@juspay/neurolink 10.12.4 → 10.12.5

package/dist/lib/processors/archive/ArchiveProcessor.js

@@ -37,6 +37,7 @@
  */
 import * as path from "path";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { isDecompressionBoundExceeded, readZipEntryWithinLimit, } from "./zipEntryReader.js";
 import { SIZE_LIMITS_MB } from "../config/index.js";
 import { FileErrorCode } from "../errors/index.js";
 // =============================================================================
@@ -159,71 +160,6 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
-/**
- * Read one ZIP entry's bytes without trusting the size it declares.
- *
- * `entry.getData()` cannot be used for this. It sizes its output buffer from
- * the central-directory `size` field, which the archive author chooses, and
- * adm-zip only arms its own guard when that field is positive:
- *
- *   const option = version >= 15 && expectedLength > 0
- *     ? { maxOutputLength: expectedLength } : {};
- *
- * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
- * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
- * The declared size is the attack, so nothing here may depend on it: the cap
- * comes from our own limit and is handed to the decoder.
- *
- * CRC is verified on both paths rather than dropped, so bypassing `getData()`
- * does not also quietly lose its corruption check — a STORED entry is copied
- * out rather than decoded, but it can be damaged just the same. It detects
- * damage, not malice — the CRC field is attacker-controlled too.
- */
-function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
-    const compressed = entry.getCompressedData();
-    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
-    // STORED: the bytes are already the payload, so its own length is the bound.
-    if (entry.header.method === ZIP_METHOD_STORED) {
-        if (compressed.length > maxBytes) {
-            return { status: "too-large" };
-        }
-        return matchesCrc(compressed)
-            ? { status: "ok", buffer: compressed }
-            : { status: "corrupt" };
-    }
-    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
-        return { status: "unsupported-method" };
-    }
-    let inflated;
-    try {
-        inflated = zlibModule.inflateRawSync(compressed, {
-            maxOutputLength: maxBytes,
-        });
-    }
-    catch (error) {
-        if (isDecompressionBoundExceeded(error)) {
-            return { status: "too-large" };
-        }
-        return { status: "corrupt" };
-    }
-    return matchesCrc(inflated)
-        ? { status: "ok", buffer: inflated }
-        : { status: "corrupt" };
-}
-/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
-const ZIP_METHOD_STORED = 0;
-const ZIP_METHOD_DEFLATED = 8;
-/**
- * Whether a zlib rejection is the output bound firing rather than bad input.
- *
- * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
- * which is the whole point — but it surfaces as a plain `RangeError`, and a
- * bomb reported as "failed to decompress" reads as a corrupt upload and invites
- * the user to send it again. It will fail identically every time.
- *
- * Keyed on `code`, not the message: the message embeds a byte count.
- */
-const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -1419,6 +1355,7 @@ export class ArchiveProcessor extends BaseFileProcessor {
                 .sort((a, b) => a.uncompressedSize - b.uncompressedSize);
             let totalExtracted = 0;
             let extractCount = 0;
+            const zlibModule = await import("zlib");
             for (const entry of candidates) {
                 if (extractCount >= ARCHIVE_CONFIG.MAX_EXTRACT_ENTRIES) {
                     break;
@@ -1431,8 +1368,17 @@ export class ArchiveProcessor extends BaseFileProcessor {
                     if (!zipEntry) {
                         continue;
                     }
-                    const data = zipEntry.getData();
-                    if (!data || data.length === 0) {
+                    // This path was already bounded, but only by coincidence: entries
+                    // declaring 0 are dropped above, oversized declarations are dropped
+                    // above, and adm-zip caps everything else at the size it declares.
+                    // That leaves the ceiling resting on library internals we do not
+                    // trust anywhere else in this file, so it is spelled out here.
+                    const read = readZipEntryWithinLimit(zipEntry, Math.min(ARCHIVE_CONFIG.MAX_EXTRACT_ENTRY_SIZE, ARCHIVE_CONFIG.MAX_TOTAL_EXTRACT_SIZE - totalExtracted), zlibModule);
+                    if (read.status !== "ok") {
+                        continue;
+                    }
+                    const data = read.buffer;
+                    if (data.length === 0) {
                         continue;
                     }
                     // Simple binary detection: check for null bytes in first 512 bytes

package/dist/lib/processors/archive/zipEntryReader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+import type { ArchiveEntryReadResult, BoundedZipEntry } from "../../types/index.js";
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export declare const ZIP_METHOD_STORED = 0;
+export declare const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export declare const isDecompressionBoundExceeded: (error: unknown) => boolean;
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export declare function readZipEntryWithinLimit(entry: BoundedZipEntry, maxBytes: number, zlibModule: typeof import("zlib")): ArchiveEntryReadResult;

