@lotics/xlsx 0.1.5 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/xlsx",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "exports": {
     ".": "./src/index.ts",
@@ -19,12 +19,13 @@
   },
   "dependencies": {
     "@formulajs/formulajs": "^4.5.6",
+    "@lotics/office-io": "^0.1.0",
     "fast-formula-parser": "^1.0.19",
     "fast-xml-parser": "^5.5.6",
     "fflate": "^0.8.2"
   },
   "devDependencies": {
     "exceljs": "^4.4.0",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.9"
   }
 }

package/src/biff8_reader.test.ts

@@ -1,8 +1,8 @@
 import { describe, it, expect } from "vitest";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { parseBiff8, isOle2 } from "./biff8_reader";
-import { PasswordProtectedError } from "./types";
+import { parseBiff8 } from "./biff8_reader";
+import { isOle2, PasswordProtectedError } from "@lotics/office-io";
 
 // A synthetic BIFF8 (.xls) workbook: 250 data rows of Unicode strings + integer,
 // float and negative numbers. The Unicode strings push the shared-string table
@@ -60,6 +60,29 @@ describe("parseBiff8", () => {
     bogus.set([0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]);
     expect(() => parseBiff8(bogus)).toThrow();
   });
+
+  it("terminates on a crafted cyclic DIFAT chain instead of hanging (DoS guard)", () => {
+    // A DIFAT sector whose next-pointer references itself. Without a file-size
+    // bound + cycle detection on the DIFAT/FAT assembly, the walk runs its full
+    // guard (~1M iterations) and the FAT loop then balloons to billions of
+    // entries — a small crafted .xls hangs the event loop + exhausts memory.
+    // The reader must bound the walk to the sectors the file actually holds and
+    // fail fast. 2 KB with a valid 512-byte sector size so it passes the
+    // sector-size check and reaches the DIFAT walk (a shorter buffer would be
+    // rejected earlier).
+    const buf = new Uint8Array(2048);
+    buf.set([0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]);
+    const dv = new DataView(buf.buffer);
+    dv.setUint16(30, 9, true); // sector shift → 512-byte sectors
+    dv.setUint16(32, 6, true); // mini sector shift → 64-byte mini sectors
+    dv.setUint32(48, 0xfffffffe, true); // firstDirSector = ENDOFCHAIN (empty dir)
+    dv.setUint32(60, 0xfffffffe, true); // firstMiniFatSector = ENDOFCHAIN
+    dv.setUint32(68, 0, true); // firstDifatSector = sector 0 …
+    dv.setUint32(1020, 0, true); // …whose last DIFAT entry points back to sector 0
+    // No workbook stream results, so a bounded parse throws quickly; an unbounded
+    // one would never reach this throw (it hangs/OOMs first).
+    expect(() => parseBiff8(buf)).toThrow();
+  });
 });
 
 // A date cell is a NUMBER record (Excel serial) whose XF points at a date

package/src/biff8_reader.ts

@@ -15,110 +15,11 @@
 
 import { emptySheet } from "./ooxml_sheet";
 import type { ParseOptions } from "./excel_parser";
-import { PasswordProtectedError } from "./types";
+import { readCfbStreams, PasswordProtectedError } from "@lotics/office-io";
 import type { ParsedSpreadsheet, ParsedSheet, ParsedRow, ParsedCell } from "./types";
 
-const OLE2_MAGIC = [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1];
-const ENDOFCHAIN = 0xfffffffe;
-const FREESECT = 0xffffffff;
 const DEFAULT_MAX_ROWS = 10_000;
 
