@pdfme/common 6.2.4 → 6.2.5-dev.1

package/dist/expression.d.ts

@@ -1,4 +1,10 @@
 import type { Schema, SchemaPageArray } from './types.js';
+/**
+ * False only for strings JSON.parse would reject, so parseData can skip the throw. Index scans, not
+ * regexes: V8 keeps the subject of the last successful match (RegExp.input), which would pin a large
+ * value after the call.
+ */
+export declare const mayBeJson: (value: string) => boolean;
 /**
  * Resolve a read-only schema's render value.
  * Text `content` is an expression template. MVT `content` is a variable JSON

package/dist/helper.d.ts

@@ -2,6 +2,11 @@ import type { PDFDocument, PDFPage } from '@pdfme/pdf-lib';
 import { Template, Font, BasePdf, Plugins, BlankPdf, PdfBytes } from './types.js';
 export declare const cloneDeep: <T>(value: T) => T;
 export declare const getFallbackFontName: (font: Font) => string;
+/**
+ * The built-in fallback font. Every call returns a new Font object around the same bytes, decoded
+ * once and kept for the life of the process: do not modify or transfer them (e.g. in a
+ * postMessage transfer list).
+ */
 export declare const getDefaultFont: () => Font;
 export declare const mm2pt: (mm: number) => number;
 export declare const pt2mm: (pt: number) => number;
@@ -16,6 +21,10 @@ export declare const migrateTemplate: (template: Template) => void;
 export declare const getInputFromTemplate: (template: Template) => {
     [key: string]: string;
 }[];
+/**
+ * Checks the URL's literal host only. DNS names that resolve to internal addresses and
+ * redirects are not covered; validate untrusted templates server-side if that matters.
+ */
 export declare const isUrlSafeToFetch: (urlString: string) => boolean;
 export type PdfLinkAnnotationRect = {
     x: number;