package/dist/lib/processors/archive/zipEntryReader.js

@@ -0,0 +1,81 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export const ZIP_METHOD_STORED = 0;
+export const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
+    const compressed = entry.getCompressedData();
+    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
+    // STORED: the bytes are already the payload, so its own length is the bound.
+    if (entry.header.method === ZIP_METHOD_STORED) {
+        if (compressed.length > maxBytes) {
+            return { status: "too-large" };
+        }
+        return matchesCrc(compressed)
+            ? { status: "ok", buffer: compressed }
+            : { status: "corrupt" };
+    }
+    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
+        return { status: "unsupported-method" };
+    }
+    let inflated;
+    try {
+        inflated = zlibModule.inflateRawSync(compressed, {
+            maxOutputLength: maxBytes,
+        });
+    }
+    catch (error) {
+        if (isDecompressionBoundExceeded(error)) {
+            return { status: "too-large" };
+        }
+        return { status: "corrupt" };
+    }
+    return matchesCrc(inflated)
+        ? { status: "ok", buffer: inflated }
+        : { status: "corrupt" };
+}
+//# sourceMappingURL=zipEntryReader.js.map

package/dist/lib/processors/document/OpenDocumentProcessor.js

@@ -7,7 +7,9 @@
  * @module processors/document/OpenDocumentProcessor
  */
 import { createRequire } from "node:module";
+import * as zlib from "node:zlib";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
 import { SIZE_LIMITS } from "../config/index.js";
 const require = createRequire(import.meta.url);
 // Re-import for local use within this file
@@ -64,7 +66,17 @@ export class OpenDocumentProcessor extends BaseFileProcessor {
             // Try to get content.xml
             const contentEntry = zip.getEntry("content.xml");
             if (contentEntry) {
-                const xmlContent = contentEntry.getData().toString("utf-8");
+                // Bounded rather than `getData()`: an ODF file is a ZIP, so its
+                // content.xml can declare any uncompressed size it likes, and
+                // `maxSizeMB` only ever saw the compressed archive on the way in.
+                const read = readZipEntryWithinLimit(contentEntry, SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024, zlib);
+                if (read.status === "too-large") {
+                    throw new Error(`content.xml exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit for OpenDocument content`);
+                }
+                if (read.status !== "ok") {
+                    throw new Error("content.xml could not be read from the archive");
+                }
+                const xmlContent = read.buffer.toString("utf-8");
                 const extracted = this.extractTextFromXml(xmlContent);
                 textContent = extracted.text;
                 paragraphCount = extracted.paragraphCount;