-/** True when the bytes begin with the OLE2 Compound File signature (legacy .xls
- *  or an encrypted OOXML package — both share this container). */
-export function isOle2(bytes: Uint8Array): boolean {
-  return bytes.length >= 8 && OLE2_MAGIC.every((b, i) => bytes[i] === b);
-}
-
-interface CfbStream {
-  name: string;
-  bytes: Uint8Array;
-}
-
-// ─── OLE2 / Compound File Binary container ──────────────────────────────────
-
-function readCfbStreams(bytes: Uint8Array): CfbStream[] {
-  const dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-  const u16 = (o: number) => dv.getUint16(o, true);
-  const u32 = (o: number) => dv.getUint32(o, true);
-
-  const sectorSize = 1 << u16(30);
-  const miniSectorSize = 1 << u16(32);
-  const firstDirSector = u32(48);
-  const miniCutoff = u32(56);
-  const firstMiniFatSector = u32(60);
-  const firstDifatSector = u32(68);
-
-  if (sectorSize < 512 || sectorSize > 1 << 20) {
-    throw new Error("Unsupported .xls: invalid OLE2 sector size");
-  }
-  const sectorOffset = (n: number) => sectorSize * (n + 1);
-
-  // DIFAT: first 109 entries live in the header; the rest chain through sectors.
-  const difat: number[] = [];
-  for (let i = 0; i < 109; i++) {
-    const v = u32(76 + i * 4);
-    if (v !== FREESECT) difat.push(v);
-  }
-  let ds = firstDifatSector;
-  const entriesPerSector = sectorSize / 4;
-  for (let guard = 0; ds !== ENDOFCHAIN && ds !== FREESECT && guard < 1 << 20; guard++) {
-    const base = sectorOffset(ds);
-    for (let i = 0; i < entriesPerSector - 1; i++) {
-      const v = u32(base + i * 4);
-      if (v !== FREESECT) difat.push(v);
-    }
-    ds = u32(base + (entriesPerSector - 1) * 4);
-  }
-
-  // FAT: sector-allocation chains, assembled from the DIFAT-listed FAT sectors.
-  const fat: number[] = [];
-  for (const fatSector of difat) {
-    const base = sectorOffset(fatSector);
-    for (let i = 0; i < entriesPerSector; i++) fat.push(u32(base + i * 4));
-  }
-
-  const readChain = (src: Uint8Array, start: number, size: number | null, ss: number, offOf: (n: number) => number, chain: number[]): Uint8Array => {
-    // A chain can't yield more sectors than the source holds; a longer walk is a
-    // cyclic/corrupt FAT (a crafted .xls DoS) — cap the read at the source size.
-    const maxSectors = Math.floor(src.length / ss) + 2;
-    const parts: Uint8Array[] = [];
-    let s = start;
-    for (let guard = 0; s !== ENDOFCHAIN && s !== FREESECT && s < chain.length && guard < maxSectors; guard++) {
-      const o = offOf(s);
-      parts.push(src.subarray(o, o + ss));
-      s = chain[s];
-    }
-    const merged = concat(parts);
-    return size != null ? merged.subarray(0, size) : merged;
-  };
-  const readBig = (start: number, size: number | null) => readChain(bytes, start, size, sectorSize, sectorOffset, fat);
-
-  // Directory: 128-byte entries in a FAT chain.
-  const dirBytes = readBig(firstDirSector, null);
-  const ddv = new DataView(dirBytes.buffer, dirBytes.byteOffset, dirBytes.byteLength);
-  interface DirEntry { name: string; type: number; start: number; size: number }
-  const dir: DirEntry[] = [];
-  for (let off = 0; off + 128 <= dirBytes.length; off += 128) {
-    const nameLen = ddv.getUint16(off + 64, true);
-    const type = ddv.getUint8(off + 66);
-    if (nameLen < 2 || type === 0) continue;
-    const name = utf16le(dirBytes.subarray(off, off + nameLen - 2));
-    dir.push({ name, type, start: ddv.getUint32(off + 116, true), size: Number(ddv.getBigUint64(off + 120, true)) });
-  }
-
-  // Mini stream (root entry's chain) holds streams below the cutoff, in mini sectors.
-  const root = dir.find((e) => e.type === 5);
-  const miniStream = root ? readBig(root.start, root.size) : new Uint8Array(0);
-  const miniFatBytes = readBig(firstMiniFatSector, null);
-  const miniFat: number[] = [];
-  for (let i = 0; i + 4 <= miniFatBytes.length; i += 4) miniFat.push(miniFatBytes[i] | (miniFatBytes[i + 1] << 8) | (miniFatBytes[i + 2] << 16) | (miniFatBytes[i + 3] << 24));
-  // Mini sectors index into the root mini-stream container, not the raw file.
-  const readMini = (start: number, size: number) => readChain(miniStream, start, size, miniSectorSize, (n) => n * miniSectorSize, miniFat);
-  const readStream = (e: DirEntry) => (e.size >= miniCutoff ? readBig(e.start, e.size) : readMini(e.start, e.size));
-
-  return dir.filter((e) => e.type === 2).map((e) => ({ name: e.name, bytes: readStream(e) }));
-}
-
 // ─── BIFF record stream ─────────────────────────────────────────────────────
 
 const REC = {
@@ -412,21 +313,6 @@ function readUnicodeShort(b: Uint8Array, offset: number, lenBytes: 1 | 2): strin
   return s;
 }
 
