@openpresentation/opf-pptx 0.20.3 → 0.20.4

package/dist/annotation-provenance.js

@@ -18,7 +18,7 @@
 import {XMLParser} from 'fast-xml-parser';
 import {attachTextTags, decodeTextTag} from './code-provenance.js';
 import {sourceLineParagraphs} from './text-provenance.js';
-import {CAPTION_TAG, FOOTNOTES_TAG} from './annotation-export.js';
+import {CAPTION_TAG, FOOTNOTES_TAG, footnotesRuleName} from './annotation-export.js';
 
 const REL = 'http://schemas.openxmlformats.org/officeDocument/2006/relationships/tags';
 const parser = new XMLParser({ignoreAttributes: false, attributeNamePrefix: '', parseTagValue: false, trimValues: false});
@@ -141,7 +141,16 @@ export function importAnnotations({shapes, paragraphs, relationships, entries, s
     if (footnote === undefined) continue;
     consumed.add(shape);
     if (!footnote || !['rule', 'entry'].includes(footnote.role)) { report({code: 'invalid-footnote-provenance', path: `slides.${slideIndex}`, message: 'A footnote tag is unreadable or invalid; its text stays an ordinary text block.'}); consumed.delete(shape); continue; }
-    if (footnote.role === 'rule') continue;
+    if (footnote.role === 'rule') {
+      const current = paragraphs[index] ?? [];
+      if (footnote.slide !== slideIndex || name(shape) !== footnotesRuleName(slideIndex)
+        || shape['p:spPr']?.['a:prstGeom']?.prst !== 'line'
+        || current.some(paragraph => paragraph.text || paragraph.bullet || paragraph.math || paragraph.fields?.length)) {
+        consumed.delete(shape);
+        report({code: 'invalid-footnote-provenance', path: `slides.${slideIndex}`, message: 'An edited or incompatible tagged footnote separator stays ordinary native content; its current text is retained.'});
+      }
+      continue;
+    }
     if (!Number.isSafeInteger(footnote.entry) || !Number.isSafeInteger(footnote.number) || footnote.number < 1 || !['reference', 'footnote'].includes(footnote.kind) || (footnote.kind === 'reference' && typeof footnote.id !== 'string') || footnote.line === undefined) { report({code: 'invalid-footnote-provenance', path: `slides.${slideIndex}`, message: 'A footnote entry tag is invalid; its text stays an ordinary text block.'}); consumed.delete(shape); continue; }
     if (!entryGroups.has(footnote.entry)) entryGroups.set(footnote.entry, []);
     entryGroups.get(footnote.entry).push({index, shape, record: footnote});

package/dist/chart-workbook.js

@@ -1,5 +1,6 @@
 import {unzipSync,zipSync} from 'fflate';
 import {XMLParser} from 'fast-xml-parser';
+import {readNestedInputZip} from './input-safety.js';
 const parser=new XMLParser({ignoreAttributes:false,attributeNamePrefix:'',parseTagValue:false,trimValues:false,removeNSPrefix:true,htmlEntities:{amp:'&',lt:'<',gt:'>',quot:'"',apos:"'"}});
 const decoder=new TextDecoder('utf-8',{fatal:true}),encoder=new TextEncoder();
 const array=value=>value===undefined?[]:Array.isArray(value)?value:[value];
@@ -25,11 +26,12 @@ function workbookContext(entries,chartPart){
  const ref=relationship(entries,chartPart,(chart?.externalData??chart?.chartData?.externalData)?.id);
  if(!ref?.type?.endsWith('/package')||!entries[ref.path])return undefined;
  // Read only bounded spreadsheet metadata. Never follow external workbook links.
+ const nested=readNestedInputZip(entries,ref.path);
  let size=0;
- const workbook=unzipSync(entries[ref.path],{filter:file=>{
-  if(!/^xl\/(workbook\.xml|_rels\/workbook\.xml\.rels|sharedStrings\.xml|worksheets\/[^/]+\.xml)$/.test(file.name))return false;
-  size+=file.originalSize;if(size>16*1024*1024)throw Error('Chart workbook metadata exceeds the limit.');return true;
- }});
+ const workbook=Object.fromEntries(Object.entries(nested).filter(([name,bytes])=>{
+  if(!/^xl\/(workbook\.xml|_rels\/workbook\.xml\.rels|sharedStrings\.xml|worksheets\/[^/]+\.xml)$/.test(name))return false;
+  size+=bytes.length;if(size>16*1024*1024)throw Error('Chart workbook metadata exceeds the limit.');return true;
+ }));
  // The category range: c:cat/c:xVal references, or the chartex cx:strDim type="cat" formula.
  const category=find(chart,'cat')[0]??find(chart,'xVal')[0]??find(chart,'strDim').find(dim=>dim?.type==='cat'),formula=category?.strRef?.f??category?.multiLvlStrRef?.f??category?.numRef?.f??(category?.type==='cat'?category?.f:undefined);
  // Infer a heading only for one contiguous vertical category range with a row
@@ -58,7 +60,7 @@ export function readChartCategoryHeading(entries,chartPart){
   // Error, boolean, date and formula results are not literal text headings.
   if(cell.t!==undefined&&!['str','n'].includes(cell.t))return undefined;
   return cell.v===undefined?undefined:text(cell.v);
- }catch{return undefined;}
+ }catch(error){if(error?.code==='pptx-limit-exceeded')throw error;return undefined;}
 }
 export function writeChartCategoryHeading(entries,chartPart,heading){
  const context=workbookContext(entries,chartPart);