package/dist/lib/processors/document/PptxProcessor.js

@@ -27,6 +27,47 @@
  * ```
  */
 import AdmZip from "adm-zip";
+import * as zlib from "node:zlib";
+import { readZipEntryWithinLimit } from "../archive/zipEntryReader.js";
+import { SIZE_LIMITS } from "../config/index.js";
+/**
+ * Total budget for everything read out of one presentation.
+ *
+ * This class is a static utility with no `BaseFileProcessor` behind it, so
+ * there is no `maxSizeMB` to inherit and nothing else was bounding these
+ * reads at all — not even a late check. A .pptx is a ZIP, so any entry in it
+ * can declare whatever uncompressed size its author likes.
+ */
+const PPTX_MAX_TOTAL_BYTES = SIZE_LIMITS.DOCUMENT_MAX_MB * 1024 * 1024;
+/**
+ * Read entries out of one presentation, refusing once the total passes budget.
+ *
+ * The budget spans the call rather than each entry: a deck of two hundred
+ * slides that each sit just under a per-entry limit is the obvious way around
+ * one. Returns null for an absent or unreadable entry, which every call site
+ * already treats as "no content here".
+ */
+function createBoundedEntryReader() {
+    let spent = 0;
+    return (entry) => {
+        if (!entry) {
+            return null;
+        }
+        const remaining = PPTX_MAX_TOTAL_BYTES - spent;
+        if (remaining <= 0) {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        const read = readZipEntryWithinLimit(entry, remaining, zlib);
+        if (read.status === "too-large") {
+            throw new Error(`PPTX content exceeds the ${SIZE_LIMITS.DOCUMENT_MAX_MB}MB limit`);
+        }
+        if (read.status !== "ok") {
+            return null;
+        }
+        spent += read.buffer.length;
+        return read.buffer.toString("utf-8");
+    };
+}
 /**
  * Regex to match text content within PowerPoint XML `<a:t>` elements.
  * These elements contain the actual visible text on slides.
@@ -63,14 +104,17 @@ export class PptxProcessor {
     static async extractText(content) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect slide entries with their slide numbers for sorting
         const slides = [];
         for (const entry of entries) {
             const match = entry.entryName.match(SLIDE_ENTRY_REGEX);
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
-                const xmlContent = entry.getData().toString("utf-8");
-                slides.push({ slideNumber, xml: xmlContent });
+                const xmlContent = readEntry(entry);
+                if (xmlContent !== null) {
+                    slides.push({ slideNumber, xml: xmlContent });
+                }
             }
         }
         // Sort slides by number (slide1, slide2, ...)
@@ -82,7 +126,7 @@ export class PptxProcessor {
         parts.push(`Presentation: ${slides.length} slide(s)\n`);
         for (const slide of slides) {
             const texts = PptxProcessor.extractTextFromXml(slide.xml);
-            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber);
+            const notes = PptxProcessor.extractNotesForSlide(zip, slide.slideNumber, readEntry);
             // Emit a slide section when it has either body text or speaker notes.
             if (texts.length > 0 || notes) {
                 parts.push(`### Slide ${slide.slideNumber}`);
@@ -111,12 +155,11 @@ export class PptxProcessor {
      * @param slideNumber - 1-indexed slide number
      * @returns The notes text (runs joined by a space), or null when absent
      */
-    static extractNotesForSlide(zip, slideNumber) {
-        const relsEntry = zip.getEntry(SLIDE_RELS_NAME(slideNumber));
-        if (!relsEntry) {
+    static extractNotesForSlide(zip, slideNumber, readEntry) {
+        const relsXml = readEntry(zip.getEntry(SLIDE_RELS_NAME(slideNumber)));
+        if (relsXml === null) {
             return null;
         }
-        const relsXml = relsEntry.getData().toString("utf-8");
         let notesTarget = null;
         RELATIONSHIP_TAG_REGEX.lastIndex = 0;
         for (let match = RELATIONSHIP_TAG_REGEX.exec(relsXml); match !== null; match = RELATIONSHIP_TAG_REGEX.exec(relsXml)) {
@@ -134,11 +177,11 @@ export class PptxProcessor {
         const normalized = notesTarget
             .replace(/^\.\.\//, "ppt/")
             .replace(/^\/+/, "");
-        const notesEntry = zip.getEntry(normalized);
-        if (!notesEntry) {
+        const notesXml = readEntry(zip.getEntry(normalized));
+        if (notesXml === null) {
             return null;
         }
-        const notes = PptxProcessor.extractTextFromXml(notesEntry.getData().toString("utf-8")).join(" ");
+        const notes = PptxProcessor.extractTextFromXml(notesXml).join(" ");
         return notes.trim() || null;
     }
     /**
@@ -175,6 +218,7 @@ export class PptxProcessor {
     static async extractSlides(content, slideNumbers) {
         const zip = new AdmZip(content);
         const entries = zip.getEntries();
+        const readEntry = createBoundedEntryReader();
         // Collect all slides
         const slides = [];
         for (const entry of entries) {
@@ -182,8 +226,10 @@ export class PptxProcessor {
             if (match) {
                 const slideNumber = parseInt(match[1], 10);
                 if (slideNumbers.includes(slideNumber)) {
-                    const xmlContent = entry.getData().toString("utf-8");
