@file-viewer/renderer-word 2.4.0 → 3.0.0

package/README.en.md

@@ -1,6 +1,6 @@
 # @file-viewer/renderer-word
 
-Standalone Word and compatible document renderer package for Flyfish File Viewer. It owns the DOCX/DOCM/DOTX/DOTM, legacy DOC/DOT, RTF, ODT, and ODP preview path so `@file-viewer/core` no longer installs Word parsing engines directly.
+Word and OpenDocument renderer package for Flyfish File Viewer. Standard/full includes DOCX/DOCM/DOTX/DOTM, legacy DOC/DOT, ODT, and ODP. RTF is enabled explicitly by `@file-viewer/capability-rtf`.
 
 ## Usage
 
@@ -33,7 +33,7 @@ Use `@file-viewer/preset-all` when you want the same complete matrix as the offi
 
 - DOCX / DOCM / DOTX / DOTM use the self-maintained `@file-viewer/docx` engine with Worker parsing, continuous reading layout, cached TOC fields, async batched rendering, and a dark document surface that follows the viewer theme.
 - DOC / DOT use `@file-viewer/doc` with a Word-like paper surface, zoom, print, and HTML export adapters.
-- RTF uses `rtf.js`; ODT / ODP read `content.xml` from OpenDocument packages for safe structure previews.
+- With the RTF capability installed, RTF uses `rtf.js`; without it the viewer shows the exact CLI enablement command. ODT / ODP read `content.xml` from OpenDocument packages for safe structure previews.
 - The renderer reuses core search, zoom, print, export, lifecycle, and operation APIs.
 
 ## Offline Assets
@@ -56,6 +56,10 @@ const options = {
 
 DOCX dark rendering follows `options.theme` by default: `dark` enables it, `light` disables it, and `system` follows the browser color scheme. Pass `options.docx.darkMode: true / false` when the host app needs a fixed result.
 
+DOC, DOCX, and RTF external links and HTTP(S) image relationships are blocked by default. Enable them explicitly with `options.docx.externalLinkPolicy: 'allow'` and `options.docx.externalResourcePolicy: 'allow'`; links are still limited to HTTP(S), `mailto:`, `tel:`, and safe relative addresses. Unknown and protocol-relative schemes are always rejected. Embedded images, internal bookmarks, and local `data:`/`blob:` image resources remain available.
+
+The standard renderer sanitizes the DOM produced by `rtf.js` before mounting it. Custom RTF integrations that consume HTML directly should first call `sanitizeFileViewerRtfHtml(document, markup, options)`; it uses the same link policy and DOMPurify boundary as the standard mount path. A strict Trusted Types CSP should allow the `file-viewer-document-sanitizer` policy name.
+
 ## Migration
 
 `@file-viewer/core` no longer depends on `@file-viewer/docx`, `@file-viewer/doc`, `rtf.js`, `linkedom`, or `@xmldom/xmldom` directly. Install and pass this renderer for full Word preview, or use `@file-viewer/preset-all`.

package/README.md

@@ -1,6 +1,6 @@
 # @file-viewer/renderer-word
 
-Flyfish File Viewer 的独立 Word / 兼容文档 renderer 包。它承接 DOCX/DOCM/DOTX/DOTM、旧版 DOC/DOT、RTF、ODT/ODP 等文档预览链路，让 `@file-viewer/core` 不再直接安装 Word 解析与渲染依赖。
+Flyfish File Viewer 的 Word / OpenDocument renderer 包。standard/full 默认承接 DOCX/DOCM/DOTX/DOTM、旧版 DOC/DOT 与 ODT/ODP；RTF 由 `@file-viewer/capability-rtf` 显式启用。
 
 ## 用法
 
@@ -33,7 +33,7 @@ const options = {
 
 - DOCX / DOCM / DOTX / DOTM 使用自研 `@file-viewer/docx`，默认 Worker 解析、连续流式阅读、目录字段缓存、异步分批渲染，并跟随 viewer 主题启用暗黑文档面。
 - DOC / DOT 使用 `@file-viewer/doc`，并套用 Word 风格纸张阅读面、缩放、打印和 HTML 导出适配。
-- RTF 使用 `rtf.js`，ODT / ODP 读取 OpenDocument 包内 `content.xml` 做安全结构预览。
+- 安装 RTF capability 后才使用 `rtf.js`；未安装时会显示精确 CLI 启用命令。ODT / ODP 读取 OpenDocument 包内 `content.xml` 做安全结构预览。
 - 继续复用 core 的统一搜索、缩放、打印、导出、生命周期和操作能力。
 