package/dist/errors.js

@@ -0,0 +1,11 @@
+export class OPFPptxError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.name = "OPFPptxError";
+    this.code = code;
+    this.details = details;
+    if (details.findings) this.findings = details.findings;
+    if (details.diagnostics) this.diagnostics = details.diagnostics;
+    if (details.path) this.path = details.path;
+  }
+}

package/dist/index.js

@@ -68,6 +68,9 @@ import {
   validate
 } from "@openpresentation/opf";
 import {checkFormat, isValidFormat} from "./format-check.js";
+import {OPFPptxError} from './errors.js';
+import {readInputZip} from './input-safety.js';
+export {OPFPptxError} from './errors.js';
 
 export {checkTypefaces, inventoryTypefaces, packageFontsUsed, THEME_SCRIPT_SUPPLEMENTS} from './typeface-inventory.js';
 export {DEFAULT_SIGNAL_LIMITS, SIGNALS_VERSION, isMonospaceFamily} from './import-signals.js';
@@ -91,18 +94,6 @@ export const runtimePolicy = Object.freeze({
   deterministicLocalExecution: true
 });
 
-export class OPFPptxError extends Error {
-  constructor(code, message, details = {}) {
-    super(message);
-    this.name = "OPFPptxError";
-    this.code = code;
-    this.details = details;
-    if (details.findings) this.findings = details.findings;
-    if (details.diagnostics) this.diagnostics = details.diagnostics;
-    if (details.path) this.path = details.path;
-  }
-}
-
 const FIXED_TIMESTAMP = "1980-01-01T00:00:00Z";
 // fflate derives the DOS zip date from local-time fields, so build this from
 // local components: a UTC instant rolls back to 1979 west of UTC (below
@@ -642,8 +633,9 @@ function readPptxZip(input) {
   }
 
   try {
-    return unzipSync(bytes);
+    return readInputZip(bytes);
   } catch (error) {
+    if (error instanceof OPFPptxError) throw error;
     throw new OPFPptxError("invalid-pptx", "PPTX input is not a readable ZIP archive.", {
       cause: errorMessage(error)
     });
@@ -2215,7 +2207,7 @@ async function addSlide(pptx, presentation, authoredSlide, slideIndex, context,
       // FA-10: a TextRun[] heading draws and exports like rich body text; its lines are named and tagged as a heading (the body's are not).
       const heading = item.field !== 'text';
       addRichFitLines(slide, item.text, item.box, itemContext, {
-        value: item.value, alignment: item.text.placement?.alignment ?? item.alignment ?? 'left',
+        value: item.value, path: item.path, alignment: item.text.placement?.alignment ?? item.alignment ?? 'left',
         fallback: item.field === 'tag' ? tagColor(itemContext) : itemContext.textColor,
         ...(heading ? {
           objectName: index => `OPF heading ${item.path} line ${index}`,
@@ -2301,7 +2293,7 @@ async function addPayload(slide, presentation, payload, region, path, context, o
   const kind = inferPayloadKind(payload);
   switch (kind) {
     case "text":
-      addTextPayload(slide, payload.text ?? payload.bullets, region, context);
+      addTextPayload(slide, payload.text ?? payload.bullets, region, context, path);
       break;
     case "list":
       addListPayload(slide, payload.items ?? payload.bullets, region, context);
@@ -2346,9 +2338,9 @@ function inferPayloadKind(payload) {
   return "unknown";
 }
 