-                    slides.push({ slideNumber, xml: xmlContent });
+                    const xmlContent = readEntry(entry);
+                    if (xmlContent !== null) {
+                        slides.push({ slideNumber, xml: xmlContent });
+                    }
                 }
             }
         }

package/dist/lib/types/processor.d.ts

@@ -774,6 +774,21 @@ export type ArchiveDecompressionResult = {
  * perfectly well-formed, and telling the user it is damaged would send them to
  * re-create a file that was never broken.
  */
+/**
+ * The slice of an adm-zip entry the bounded reader depends on.
+ *
+ * Structural rather than adm-zip's own `IZipEntry` so the reader states what it
+ * actually needs — the compressed bytes and the header fields it refuses to
+ * trust — instead of importing a library type it would then have to satisfy in
+ * full when building a test double.
+ */
+export type BoundedZipEntry = {
+    getCompressedData: () => Buffer;
+    header: {
+        method: number;
+        crc: number;
+    };
+};
 export type ArchiveEntryReadResult = {
     readonly status: "ok";
     readonly buffer: Buffer;

package/dist/processors/archive/ArchiveProcessor.js

@@ -37,6 +37,7 @@
  */
 import * as path from "path";
 import { BaseFileProcessor } from "../base/BaseFileProcessor.js";
+import { isDecompressionBoundExceeded, readZipEntryWithinLimit, } from "./zipEntryReader.js";
 import { SIZE_LIMITS_MB } from "../config/index.js";
 import { FileErrorCode } from "../errors/index.js";
 // =============================================================================
@@ -159,71 +160,6 @@ const SINGLE_STREAM_TOOLS = {
     xz: "xz",
     zst: "zstd",
 };
-/**
- * Read one ZIP entry's bytes without trusting the size it declares.
- *
- * `entry.getData()` cannot be used for this. It sizes its output buffer from
- * the central-directory `size` field, which the archive author chooses, and
- * adm-zip only arms its own guard when that field is positive:
- *
- *   const option = version >= 15 && expectedLength > 0
- *     ? { maxOutputLength: expectedLength } : {};
- *
- * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
- * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
- * The declared size is the attack, so nothing here may depend on it: the cap
- * comes from our own limit and is handed to the decoder.
- *
- * CRC is verified on both paths rather than dropped, so bypassing `getData()`
- * does not also quietly lose its corruption check — a STORED entry is copied
- * out rather than decoded, but it can be damaged just the same. It detects
- * damage, not malice — the CRC field is attacker-controlled too.
- */
-function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
-    const compressed = entry.getCompressedData();
-    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
-    // STORED: the bytes are already the payload, so its own length is the bound.
-    if (entry.header.method === ZIP_METHOD_STORED) {
-        if (compressed.length > maxBytes) {
-            return { status: "too-large" };
-        }
-        return matchesCrc(compressed)
-            ? { status: "ok", buffer: compressed }
-            : { status: "corrupt" };
-    }
-    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
-        return { status: "unsupported-method" };
-    }
-    let inflated;
-    try {
-        inflated = zlibModule.inflateRawSync(compressed, {
-            maxOutputLength: maxBytes,
-        });
-    }
-    catch (error) {
-        if (isDecompressionBoundExceeded(error)) {
-            return { status: "too-large" };
-        }
-        return { status: "corrupt" };
-    }
-    return matchesCrc(inflated)
-        ? { status: "ok", buffer: inflated }
-        : { status: "corrupt" };
-}
-/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
-const ZIP_METHOD_STORED = 0;
-const ZIP_METHOD_DEFLATED = 8;
-/**
- * Whether a zlib rejection is the output bound firing rather than bad input.
- *
- * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
- * which is the whole point — but it surfaces as a plain `RangeError`, and a
- * bomb reported as "failed to decompress" reads as a corrupt upload and invites
- * the user to send it again. It will fail identically every time.
- *
- * Keyed on `code`, not the message: the message embeds a byte count.
- */
-const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
 /** File extensions recognized as archive formats */
 const SUPPORTED_ARCHIVE_EXTENSIONS = [".zip", ".tar", ".gz", ".tgz", ".bz2", ".tbz2", ".jar", ".xz", ".txz", ".zst", ".tzst"];
 // =============================================================================
@@ -1419,6 +1355,7 @@ export class ArchiveProcessor extends BaseFileProcessor {
                 .sort((a, b) => a.uncompressedSize - b.uncompressedSize);
             let totalExtracted = 0;
             let extractCount = 0;
+            const zlibModule = await import("zlib");
             for (const entry of candidates) {
                 if (extractCount >= ARCHIVE_CONFIG.MAX_EXTRACT_ENTRIES) {
                     break;
@@ -1431,8 +1368,17 @@ export class ArchiveProcessor extends BaseFileProcessor {
                     if (!zipEntry) {
                         continue;
                     }
-                    const data = zipEntry.getData();