-function utf16le(b: Uint8Array): string {
-  let s = "";
-  for (let i = 0; i + 1 < b.length; i += 2) s += String.fromCharCode(b[i] | (b[i + 1] << 8));
-  return s;
-}
-
-function concat(parts: Uint8Array[]): Uint8Array {
-  let total = 0;
-  for (const p of parts) total += p.length;
-  const out = new Uint8Array(total);
-  let o = 0;
-  for (const p of parts) { out.set(p, o); o += p.length; }
-  return out;
-}
-
 /** Built-in number-format strings we care about (dates → so serials render as
  *  dates downstream; currency/decimals are otherwise "General"). */
 function builtinFormat(id: number): string {

package/src/excel_parser.test.ts

@@ -655,7 +655,7 @@ EST</v></c></row>
     expect(result.sheets[0].rows[0].cells[0].style.fontStrike).toBe(true);
   });
 
-  test("skips hidden rows", async () => {
+  test("keeps hidden rows, flagged hidden", async () => {
     const workbook = new ExcelJS.Workbook();
     const ws = workbook.addWorksheet("HiddenRows");
 
@@ -669,11 +669,16 @@ EST</v></c></row>
 
     const result = await parseExcelFile("https://example.com/test.xlsx");
 
-
-    const rowIndices = result.sheets[0].rows.map((r) => r.index);
+    const rows = result.sheets[0].rows;
+    const rowIndices = rows.map((r) => r.index);
+    // Hidden rows are real data — kept (so they round-trip and cross-sheet refs
+    // resolve) but flagged hidden so renderers can skip them.
     expect(rowIndices).toContain(1);
-    expect(rowIndices).not.toContain(2);
+    expect(rowIndices).toContain(2);
     expect(rowIndices).toContain(3);
+    expect(rows.find((r) => r.index === 1)?.hidden).toBe(false);
+    expect(rows.find((r) => r.index === 2)?.hidden).toBe(true);
+    expect(rows.find((r) => r.index === 3)?.hidden).toBe(false);
   });
 
   test("marks hidden columns", async () => {

package/src/excel_parser.ts

@@ -16,7 +16,8 @@ import {
   extractWorkbookPivotCaches,
 } from "./ooxml_pivot";
 import { parseVmlDrawing } from "./ooxml_shape";
-import { parseBiff8, isOle2 } from "./biff8_reader";
+import { parseBiff8 } from "./biff8_reader";
+import { isOle2 } from "@lotics/office-io";
 import type { ParsedSpreadsheet, ParsedSheet, PrintTitles } from "./types";
 import type { ParsedChart } from "./ooxml_chart_types";
 import type { ParsedPivotCache, ParsedPivotTable } from "./ooxml_pivot_types";
@@ -38,7 +39,6 @@ export type {
   BorderStyle,
   MergedCellRange,
 } from "./types";
-export { PasswordProtectedError } from "./types";
 
 export type {
   ParsedConditionalFormat,

package/src/index.ts

@@ -35,7 +35,6 @@ export type {
   HeaderFooter,
 } from "./types";
 
-export { PasswordProtectedError } from "./types";
 
 // -----------------------------------------------------------------------------
 // Workbook model & cell storage
@@ -100,6 +99,14 @@ export {
 
 export type { ParseOptions } from "./excel_parser";
 
+// -----------------------------------------------------------------------------
+// Errors
+// -----------------------------------------------------------------------------
+
+// Single definition lives in @lotics/office-io (the .doc reader throws the same
+// class); the barrel keeps it in the public API for external catch sites.
+export { PasswordProtectedError } from "@lotics/office-io";
+
 export { exportWorkbook } from "./xlsx_writer";
 
 // -----------------------------------------------------------------------------

package/src/ooxml_zip.ts

@@ -1,5 +1,5 @@
 import { unzipSync } from "fflate";
-import { PasswordProtectedError } from "./types";
+import { PasswordProtectedError } from "@lotics/office-io";
 
 // OLE2 Compound Document magic bytes — used by legacy .xls and encrypted .xlsx
 const OLE2_MAGIC = [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1];

package/src/types.ts

@@ -227,13 +227,3 @@ export interface MergedCellRange {
   endCol: number;
 }
 
-// =============================================================================
-// Errors
-// =============================================================================
-
-export class PasswordProtectedError extends Error {
-  constructor() {
-    super("This file is password-protected and cannot be previewed");
-    this.name = "PasswordProtectedError";
-  }
-}