@gilav21/shadcn-angular-rte 0.1.2 → 0.2.1

package/fesm2022/{gilav21-shadcn-angular-rte-pdf-readable-DmE-CIxv.mjs → gilav21-shadcn-angular-rte-pdf-readable-JvCpuNQH.mjs}

@@ -1,4 +1,79 @@
 import { B as ByteSink, z as zlibInflate } from './gilav21-shadcn-angular-rte-inflate-laXxypva.mjs';
+import { a as cssFontFamily, e as escapeAttribute, s as safeLinkHref } from './gilav21-shadcn-angular-rte-markup-safety-qJk8EoPk.mjs';
+
+const DEFAULT_PARSER_LIMITS = Object.freeze({
+    maxImagePixels: 50_000_000,
+    maxDecodedBytesTotal: 1024 * 1024 * 1024,
+    maxNestingDepth: 32,
+    maxFormDrawsPerPage: 10_000,
+    maxPages: 10_000,
+    maxOle2StreamBytes: 256 * 1024 * 1024,
+});
+/**
+ * Marks `node` visited. Returns false when it already was, so a walk over a
+ * shared or cyclic reference graph visits each node once.
+ */
+function visitOnce(seen, node) {
+    if (seen.has(node))
+        return false;
+    seen.add(node);
+    return true;
+}
+/**
+ * Guards recursive drawing of shared content (form XObjects): a node is
+ * skipped when it is already on the current draw path (a cycle), when the path
+ * is at the depth cap, or when the draw budget is spent. A node that is merely
+ * shared — drawn again from a different path — is drawn every time, because the
+ * path is a recursion stack, not an "ever drawn" set.
+ */
+class DrawPath {
+    constructor(maxDepth, maxDraws) {
+        this.maxDepth = maxDepth;
+        this.maxDraws = maxDraws;
+        this.path = new Set();
+        this.draws = 0;
+    }
+    /** Runs `draw` inside `node` unless a guard trips; returns whether it ran. */
+    enter(node, draw) {
+        if (this.path.has(node) || this.path.size >= this.maxDepth || this.draws >= this.maxDraws) {
+            return false;
+        }
+        this.draws++;
+        this.path.add(node);
+        try {
+            draw();
+        }
+        finally {
+            this.path.delete(node);
+        }
+        return true;
+    }
+}
+/** A byte budget shared by every stream decode in one parse. */
+class DecodeBudget {
+    constructor(total) {
+        this.remaining = total;
+    }
+    /** Charges `bytes`; returns false (charging nothing) when they do not fit. */
+    take(bytes) {
+        if (bytes > this.remaining)
+            return false;
+        this.remaining -= bytes;
+        return true;
+    }
+    /** True once nothing is left, so a caller can refuse work before doing it. */
+    get spent() {
+        return this.remaining <= 0;
+    }
+    /**
+     * Gives up what is left. A charge that did not fit means the work it paid
+     * for was already done; spending the rest stops every later decode of the
+     * same size from doing that work again just to be refused.
+     */
+    spendRemainder() {
+        this.remaining = 0;
+    }
+}
 
 /**
  * Ceiling for a single decoded PDF stream. A stream's filter chain can expand
@@ -369,8 +444,12 @@ function decodeCCITTFax(data, parms, reader) {
     const rows = reader.getNumber(parms['Rows']) || 0;
     const encodedByteAlign = !!parms['EncodedByteAlign'];
     const blackIs1 = !!parms['BlackIs1'];
+    // Columns and Rows are the file's claim, not the image's size: a row that
+    // alone exceeds the pixel cap is refused, and rows stop where the cap does.
+    if (columns <= 0 || columns > reader.limits.maxImagePixels)
+        return new Uint8Array(0);
     const rowBytes = Math.ceil(columns / 8);
-    const maxRows = rows > 0 ? rows : 10000;
+    const maxRows = Math.min(rows > 0 ? rows : 10000, Math.floor(reader.limits.maxImagePixels / columns));
     const output = [];
     const bitReader = new CCITTBitReader(data);
     if (k < 0) {
@@ -399,7 +478,9 @@ function decodeCCITTGroup3Row(reader, columns) {
     const line = new Uint8Array(columns);
     let col = 0;
     let isWhite = true;
-    while (col < columns) {
+    // Past the end of the data every bit reads 0, which is no code at all, so a
+    // row cut short would otherwise alternate zero-length runs forever.
+    while (col < columns && !reader.exhausted) {
         const tree = isWhite ? whiteTree : blackTree;
         const runLen = ccittDecodeRun(reader, tree);
         const fill = isWhite ? 0 : 1;
@@ -575,13 +656,24 @@ function paethPredictor(a, b, c) {
 }
 // ── PDF structure parser ────────────────────────────────────────────────
 class PdfReader {
-    constructor(buffer) {
+    /**
+     * `limits` holds the caps the reader and its renderers apply to what the
+     * file declares — image size, nesting, page count, form draws and total
+     * decoded bytes.
+     */
+    constructor(buffer, limits = DEFAULT_PARSER_LIMITS) {
+        this.limits = limits;
         this.objects = new Map();
         this.parsedObjects = new Map();
         this.compressedObjects = new Map();
         this.trailer = null;
+        /** References being parsed right now: an object whose /Length leads back to itself must not recurse. */
+        this.resolving = new Set();
+        /** Arrays and dictionaries open right now in the value being parsed. */
+        this.nesting = 0;
         this.data = new Uint8Array(buffer);
         this.text = new TextDecoder('latin1').decode(this.data);
+        this.decodeBudget = new DecodeBudget(limits.maxDecodedBytesTotal);
     }
     parse() {
         this.findXRef();
@@ -614,12 +706,21 @@ class PdfReader {
         match ??= this.findLastStartxref(this.text.slice(-8192));
         if (!match)
             throw new Error('Could not find startxref in PDF');
-        const xrefOffset = Number.parseInt(match[1], 10);
-        if (this.text.substring(xrefOffset, xrefOffset + 4) === 'xref') {
-            this.parseTraditionalXRef(xrefOffset);
-        }
-        else {
-            this.parseXRefStream(xrefOffset);
+        this.walkXRefChain(Number.parseInt(match[1], 10));
+    }
+    /**
+     * Reads the newest xref section, then each /Prev behind it. A section
+     * already read ends the walk, so a /Prev that points back at itself or at a
+     * later section cannot loop, and the walk needs no call stack however long
+     * the chain of incremental updates is.