-function addTextPayload(slide, value, region, context) {
+function addTextPayload(slide, value, region, context, path) {
   if (Array.isArray(value)) {
-    slide.addText(textRuns(value, context, 18), textBoxOptions(region, context, 18));
+    slide.addText(textRuns(value, context, 18, path), textBoxOptions(region, context, 18));
     return;
   }
   if (Array.isArray(value?.bullets)) {
@@ -2366,9 +2358,10 @@ function listRunLook(fit,style,context){
   if(text.size!==1||description.size>1)return undefined;
   return {text:JSON.parse([...text][0]),...(description.size?{description:JSON.parse([...description][0])}:{})};
 }
-function richLineRuns(line,color,native,context) {
+function richLineRuns(line,color,native,context,path) {
   const fallback=color.replace(/^#/,'');
   return line.fragments.map(fragment=>{
+    assertXmlText(fragment.run.text ?? fragment.text, path);
     const runColor=exportColor(fragment.run.color,context,fallback),color=nativeColor(fragment.run.color,runColor,context,native);
     return {text:fragment.text,options:{...nativeFontOptions(fragment.style),fontSize:(fragment.nominalSize??fragment.fontSize)*.75,color:linkColor(fragment.run,color,context),underline:fragment.run.underline?{style:'sng',color:linkColor(fragment.run,color,context)}:undefined,strike:fragment.run.strikethrough?'sngStrike':undefined,baseline:fragment.baselineShift?-fragment.baselineShift/(fragment.nominalSize??fragment.fontSize)*2000:undefined,hyperlink:fragment.run.link&&/^(https?:|mailto:|tel:)/i.test(fragment.run.link)?{url:fragment.run.link}:undefined,...langOptions(context,fragment.style.lang)}};
   });
@@ -2416,7 +2409,7 @@ async function addMeasuredList(slide,fit,context,path,bulletImage,presentation,s
         const number=first?entry.marker.number:undefined;
         if(first)context.listMarkers.set(objectName,{fontFamily:entry.marker.style.fontFamily,fontSize:entry.marker.fontSize*.75,color:pptxColor(context.textColor),picture:number?false:picture});
         const paragraph=first?{bullet:number?{type:'number',style:autoNumScheme(number.style,number.suffix),startAt:number.value,indent:entry.marker.indent*.75}:{characterCode:entry.marker.text.codePointAt(0).toString(16).padStart(4,'0'),indent:entry.marker.indent*.75},indentLevel:level}:{bullet:false};
-        const runs=richLineRuns(line,color,native,context);
+        const runs=richLineRuns(line,color,native,context,path);
         if(!runs.length)runs.push({text:'',options:{}});
         // Keep paragraph intent identical across runs. ZIP normalization below
         // removes the duplicate paragraph-property nodes emitted by PptxGenJS.
@@ -2876,6 +2869,7 @@ function addTablePayload(slide, authoredTable, region, context, options, path, p
     const defaultText = cellStyle.color === undefined ? tableTextSchemeValue(fillValue, baseColor, context) : undefined;
     const alpha = value => value.length === 8 ? (1 - parseInt(value.slice(6), 16) / 255) * 100 : 0;
     const text = stringifyText(cell.value), style = cell.textStyle;
+    assertXmlText(text, cell.path ?? path);
     const fragments = rich ? fit.richLines.flatMap(line => line.fragments) : [];
     const runs = rich ? cell.value.flatMap((value, index) => {
       const run = typeof value === 'string' ? {text:value} : value;
@@ -2955,10 +2949,11 @@ function pixelBox(region) {
 // super/subscript (a citation marker is a baseline run) and http(s)/mailto links. The body's lines stay untagged; a heading or quote
 // body passes `objectName` and `tag`, which name and tag every line with the boundary between wrapped lines (a soft wrap inserts
 // nothing, a hard line break keeps its separator), recovered from the flattened text. `fallback` is the color of runs without one.
-function addRichFitLines(slide, fit, box, context, {value, alignment: logicalAlignment, fallback, objectName, tag}) {
+function addRichFitLines(slide, fit, box, context, {value, path, alignment: logicalAlignment, fallback, objectName, tag}) {
   const region = {x: box.x / 96, y: box.y / 96, w: box.width / 96, h: box.height / 96};
   const runText = run => typeof run === 'string' ? run : run.text;
   const whole = typeof value === 'string' ? value : value.map(runText).join('');
+  assertXmlText(whole, path);
   const count = fit.richLines.length;
   let cursor = 0;
   for (const [index, line] of fit.richLines.entries()) {
@@ -2984,11 +2979,15 @@ function addRichFitLines(slide, fit, box, context, {value, alignment: logicalAli
   }
 }
 
