@json-to-office/jto 0.26.0 → 0.28.0

package/dist/client/templates/modern-annual-report-2.docx.json

@@ -360,7 +360,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-1.88x2.13.png",
+                  "path": "media/modern-annual-report-2/hatch-1.88x2.13.png",
                   "x": 0.63,
                   "y": 8.43,
                   "w": 1.88,
@@ -1559,7 +1559,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-3.53x4.22.png",
+                  "path": "media/modern-annual-report-2/hatch-3.53x4.22.png",
                   "x": 0.5,
                   "y": 1.49,
                   "w": 3.53,
@@ -2511,7 +2511,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-2.19x2.61.png",
+                  "path": "media/modern-annual-report-2/hatch-2.19x2.61.png",
                   "x": 0.53,
                   "y": 8.62,
                   "w": 2.19,
@@ -3985,7 +3985,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/image2.png",
+                  "path": "media/modern-annual-report-2/image2.png",
                   "x": 0.53,
                   "y": 1.91,
                   "w": 7.28,
@@ -4624,7 +4624,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-2.57x2.91.png",
+                  "path": "media/modern-annual-report-2/hatch-2.57x2.91.png",
                   "x": 5.17,
                   "y": 0.55,
                   "w": 2.57,
@@ -10651,7 +10651,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-2.78x3.03.png",
+                  "path": "media/modern-annual-report-2/hatch-2.78x3.03.png",
                   "x": 4.97,
                   "y": 0.44,
                   "w": 2.78,
@@ -12075,7 +12075,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-3.8x5.41.png",
+                  "path": "media/modern-annual-report-2/hatch-3.8x5.41.png",
                   "x": 0.45,
                   "y": 0.41,
                   "w": 3.8,
@@ -12535,7 +12535,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/image4.png",
+                  "path": "media/modern-annual-report-2/image4.png",
                   "x": 0.48,
                   "y": 7.24,
                   "w": 7.27,
@@ -13049,7 +13049,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-2.22x2.88.png",
+                  "path": "media/modern-annual-report-2/hatch-2.22x2.88.png",
                   "x": 2.99,
                   "y": 6.26,
                   "w": 2.22,
@@ -14376,7 +14376,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/image6.png",
+                  "path": "media/modern-annual-report-2/image6.png",
                   "x": 0.44,
                   "y": 0.49,
                   "w": 7.27,
@@ -14386,7 +14386,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-1.86x2.03.png",
+                  "path": "media/modern-annual-report-2/hatch-1.86x2.03.png",
                   "x": 0.45,
                   "y": 9.18,
                   "w": 1.86,
@@ -14940,7 +14940,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-2/hatch-4.46x6.42.png",
+                  "path": "media/modern-annual-report-2/hatch-4.46x6.42.png",
                   "x": 3.34,
                   "y": 0.52,
                   "w": 4.46,