+     */
+    walkXRefChain(newest) {
+        const seen = new Set();
+        let offset = newest;
+        while (offset !== null && visitOnce(seen, offset)) {
+            offset = this.text.substring(offset, offset + 4) === 'xref'
+                ? this.parseTraditionalXRef(offset)
+                : this.parseXRefStream(offset);
         }
     }
     /**
@@ -724,23 +825,27 @@ class PdfReader {
             this.objects.set(key, { offset: entryOffset, gen });
         }
     }
+    /** Adopts the section's trailer; returns the /Prev offset it names, if any. */
     parseTrailerDict(offset) {
         const trailerPos = this.text.indexOf('trailer', offset);
         if (trailerPos === -1)
-            return;
+            return null;
         const dictStart = this.text.indexOf('<<', trailerPos);
         if (dictStart === -1)
-            return;
+            return null;
         const result = this.parseObjectAt(dictStart);
         if (result.obj.type !== 'dict')
-            return;
+            return null;
         const dict = result.obj.value;
         this.trailer ??= dict;
+        return this.prevOffset(dict);
+    }
+    prevOffset(dict) {
         const prev = dict['Prev'];
-        if (prev?.type === 'number') {
-            this.parseTraditionalXRef(prev.value);
-        }
+        return prev?.type === 'number' ? prev.value : null;
     }
+    /** Smallest an entry can be: 10 + 1 + 5 + 1 + 1 characters, with no terminator. */
+    static { this.MIN_XREF_ENTRY_CHARS = 18; }
     parseTraditionalXRef(offset) {
         let pos = offset + 4;
         pos = this.skipWhitespace(pos);
@@ -754,14 +859,18 @@ class PdfReader {
             const count = Number.parseInt(headerMatch[2], 10);
             pos += headerMatch[0].length;
             pos = this.skipWhitespace(pos);
-            for (let i = 0; i < count; i++) {
+            // The count is the file's claim; the bytes left bound what it can hold.
+            const holdable = Math.ceil((this.text.length - pos) / PdfReader.MIN_XREF_ENTRY_CHARS);
+            for (let i = 0; i < Math.min(count, holdable); i++) {
+                if (this.text.startsWith('trailer', pos))
+                    break;
                 this.parseXRefEntry(this.text.substring(pos, pos + 20), startObj, i);
                 pos += 20;
                 while (pos < this.text.length && (this.text[pos] === '\r' || this.text[pos] === '\n' || this.text[pos] === ' '))
                     pos++;
             }
         }
-        this.parseTrailerDict(offset);
+        return this.parseTrailerDict(offset);
     }
     readXRefField(decoded, bytePos, fieldOffset, fieldWidth) {
         let value = 0;
@@ -809,18 +918,13 @@ class PdfReader {
             }
         }
     }
-    followPrevXRef(dict) {
-        const prev = dict['Prev'];
-        if (prev?.type !== 'number')
-            return;
-        const prevOffset = prev.value;
-        if (this.text.substring(prevOffset, prevOffset + 4) === 'xref') {
-            this.parseTraditionalXRef(prevOffset);
-        }
-        else {
-            this.parseXRefStream(prevOffset);
-        }
+    /** An xref stream entry is three fields of 0-8 bytes; all-zero widths would consume no input. */
+    static isValidXRefWidths(w) {
+        return w.length >= 3
+            && w.every(width => Number.isInteger(width) && width >= 0 && width <= 8)
+            && w[0] + w[1] + w[2] > 0;
     }
+    /** Adopts the section's entries and trailer; returns the /Prev offset it names, if any. */
     parseXRefStream(offset) {
         const result = this.parseObjectAt(offset);
         const obj = result.obj;
@@ -833,10 +937,12 @@ class PdfReader {
         if (wArr?.type !== 'array')
             throw new Error('Missing /W in xref stream');
         const w = wArr.value.map(o => o.value);
+        if (!PdfReader.isValidXRefWidths(w))
+            throw new Error('Invalid /W in xref stream');
         const indexArr = this.getXRefIndexArray(dict);
         const decoded = this.decodeStreamData(dict, streamData);
         this.processXRefStreamEntries(decoded, w, indexArr);
-        this.followPrevXRef(dict);
+        return this.prevOffset(dict);
     }
     skipWhitespace(pos) {
         while (pos < this.text.length && ' \t\r\n\0\f'.includes(this.text[pos]))
@@ -847,10 +953,8 @@ class PdfReader {
         const lengthObj = dict['Length'];
         if (!lengthObj)
             return 0;
-        if (lengthObj.type === 'ref') {
-            return this.resolveRef(lengthObj).value;
-        }
-        return lengthObj.value;
+        const length = lengthObj.type === 'ref' ? this.resolveRef(lengthObj) : lengthObj;
+        return typeof length.value === 'number' ? length.value : 0;
     }
     parseObjectAt(offset) {
         let pos = offset;
@@ -890,7 +994,7 @@ class PdfReader {
         const ch = this.text[pos];
         const ch2 = pos + 1 < this.text.length ? this.text[pos + 1] : '';
         if (ch === '<' && ch2 === '<') {
-            return this.parseDict(pos);
+            return this.parseNested(pos, () => this.parseDict(pos));
         }
         if (ch === '<') {
             return this.parseHexString(pos);
@@ -902,7 +1006,7 @@ class PdfReader {
             return this.parseName(pos);
         }
         if (ch === '[') {
-            return this.parseArray(pos);
+            return this.parseNested(pos, () => this.parseArray(pos));
         }
         if (ch === 't' && this.text.substring(pos, pos + 4) === 'true') {
             return { obj: { type: 'boolean', value: true }, endPos: pos + 4 };
@@ -932,6 +1036,56 @@ class PdfReader {
         }
         return { obj: { type: 'number', value: num }, endPos: afterNum };
     }
+    /**
+     * Parses the container at `pos` unless it would open past the nesting cap.
+     * One that would is skipped whole and read as null: following it down costs
+     * a stack frame per level, and a file can nest to its own length.