+function assertXmlText(text, path) {
+  const invalid=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uD800-\uDFFF\uFFFE\uFFFF]/u.exec(String(text??''));
+  if(invalid)throw new OPFPptxError('invalid-text',`Text contains U+${invalid[0].codePointAt(0).toString(16).toUpperCase().padStart(4,'0')} at UTF-16 offset ${invalid.index}, which DrawingML XML cannot represent.`,{path});
+}
+
 // Match the published renderer's payload geometry and shared core text fitting.
 // Each fitted line remains native editable text, without PowerPoint rewrapping it.
 function addMeasuredPayloadText(slide, text, box, context, options, config) {
-  const invalid=/[\u0000-\u0008\u000B\u000C\u000E-\u001F\uD800-\uDFFF\uFFFE\uFFFF]/u.exec(String(text??''));
-  if(invalid)throw new OPFPptxError('invalid-text',`Text contains U+${invalid[0].codePointAt(0).toString(16).toUpperCase().padStart(4,'0')} at UTF-16 offset ${invalid.index}, which DrawingML XML cannot represent.`,{path:config.path});
+  assertXmlText(text, config.path);
   const scale = Math.min(context.dimensions.widthInches, context.dimensions.heightInches) * 96 / 720;
   const style = config.textStyle ?? resolveTextStyle({fontFamily: config.fontFamily ?? context.fonts.body, fontWeight: config.fontWeight ?? 400, path: config.path}, options.textMeasurement);
   const fit = config.fit ?? fitText(String(text ?? ''), box, config.fontSize * scale, (context.composition?.minFontSize ?? 16) * scale, textWidthMeasurer(style, options.textMeasurement));
@@ -3230,7 +3229,7 @@ async function addQuotePayload(slide, presentation, value, layout, context, opti
     // FA-10: a TextRun[] quote body (core's rich lines, quotation marks joined to its first and last run) is exported line by line like rich body text, with the same quote tags.
     if (part.runs && part.fit.richLines) {
       addRichFitLines(slide, part.fit, part.box, context, {
-        value: part.text, alignment: part.fit.placement?.alignment ?? context.contentAlignment ?? 'left', fallback: context.textColor,
+        value: part.text, path: part.path, alignment: part.fit.placement?.alignment ?? context.contentAlignment ?? 'left', fallback: context.textColor,
         objectName: line => `OPF quote ${group} part ${index} line ${line}`,
         tag: (name, line, count, boundary) => context.quoteTags.set(name, {v: 1, role: 'text', group, part: index, line, count, ...boundary, base: richBase(part.fit, part.style, context.colors.text), ...(index === 0 && line === 0 ? {anchor} : {})})
       });
@@ -3574,9 +3573,10 @@ function textBoxOptions(region, context, fontSize) {
 // The private text helpers annotation-export.js writes captions and footnote lines with (RR-34).
 const exportHelpers = {textBoxOptions, nativeFontOptions, exportColor, nativeColor};
 