package/dist/client/templates/modern-annual-report-3.docx.json

@@ -86,7 +86,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-7054x10363-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-7054x10363-v2.png",
                   "x": 0.61,
                   "y": 0.67,
                   "w": 7.054,
@@ -432,7 +432,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1817x2117-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1817x2117-v2.png",
                   "x": 5.98,
                   "y": 1.57,
                   "w": 1.817,
@@ -840,7 +840,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-2544x3221-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-2544x3221-v2.png",
                   "x": 0.51,
                   "y": 7.22,
                   "w": 2.544,
@@ -1621,7 +1621,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-2084x2506-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-2084x2506-v2.png",
                   "x": 3.1,
                   "y": 3.06,
                   "w": 2.084,
@@ -1896,7 +1896,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1312x1574-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1312x1574-v2.png",
                   "x": 6.43,
                   "y": 2.1,
                   "w": 1.312,
@@ -3132,7 +3132,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1618x1597-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1618x1597-v2.png",
                   "x": 0.52,
                   "y": 5.62,
                   "w": 1.618,
@@ -7603,7 +7603,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1822x2099-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1822x2099-v2.png",
                   "x": 5.92,
                   "y": 4.96,
                   "w": 1.822,
@@ -9110,7 +9110,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-7253x2778-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-7253x2778-v2.png",
                   "x": 0.52,
                   "y": 5.26,
                   "w": 7.253,
@@ -9403,7 +9403,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1874x2077-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1874x2077-v2.png",
                   "x": 4.22,
                   "y": 0.5,
                   "w": 1.874,
@@ -10199,7 +10199,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-7256x6807-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-7256x6807-v2.png",
                   "x": 0.48,
                   "y": 0.45,
                   "w": 7.256,
@@ -10752,7 +10752,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1308x1454-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1308x1454-v2.png",
                   "x": 5.52,
                   "y": 4.2,
                   "w": 1.308,
@@ -11382,7 +11382,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-1660x1818-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-1660x1818-v2.png",
                   "x": 0.61,
                   "y": 9.24,
                   "w": 1.66,
@@ -12381,7 +12381,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-2622x3017-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-2622x3017-v2.png",
                   "x": 0.5,
                   "y": 5.08,
                   "w": 2.622,
@@ -12763,7 +12763,7 @@
               {
                 "name": "image",
                 "props": {
-                  "path": "packages/jto/src/client/public/templates/media/modern-annual-report-3/pct30-7054x10363-v2.png",
+                  "path": "media/modern-annual-report-3/pct30-7054x10363-v2.png",
                   "x": 0.6,
                   "y": 0.61,
                   "w": 7.054,

package/dist/client/templates/standard-annual-report.docx.json

@@ -6719,7 +6719,7 @@
         {
           "name": "image",
           "props": {
-            "path": "packages/jto/src/client/public/templates/media/standard-annual-report/image23.png",
+            "path": "media/standard-annual-report/image23.png",
             "width": 755,
             "height": 504,
             "floating": {
@@ -7005,7 +7005,7 @@
         {
           "name": "image",
           "props": {
-            "path": "packages/jto/src/client/public/templates/media/standard-annual-report/image25.png",
+            "path": "media/standard-annual-report/image25.png",
             "width": 301,
             "height": 453,
             "floating": {

package/dist/render-server.js

@@ -7,6 +7,7 @@ import { HTTPException as HTTPException4 } from "hono/http-exception";
 import { secureHeaders } from "hono/secure-headers";
 
 // src/server/rasterize-route.ts
+import path from "path";
 import { Type } from "@sinclair/typebox";
 import { bodyLimit } from "hono/body-limit";
 import { HTTPException as HTTPException2 } from "hono/http-exception";
@@ -69,9 +70,9 @@ function getValidated(c, target) {
 