+     */
+    parseNested(pos, parse) {
+        if (this.nesting >= this.limits.maxNestingDepth) {
+            return { obj: { type: 'null', value: null }, endPos: this.skipContainer(pos) };
+        }
+        this.nesting++;
+        try {
+            return parse();
+        }
+        finally {
+            this.nesting--;
+        }
+    }
+    /** The end of the dictionary or array opening at `pos`, found without recursion. */
+    skipContainer(pos) {
+        let depth = 0;
+        let i = pos;
+        while (i < this.text.length) {
+            const ch = this.text[i];
+            const pair = ch + this.text.charAt(i + 1);
+            if (ch === '(') {
+                i = this.parseLiteralString(i).endPos;
+            }
+            else if (pair === '<<' || pair === '>>') {
+                depth += pair === '<<' ? 1 : -1;
+                i += 2;
+            }
+            else if (ch === '<') {
+                // Not parseHexString: malformed hex is skipped, not decoded.
+                const close = this.text.indexOf('>', i);
+                i = close === -1 ? this.text.length : close + 1;
+            }
+            else {
+                depth += PdfReader.bracketDelta(ch);
+                i++;
+            }
+            if (depth <= 0)
+                return i;
+        }
+        return i;
+    }
+    static bracketDelta(ch) {
+        if (ch === '[')
+            return 1;
+        return ch === ']' ? -1 : 0;
+    }
     parseDict(pos) {
         pos += 2;
         const dict = {};
@@ -1115,9 +1269,17 @@ class PdfReader {
             this.parseObjectStream(compressed.streamObjNum);
             return this.parsedObjects.get(key) ?? { type: 'null', value: null };
         }
-        const result = this.parseObjectAt(entry.offset);
-        this.parsedObjects.set(key, result.obj);
-        return result.obj;
+        if (this.resolving.has(key))
+            return { type: 'null', value: null };
+        this.resolving.add(key);
+        try {
+            const result = this.parseObjectAt(entry.offset);
+            this.parsedObjects.set(key, result.obj);
+            return result.obj;
+        }
+        finally {
+            this.resolving.delete(key);
+        }
     }
     /**
      * Follow a chain of indirect references to the object it ends at.
@@ -1236,6 +1398,8 @@ class PdfReader {
         const filterObj = dict['Filter'];
         if (!filterObj)
             return rawStream;
+        if (this.decodeBudget.spent)
+            return new Uint8Array(0);
         const filters = this.resolveFilterNames(filterObj);
         const decodeParms = this.getDecodeParmsArray(dict, filters.length);
         let result = rawStream;
@@ -1250,7 +1414,14 @@ class PdfReader {
                 return rawStream;
             }
         }
-        return result;
+        // A stream referenced from many places is decoded again at each one; the
+        // budget is what keeps those repeats from adding up to gigabytes. Past
+        // it the stream reads as empty, and the budget is spent so the next
+        // reference is refused before it decodes anything.
+        if (this.decodeBudget.take(result.length))
+            return result;
+        this.decodeBudget.spendRemainder();
+        return new Uint8Array(0);
     }
     getStreamData(obj) {
         const resolved = this.resolveDeep(obj);
@@ -1296,21 +1467,32 @@ class PdfReader {
         return this.collectPages(pagesRef);
     }
     static { this.INHERITABLE_PAGE_KEYS = ['Resources', 'MediaBox', 'CropBox', 'Rotate']; }
-    collectPages(node, inherited = {}) {
-        const dict = this.getDict(node);
-        const typeObj = dict['Type'];
-        const typeName = typeObj ? this.getString(typeObj) : '';
-        const kids = dict['Kids'];
-        if (typeName === 'Page' || (!kids && dict['Contents'])) {
-            this.applyInheritedPageKeys(dict, inherited);
-            return [this.resolveDeep(node)];
-        }
-        if (!kids)
-            return [];
-        const nextInherited = this.mergeInheritablePageKeys(dict, inherited);
+    /**
+     * Walks the page tree depth-first, in page order. Each node is visited once,
+     * so a /Kids that lists an ancestor, or the same child many times, yields
+     * every distinct page once; the walk keeps its own stack, so a tree of any
+     * depth costs no call stack.
+     */
+    collectPages(root) {
         const pages = [];
-        for (const kid of this.getArray(kids)) {
-            pages.push(...this.collectPages(kid, nextInherited));
+        const seen = new Set();
+        const pending = [{ node: root, inherited: {} }];
+        for (let next = pending.pop(); next && pages.length < this.limits.maxPages; next = pending.pop()) {
+            const resolved = this.resolveDeep(next.node);
+            if (!visitOnce(seen, resolved))
+                continue;
+            const dict = this.getDict(resolved);
+            const kids = dict['Kids'];
+            if (this.getString(dict['Type']) === 'Page' || (!kids && dict['Contents'])) {
+                this.applyInheritedPageKeys(dict, next.inherited);
+                pages.push(resolved);
+            }
+            else if (kids) {
+                const inherited = this.mergeInheritablePageKeys(dict, next.inherited);
+                // Pushed last-first, so the first kid is popped first.
+                for (const kid of this.getArray(kids).reverse())
+                    pending.push({ node: kid, inherited });
+            }
         }
         return pages;
     }
@@ -1417,11 +1599,32 @@ function pdfStringToUnicode(raw, fontInfo) {
     const { result, charCodes } = decodeSingleByteString(raw, fontInfo?.toUnicode);
     return { text: result, charCodes };
 }
+const WHITESPACE = /\s/;
+/**
+ * The text between each `begin` marker (plus the one whitespace character that
+ * must follow it) and the next `end`, in order. Found with indexOf: a lazy
+ * regex retries from every unterminated `begin` and rescans to the end of the
+ * text each time, which is quadratic. Once no `end` is left, no later section
+ * can close either, so the scan stops.