 ## 离线资产
@@ -56,6 +56,10 @@ const options = {
 
 DOCX 暗黑渲染默认由 `options.theme` 决定：`dark` 开启、`light` 关闭、`system` 跟随浏览器系统主题。需要业务固定效果时可传 `options.docx.darkMode: true / false`。
 
+DOC、DOCX 与 RTF 的外部链接及 HTTP(S) 图片关系默认阻断。只有显式设置 `options.docx.externalLinkPolicy: 'allow'` 和 `options.docx.externalResourcePolicy: 'allow'` 才会启用；链接仍只接受 HTTP(S)、`mailto:`、`tel:` 和安全相对地址，未知协议与协议相对地址始终拒绝。内嵌图片、内部书签以及本地 `data:`/`blob:` 图片资源不受影响。
+
+标准 renderer 会在挂载前净化 `rtf.js` 产生的 DOM。自定义 RTF 集成若直接消费 HTML，应先调用 `sanitizeFileViewerRtfHtml(document, markup, options)`；该边界与标准挂载使用同一链接策略和 DOMPurify 配置。严格 Trusted Types CSP 需允许 `file-viewer-document-sanitizer` 策略名。
+
 ## 迁移说明
 
 `@file-viewer/core` 已不再直接依赖 `@file-viewer/docx`、`@file-viewer/doc`、`rtf.js`、`linkedom` 或 `@xmldom/xmldom`。需要 Word 完整预览时，请安装本包并通过 `renderers` 传入，或使用 `@file-viewer/preset-all`。

package/dist/index.d.ts

@@ -1,4 +1,8 @@
 import { type FileRenderHandler, type FileViewerRenderedInstance, type FileViewerRendererPlugin, type RendererDefinition } from '@file-viewer/core';
+export { getFileViewerRtfLoader, registerFileViewerRtfLoader, } from './optionalCapabilities.js';
+export type { FileViewerRtfLoader, FileViewerRtfModule, } from './optionalCapabilities.js';
+export { createFileViewerRtfHyperlinkContainer, isSafeFileViewerRtfHyperlink, sanitizeFileViewerRtfElement, sanitizeFileViewerRtfHtml, sanitizeFileViewerRtfHyperlink, } from './sanitizeRtf.js';
+export type { FileViewerRtfExternalPolicy, FileViewerRtfSanitizeOptions, } from './sanitizeRtf.js';
 export declare const wordRendererDefinitions: RendererDefinition[];
 export declare const renderFileViewerWordDocx: FileRenderHandler<FileViewerRenderedInstance, HTMLDivElement>;
 /**

package/dist/index.js

@@ -1,4 +1,6 @@
 import { DEFAULT_RENDERER_DEFINITIONS, } from '@file-viewer/core';
+export { getFileViewerRtfLoader, registerFileViewerRtfLoader, } from './optionalCapabilities.js';
+export { createFileViewerRtfHyperlinkContainer, isSafeFileViewerRtfHyperlink, sanitizeFileViewerRtfElement, sanitizeFileViewerRtfHtml, sanitizeFileViewerRtfHyperlink, } from './sanitizeRtf.js';
 const wordRendererIds = [
     'office-word-openxml',
     'office-word-binary',