-function textRuns(value, context, fallbackFontSize) {
+function textRuns(value, context, fallbackFontSize, path) {
   const runs = Array.isArray(value) ? value : [value];
   return runs.map((run) => {
+    assertXmlText(typeof run === "string" ? run : run?.text, path);
     if (typeof run === "string") {
       return {
         text: run,

package/dist/input-safety.js

@@ -0,0 +1,115 @@
+// Internal import safety policy, shared by PPTX and nested workbook/introspection readers.
+// No caller-provided limits and no claim that ZIP CRC/provenance authenticates the source.
+import {unzipSync, Unzip, UnzipInflate} from 'fflate';
+import {OPFPptxError} from './errors.js';
+const MiB=1024*1024;
+export const INPUT_LIMITS=Object.freeze({compressedBytes:64*MiB,members:10000,memberBytes:64*MiB,expandedBytes:256*MiB,xmlBytes:16*MiB,xmlDepth:256,nestedDepth:16});
+const states=new WeakMap();
+const xmlPart=name=>/\.(?:xml|rels)$/i.test(name);
+const invalid=(message,path)=>new OPFPptxError('invalid-pptx',message,path===undefined?{}:{path});
+function limit(name,actual,path){
+ const maximum=INPUT_LIMITS[name];
+ if(actual>maximum)throw new OPFPptxError('pptx-limit-exceeded',`PPTX ${name} exceeds the supported limit (${maximum}).`,{limit:name,maximum,actual,...(path===undefined?{}:{path})});
+}
+function memberName(name){
+ if(typeof name!=='string'||!name||/[\\\x00-\x1f]/.test(name)||name.startsWith('/')||/^[a-z]:/i.test(name)||name.split('/').some((p,i,a)=>p==='.'||p==='..'||p===''&&i!==a.length-1))throw invalid('PPTX contains a noncanonical ZIP member name.',name);
+}
+function checkXml(bytes,path){
+ limit('xmlBytes',bytes.length,path);
+ // Check nesting before any recursive parser/tree walk; skip comments, CDATA and PIs.
+ // Reject DTDs entirely: OOXML parts do not need document entities or external declarations.
+ let text;
+ const encoding=bytes[0]===0xff&&bytes[1]===0xfe?'utf-16le':bytes[0]===0xfe&&bytes[1]===0xff?'utf-16be':'utf-8';
+ try{text=new TextDecoder(encoding,{fatal:true}).decode(bytes);}catch{throw invalid('PPTX XML is not valid encoded text.',path);}
+ const declarations=text.replace(/<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>/g,'');
+ if(/<!DOCTYPE\b|<!ENTITY\b/i.test(declarations))throw invalid('PPTX XML document entities are not supported.',path);
+ const stack=[];
+ // Count broad XML name tokens, including Unicode/namespace names the OOXML parser
+ // accepts. This is a resource preflight, not a replacement XML grammar validator.
+ const tokens=/<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<\/?[^\s<>\/"'=!?]+(?:[^<>"']|"[^"]*"|'[^']*')*>/g;
+ for(const [token]of text.matchAll(tokens)){
+  if(token.startsWith('<?')||token.startsWith('<!'))continue;
+  const name=/^<\/?([^\s<>\/"'=!?]+)/.exec(token)[1];
+  if(token.startsWith('</')){if(stack.pop()!==name)throw invalid('PPTX XML has an unmatched closing element.',path);}
+  else {limit('xmlDepth',stack.length+1,path);if(!/\/\s*>$/.test(token))stack.push(name);}
+ }
+ if(stack.length)throw invalid('PPTX XML has unclosed elements.',path);
+}
+function stateOf(entries){
+ let state=states.get(entries);
+ if(!state){
+  const budget={members:0,expanded:0};state={budget,depth:0,cache:new Map()};
+  for(const [name,bytes]of Object.entries(entries)){
+   memberName(name);if(!(bytes instanceof Uint8Array))throw invalid('PPTX member is not bytes.',name);
+   limit('members',++budget.members,name);limit('memberBytes',bytes.length,name);budget.expanded+=bytes.length;limit('expandedBytes',budget.expanded,name);
+   if(xmlPart(name))checkXml(bytes,name);
+  }
+  states.set(entries,state);
+ }
+ return state;
+}
+export function checkInputEntries(entries){stateOf(entries);return entries;}
+
+export function readInputZip(input,{budget={members:0,expanded:0},depth=0,path}={}){
+ const bytes=input instanceof ArrayBuffer?new Uint8Array(input):input;