+ */
+function* markedSections(text, begin, end) {
+    let from = 0;
+    for (let start = text.indexOf(begin, from); start !== -1; start = text.indexOf(begin, from)) {
+        const bodyStart = start + begin.length + 1;
+        if (!WHITESPACE.test(text.charAt(bodyStart - 1))) {
+            from = start + 1;
+            continue;
+        }
+        const close = text.indexOf(end, bodyStart);
+        if (close === -1)
+            return;
+        yield text.slice(bodyStart, close);
+        from = close + end.length;
+    }
+}
 function parseBfCharEntries(text, map) {
-    const bfCharRe = /beginbfchar\s([\s\S]*?)endbfchar/g;
-    let match;
-    while ((match = bfCharRe.exec(text)) !== null) {
-        for (const entry of match[1].trim().split('\n')) {
+    for (const section of markedSections(text, 'beginbfchar', 'endbfchar')) {
+        for (const entry of section.trim().split('\n')) {
             const parts = /<([0-9a-fA-F]+)>\s*<([0-9a-fA-F]+)>/.exec(entry.trim());
             if (!parts)
                 continue;
@@ -1468,10 +1671,8 @@ function parseBfRangeEntry(trimmed, map) {
     }
 }
 function parseBfRangeEntries(text, map) {
-    const bfRangeRe = /beginbfrange\s([\s\S]*?)endbfrange/g;
-    let match;
-    while ((match = bfRangeRe.exec(text)) !== null) {
-        for (const entry of match[1].trim().split('\n')) {
+    for (const section of markedSections(text, 'beginbfrange', 'endbfrange')) {
+        for (const entry of section.trim().split('\n')) {
             parseBfRangeEntry(entry.trim(), map);
         }
     }
@@ -2709,9 +2910,15 @@ function buildFormCtm(ctx, dict) {
     const m = matrixArr.map(o => ctx.reader.getNumber(o));
     return multiplyMatrix$1(m, ctx.gs.ctm);
 }
+/**
+ * Draws a form XObject unless it is already being drawn higher up (a cycle),
+ * the path is at the nesting cap, or the page's draw budget is spent. A form
+ * shared between sibling draws is drawn every time.
+ */
 function processFormXObject(parentCtx, formObj) {
-    if (parentCtx.formDepth >= 10)
-        return;
+    parentCtx.formDraws.enter(formObj, () => drawFormXObject(parentCtx, formObj));
+}
+function drawFormXObject(parentCtx, formObj) {
     const dict = formObj.value;
     if (!formObj.stream)
         return;
@@ -2745,7 +2952,7 @@ function buildFormContext(parentCtx, fontInfoMap, xObjectDict, resources, formCt
             lineCap: parentCtx.gs.lineCap, lineJoin: parentCtx.gs.lineJoin,
         },
         operandStack: [], pageIndex: parentCtx.pageIndex,
-        formDepth: parentCtx.formDepth + 1, compatibilityMode: 0,
+        formDraws: parentCtx.formDraws, compatibilityMode: 0,
         mcidStack: [], ocgOffSet: parentCtx.ocgOffSet ?? new Set(),
         ocgHiddenDepth: 0, perFragment: parentCtx.perFragment,
         patternFillImage: null,
@@ -3739,7 +3946,7 @@ function buildExtractionContext(reader, resources, fontDict, xObjectDict, initia
             dashArray: [], dashPhase: 0, lineCap: 0, lineJoin: 0,
         },
         operandStack: [], pageIndex,
-        formDepth: 0, compatibilityMode: 0,
+        formDraws: new DrawPath(reader.limits.maxNestingDepth, reader.limits.maxFormDrawsPerPage), compatibilityMode: 0,
         mcidStack: [], ocgOffSet: new Set(),
         ocgHiddenDepth: 0, perFragment: options?.perFragment ?? false,
         patternFillImage: null,
@@ -3795,6 +4002,16 @@ function resolveImageFilterName(reader, dict) {
     const last = reader.resolveDeep(lastEntry);
     return last.type === 'name' ? last.value : '';
 }
+const ALLOWED_BITS_PER_COMPONENT = new Set([1, 2, 4, 8, 16]);
+/**
+ * Whether the declared raster is one we will expand into pixel rows, PNG and
+ * base64 (roughly 24 bytes per source byte). The size is the file's claim, so it
+ * is checked before anything is allocated for it.
+ */
+function isDecodableRaster(reader, width, height, dict) {
+    const bpc = reader.getNumber(dict['BitsPerComponent']) || 8;
+    return ALLOWED_BITS_PER_COMPONENT.has(bpc) && width * height <= reader.limits.maxImagePixels;
+}
 function buildImageDataUrl(filterName, xObj, reader, width, height, dict) {
     if (filterName === 'DCTDecode') {
         if (!xObj.stream)
@@ -3806,6 +4023,8 @@ function buildImageDataUrl(filterName, xObj, reader, width, height, dict) {
             return null;
         return `data:image/jp2;base64,${uint8ArrayToBase64(xObj.stream)}`;
     }
+    if (!isDecodableRaster(reader, width, height, dict))
+        return null;
     const decoded = reader.getStreamData(xObj);
     if (decoded.length === 0)
         return null;
@@ -4620,7 +4839,7 @@ function buildItemStyles(item, bodyFont, bodySize) {
     if (!isDefaultColor(item.color))
         styles.push(`color: ${item.color}`);
     if (item.fontFamily && item.fontFamily !== bodyFont)
-        styles.push(`font-family: '${item.fontFamily}'`);
+        styles.push(`font-family: ${cssFontFamily(item.fontFamily)}`);
     const sizeRatio = bodySize > 0 ? item.fontSize / bodySize : 1;
     if (sizeRatio < 0.85 || sizeRatio > 1.15) {
         const editorSize = Math.round(sizeRatio * 12);
@@ -4642,7 +4861,7 @@ function wrapItemHtml(item, text, bodyFont, bodySize, linkUri) {
     let fragment = text;
     const styles = buildItemStyles(item, bodyFont, bodySize);
     if (styles.length > 0) {
-        fragment = `<span style="${styles.join('; ')}">${fragment}</span>`;
+        fragment = `<span style="${escapeAttribute(styles.join('; '))}">${fragment}</span>`;
     }
     if (item.textRise > 1) {
         fragment = `<sup>${fragment}</sup>`;
@@ -4654,10 +4873,10 @@ function wrapItemHtml(item, text, bodyFont, bodySize, linkUri) {
         fragment = `<em>${fragment}</em>`;
     if (item.bold)
         fragment = `<strong>${fragment}</strong>`;
-    if (linkUri) {
-        const safeUri = escapeHtml$2(linkUri);
+    const safeUri = linkUri ? safeLinkHref(linkUri) : undefined;
+    if (safeUri !== undefined) {
         const linkColor = isDefaultColor(item.color) ? '#1a0dab' : item.color;
-        fragment = `<a href="${safeUri}" target="_blank" rel="noopener noreferrer" style="color:${linkColor};text-decoration:underline">${fragment}</a>`;
+        fragment = `<a href="${escapeAttribute(safeUri)}" target="_blank" rel="noopener noreferrer" style="color:${linkColor};text-decoration:underline">${fragment}</a>`;
     }
     return fragment;
 }
@@ -4756,7 +4975,21 @@ function detectColumns(lines) {
 const BULLET_PATTERN = /^[\u2022\u2023\u25E6\u2043\u2219\u25CF\u25CB\u25AA\u25AB\u2013\u2014\-*]\s*/;
 const BULLET_CHARS = /^[\u2022\u2023\u25E6\u2043\u2219\u25CF\u25CB\u25AA\u25AB\u2013\u2014\-*]+$/;
 const NUMBERED_PATTERN = /^(\d{1,3})[.)]\s+/;
-const NUMBERED_PATTERN_RTL_END = /(?=(\s+))\1[.)]\d{1,3}$/;
+const RTL_NUMBER_TAIL = /[.)]\d{1,3}$/;
+/**
+ * Where a trailing right-to-left list number starts — whitespace, then ".12"
+ * or ")12" at the end of the text — or -1. Matched from the number backwards:
+ * a `\s+` regex retried from every space of a long run is quadratic.