package/dist/openDocument.js

@@ -1,5 +1,7 @@
 import JSZip from 'jszip';
 import { createFileViewerTranslator, } from '@file-viewer/core';
+import { getFileViewerRtfLoader } from './optionalCapabilities.js';
+import { createFileViewerRtfHyperlinkContainer, sanitizeFileViewerRtfElement, } from './sanitizeRtf.js';
 const openDocumentStyle = `
 .odf-viewer{min-height:100%;padding:28px;overflow:auto;background:var(--file-viewer-render-surface-background,#dfe5eb);box-sizing:border-box}
 .odf-shell{width:min(100%,980px);margin:0 auto}
@@ -12,8 +14,8 @@ const openDocumentStyle = `
 @media (prefers-color-scheme:dark){[data-viewer-theme='system'] .odf-viewer,[data-viewer-theme='system'] .flyfish-rtf-viewer{color-scheme:dark;background:var(--file-viewer-render-surface-background,#0d1117);color:#e6edf3}[data-viewer-theme='system'] .odf-page,[data-viewer-theme='system'] .flyfish-rtf-paper{border:1px solid rgba(139,148,158,.24);background:#161b22;color:#e6edf3;box-shadow:0 18px 44px rgba(0,0,0,.34)}}
 @media (max-width:720px){.odf-viewer,.flyfish-rtf-viewer{padding:14px}.odf-page{padding:28px 24px}.flyfish-rtf-paper{padding:36px 28px}}
 `;
-const createStyle = () => {
-    const style = document.createElement('style');
+const createStyle = (documentRef = document) => {
+    const style = documentRef.createElement('style');
     style.textContent = openDocumentStyle;
     return style;
 };
@@ -73,23 +75,35 @@ const renderOdfPages = (pages) => {
     return root;
 };
 const resolveRtfJs = async () => {
-    const rtfModule = await import('rtf.js/dist/RTFJS.bundle.js');
+    const loadRtf = getFileViewerRtfLoader();
+    if (!loadRtf) {
+        throw new Error('RTF support is opt-in. Run `npx file-viewer-cli add rtf --write`, then `npx file-viewer-cli install --yes`.');
+    }
+    const rtfModule = await loadRtf();
     return rtfModule.RTFJS || rtfModule.default || rtfModule;
 };
 const renderRtf = async (buffer, target, context) => {
-    var _a, _b;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const RTFJS = await resolveRtfJs();
-    (_a = RTFJS.loggingEnabled) === null || _a === void 0 ? void 0 : _a.call(RTFJS, false);
-    const doc = new RTFJS.Document(buffer, {});
+    const documentRef = target.ownerDocument || document;
+    const externalLinkPolicy = (_c = (_b = (_a = context === null || context === void 0 ? void 0 : context.options) === null || _a === void 0 ? void 0 : _a.docx) === null || _b === void 0 ? void 0 : _b.externalLinkPolicy) !== null && _c !== void 0 ? _c : 'block';
+    const externalResourcePolicy = (_f = (_e = (_d = context === null || context === void 0 ? void 0 : context.options) === null || _d === void 0 ? void 0 : _d.docx) === null || _e === void 0 ? void 0 : _e.externalResourcePolicy) !== null && _f !== void 0 ? _f : 'block';
+    (_g = RTFJS.loggingEnabled) === null || _g === void 0 ? void 0 : _g.call(RTFJS, false);
+    const doc = new RTFJS.Document(buffer, {
+        onHyperlink: (create, hyperlink) => createFileViewerRtfHyperlinkContainer(documentRef, create, hyperlink, externalLinkPolicy),
+    });
     const elements = await doc.render();
-    const stage = document.createElement('div');
+    const stage = documentRef.createElement('div');
     stage.className = 'flyfish-rtf-viewer';
-    const paper = document.createElement('article');
+    const paper = documentRef.createElement('article');
     paper.className = 'flyfish-rtf-paper';
-    elements.forEach((element) => paper.appendChild(element));
+    elements.forEach((element) => paper.append(sanitizeFileViewerRtfElement(documentRef, element, {
+        externalLinkPolicy,
+        externalResourcePolicy,
+    })));
     stage.appendChild(paper);
-    target.replaceChildren(createStyle(), stage);
-    (_b = context === null || context === void 0 ? void 0 : context.registerThumbnailAdapter) === null || _b === void 0 ? void 0 : _b.call(context, { getTarget: () => paper });
+    target.replaceChildren(createStyle(documentRef), stage);
+    (_h = context === null || context === void 0 ? void 0 : context.registerThumbnailAdapter) === null || _h === void 0 ? void 0 : _h.call(context, { getTarget: () => paper });
     return {
         $el: target,
         unmount() {

