@poe-platform/safe-bash 0.1.810 → 0.1.811

package/dist/spreadsheet-format-xls/biff-encrypted-properties.js

@@ -23,7 +23,8 @@ export async function encryptedBiffPropertyStream(streams, context, charge, prop
             invalidBiff("duplicate encrypted property stream");
         names.add(key);
         if (key === "ENCRYPTION") {
-            encrypted = bytes;
+            const input = propertySources?.get(name);
+            encrypted = input ? propertyRange(input, context) : bytes;
             continue;
         }
         const file = propertyRange(propertySources?.get(name) ?? bytes, context);
@@ -45,9 +46,11 @@ export async function encryptedBiffPropertyStream(streams, context, charge, prop
     }
     if (!encrypted)
         throw new SsconvertError("unsupported-feature", "Unsupported ssconvert feature: encrypted Excel workbook ancillary properties require the encryption stream");
-    if (encrypted.length > context.limits.inputBytes)
+    const length = encrypted instanceof Uint8Array ? encrypted.length : encrypted.size;
+    if (length > context.limits.inputBytes)
         throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
-    new Binary(encrypted).check(0, 8);
+    if (length < 8)
+        invalidBiff("truncated binary data");
     return encrypted;
 }
 /** MS-OFFCRYPTO 2.3.5.4: header/table restart block 0; each payload restarts its
@@ -99,7 +102,10 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
     };
     try {
         check();
-        const descriptors = readEncryptedPropertyDescriptors(encrypted, decrypt, context, charge), source = new Binary(encrypted);
+        if (encrypted.length > context.limits.inputBytes)
+            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
+        const source = new Binary(encrypted), { offset, size } = propertyTableRange(decrypt(source.slice(0, 8), 0), source);
+        const descriptors = readEncryptedPropertyDescriptors(source, offset, size, decrypt(source.slice(offset, size), 0), context, charge);
         for (const entry of descriptors)
             result.set(entry.name, decrypt(source.slice(entry.offset, entry.size), entry.block));
         return result;
@@ -109,16 +115,16 @@ export function decryptBiffPropertyContainer(encrypted, keyStream, context, char
         throw error;
     }
 }
-function readEncryptedPropertyDescriptors(encrypted, decrypt, context, charge) {
-    if (encrypted.length > context.limits.inputBytes)
-        throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
-    const source = new Binary(encrypted), header = new Binary(decrypt(source.slice(0, 8), 0));
-    const offset = header.u32(0), size = header.u32(4);
-    header.bytes.fill(0);
+function propertyTableRange(bytes, source) {
+    const header = new Binary(bytes), offset = header.u32(0), size = header.u32(4);
+    bytes.fill(0);
     if (offset < 8 || size < 4)
         invalidBiff("invalid encrypted property descriptor range");
     source.check(offset, size);
-    const table = new Binary(decrypt(source.slice(offset, size), 0)), count = table.u32(0);
+    return { offset, size };
+}
+function readEncryptedPropertyDescriptors(source, offset, size, bytes, context, charge) {
+    const table = new Binary(bytes), count = table.u32(0);
     if (count > Math.floor((size - 4) / 18))
         invalidBiff("invalid encrypted property descriptor count");
     if (count > (context.limits.workbookNodes ?? context.limits.inputBytes))
@@ -168,10 +174,11 @@ function readEncryptedPropertyDescriptors(encrypted, decrypt, context, charge) {
             invalidBiff("overlapping encrypted property payloads");
     return descriptors;
 }
-/** Decrypt payloads directly into caller storage. Container bytes and the validated
- * descriptor table are still buffered; payload plaintext never accumulates in RAM. */
+/** Decrypt retained ciphertext directly into caller storage. Only the descriptor
+ * table is buffered; payload plaintext never accumulates in RAM. */
 export async function decryptBiffPropertySources(encrypted, createCipher, context, charge) {
     const result = new Map(), owned = [];
+    const input = propertyRange(encrypted, context);
     let closed = false;
     const check = () => { context.signal.throwIfAborted(); if (closed)
         throw new SsconvertError("invalid-request", "Encrypted BIFF property reader disposed"); };
@@ -186,14 +193,16 @@ export async function decryptBiffPropertySources(encrypted, createCipher, contex
             throw new AggregateError(errors, "Encrypted BIFF property cleanup failed");
     };
     context.own(close);
-    function* chunks(bytes, block) {
+    async function* chunks(offset, size, block) {
         check();
-        charge(bytes.length * 2 + 320);
+        input.check(offset, size);
+        charge(size * 2 + 320);
         const cipher = createCipher(block);
         try {
             check();
-            for (let at = 0; at < bytes.length; at += 16384) {
-                const output = bytes.slice(at, at + 16384);
+            for (let at = 0; at < size;) {
+                const output = await input.read(offset + at, Math.min(16384, size - at), { signal: context.signal });
+                at += output.length;
                 try {
                     cipher.xor(output);
                     check();
@@ -211,19 +220,23 @@ export async function decryptBiffPropertySources(encrypted, createCipher, contex
     }
     try {
         check();
-        const descriptors = readEncryptedPropertyDescriptors(encrypted, (bytes, block) => {
-            const output = new Uint8Array(bytes.length);
+        if (input.size > context.limits.inputBytes)
+            throw new SsconvertError("resource-limit", "ssconvert encrypted BIFF property input limit exceeded");
+        const decrypt = async (offset, size) => {
+            input.check(offset, size);
+            const output = new Uint8Array(size);
             owned.push(output);
             let at = 0;
-            for (const part of chunks(bytes, block)) {
+            for await (const part of chunks(offset, size, 0)) {
                 output.set(part, at);
                 at += part.length;
             }
             return output;
-        }, context, charge);
+        };
+        const { offset, size } = propertyTableRange(await decrypt(0, 8), input);
+        const descriptors = readEncryptedPropertyDescriptors(input, offset, size, await decrypt(offset, size), context, charge);
         for (const entry of descriptors) {
-            const bytes = encrypted.subarray(entry.offset, entry.offset + entry.size);
-            const source = await stagePropertyBytes({ length: entry.size, chunks: () => chunks(bytes, entry.block) }, context, context.limits.inputBytes);
+            const source = await stagePropertyBytes({ length: entry.size, chunks: () => chunks(entry.offset, entry.size, entry.block) }, context, context.limits.inputBytes);
             result.set(entry.name, source);
             check();
         }