+ if(!(bytes instanceof Uint8Array))throw invalid('PPTX input must be a Uint8Array or ArrayBuffer.',path);
+ limit('compressedBytes',bytes.length,path);limit('nestedDepth',depth,path);
+ const metadata=new Map();let declared=0;
+ try{
+  // fflate's central-directory iterator supplies names/sizes without allocating expanded data
+  // when filter always returns false. Do not use its fixed-size inflate output for untrusted data:
+  // a dishonest originalSize can silently truncate a DEFLATE stream in unzipSync.
+  unzipSync(bytes,{filter(file){
+   memberName(file.name);
+   if(metadata.has(file.name))throw invalid('PPTX repeats a ZIP member name.',file.name);
+   limit('members',budget.members+metadata.size+1,file.name);
+   if(!Number.isSafeInteger(file.size)||file.size<0||file.size>bytes.length||!Number.isSafeInteger(file.originalSize)||file.originalSize<0)throw invalid('PPTX has invalid ZIP member sizes.',file.name);
+   if(![0,8].includes(file.compression))throw invalid('PPTX uses an unsupported ZIP compression method.',file.name);
+   limit('memberBytes',file.originalSize,file.name);
+   if(xmlPart(file.name))limit('xmlBytes',file.originalSize,file.name);
+   declared+=file.originalSize;limit('expandedBytes',budget.expanded+declared,file.name);
+   metadata.set(file.name,file);return false;
+  }});
+  const entries=Object.create(null),seen=new Set();let failure;
+  const unzip=new Unzip(file=>{
+   const expected=metadata.get(file.name);
+   if(!expected||seen.has(file.name))throw invalid('PPTX local ZIP members do not match its directory.',file.name);
+   seen.add(file.name);
+   if(file.compression!==expected.compression||file.size!==undefined&&file.size!==expected.size||file.originalSize!==undefined&&file.originalSize!==expected.originalSize)throw invalid('PPTX local and directory sizes or methods disagree.',file.name);
+   let count=0;const chunks=[];
+   file.ondata=(error,chunk,final)=>{
+    if(failure)return;
+    try{
+     if(error)throw error;
+     count+=chunk.length;limit('memberBytes',count,file.name);
+     if(count>expected.originalSize)throw invalid('PPTX expands beyond its declared member size.',file.name);
+     budget.expanded+=chunk.length;limit('expandedBytes',budget.expanded,file.name);
+     chunks.push(chunk);
+     if(final){
+      if(count!==expected.originalSize)throw invalid('PPTX expanded member size differs from its directory.',file.name);
+      const data=new Uint8Array(count);let at=0;for(const part of chunks){data.set(part,at);at+=part.length;}chunks.length=0;
+      if(xmlPart(file.name))checkXml(data,file.name);
+      entries[file.name]=data;
+     }
+    }catch(error){failure=error;}
+   };
+   file.start();
+  });
+  unzip.register(UnzipInflate);
+  // A 4KiB compressed feed bounds an individual inflater emission (~4MiB at DEFLATE's
+  // maximum expansion) before our actual-output counter can reject dishonest metadata.
+  for(let at=0;at<bytes.length;at+=4096){unzip.push(bytes.subarray(at,at+4096),at+4096>=bytes.length);if(failure)throw failure;}
+  if(seen.size!==metadata.size||Object.keys(entries).length!==metadata.size)throw invalid('PPTX ZIP members are missing or incomplete.',path);
+  budget.members+=metadata.size;states.set(entries,{budget,depth,cache:new Map()});return entries;
+ }catch(error){
+  if(error instanceof OPFPptxError)throw error;
+  throw new OPFPptxError('invalid-pptx','PPTX input is not a readable ZIP archive.',{...(path===undefined?{}:{path}),cause:error instanceof Error?error.message:String(error)});
+ }
+}
+export function readNestedInputZip(entries,path){
+ const state=stateOf(entries);
+ const cached=state.cache.get(path),source=entries[path];
+ if(cached?.source===source)return cached.entries;
+ const nested=readInputZip(source,{budget:state.budget,depth:state.depth+1,path});
+ state.cache.set(path,{source,entries:nested});return nested;
+}