package/dist/optionalCapabilities.d.ts

@@ -0,0 +1,7 @@
+export type FileViewerRtfModule = {
+    RTFJS?: any;
+    default?: any;
+};
+export type FileViewerRtfLoader = () => Promise<FileViewerRtfModule>;
+export declare const registerFileViewerRtfLoader: (loader: FileViewerRtfLoader | null) => void;
+export declare const getFileViewerRtfLoader: () => FileViewerRtfLoader | null;

package/dist/optionalCapabilities.js

@@ -0,0 +1,5 @@
+let rtfLoader = null;
+export const registerFileViewerRtfLoader = (loader) => {
+    rtfLoader = loader;
+};
+export const getFileViewerRtfLoader = () => rtfLoader;

package/dist/sanitizeRtf.d.ts

@@ -0,0 +1,25 @@
+export type FileViewerRtfExternalPolicy = 'allow' | 'block';
+export interface FileViewerRtfSanitizeOptions {
+    externalLinkPolicy?: FileViewerRtfExternalPolicy;
+    externalResourcePolicy?: FileViewerRtfExternalPolicy;
+}
+/**
+ * Canonicalizes an RTF field hyperlink through the same policy used by DOC.
+ * Word's `HYPERLINK \\l "bookmark"` field syntax is converted to a fragment
+ * before external navigation is considered, so bookmarks remain available
+ * even when the default external-link policy is `block`.
+ */
+export declare const sanitizeFileViewerRtfHyperlink: (value: string, policy?: FileViewerRtfExternalPolicy) => string | null;
+export declare const isSafeFileViewerRtfHyperlink: (value: string, policy?: FileViewerRtfExternalPolicy) => boolean;
+export declare const createFileViewerRtfHyperlinkContainer: (documentRef: Document, create: () => HTMLElement, hyperlink: {
+    url: () => string;
+}, policy?: FileViewerRtfExternalPolicy) => {
+    element: HTMLSpanElement;
+    content: HTMLSpanElement;
+};
+export declare const sanitizeFileViewerRtfElement: (documentRef: Document, element: HTMLElement, options?: FileViewerRtfSanitizeOptions) => DocumentFragment;
+/**
+ * Safe serialization boundary for integrations that consume renderer markup
+ * directly instead of mounting through the standard File Viewer handler.
+ */
+export declare const sanitizeFileViewerRtfHtml: (documentRef: Document, markup: string, options?: FileViewerRtfSanitizeOptions) => string;