+ */
+function rtlNumberTailStart(text) {
+    const tail = RTL_NUMBER_TAIL.exec(text);
+    if (!tail)
+        return -1;
+    let start = tail.index;
+    while (start > 0 && WHITESPACE.test(text.charAt(start - 1)))
+        start--;
+    return start === tail.index ? -1 : start;
+}
 function stripBulletItems(line) {
     const filtered = line.items.filter(item => {
         const t = item.text.trim();
@@ -4795,9 +5028,9 @@ function stripNumberedPrefix(line) {
             const trimmed = item.text.replace(NUMBERED_PATTERN, '');
             if (trimmed !== item.text)
                 return { ...item, text: trimmed };
-            const trimmedRtl = item.text.replace(NUMBERED_PATTERN_RTL_END, '');
-            if (trimmedRtl !== item.text)
-                return { ...item, text: trimmedRtl };
+            const rtlStart = rtlNumberTailStart(item.text);
+            if (rtlStart >= 0)
+                return { ...item, text: item.text.slice(0, rtlStart) };
             return item;
         }),
         y: line.y,
@@ -4980,7 +5213,7 @@ function appendToParagraph(line, bodySize, bodyFont, state, options, rtl) {
     detectParagraphIndent(state);
 }
 function isNumberedLine(lineText, rtl) {
-    return NUMBERED_PATTERN.test(lineText) || (rtl && NUMBERED_PATTERN_RTL_END.test(lineText));
+    return NUMBERED_PATTERN.test(lineText) || (rtl && rtlNumberTailStart(lineText) >= 0);
 }
 function processHtmlLine(line, lineText, bodySize, bodyFont, state, options) {
     const { structureMap } = options;
@@ -5791,39 +6024,44 @@ function resolvePageIndex(reader, pageRef, pages) {
     return findPageIndexByDict(reader, dict, pages);
 }
 function processStructKDict(opts) {
-    const { reader, kDict, pages, effectivePage, depth, mcids, children, elemRef } = opts;
+    const { walk, kDict, effectivePage, depth, mcids, children, elemRef } = opts;
     const mcidObj = kDict['MCID'];
     if (mcidObj) {
-        const mcidVal = reader.getNumber(mcidObj);
+        const mcidVal = walk.reader.getNumber(mcidObj);
         const mcidPageRef = kDict['Pg'];
-        const mcidPage = mcidPageRef ? resolvePageIndex(reader, mcidPageRef, pages) : effectivePage;
+        const mcidPage = mcidPageRef ? resolvePageIndex(walk.reader, mcidPageRef, walk.pages) : effectivePage;
         mcids.push({ mcid: mcidVal, page: mcidPage >= 0 ? mcidPage : effectivePage });
     }
     else {
-        const child = parseStructureElement(reader, elemRef, pages, effectivePage, depth + 1);
+        const child = parseStructureElement(walk, elemRef, effectivePage, depth + 1);
         if (child)
             children.push(child);
     }
 }
-function processStructKArrayItem(reader, item, pages, effectivePage, depth, mcids, children) {
-    const itemResolved = reader.resolveDeep(item);
+function processStructKArrayItem(walk, item, effectivePage, depth, mcids, children) {
+    const itemResolved = walk.reader.resolveDeep(item);
     if (itemResolved.type === 'number') {
         mcids.push({ mcid: itemResolved.value, page: effectivePage });
     }
     else if (itemResolved.type === 'dict') {
         const itemDict = itemResolved.value;
-        processStructKDict({ reader, kDict: itemDict, pages, effectivePage, depth, mcids, children, elemRef: item });
+        processStructKDict({ walk, kDict: itemDict, effectivePage, depth, mcids, children, elemRef: item });
     }
 }
-function parseStructureElement(reader, elemObj, pages, parentPageIdx, depth) {
+function parseStructureElement(walk, elemObj, parentPageIdx, depth) {
     if (depth > 50)
         return null;
+    const { reader, pages } = walk;
     const resolved = reader.resolveDeep(elemObj);
     if (resolved.type === 'number') {
         return { type: 'MCID', mcids: [{ mcid: resolved.value, page: parentPageIdx }], children: [] };
     }
     if (resolved.type !== 'dict')
         return null;
+    // An element has one parent; a second reference to it is a shared or cyclic
+    // node, and expanding it again costs a copy of its whole subtree each time.