 // src/server/security/outbound-source-policy.ts
 var UnsafeOutboundSourceError = class extends Error {
-  constructor(path, reason) {
-    super(`Unsafe outbound source at ${path}: ${reason}`);
-    this.path = path;
+  constructor(path2, reason) {
+    super(`Unsafe outbound source at ${path2}: ${reason}`);
+    this.path = path2;
     this.name = "UnsafeOutboundSourceError";
   }
 };
@@ -125,36 +126,36 @@ function isPrivateHost(host) {
   const firstIpv6Group = Number.parseInt(normalized.split(":")[0] || "0", 16);
   return firstIpv6Group >= 64512 && firstIpv6Group <= 65023 || firstIpv6Group >= 65152 && firstIpv6Group <= 65215;
 }
-function assertAllowedUrl(source, path, allowedHosts) {
+function assertAllowedUrl(source, path2, allowedHosts) {
   if (source.startsWith("data:")) return;
   let url;
   try {
     url = new URL(source);
   } catch {
     throw new UnsafeOutboundSourceError(
-      path,
+      path2,
       "local and relative file paths are disabled for HTTP requests"
     );
   }
   if (url.protocol !== "https:") {
-    throw new UnsafeOutboundSourceError(path, "only HTTPS URLs are allowed");
+    throw new UnsafeOutboundSourceError(path2, "only HTTPS URLs are allowed");
   }
   if (url.username || url.password) {
     throw new UnsafeOutboundSourceError(
-      path,
+      path2,
       "URLs containing credentials are not allowed"
     );
   }
   const host = url.hostname.toLowerCase().replace(/\.$/, "");
   if (isPrivateHost(host)) {
     throw new UnsafeOutboundSourceError(
-      path,
+      path2,
       `private or local host "${host}" is not allowed`
     );
   }
   if (!allowedHosts.some((pattern) => hostMatches(host, pattern))) {
     throw new UnsafeOutboundSourceError(
-      path,
+      path2,
       `host "${host}" is not in OUTBOUND_HOST_ALLOWLIST`
     );
   }
@@ -172,13 +173,13 @@ function extractCssReferences(input) {
 function extractAbsoluteUrls(input) {
   return input.match(/(?:https?|file):\/\/[^\s'"<>)}\]]+/gi) ?? [];
 }
-function assertSafeSvg(svg, path, allowedHosts) {
+function assertSafeSvg(svg, path2, allowedHosts) {
   if (/<\s*script\b/i.test(svg) || /<\s*(?:foreignObject|iframe|object|embed)\b/i.test(svg) || /\bon[a-z]+\s*=/i.test(svg)) {
-    throw new UnsafeOutboundSourceError(path, "active SVG content is disabled");
+    throw new UnsafeOutboundSourceError(path2, "active SVG content is disabled");
   }
   if (/<!\s*(?:DOCTYPE|ENTITY)\b/i.test(svg)) {
     throw new UnsafeOutboundSourceError(
-      path,
+      path2,
       "SVG document types and entities are disabled"
     );
   }
@@ -187,20 +188,20 @@ function assertSafeSvg(svg, path, allowedHosts) {
   while (match = refPattern.exec(svg)) {
     const ref = match[2].trim();
     if (!ref || ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path, allowedHosts);
+    assertAllowedUrl(ref, path2, allowedHosts);
   }
   for (const ref of extractCssReferences(svg)) {
     if (ref.startsWith("#") || ref.startsWith("data:")) continue;
-    assertAllowedUrl(ref, path, allowedHosts);
+    assertAllowedUrl(ref, path2, allowedHosts);
   }
 }
-function assertSafeEncodedImage(source, path, allowedHosts) {
+function assertSafeEncodedImage(source, path2, allowedHosts) {
   let candidate = source.trim();
   let declaredSvg = false;
   if (candidate.startsWith("data:")) {
     const comma = candidate.indexOf(",");
     if (comma < 0) {
-      throw new UnsafeOutboundSourceError(path, "malformed image data URL");
+      throw new UnsafeOutboundSourceError(path2, "malformed image data URL");
     }
     const metadata = candidate.slice(5, comma);
     declaredSvg = metadata.split(";")[0].toLowerCase() === "image/svg+xml";
@@ -209,7 +210,7 @@ function assertSafeEncodedImage(source, path, allowedHosts) {
     try {
       candidate = /(?:^|;)base64(?:;|$)/i.test(metadata) ? Buffer.from(payload, "base64").toString("utf8") : decodeURIComponent(payload);
     } catch {
-      throw new UnsafeOutboundSourceError(path, "malformed SVG data URL");
+      throw new UnsafeOutboundSourceError(path2, "malformed SVG data URL");
     }
   } else if (!/<\s*svg\b/i.test(candidate)) {