package/dist/svg-image.js

@@ -153,7 +153,9 @@ function sanitize(input, text) {
       } else if (!skipping) {
         if (chunk.includes(']]>')) malformed('a stray CDATA terminator');
         const style = stack.at(-1).name === 'style';
-        out.push(references(style ? filterCss(chunk) : chunk));
+        const filtered = style ? filterCss(chunk) : chunk;
+        if (filtered !== chunk) removed.add('external references');
+        out.push(references(filtered));
       }
       continue;
     }
@@ -167,7 +169,12 @@ function sanitize(input, text) {
       const end = text.indexOf(']]>', index + 9);
       if (end < 0) malformed('an unterminated CDATA section');
       if (!stack.length) malformed('CDATA outside the root element');
-      if (!skipping) out.push(`<![CDATA[${stack.at(-1).name === 'style' ? filterCss(text.slice(index + 9, end)) : text.slice(index + 9, end)}]]>`);
+      if (!skipping) {
+        const chunk = text.slice(index + 9, end);
+        const filtered = stack.at(-1).name === 'style' ? filterCss(chunk) : chunk;
+        if (filtered !== chunk) removed.add('external references');
+        out.push(`<![CDATA[${filtered}]]>`);
+      }
       index = end + 3;
       continue;
     }

package/dist/typeface-inventory.js

@@ -1,4 +1,4 @@
-import {unzipSync} from 'fflate';
+import {checkInputEntries,readInputZip,readNestedInputZip} from './input-safety.js';
 
 // Typeface inventory for a PPTX package (FF-08, font-fidelity-everywhere).
 //
@@ -45,7 +45,7 @@ export function inventoryTypefaces(input, options = {}) {
     for (const path of Object.keys(entries).sort()) {
       const bytes = entries[path];
       if (NESTED_PACKAGE.test(path)) {
-        if (options.nested !== false) visit(unzipSync(bytes), `${prefix}${path}!/`);
+        if (options.nested !== false) visit(readNestedInputZip(entries,path), `${prefix}${path}!/`);
         continue;
       }
       if (!XML_PART.test(path)) continue;
@@ -162,9 +162,9 @@ export function compareFontNames(left, right) {
 }
 
 function toEntries(input) {
-  if (input instanceof Uint8Array) return unzipSync(input);
-  if (input instanceof ArrayBuffer) return unzipSync(new Uint8Array(input));
-  if (input && typeof input === 'object') return input;
+  if (input instanceof Uint8Array) return readInputZip(input);
+  if (input instanceof ArrayBuffer) return readInputZip(new Uint8Array(input));
+  if (input && typeof input === 'object') return checkInputEntries(input);
   throw new TypeError('Expected PPTX bytes or a map of package parts.');
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openpresentation/opf-pptx",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Pure local OPF to PPTX export and PPTX to OPF import tooling.",
   "license": "MIT",
   "type": "module",
@@ -66,7 +66,7 @@
   "dependencies": {
     "@node-projects/jszip": "4.3.0",
     "@openpresentation/gallery": "^3.0.0",
-    "@openpresentation/opf": "^0.20.2",
+    "@openpresentation/opf": "^0.20.5",
     "@rgrove/parse-xml": "4.2.3",
     "fast-xml-parser": "^5.8.0",
     "fflate": "^0.8.3",
@@ -74,7 +74,7 @@
     "sharp": "0.35.5"
   },
   "peerDependencies": {
-    "@openpresentation/opf-render": "^0.20.2"
+    "@openpresentation/opf-render": "^0.20.4"
   },
   "peerDependenciesMeta": {
     "@openpresentation/opf-render": {
@@ -98,7 +98,7 @@
     "@expo-google-fonts/roboto": "0.4.3",
     "@expo-google-fonts/roboto-mono": "0.4.2",
     "@expo-google-fonts/tinos": "0.4.2",
-    "@openpresentation/opf-render": "0.20.2",
+    "@openpresentation/opf-render": "0.20.4",
     "@resvg/resvg-js": "2.6.2",
     "esbuild": "0.28.2",
     "playwright": "1.64.0"