package/dist/index.js

@@ -3,7 +3,7 @@ import { Buffer } from "buffer";
 import { PDFName } from "@pdfme/pdf-lib";
 import * as acorn from "acorn";
 //#region src/version.ts
-var PDFME_VERSION = "6.2.4";
+var PDFME_VERSION = "6.2.5";
 //#endregion
 //#region src/pageSize.ts
 var PAGE_SIZE_PRESETS = {
@@ -373,10 +373,19 @@ var getFallbackFontName = (font) => {
 	if (fallbackFontName === initial) throw Error(`[@pdfme/common] fallback flag is not found in font. true fallback flag must be only one.`);
 	return fallbackFontName;
 };
-var getDefaultFont = () => ({ [DEFAULT_FONT_NAME]: {
-	data: b64toUint8Array(DEFAULT_FONT_VALUE),
-	fallback: true
-} });
+var defaultFontData;
+/**
+* The built-in fallback font. Every call returns a new Font object around the same bytes, decoded
+* once and kept for the life of the process: do not modify or transfer them (e.g. in a
+* postMessage transfer list).
+*/
+var getDefaultFont = () => {
+	if (!defaultFontData) defaultFontData = b64toUint8Array(DEFAULT_FONT_VALUE);
+	return { [DEFAULT_FONT_NAME]: {
+		data: defaultFontData,
+		fallback: true
+	} };
+};
 var mm2pt = (mm) => {
 	return parseFloat(String(mm)) * MM_TO_PT_RATIO;
 };
@@ -423,6 +432,123 @@ var getInputFromTemplate = (template) => {
 	});
 	return [input];
 };
+var parseIpv4 = (host) => {
+	const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (!match) return null;
+	const octets = match.slice(1).map(Number);
+	return octets.every((octet) => octet <= 255) ? octets : null;
+};
+var parseIpv6 = (host) => {
+	let address = host.toLowerCase();
+	const lastColon = address.lastIndexOf(":");
+	const tail = address.slice(lastColon + 1);
+	if (tail.includes(".")) {
+		const octets = parseIpv4(tail);
+		if (!octets) return null;
+		const high = (octets[0] << 8 | octets[1]).toString(16);
+		const low = (octets[2] << 8 | octets[3]).toString(16);
+		address = `${address.slice(0, lastColon + 1)}${high}:${low}`;
+	}
+	const halves = address.split("::");
+	if (halves.length > 2) return null;
+	const toGroups = (part) => part === "" ? [] : part.split(":");
+	const head = toGroups(halves[0]);
+	let groups = head;
+	if (halves.length === 2) {
+		const rest = toGroups(halves[1]);
+		const missing = 8 - head.length - rest.length;
+		if (missing < 1) return null;
+		groups = [
+			...head,
+			...Array(missing).fill("0"),
+			...rest
+		];
+	}
+	if (groups.length !== 8 || !groups.every((group) => /^[0-9a-f]{1,4}$/.test(group))) return null;
+	return groups.map((group) => parseInt(group, 16));
+};
+var ipv4ToInt = (octets) => (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+var toIpv4Range = (cidr) => {
+	const [address, prefix] = cidr.split("/");
+	const prefixLength = Number(prefix);
+	const mask = prefixLength === 0 ? 0 : -1 << 32 - prefixLength >>> 0;
+	return {
+		base: (ipv4ToInt(parseIpv4(address)) & mask) >>> 0,
+		mask
+	};
+};
+var toIpv6Range = (cidr) => {
+	const [address, prefix] = cidr.split("/");
+	return {
+		base: parseIpv6(address),
+		prefixLength: Number(prefix)
+	};
+};
+var NON_PUBLIC_IPV4_RANGES = [
+	"0.0.0.0/8",
+	"10.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.0.0.0/24",
+	"192.0.2.0/24",
+	"192.88.99.0/24",
+	"192.168.0.0/16",
+	"198.18.0.0/15",
+	"198.51.100.0/24",
+	"203.0.113.0/24",
+	"224.0.0.0/4",
+	"240.0.0.0/4"
+].map(toIpv4Range);
+var NON_PUBLIC_IPV6_RANGES = [
+	"::/96",
+	"100::/64",
+	"2001::/32",
+	"2001:db8::/32",
+	"64:ff9b:1::/48",
+	"fc00::/7",
+	"fe80::/10",
+	"fec0::/10",
+	"ff00::/8"
+].map(toIpv6Range);
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
+	"localhost",
+	"localhost.localdomain",
+	"ip6-localhost",
+	"ip6-loopback"
+]);
+var IPV4_MAPPED_RANGE = toIpv6Range("::ffff:0:0/96");
+var NAT64_WELL_KNOWN_RANGE = toIpv6Range("64:ff9b::/96");
+var SIX_TO_FOUR_RANGE = toIpv6Range("2002::/16");
+var isPublicIpv4 = (octets) => {
+	const value = ipv4ToInt(octets);
+	return NON_PUBLIC_IPV4_RANGES.every(({ base, mask }) => (value & mask) >>> 0 !== base);
+};
+var isInIpv6Range = (groups, { base, prefixLength }) => {
+	for (let i = 0; i < 8; i++) {
+		const bits = Math.min(16, Math.max(0, prefixLength - i * 16));
+		if (bits === 0) return true;
+		const mask = 65535 << 16 - bits & 65535;
+		if ((groups[i] & mask) !== (base[i] & mask)) return false;
+	}
+	return true;
+};
+var ipv4FromGroups = (high, low) => [
+	high >> 8,
+	high & 255,
+	low >> 8,
+	low & 255
+];
+var isPublicIpv6 = (groups) => {
+	if (isInIpv6Range(groups, IPV4_MAPPED_RANGE) || isInIpv6Range(groups, NAT64_WELL_KNOWN_RANGE)) return isPublicIpv4(ipv4FromGroups(groups[6], groups[7]));
+	if (isInIpv6Range(groups, SIX_TO_FOUR_RANGE)) return isPublicIpv4(ipv4FromGroups(groups[1], groups[2]));
+	return NON_PUBLIC_IPV6_RANGES.every((range) => !isInIpv6Range(groups, range));