     candidate = Buffer.from(candidate, "base64").toString("utf8");
@@ -217,37 +218,37 @@ function assertSafeEncodedImage(source, path, allowedHosts) {
   const svgStart = candidate.search(/<\s*svg\b/i);
   if (svgStart < 0) {
     if (declaredSvg) {
-      throw new UnsafeOutboundSourceError(path, "malformed SVG image data");
+      throw new UnsafeOutboundSourceError(path2, "malformed SVG image data");
     }
     return;
   }
-  assertSafeSvg(candidate, path, allowedHosts);
+  assertSafeSvg(candidate, path2, allowedHosts);
 }
-function assertSafeResources(resources, path, allowedHosts) {
+function assertSafeResources(resources, path2, allowedHosts) {
   if (typeof resources.js === "string" && resources.js.trim()) {
     throw new UnsafeOutboundSourceError(
-      `${path}.js`,
+      `${path2}.js`,
       "remote renderer JavaScript resources are disabled"
     );
   }
   if (typeof resources.css === "string") {
     for (const ref of extractCssReferences(resources.css)) {
       if (ref.startsWith("data:")) continue;
-      assertAllowedUrl(ref, `${path}.css`, allowedHosts);
+      assertAllowedUrl(ref, `${path2}.css`, allowedHosts);
     }
   }
   if (Array.isArray(resources.files) && resources.files.length > 0) {
     throw new UnsafeOutboundSourceError(
-      `${path}.files`,
+      `${path2}.files`,
       "remote renderer JavaScript resources are disabled"
     );
   }
 }
-function assertNoRemoteReferences(value, path, allowedHosts, seen) {
+function assertNoRemoteReferences(value, path2, allowedHosts, seen) {
   if (typeof value === "string") {
     if (/\b(?:fetch|XMLHttpRequest|WebSocket|EventSource)\s*\(/i.test(value) || /\b(?:javascript|file):/i.test(value)) {
       throw new UnsafeOutboundSourceError(
-        path,
+        path2,
         "network-capable JavaScript and file URLs are disabled"
       );
     }
@@ -256,11 +257,11 @@ function assertNoRemoteReferences(value, path, allowedHosts, seen) {
       ...extractCssReferences(value)
     ]) {
       if (url.startsWith("data:")) continue;
-      assertAllowedUrl(url, path, allowedHosts);
+      assertAllowedUrl(url, path2, allowedHosts);
     }
     if (/^\/\//.test(value.trim())) {
       throw new UnsafeOutboundSourceError(
-        path,
+        path2,
         "protocol-relative URLs are disabled"
       );
     }
@@ -270,20 +271,20 @@ function assertNoRemoteReferences(value, path, allowedHosts, seen) {
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => assertNoRemoteReferences(entry, `${path}[${index}]`, allowedHosts, seen)
+      (entry, index) => assertNoRemoteReferences(entry, `${path2}[${index}]`, allowedHosts, seen)
     );
     return;
   }
   for (const [key, child] of Object.entries(value)) {
-    assertNoRemoteReferences(child, `${path}.${key}`, allowedHosts, seen);
+    assertNoRemoteReferences(child, `${path2}.${key}`, allowedHosts, seen);
   }
 }
-function visit(value, path, containerKey, allowedHosts, seen) {
+function visit(value, path2, containerKey, allowedHosts, seen) {
   if (!value || typeof value !== "object" || seen.has(value)) return;
   seen.add(value);
   if (Array.isArray(value)) {
     value.forEach(
-      (entry, index) => visit(entry, `${path}[${index}]`, containerKey, allowedHosts, seen)
+      (entry, index) => visit(entry, `${path2}[${index}]`, containerKey, allowedHosts, seen)
     );
     return;
   }
@@ -291,7 +292,7 @@ function visit(value, path, containerKey, allowedHosts, seen) {
   for (const key of Object.keys(record)) {
     if (DANGEROUS_KEYS.has(key)) {
       throw new UnsafeOutboundSourceError(
-        `${path}.${key}`,
+        `${path2}.${key}`,
         "prototype mutation keys are disabled"
       );
     }
@@ -299,31 +300,31 @@ function visit(value, path, containerKey, allowedHosts, seen) {
   const kind = typeof record.kind === "string" ? record.kind : void 0;
   if (kind === "file" && typeof record.path === "string") {
     throw new UnsafeOutboundSourceError(
-      `${path}.path`,
+      `${path2}.path`,
       "local file sources are disabled for HTTP requests"
     );
   }
   if ((kind === "url" || kind === "variable") && typeof record.url === "string") {