package/dist/sanitizeRtf.js

@@ -0,0 +1,149 @@
+import { sanitizeFileViewerDocumentMarkup, sanitizeMsDocLinkHref } from '@file-viewer/doc';
+// eslint-disable-next-line no-control-regex -- remove URL controls before scheme validation
+const compactUrl = (value) => value.trim().replace(/[\u0000-\u0020\u007f-\u009f]/g, '');
+const schemeOf = (value) => {
+    var _a, _b;
+    return (_b = (_a = compactUrl(value)
+        .match(/^([a-z][a-z0-9+.-]*):/i)) === null || _a === void 0 ? void 0 : _a[1]) === null || _b === void 0 ? void 0 : _b.toLowerCase();
+};
+const normalizeRtfBookmarkHref = (value) => {
+    const match = String(value !== null && value !== void 0 ? value : '')
+        .trim()
+        .match(/^\\l\s+(?:"([^"]+)"|([^\s"]+))\s*$/i);
+    if (!match)
+        return null;
+    const bookmark = (match[1] || match[2] || '').trim();
+    return /^[A-Za-z_][A-Za-z0-9_]{0,39}$/.test(bookmark) ? `#${bookmark}` : null;
+};
+/**
+ * Canonicalizes an RTF field hyperlink through the same policy used by DOC.
+ * Word's `HYPERLINK \\l "bookmark"` field syntax is converted to a fragment
+ * before external navigation is considered, so bookmarks remain available
+ * even when the default external-link policy is `block`.
+ */
+export const sanitizeFileViewerRtfHyperlink = (value, policy = 'block') => {
+    const bookmarkHref = normalizeRtfBookmarkHref(value);
+    return sanitizeMsDocLinkHref(bookmarkHref || value, policy);
+};
+export const isSafeFileViewerRtfHyperlink = (value, policy = 'allow') => sanitizeFileViewerRtfHyperlink(value, policy) !== null;
+const sanitizeResourceUrl = (value, policy = 'block') => {
+    const compact = compactUrl(value);
+    if (compact.startsWith('#'))
+        return compact;
+    if (/^data:image\/(?:png|gif|jpe?g|webp);base64,/i.test(compact))
+        return compact;
+    const scheme = schemeOf(compact);
+    if (scheme === 'blob')
+        return compact;
+    if (policy !== 'allow')
+        return null;
+    if (scheme === 'http' || scheme === 'https')
+        return compact;
+    if (!scheme && !compact.startsWith('//') && !compact.includes('\\'))
+        return compact;
+    return null;
+};
+const decodeCssEscapes = (value) => value
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\\([0-9a-f]{1,6})\s?/gi, (_match, digits) => {
+    const codePoint = Number.parseInt(digits, 16);
+    return codePoint > 0 && codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : '';
+})
+    .replace(/\\([^\r\n\f])/g, '$1');
+const safeStyle = (value) => !/(?:expression\s*\(|(?:url|src|image|image-set|cross-fade)\s*\(|@import|behavior\s*:|-moz-binding)/i.test(decodeCssEscapes(value));
+const isResourceHrefElement = (node) => ['image', 'use'].includes(node.localName.toLowerCase());
+export const createFileViewerRtfHyperlinkContainer = (documentRef, create, hyperlink, policy = 'block') => {
+    const href = sanitizeFileViewerRtfHyperlink(hyperlink.url(), policy);
+    if (!href) {
+        const span = documentRef.createElement('span');
+        span.dataset.fileViewerBlockedLink = 'true';
+        span.setAttribute('aria-disabled', 'true');
+        return { element: span, content: span };
+    }
+    const anchor = create();
+    anchor.setAttribute('href', href);
+    if ((anchor.getAttribute('target') || '').toLowerCase() === '_blank')
+        anchor.setAttribute('rel', 'noopener noreferrer');
+    return { element: anchor, content: anchor };
+};
+const fallbackFragment = (documentRef, text) => {
+    const fragment = documentRef.createDocumentFragment();
+    fragment.append(documentRef.createTextNode(text));
+    return fragment;
+};
+const sanitizeFileViewerRtfMarkup = (documentRef, markup, fallbackText, options = {}) => {
+    const fallback = () => {
+        return fallbackFragment(documentRef, fallbackText);
+    };
+    const windowRef = documentRef.defaultView;
+    if (!windowRef)
+        return fallback();
+    const fragment = sanitizeFileViewerDocumentMarkup(markup, windowRef, {
+        RETURN_DOM_FRAGMENT: true,
+        USE_PROFILES: { html: true, svg: true, svgFilters: true },
+        ADD_ATTR: ['target'],
+        FORBID_TAGS: [
+            'base',
+            'embed',
+            'foreignObject',
+            'form',
+            'iframe',
+            'object',
+            'script',
+            'style',
+            'template'
+        ],
+        FORBID_ATTR: ['action', 'formaction', 'srcdoc']
+    });
+    if ((fragment === null || fragment === void 0 ? void 0 : fragment.nodeType) !== 11)
+        return fallback();
+    fragment.querySelectorAll('*').forEach((node) => {
+        var _a, _b, _c;
+        for (const attribute of Array.from(node.attributes)) {
+            if (/^on/i.test(attribute.name))
+                node.removeAttribute(attribute.name);
+            else if (attribute.name.toLowerCase() === 'style' && !safeStyle(attribute.value))
+                node.removeAttribute(attribute.name);
+            else if (/^(?:href|xlink:href)$/i.test(attribute.name)) {
+                const href = isResourceHrefElement(node)
+                    ? sanitizeResourceUrl(attribute.value, (_a = options.externalResourcePolicy) !== null && _a !== void 0 ? _a : 'block')
+                    : sanitizeFileViewerRtfHyperlink(attribute.value, (_b = options.externalLinkPolicy) !== null && _b !== void 0 ? _b : 'block');
+                if (href)
+                    node.setAttribute(attribute.name, href);
+                else
+                    node.removeAttribute(attribute.name);
+            }
+            else if (/^src$/i.test(attribute.name)) {
+                const source = sanitizeResourceUrl(attribute.value, (_c = options.externalResourcePolicy) !== null && _c !== void 0 ? _c : 'block');
+                if (source)
+                    node.setAttribute(attribute.name, source);
+                else
+                    node.removeAttribute(attribute.name);
+            }
+            else if (/^(?:background|poster|srcset)$/i.test(attribute.name)) {
+                node.removeAttribute(attribute.name);
+            }
+            else if (/^ping$/i.test(attribute.name)) {
+                node.removeAttribute(attribute.name);
+            }
+        }
+        if (node instanceof windowRef.HTMLAnchorElement) {
+            if ((node.getAttribute('href') || '').startsWith('#'))
+                node.removeAttribute('target');
+            else if ((node.getAttribute('target') || '').toLowerCase() === '_blank') {
+                node.setAttribute('rel', 'noopener noreferrer');
+            }
+        }
+    });
+    return fragment;
+};
+export const sanitizeFileViewerRtfElement = (documentRef, element, options = {}) => sanitizeFileViewerRtfMarkup(documentRef, element.outerHTML, element.textContent || '', options);
+/**
+ * Safe serialization boundary for integrations that consume renderer markup
+ * directly instead of mounting through the standard File Viewer handler.
+ */
+export const sanitizeFileViewerRtfHtml = (documentRef, markup, options = {}) => {
+    const container = documentRef.createElement('div');
+    container.append(sanitizeFileViewerRtfMarkup(documentRef, markup, markup, options));
+    return container.innerHTML;
+};

