weight": "heavy",
+  "profiles": []
+}

package/package.json

@@ -0,0 +1,106 @@
+{
+  "name": "@file-viewer/renderer-signature",
+  "version": "3.0.0",
+  "private": false,
+  "type": "module",
+  "sideEffects": false,
+  "description": "Opt-in browser-local CMS, CAdES, timestamp, ASiC, evidence-record, JWS and OpenPGP renderer for File Viewer.",
+  "keywords": [
+    "file-viewer",
+    "renderer",
+    "signature",
+    "cms",
+    "pkcs7",
+    "cades",
+    "rfc3161",
+    "timestamp",
+    "asic",
+    "evidence-record",
+    "jws",
+    "document-preview",
+    "self-hosted",
+    "openpgp",
+    "rpgp",
+    "wasm",
+    "web-worker"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "author": {
+    "name": "Yu Wang",
+    "email": "admin@flyfish.dev"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/flyfish-dev/file-viewer.git",
+    "directory": "packages/renderers/signature"
+  },
+  "homepage": "https://doc.file-viewer.app/guide/on-demand-renderers",
+  "bugs": {
+    "url": "https://github.com/flyfish-dev/file-viewer/issues"
+  },
+  "funding": {
+    "type": "individual",
+    "url": "https://dev.flyfish.group/donate?source=npm"
+  },
+  "fileViewer": {
+    "capabilityManifest": "file-viewer.capability.json"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json",
+    "./capability": "./file-viewer.capability.json",
+    "./inspect": {
+      "types": "./dist/inspect.d.ts",
+      "import": "./dist/inspect.js",
+      "default": "./dist/inspect.js"
+    },
+    "./worker/signature.worker.js": "./dist/signature.worker.js",
+    "./worker/container.worker.js": "./dist/container.worker.js",
+    "./wasm/rpgp_wrapper.js": "./dist/rpgp-wasm/rpgp_wrapper.js",
+    "./wasm/rpgp_wrapper_bg.wasm": "./dist/rpgp-wasm/rpgp_wrapper_bg.wasm"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "README.en.md",
+    "file-viewer.capability.json",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md",
+    "THIRD_PARTY_LICENSES.json"
+  ],
+  "dependencies": {
+    "@file-viewer/core": "3.0.0",
+    "jszip": "3.10.1"
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "license": "Apache-2.0",
+  "scripts": {
+    "build:ts": "tsc -b tsconfig.json --force",
+    "build:wasm": "node scripts/build-wasm.mjs",
+    "build": "pnpm build:ts && pnpm build:wasm",
+    "type-check": "tsc -b tsconfig.json",
+    "verify:github-206": "pnpm build:ts && node scripts/verify-github-206.mjs",
+    "verify:fixtures": "bash test/fixtures/github-206-contributed/scripts/verify_all.sh",
+    "verify:openpgp-architecture": "node scripts/verify-openpgp-architecture.mjs",
+    "verify:openpgp-detection": "pnpm build:ts && node scripts/verify-openpgp-detection.mjs",
+    "verify:openpgp-runtime": "node scripts/verify-openpgp-runtime.mjs",
+    "verify:structured": "pnpm build:ts && node scripts/verify-structured-formats.mjs",
+    "generate:licenses": "node scripts/generate-license-ledger.mjs",
+    "verify:licenses": "node scripts/generate-license-ledger.mjs --check",
+    "verify:artifacts": "node scripts/verify-artifacts.mjs",
+    "verify:openpgp": "pnpm build:wasm && pnpm verify:openpgp-architecture && pnpm verify:openpgp-detection && pnpm verify:openpgp-runtime",
+    "verify": "pnpm verify:licenses && pnpm verify:fixtures && pnpm verify:github-206 && pnpm verify:structured && pnpm verify:openpgp && pnpm verify:artifacts"
+  }
+}