-    assertAllowedUrl(record.url, `${path}.url`, allowedHosts);
+    assertAllowedUrl(record.url, `${path2}.url`, allowedHosts);
   }
   const componentName = typeof record.name === "string" ? record.name.toLowerCase() : void 0;
   const props = isRecord(record.props) ? record.props : void 0;
   if (componentName && props) {
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.path === "string") {
-      assertAllowedUrl(props.path, `${path}.props.path`, allowedHosts);
-      assertSafeEncodedImage(props.path, `${path}.props.path`, allowedHosts);
+      assertAllowedUrl(props.path, `${path2}.props.path`, allowedHosts);
+      assertSafeEncodedImage(props.path, `${path2}.props.path`, allowedHosts);
     }
     if (COMPONENT_SOURCE_NAMES.has(componentName) && typeof props.base64 === "string") {
       assertSafeEncodedImage(
         props.base64,
-        `${path}.props.base64`,
+        `${path2}.props.base64`,
         allowedHosts
       );
     }
     if ((componentName === "highcharts" || componentName === "visual") && typeof props.serverUrl === "string") {
       assertAllowedUrl(
         props.serverUrl,
-        `${path}.props.serverUrl`,
+        `${path2}.props.serverUrl`,
         allowedHosts
       );
     }
@@ -331,30 +332,30 @@ function visit(value, path, containerKey, allowedHosts, seen) {
       if (isRecord(props.resources)) {
         assertSafeResources(
           props.resources,
-          `${path}.props.resources`,
+          `${path2}.props.resources`,
           allowedHosts
         );
       }
       assertNoRemoteReferences(
         props.options,
-        `${path}.props.options`,
+        `${path2}.props.options`,
         allowedHosts,
         /* @__PURE__ */ new WeakSet()
       );
     }
   }
   if (containerKey === "image" && typeof record.path === "string") {
-    assertAllowedUrl(record.path, `${path}.path`, allowedHosts);
-    assertSafeEncodedImage(record.path, `${path}.path`, allowedHosts);
+    assertAllowedUrl(record.path, `${path2}.path`, allowedHosts);
+    assertSafeEncodedImage(record.path, `${path2}.path`, allowedHosts);
   }
   if (typeof record.svg === "string") {
-    assertSafeSvg(record.svg, `${path}.svg`, allowedHosts);
+    assertSafeSvg(record.svg, `${path2}.svg`, allowedHosts);
   }
   if (containerKey === "resources") {
-    assertSafeResources(record, path, allowedHosts);
+    assertSafeResources(record, path2, allowedHosts);
   }
   for (const [key, child] of Object.entries(record)) {
-    visit(child, `${path}.${key}`, key, allowedHosts, seen);
+    visit(child, `${path2}.${key}`, key, allowedHosts, seen);
   }
 }
 function assertSafeOutboundSources(value, policy, rootPath = "request") {
@@ -386,7 +387,8 @@ var RasterizeRequestSchema = Type.Object(
     presentation: Type.Object({}, { additionalProperties: true }),
     dpi: Type.Optional(
       Type.Number({ minimum: MIN_VISUAL_DPI, maximum: MAX_VISUAL_DPI })
-    )
+    ),
+    baseDir: Type.Optional(Type.String())
   },
   { additionalProperties: false }
 );
@@ -420,7 +422,18 @@ function registerRasterizeRoute(router, options = {}) {
     jsonOnly,
     tbValidator(RasterizeRequestSchema),
     async (c) => {
-      const { presentation, dpi } = getValidated(c, "json");
+      const { presentation, dpi, baseDir } = getValidated(c, "json");
+      let safeBaseDir;
+      if (baseDir !== void 0) {
+        const resolved = path.resolve(baseDir);
+        const cwd = process.cwd();
+        if (resolved !== cwd && !resolved.startsWith(cwd + path.sep)) {
+          throw new HTTPException2(400, {
+            message: "baseDir must be inside the server working directory"
+          });
+        }
+        safeBaseDir = resolved;
+      }
       try {
         if (options.sourcePolicy) {
           assertSafeOutboundSources(
@@ -431,7 +444,8 @@ function registerRasterizeRoute(router, options = {}) {
         }
         const result = await getRasterizer()({
           presentation,
-          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI)
+          dpi: clampVisualDpi(dpi ?? DEFAULT_VISUAL_DPI),
+          baseDir: safeBaseDir
         });
         return c.json(result);
       } catch (error) {