package/dist/wordDoc.js

@@ -368,11 +368,12 @@ function makeMsDocResponsive(target) {
  * 渲染 doc 文件
  */
 export default async function render(buffer, target, context) {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f, _g, _h;
     const rendered = await parseMsDocToHtml(buffer, {
         renderOptions: {
             css: `${defaultMsDocCss()}\n${WORD_PAGE_CSS}`,
-            externalLinkPolicy: (_c = (_b = (_a = context === null || context === void 0 ? void 0 : context.options) === null || _a === void 0 ? void 0 : _a.docx) === null || _b === void 0 ? void 0 : _b.externalLinkPolicy) !== null && _c !== void 0 ? _c : 'block'
+            externalLinkPolicy: (_c = (_b = (_a = context === null || context === void 0 ? void 0 : context.options) === null || _a === void 0 ? void 0 : _a.docx) === null || _b === void 0 ? void 0 : _b.externalLinkPolicy) !== null && _c !== void 0 ? _c : 'block',
+            externalResourcePolicy: (_f = (_e = (_d = context === null || context === void 0 ? void 0 : context.options) === null || _d === void 0 ? void 0 : _d.docx) === null || _e === void 0 ? void 0 : _e.externalResourcePolicy) !== null && _f !== void 0 ? _f : 'block'
         }
     });
     const targetWindow = target.ownerDocument.defaultView;
@@ -386,13 +387,13 @@ export default async function render(buffer, target, context) {
     content.append(sanitizeMsDocHtml(wrapAsWordPages(rendered.html), targetWindow));
     target.replaceChildren(style, ...Array.from(content.childNodes));
     const disposeResponsive = makeMsDocResponsive(target);
-    (_d = context === null || context === void 0 ? void 0 : context.registerExportAdapter) === null || _d === void 0 ? void 0 : _d.call(context, {
+    (_g = context === null || context === void 0 ? void 0 : context.registerExportAdapter) === null || _g === void 0 ? void 0 : _g.call(context, {
         includeDocumentStyles: false,
         getPrintMaskPages: () => Array.from(target.querySelectorAll('.msdoc-page')),
         printStyle: buildMsDocPrintStyle,
         toHtml: () => prepareMsDocCloneForExport(target)
     });
-    (_e = context === null || context === void 0 ? void 0 : context.registerThumbnailAdapter) === null || _e === void 0 ? void 0 : _e.call(context, {
+    (_h = context === null || context === void 0 ? void 0 : context.registerThumbnailAdapter) === null || _h === void 0 ? void 0 : _h.call(context, {
         getTarget: () => target.querySelector('.msdoc-page') || target
     });
     return {
@@ -402,7 +403,7 @@ export default async function render(buffer, target, context) {
             (_a = context === null || context === void 0 ? void 0 : context.registerExportAdapter) === null || _a === void 0 ? void 0 : _a.call(context, null);
             (_b = context === null || context === void 0 ? void 0 : context.registerThumbnailAdapter) === null || _b === void 0 ? void 0 : _b.call(context, null);
             disposeResponsive();
-            target.innerHTML = '';
+            target.replaceChildren();
         }
     };
 }