+    if (!visitOnce(walk.seen, resolved))
+        return null;
     const dict = resolved.value;
     const typeStr = reader.getString(dict['Type']);
     if (typeStr && typeStr !== 'StructElem')
@@ -5843,11 +6081,11 @@ function parseStructureElement(reader, elemObj, pages, parentPageIdx, depth) {
     }
     else if (kResolved.type === 'dict') {
         const kDict = kResolved.value;
-        processStructKDict({ reader, kDict, pages, effectivePage, depth, mcids, children, elemRef: kResolved });
+        processStructKDict({ walk, kDict, effectivePage, depth, mcids, children, elemRef: kResolved });
     }
     else if (kResolved.type === 'array') {
         for (const item of kResolved.value) {
-            processStructKArrayItem(reader, item, pages, effectivePage, depth, mcids, children);
+            processStructKArrayItem(walk, item, effectivePage, depth, mcids, children);
         }
     }
     return { type: sType, mcids, children };
@@ -5863,8 +6101,8 @@ function collectMcidTypes(node, result) {
         collectMcidTypes(child, result);
     }
 }
-function collectMcidTypesFromElement(reader, item, pages, mcidToType) {
-    const node = parseStructureElement(reader, item, pages, 0, 0);
+function collectMcidTypesFromElement(walk, item, mcidToType) {
+    const node = parseStructureElement(walk, item, 0, 0);
     if (node)
         collectMcidTypes(node, mcidToType);
 }
@@ -5880,14 +6118,15 @@ function parseStructureTree(reader, pages) {
         if (!kObj)
             return emptyResult;
         const mcidToType = new Map();
+        const walk = { reader, pages, seen: new Set() };
         const kResolved = reader.resolveDeep(kObj);
         if (kResolved.type === 'array') {
             for (const item of kResolved.value) {
-                collectMcidTypesFromElement(reader, item, pages, mcidToType);
+                collectMcidTypesFromElement(walk, item, mcidToType);
             }
         }
         else {
-            collectMcidTypesFromElement(reader, kObj, pages, mcidToType);
+            collectMcidTypesFromElement(walk, kObj, mcidToType);
         }
         return { mcidToType, hasStructure: mcidToType.size > 0 };
     }
@@ -5924,7 +6163,11 @@ function isStructureListItem(type) {
     return type === 'LI' || type === 'LBody' || type === 'Lbl';
 }
 // ── Main export ─────────────────────────────────────────────────────────
-async function parsePdf(buffer) {
+/**
+ * Parses a PDF into flowing HTML and plain text.
+ * Input is untrusted; structures exceeding internal limits are skipped.
+ */
+async function parsePdf(buffer, limits = DEFAULT_PARSER_LIMITS) {
     const header = new Uint8Array(buffer, 0, Math.min(5, buffer.byteLength));
     if (header.length < 5 ||
         header[0] !== 0x25 ||
@@ -5934,7 +6177,7 @@ async function parsePdf(buffer) {
         header[4] !== 0x2D) {
         throw new Error('Not a valid PDF file.');
     }
-    const reader = new PdfReader(buffer);
+    const reader = new PdfReader(buffer, limits);
     try {
         reader.parse();
     }
@@ -6036,14 +6279,18 @@ function extractAllPages(reader, pdfPages, structureMap) {
     }
     return { pages, allTextParts, allHtmlParts, allImageOnly };
 }
-async function parsePdfPaged(buffer) {
+/**
+ * Parses a PDF into one HTML fragment per page, plus the outline.
+ * Input is untrusted; structures exceeding internal limits are skipped.
+ */
+async function parsePdfPaged(buffer, limits = DEFAULT_PARSER_LIMITS) {
     const header = new Uint8Array(buffer, 0, Math.min(5, buffer.byteLength));
     if (header.length < 5 ||
         header[0] !== 0x25 || header[1] !== 0x50 || header[2] !== 0x44 ||
         header[3] !== 0x46 || header[4] !== 0x2D) {
         throw new Error('Not a valid PDF file.');
     }
-    const reader = new PdfReader(buffer);
+    const reader = new PdfReader(buffer, limits);
     try {
         reader.parse();
     }
@@ -6080,7 +6327,7 @@ function parseOutline(reader, pdfPages) {
         if (!firstRef)
             return [];
         const pageMap = buildPageObjNumMap(reader, pdfPages);
-        return parseOutlineItems(reader, firstRef, pageMap, 0);
+        return parseOutlineItems(reader, firstRef, pageMap, 0, new Set());
     }
     catch {
         return [];
@@ -6131,11 +6378,14 @@ function resolveOutlinePageIndex(reader, item, pageMap) {
         return -1;
     }
 }
-function parseOutlineItems(reader, firstRef, pageMap, depth) {
+/**
+ * `visited` spans the whole outline tree, not one sibling list: two items
+ * pointing at the same child list would otherwise each expand it in full.
+ */
+function parseOutlineItems(reader, firstRef, pageMap, depth, visited) {
     if (depth > 10)
         return [];
     const items = [];
-    const visited = new Set();
     let currentRef = firstRef;
     while (currentRef) {
         const key = currentRef.type === 'ref' ? currentRef.value : '';
@@ -6150,7 +6400,7 @@ function parseOutlineItems(reader, firstRef, pageMap, depth) {
             let children = [];
             const childFirst = itemDict['First'];
             if (childFirst) {
-                children = parseOutlineItems(reader, childFirst, pageMap, depth + 1);
+                children = parseOutlineItems(reader, childFirst, pageMap, depth + 1, visited);
             }
             items.push({ title, pageIndex, children });
             const nextRef = itemDict['Next'];
@@ -7247,6 +7497,42 @@ function escapeHtml$1(str) {
         .replaceAll('>', '&gt;')
         .replaceAll('"', '&quot;');
 }
+/**
+ * A font name taken from the PDF as a quoted CSS string. The CSS is emitted inside
+ * a `<style>` element, so quotes and backslashes are escaped, control characters
+ * dropped and `<` hex-escaped: nothing in the name can end the string, the rule or
+ * the style element.
+ */
+function cssQuotedFontName(name) {
+    let quoted = '';
+    for (const ch of name) {
+        const code = ch.codePointAt(0) ?? 0;
+        if (code < 0x20 || code === 0x7f)
+            continue;
+        if (ch === '\\' || ch === "'")
+            quoted += `\\${ch}`;
+        else if (ch === '<')
+            quoted += String.raw `\3c `;
+        else
+            quoted += ch;
+    }
+    return `'${quoted}'`;
+}
+const SAFE_LINK_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
+/**
+ * The link annotation's URI as the browser will parse it when it is an absolute
+ * http, https or mailto URL; `undefined` for any other scheme or a relative URI.
+ */
+function safeLinkUri(uri) {
+    try {
+        const url = new URL(uri);
+        return SAFE_LINK_PROTOCOLS.has(url.protocol) ? url.href : undefined;
+    }
+    catch {
+        // Not an absolute URL; a relative URI has no page to resolve against here.