-                    if (!data || data.length === 0) {
+                    // This path was already bounded, but only by coincidence: entries
+                    // declaring 0 are dropped above, oversized declarations are dropped
+                    // above, and adm-zip caps everything else at the size it declares.
+                    // That leaves the ceiling resting on library internals we do not
+                    // trust anywhere else in this file, so it is spelled out here.
+                    const read = readZipEntryWithinLimit(zipEntry, Math.min(ARCHIVE_CONFIG.MAX_EXTRACT_ENTRY_SIZE, ARCHIVE_CONFIG.MAX_TOTAL_EXTRACT_SIZE - totalExtracted), zlibModule);
+                    if (read.status !== "ok") {
+                        continue;
+                    }
+                    const data = read.buffer;
+                    if (data.length === 0) {
                         continue;
                     }
                     // Simple binary detection: check for null bytes in first 512 bytes

package/dist/processors/archive/zipEntryReader.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+import type { ArchiveEntryReadResult, BoundedZipEntry } from "../../types/index.js";
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export declare const ZIP_METHOD_STORED = 0;
+export declare const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export declare const isDecompressionBoundExceeded: (error: unknown) => boolean;
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export declare function readZipEntryWithinLimit(entry: BoundedZipEntry, maxBytes: number, zlibModule: typeof import("zlib")): ArchiveEntryReadResult;

package/dist/processors/archive/zipEntryReader.js

@@ -0,0 +1,80 @@
+/**
+ * Bounded ZIP entry reading, shared by every processor that opens a ZIP.
+ *
+ * Extracted from ArchiveProcessor because the Office formats are ZIPs too:
+ * .pptx and .odt read their entries directly and so can be handed the same
+ * bomb, and need the same refusal. One implementation rather than three means
+ * a correction to the guard lands everywhere at once.
+ *
+ * .docx and .xlsx deliberately do NOT use this. mammoth and exceljs unzip for
+ * themselves and were measured refusing a 400MB bomb at 46MB and 53MB peak,
+ * so wrapping them in a pre-scan bought no safety and roughly tripled the cost
+ * of every ordinary document.
+ *
+ * @module processors/archive/zipEntryReader
+ */
+/** ZIP compression methods this reader handles (APPNOTE 4.4.5). */
+export const ZIP_METHOD_STORED = 0;
+export const ZIP_METHOD_DEFLATED = 8;
+/**
+ * Whether a zlib rejection is the output bound firing rather than bad input.
+ *
+ * `maxOutputLength` aborts an inflate the moment its output would pass the cap,
+ * which is the whole point — but it surfaces as a plain `RangeError`, and a
+ * bomb reported as "failed to decompress" reads as a corrupt upload and invites
+ * the user to send it again. It will fail identically every time.
+ *
+ * Keyed on `code`, not the message: the message embeds a byte count.
+ */
+export const isDecompressionBoundExceeded = (error) => error?.code === "ERR_BUFFER_TOO_LARGE";
+/**
+ * Read one ZIP entry's bytes without trusting the size it declares.
+ *
+ * `entry.getData()` cannot be used for this. It sizes its output buffer from
+ * the central-directory `size` field, which the archive author chooses, and
+ * adm-zip only arms its own guard when that field is positive:
+ *
+ *   const option = version >= 15 && expectedLength > 0
+ *     ? { maxOutputLength: expectedLength } : {};
+ *
+ * So an entry declaring 0 disables the bound and the caller's `size > maxSize`
+ * check in one move — `0 > 5MB` is false, and the inflate then runs uncapped.
+ * The declared size is the attack, so nothing here may depend on it: the cap
+ * comes from our own limit and is handed to the decoder.
+ *
+ * CRC is verified on both paths rather than dropped, so bypassing `getData()`
+ * does not also quietly lose its corruption check — a STORED entry is copied
+ * out rather than decoded, but it can be damaged just the same. It detects
+ * damage, not malice — the CRC field is attacker-controlled too.
+ */
+export function readZipEntryWithinLimit(entry, maxBytes, zlibModule) {
+    const compressed = entry.getCompressedData();
+    const matchesCrc = (data) => (zlibModule.crc32(data) >>> 0) === (entry.header.crc >>> 0);
+    // STORED: the bytes are already the payload, so its own length is the bound.
+    if (entry.header.method === ZIP_METHOD_STORED) {
+        if (compressed.length > maxBytes) {
+            return { status: "too-large" };
+        }
+        return matchesCrc(compressed)
+            ? { status: "ok", buffer: compressed }
+            : { status: "corrupt" };
+    }
+    if (entry.header.method !== ZIP_METHOD_DEFLATED) {
+        return { status: "unsupported-method" };
+    }
+    let inflated;
+    try {
+        inflated = zlibModule.inflateRawSync(compressed, {
+            maxOutputLength: maxBytes,
+        });
+    }
+    catch (error) {
+        if (isDecompressionBoundExceeded(error)) {
+            return { status: "too-large" };
+        }
+        return { status: "corrupt" };
+    }
+    return matchesCrc(inflated)
+        ? { status: "ok", buffer: inflated }
+        : { status: "corrupt" };
+}