package/dist/wordDocx.d.ts

@@ -2,8 +2,10 @@ import type { Options, renderAsync } from '@file-viewer/docx';
 import { type FileRenderContext, type FileViewerDocxOptions, type FileViewerRenderedInstance as AppWrapper } from '@file-viewer/core';
 type DocxRenderAsync = typeof renderAsync;
 type DocxExternalLinkPolicy = NonNullable<FileViewerDocxOptions['externalLinkPolicy']>;
+type DocxExternalResourcePolicy = NonNullable<FileViewerDocxOptions['externalResourcePolicy']>;
 type DocxRenderOptions = Partial<Options> & {
     externalLinkPolicy: DocxExternalLinkPolicy;
+    externalResourcePolicy: DocxExternalResourcePolicy;
 };
 export declare const isMissingDocxHeaderFooterRootError: (error: unknown) => boolean;
 /**

package/dist/wordDocx.js

@@ -9,7 +9,7 @@ const DOCX_WORKER_UNSAFE_PROTOCOLS = new Set(['file:', 'about:', 'data:']);
 const DOCX_MIN_SCALE = 0.24;
 const DOCX_MAX_SCALE = 3;
 const DOCX_ZOOM_STEP = 0.15;
-const DOCX_VENDOR_ASSET_VERSION = '0.3.27';
+const DOCX_VENDOR_ASSET_VERSION = '0.3.28';
 const ZIP_SIGNATURE_PK = 0x504b;
 const WORDPROCESSINGML_NAMESPACE = 'http://schemas.openxmlformats.org/wordprocessingml/2006/main';
 const OFFICE_RELATIONSHIP_NAMESPACE = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships';
@@ -74,7 +74,7 @@ export const renderDocxWithHeaderFooterFallback = async (render, buffer, target,
         if (!isMissingDocxHeaderFooterRootError(error)) {
             throw error;
         }
-        target.innerHTML = '';
+        target.replaceChildren();
         await render(buffer, target, undefined, {
             ...options,
             renderHeaders: false,
@@ -283,7 +283,7 @@ export const applyDocxExternalLinkPolicy = (target, policy) => {
     return blocked;
 };
 export const createDocxOptions = (target, context, notifyProgressiveRender) => {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     const docxOptions = (_a = context === null || context === void 0 ? void 0 : context.options) === null || _a === void 0 ? void 0 : _a.docx;
     const documentBaseUrl = resolveFileViewerRuntimeAssetBaseUrl(target.ownerDocument);
     const useWorker = shouldUseDocxWorker(target, docxOptions);
@@ -295,11 +295,13 @@ export const createDocxOptions = (target, context, notifyProgressiveRender) => {
         }
     };
     const externalLinkPolicy = (_b = docxOptions === null || docxOptions === void 0 ? void 0 : docxOptions.externalLinkPolicy) !== null && _b !== void 0 ? _b : 'block';
+    const externalResourcePolicy = (_c = docxOptions === null || docxOptions === void 0 ? void 0 : docxOptions.externalResourcePolicy) !== null && _c !== void 0 ? _c : 'block';
     const options = {
         useWorker,
         breakPages: usePagedLayout,
-        ignoreLastRenderedPageBreak: (_c = docxOptions === null || docxOptions === void 0 ? void 0 : docxOptions.ignoreLastRenderedPageBreak) !== null && _c !== void 0 ? _c : !usePagedLayout,
+        ignoreLastRenderedPageBreak: (_d = docxOptions === null || docxOptions === void 0 ? void 0 : docxOptions.ignoreLastRenderedPageBreak) !== null && _d !== void 0 ? _d : !usePagedLayout,
         externalLinkPolicy,
+        externalResourcePolicy,
         darkMode,
         progress: event => {
             if (event.phase === 'render' || event.phase === 'layout' || event.phase === 'done') {
@@ -700,7 +702,7 @@ function prepareDocxCloneForExport(target) {
 export default async function (buffer, target, context) {
     var _a, _b;
     assertValidDocxPackage(buffer, context);
-    target.innerHTML = '';
+    target.replaceChildren();
     let hasNotifiedProgressiveRender = false;
     const notifyProgressiveRender = () => {
         var _a;
@@ -753,7 +755,7 @@ export default async function (buffer, target, context) {
             delete target.dataset.docxDarkMode;
             delete target.dataset.docxHeaderFooterFallback;
             delete target.dataset.docxPageBackground;
-            target.innerHTML = '';
+            target.replaceChildren();
         }
     };
 }