+        return undefined;
+    }
+}
 function resolveFontDescriptor(reader, fontObjDict) {
     const direct = fontObjDict['FontDescriptor'];
     if (direct)
@@ -7537,6 +7823,21 @@ function buildFallbackGlyph(fb, unicode, targetAdvance, unitsPerEm) {
 // Serif font family keywords for generic fallback detection
 const SERIF_KEYWORDS = ['times', 'georgia', 'cambria', 'garamond', 'palatino', 'bodoni', 'baskerville', 'bookman', 'century'];
 const MONO_KEYWORDS = ['courier', 'mono', 'consolas', 'menlo', 'lucidaconsole', 'inconsolata'];
+const STYLE_SUFFIX = /(?:Bold|Italic|Regular|Medium|Light|Condensed|Black|Heavy|Oblique|Book|Demi|Semi|Ultra|Thin|Extra|PS)$/i;
+/**
+ * Drops one trailing style word and the whitespace before it ("Arial Bold" →
+ * "Arial"). Found from the word backwards: a `\s+` regex retried from every
+ * space of a long run of spaces is quadratic.
+ */
+function stripStyleSuffix(name) {
+    const word = STYLE_SUFFIX.exec(name);
+    if (!word)
+        return name;
+    let end = word.index;
+    while (end > 0 && /\s/.test(name.charAt(end - 1)))
+        end--;
+    return end === word.index ? name : name.slice(0, end);
+}
 /**
  * Dynamically extract a CSS font-family from any PDF BaseFontName.
  * No static map needed — works for any font by parsing the name.
@@ -7561,9 +7862,8 @@ function getSystemFontFamily(baseFontName) {
     // Clean up dashes/underscores/commas to spaces
     name = name.replaceAll(/[-_,]+/g, ' ').trim();
     // Remove style/weight suffixes (run twice to catch consecutive: "PS Bold" → "")
-    const stylePat = /(?=(\s+))\1(Bold|Italic|Regular|Medium|Light|Condensed|Black|Heavy|Oblique|Book|Demi|Semi|Ultra|Thin|Extra|PS)$/gi;
-    name = name.replaceAll(stylePat, '').trim();
-    name = name.replaceAll(stylePat, '').trim();
+    name = stripStyleSuffix(name).trim();
+    name = stripStyleSuffix(name).trim();
     // Title-case all-lowercase names: "arialuni" → "Arialuni"
     if (name === name.toLowerCase() && name.length > 0) {
         name = name[0].toUpperCase() + name.slice(1);
@@ -7575,7 +7875,7 @@ function getSystemFontFamily(baseFontName) {
         generic = 'serif';
     else if (MONO_KEYWORDS.some(k => lower.includes(k)))
         generic = 'monospace';
-    return `'${name}', ${generic}`;
+    return `${cssQuotedFontName(name)}, ${generic}`;
 }
 function usesSystemFallback(entry) {
     return !entry.reEncodedData;
@@ -7644,7 +7944,7 @@ function fallbackChainFor(entry) {
         generic = 'monospace';
     else if (FAMILY_SERIF_HINT.test(name))
         generic = 'serif';
-    const original = entry.familyName ? `'${entry.familyName.replaceAll(/['";]/g, '')}',` : '';
+    const original = entry.familyName ? `${cssQuotedFontName(entry.familyName)},` : '';
     return `${original}${generic}`;
 }
 function resolveFontFamily(entry, isSymbolFont, familyPrefix = '') {
@@ -7660,7 +7960,7 @@ function resolveFontFamily(entry, isSymbolFont, familyPrefix = '') {
     if (entry.fontData && fontFormatToMime(entry.fontData.format)) {
         return `${embeddedId},${fallbackChainFor(entry)}`;
     }
-    return entry.familyName || 'serif';
+    return entry.familyName ? cssQuotedFontName(entry.familyName) : 'serif';
 }
 class FontRegistry {
     constructor(familyPrefix = '') {
@@ -8785,12 +9085,18 @@ class PixelPerfectProcessor {
         this.reader = reader;
         this.fontRegistry = fontRegistry;
         this.zoom = zoom;
+        this.formDraws = this.newFormDraws();
         // general.cc:326-327: text_scale_factor1 = max(zoom, font_size_multiplier)
         this.textScaleFactor1 = Math.max(zoom, FONT_SIZE_MULTIPLIER);
         this.textScaleFactor2 = zoom / this.textScaleFactor1;
     }
+    newFormDraws() {
+        const { maxNestingDepth, maxFormDrawsPerPage } = this.reader.limits;
+        return new DrawPath(maxNestingDepth, maxFormDrawsPerPage);
+    }
     processPage(pageObj, _pageIndex) {
         this.resetState();
+        this.formDraws = this.newFormDraws();
         this.lines.length = 0;
         this.pathRects.length = 0;
         this.imageItems.length = 0;
@@ -9571,13 +9877,13 @@ class PixelPerfectProcessor {
         const objDict = this.reader.getDict(ref);
         const subtype = this.reader.getString(objDict['Subtype']);
         if (subtype === 'Form') {
-            this.processFormXObject(ref, resources, pageWidth, pageHeight);
+            this.formDraws.enter(this.reader.resolveDeep(ref), () => this.drawFormXObject(ref, resources, pageWidth, pageHeight));
         }
         else if (subtype === 'Image') {
             this.processImageXObject(ref, objDict);
         }
     }
-    processFormXObject(ref, parentResources, pageWidth, pageHeight) {
+    drawFormXObject(ref, parentResources, pageWidth, pageHeight) {
         const objDict = this.reader.getDict(ref);
         const formResources = objDict['Resources']
             ? this.reader.getDict(objDict['Resources'])
@@ -9864,14 +10170,17 @@ function renderImage(img, z) {
     const w = round$1(img.renderWidth * z);
     const h = round$1(img.renderHeight * z);
     return `<img class="bi" style="position:absolute;left:${left}px;bottom:${bottom}px;` +
-        `width:${w}px;height:${h}px;" src="${img.dataUrl}"/>`;
+        `width:${w}px;height:${h}px;" src="${escapeHtml$1(img.dataUrl)}"/>`;
 }
 function renderAnnotation(ann, z) {
+    const href = safeLinkUri(ann.uri);
+    if (!href)
+        return '';
     const left = round$1(ann.x * z);
     const bottom = round$1(ann.y * z);
     const w = round$1(ann.width * z);
     const h = round$1(ann.height * z);
-    return `<a class="l" href="${escapeHtml$1(ann.uri)}">` +
+    return `<a class="l" href="${escapeHtml$1(href)}">` +
         `<div style="position:absolute;left:${left}px;bottom:${bottom}px;` +
         `width:${w}px;height:${h}px;background-color:rgba(255,255,255,0.000001);border-style:none;"></div></a>`;
 }
@@ -9957,14 +10266,18 @@ function assemblePageHtml(result, pageIndex, mgr, fontRegistry, z) {
     };
 }
 // ── Main Entry Point ──────────────────────────────────────────────────
-async function renderPixelPerfectPaged(buffer, options) {
+/**
+ * Renders a PDF page by page with absolutely positioned text, for pixel-faithful display.