+};
+/**
+* Checks the URL's literal host only. DNS names that resolve to internal addresses and
+* redirects are not covered; validate untrusted templates server-side if that matters.
+*/
 var isUrlSafeToFetch = (urlString) => {
 	let parsed;
 	try {
@@ -432,31 +558,15 @@ var isUrlSafeToFetch = (urlString) => {
 	}
 	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
 	const hostname = parsed.hostname.toLowerCase();
-	if (hostname === "localhost" || hostname === "0.0.0.0" || hostname === "[::1]" || hostname === "::1") return false;
-	const bare = hostname.replace(/^\[|\]$/g, "");
-	if (/^fe80:/i.test(bare)) return false;
-	if (/^f[cd]/i.test(bare)) return false;
-	const ipv4MappedMatch = bare.match(/^::ffff:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/i);
-	if (ipv4MappedMatch) {
-		const a = Number(ipv4MappedMatch[1]);
-		const b = Number(ipv4MappedMatch[2]);
-		if (a === 0 || a === 10 || a === 127) return false;
-		if (a === 169 && b === 254) return false;
-		if (a === 172 && b >= 16 && b <= 31) return false;
-		if (a === 192 && b === 168) return false;
-	}
-	const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-	if (ipv4Match) {
-		const a = Number(ipv4Match[1]);
-		const b = Number(ipv4Match[2]);
-		if (a === 0) return false;
-		if (a === 10) return false;
-		if (a === 127) return false;
-		if (a === 169 && b === 254) return false;
-		if (a === 172 && b >= 16 && b <= 31) return false;
-		if (a === 192 && b === 168) return false;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) {
+		const groups = parseIpv6(hostname.slice(1, -1));
+		return groups !== null && isPublicIpv6(groups);
 	}
-	return true;
+	const host = hostname.replace(/\.+$/, "");
+	if (!host) return false;
+	const ipv4 = parseIpv4(host);
+	if (ipv4) return isPublicIpv4(ipv4);
+	return !LOOPBACK_HOSTNAMES.has(host) && !host.endsWith(".localhost");
 };
 var SAFE_LINK_URI_PROTOCOLS = /* @__PURE__ */ new Set([
 	"http:",
@@ -665,6 +775,50 @@ var checkGenerateProps = (data) => {
 //#endregion
 //#region src/expression.ts
 var expressionCache = /* @__PURE__ */ new Map();
+var isJsonWhitespace = (ch) => ch === " " || ch === "	" || ch === "\n" || ch === "\r";
+var isDigit = (ch) => ch !== void 0 && ch >= "0" && ch <= "9";
+var isJsonNumber = (value, start, end) => {
+	let i = start;
+	if (value[i] === "-") i++;
+	if (!isDigit(value[i])) return false;
+	if (value[i] === "0") i++;
+	else while (i < end && isDigit(value[i])) i++;
+	if (value[i] === ".") {
+		const digits = ++i;
+		while (i < end && isDigit(value[i])) i++;
+		if (i === digits) return false;
+	}
+	if (value[i] === "e" || value[i] === "E") {
+		i++;
+		if (value[i] === "+" || value[i] === "-") i++;
+		const digits = i;
+		while (i < end && isDigit(value[i])) i++;
+		if (i === digits) return false;
+	}
+	return i === end;
+};
+/**
+* False only for strings JSON.parse would reject, so parseData can skip the throw. Index scans, not
+* regexes: V8 keeps the subject of the last successful match (RegExp.input), which would pin a large
+* value after the call.
+*/
+var mayBeJson = (value) => {
+	let start = 0;
+	let end = value.length;
+	while (start < end && isJsonWhitespace(value[start])) start++;
+	while (end > start && isJsonWhitespace(value[end - 1])) end--;
+	const first = value[start];
+	if (first === "{") {
+		let i = start + 1;
+		while (i < end && isJsonWhitespace(value[i])) i++;
+		return value[i] === "\"" || value[i] === "}";
+	}
+	if (first === "[" || first === "\"") return true;
+	if (first === "t") return end - start === 4 && value.startsWith("true", start);
+	if (first === "f") return end - start === 5 && value.startsWith("false", start);
+	if (first === "n") return end - start === 4 && value.startsWith("null", start);
+	return isJsonNumber(value, start, end);
+};
 /**
 * Parse each string value in `data` as JSON, falling back to the original
 * string on failure. Previously memoized via a module-level `parseDataCache`
@@ -674,10 +828,14 @@ var expressionCache = /* @__PURE__ */ new Map();
 *   base64 (e.g. image schemas) or inputs containing base64 values. Every
 *   unique inputs state pinned its own multi-MB key for the app lifetime.
 * Parsing is O(fields) and cheap; removing the cache is strictly a win.
+*
+* It is called once per placeholder field, over every field, so most strings are not JSON and
+* a thrown SyntaxError each made it the bulk of a render. Strings that cannot be JSON skip
+* JSON.parse (see mayBeJson); the result is the same.
 */
 var parseData = (data) => {
 	return Object.fromEntries(Object.entries(data).map(([key, value]) => {
-		if (typeof value === "string") try {
+		if (typeof value === "string" && mayBeJson(value)) try {
 			return [key, JSON.parse(value)];
 		} catch {
 			return [key, value];