package/file-viewer.capability.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../../../ecosystem/capability-manifest.schema.json",
+  "schemaVersion": 1,
+  "id": "word",
+  "packageName": "@file-viewer/renderer-word",
+  "rendererIds": ["office-word-openxml", "office-word-binary", "open-document"],
+  "formats": ["docx", "docm", "dotx", "dotm", "doc", "dot", "odt", "odp"],
+  "assets": {
+    "rendererIds": ["office-word-openxml"],
+    "packageName": "@file-viewer/assets-standard",
+    "bin": "file-viewer-assets-standard",
+    "apiExport": "installFileViewerStandardAssets",
+    "target": "public/file-viewer",
+    "copyGroups": ["office-word-openxml"],
+    "copyMode": "profile-pack",
+    "receiptFilename": "file-viewer-assets-standard.receipt.json",
+    "notice": "DOCX Worker and its offline ZIP runtime."
+  },
+  "license": { "spdx": "Apache-2.0", "policy": "permissive" },
+  "weight": "standard",
+  "profiles": ["standard", "office", "all"]
+}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@file-viewer/renderer-word",
-  "version": "2.4.0",
+  "version": "3.0.0",
   "private": false,
   "type": "module",
-  "description": "Standalone Word and compatible document renderer plugin for File Viewer powered by @file-viewer/docx, @file-viewer/doc, and RTF/ODF parsing.",
+  "description": "Standalone DOCX, DOC, and OpenDocument renderer for File Viewer; RTF parsing is an explicit opt-in capability.",
   "keywords": [
     "file-viewer",
     "renderer",
@@ -52,23 +52,29 @@
   },
   "files": [
     "dist",
+    "file-viewer.capability.json",
     "README.md",
     "README.en.md",
     "LICENSE"
   ],
   "dependencies": {
-    "@file-viewer/core": "2.4.0",
-    "@file-viewer/doc": "2.4.0",
-    "@file-viewer/docx": "^0.3.27",
-    "jszip": "^3.10.1",
-    "rtf.js": "^3.0.9"
+    "@file-viewer/core": "3.0.0",
+    "@file-viewer/doc": "3.0.0",
+    "@file-viewer/docx": "0.3.28",
+    "jszip": "^3.10.1"
   },
   "devDependencies": {
+    "rtf.js": "^3.0.9",
+    "jsdom": "^27.4.0",
     "typescript": "^6.0.3"
   },
+  "fileViewer": {
+    "capabilityManifest": "./file-viewer.capability.json"
+  },
   "license": "Apache-2.0",
   "scripts": {
-    "build": "tsc -b tsconfig.json",
-    "type-check": "tsc -b tsconfig.json"
+    "build": "tsc -b tsconfig.json && node --test test/*.test.mjs",
+    "type-check": "tsc -b tsconfig.json",
+    "verify:rtf-security": "npm exec --yes --package playwright@1.61.1 -- node scripts/verify-rtf-link-policy.mjs"
   }
 }