+ * Input is untrusted; structures exceeding internal limits are skipped.
+ */
+async function renderPixelPerfectPaged(buffer, options, limits = DEFAULT_PARSER_LIMITS) {
     const header = new Uint8Array(buffer, 0, Math.min(5, buffer.byteLength));
     if (header.length < 5 ||
         header[0] !== 0x25 || header[1] !== 0x50 || header[2] !== 0x44 ||
         header[3] !== 0x46 || header[4] !== 0x2D) {
         throw new Error('Not a valid PDF file.');
     }
-    const reader = new PdfReader(buffer);
+    const reader = new PdfReader(buffer, limits);
     try {
         reader.parse();
     }
@@ -14365,8 +14678,9 @@ function emitRun(run, dominant, ctx) {
         html = `<sup>${html}</sup>`;
     if (style.baselineShift === 'sub')
         html = `<sub>${html}</sub>`;
-    if (style.link)
-        html = `<a href="${escapeHtml(style.link)}" target="_blank" rel="noopener">${html}</a>`;
+    const href = style.link ? safeLinkHref(style.link) : undefined;
+    if (href !== undefined)
+        html = `<a href="${escapeHtml(href)}" target="_blank" rel="noopener">${html}</a>`;
     return html;
 }
 function dominantRunStyle(lines) {
@@ -14493,11 +14807,17 @@ function colorValue(color) {
     const normalized = color.toLowerCase();
     return normalized === '#000000' || normalized === '#000' ? '' : color;
 }
+/**
+ * The declarations as the VALUE of a double-quoted `style` attribute. Escaped
+ * here, at the one place every style attribute is built, because a font name
+ * can hold `&#39&#59…` (character references without their semicolon), which a
+ * browser decodes back into a quote and a `;` and so into a further declaration.
+ */
 function styleAttr(pairs) {
-    return pairs
+    return escapeHtml(pairs
         .filter(([, value]) => value !== '')
         .map(([prop, value]) => `${prop}:${value}`)
-        .join(';');
+        .join(';'));
 }
 function attrString(styleValue, dir) {
     const stylePart = styleValue ? ` style="${styleValue}"` : '';
@@ -14604,17 +14924,17 @@ function registerPageFonts(reader, pageObj, registry, fonts) {
     try {
         const pageDict = reader.getDict(pageObj);
         const resources = pageDict['Resources'] ? reader.getDict(pageDict['Resources']) : {};
-        registerResourceFonts(reader, resources, registry, fonts, 0);
+        registerResourceFonts(reader, resources, registry, fonts, { depth: 0, seen: new Set() });
     }
     catch {
         // A malformed resource dict must not abort the page's text extraction.
     }
 }
-function registerResourceFonts(reader, resources, registry, fonts, depth) {
-    if (depth > MAX_RESOURCE_DEPTH)
+function registerResourceFonts(reader, resources, registry, fonts, walk) {
+    if (walk.depth > MAX_RESOURCE_DEPTH || !visitOnce(walk.seen, resources))
         return;
     registerFontDict(reader, resources, registry, fonts);
-    descendIntoXObjects(reader, resources, registry, fonts, depth);
+    descendIntoXObjects(reader, resources, registry, fonts, walk);
 }
 function registerFontDict(reader, resources, registry, fonts) {
     if (!resources['Font'])
@@ -14642,14 +14962,14 @@ function registerSingleFont(reader, name, ref, registry, fonts) {
         // A single broken font program must not abort the import.
     }
 }
-function descendIntoXObjects(reader, resources, registry, fonts, depth) {
+function descendIntoXObjects(reader, resources, registry, fonts, walk) {
     if (!resources['XObject'])
         return;
     const xObjects = reader.getDict(resources['XObject']);
     for (const ref of Object.values(xObjects)) {
         const nested = resolveXObjectResources(reader, ref);
         if (nested)
-            registerResourceFonts(reader, nested, registry, fonts, depth + 1);
+            registerResourceFonts(reader, nested, registry, fonts, { depth: walk.depth + 1, seen: walk.seen });
     }
 }
 function resolveXObjectResources(reader, ref) {
@@ -14876,10 +15196,11 @@ let importCounter = 0;
  * the original document (fonts, colors, alignment, spacing) without absolute
  * positioning. The returned `fontFaceCss` must be added to the host document
  * (e.g. a `<style>` in `<head>`) for embedded fonts to render.
+ * Input is untrusted; structures exceeding internal limits are skipped.
  */
-async function parsePdfReadable(buffer, options) {
+async function parsePdfReadable(buffer, options, limits = DEFAULT_PARSER_LIMITS) {
     const opts = normalizeOptions(options);
-    const reader = createValidatedReader(buffer);
+    const reader = createValidatedReader(buffer, limits);
     const pages = reader.getPages();
     if (pages.length === 0) {
         throw new Error('PDF contains no pages.');
@@ -14912,7 +15233,7 @@ function normalizeOptions(options) {
         fontFamilyPrefix: options?.fontFamilyPrefix ?? `pdf${importCounter.toString(36)}-`,
     };
 }
-function createValidatedReader(buffer) {
+function createValidatedReader(buffer, limits) {
     const header = new Uint8Array(buffer, 0, Math.min(5, buffer.byteLength));
     const isPdf = header.length === 5 &&
         header[0] === 0x25 && header[1] === 0x50 && header[2] === 0x44 &&
@@ -14920,7 +15241,7 @@ function createValidatedReader(buffer) {
     if (!isPdf) {
         throw new Error('Not a valid PDF file.');
     }
-    const reader = new PdfReader(buffer);
+    const reader = new PdfReader(buffer, limits);
     try {
         reader.parse();
     }
@@ -15005,4 +15326,4 @@ function emitImageOnly(extracted, opts) {
 }
 
 export { parsePdfReadable };
-//# sourceMappingURL=gilav21-shadcn-angular-rte-pdf-readable-DmE-CIxv.mjs.map
+//# sourceMappingURL=gilav21-shadcn-angular-rte-pdf-readable-JvCpuNQH.mjs.map