package/dist/spreadsheet-format-xls/biff-encryption.js

@@ -339,7 +339,7 @@ export async function decryptBiffRecords(records, revision, context, streams, pr
             }
         };
         // Staging must finish while the block-key base still exists.
-        return context.createWorkingStorage ? await decryptBiffPropertySources(properties, createCipher, context, admit) :
+        return context.createWorkingStorage || !(properties instanceof Uint8Array) ? await decryptBiffPropertySources(properties, createCipher, context, admit) :
             decryptBiffPropertyContainer(properties, keyStream, context, admit, createCipher);
     }
     catch (error) {

package/dist/spreadsheet-format-xls/biff-property-bytes.d.ts

@@ -6,4 +6,7 @@ export type BiffPropertyBytes = Uint8Array | {
 };
 export declare function propertyChunks(value: BiffPropertyBytes): Iterable<Uint8Array>;
 /** Consume lazy serialization once into caller storage; never retain emitted chunks. */
-export declare function stagePropertyBytes(value: BiffPropertyBytes, context: CapabilityContext, maximumBytes?: number): Promise<BiffPropertySource>;
+export declare function stagePropertyBytes(value: BiffPropertyBytes | {
+    readonly length: number;
+    chunks(): AsyncIterable<Uint8Array>;
+}, context: CapabilityContext, maximumBytes?: number): Promise<BiffPropertySource>;

package/dist/spreadsheet-format-xls/biff-property-bytes.js

@@ -61,7 +61,7 @@ export async function stagePropertyBytes(value, context, maximumBytes = context.
                 count = 0;
             };
             try {
-                for (const part of propertyChunks(value)) {
+                for await (const part of value instanceof Uint8Array ? propertyChunks(value) : value.chunks()) {
                     check();
                     if (part.length > source.size - written - count)
                         throw new SsconvertError('io', 'Invalid BIFF property serialization size');

package/dist/spreadsheet-format-xls/biff-range.js

@@ -100,7 +100,7 @@ export async function readBiffRange(input, context, probe = false) {
                 // Only these ancillary payloads are interpreted by the existing reader.
                 // Keep other names for its name/work admission, without copying ignored streams.
                 const needed = ["ENCRYPTION", "\u0005SUMMARYINFORMATION", "\u0005DOCUMENTSUMMARYINFORMATION"].includes(name.toUpperCase());
-                if (needed && name.toUpperCase() !== "ENCRYPTION" && recordStore) {
+                if (needed && recordStore) {
                     propertySources.set(name, { size: stream.size, async read(at, count, options) {
                             try {
                                 return await stream.read(at, count, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-bash",
-  "version": "0.1.810",
+  "version": "0.1.811",
   "description": "Extensible virtual shell with pluggable filesystems and streaming commands",
   "type": "module",
   "license": "MIT",
@@ -1407,7 +1407,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@poe-platform/safe-fs": "0.1.810",
+    "@poe-platform/safe-fs": "0.1.811",
     "pdf-lib": "1.17.1",
     "@types/node": "^25.2.2",
     "@formatjs/intl-numberformat": "9.4.0",
@@ -1420,6 +1420,7 @@
     "parse5": "7.3.0",
     "@pdf-lib/fontkit": "1.1.1",
     "linebreak": "^1.1.0",
+    "bidi-js": "1.1.0",
     "saxes": "^6.0.0",
     "temporal-polyfill": "1.0.4",
     "@formatjs/intl-localematcher": "0.8.13",
@@ -2729,9 +2730,11 @@
     "./dist/spreadsheet-engine/rendering/images/index.js",
     "./dist/spreadsheet-engine/rendering/images/profile-raster.js",
     "./dist/spreadsheet-engine/rendering/images/scene.js",
+    "./dist/spreadsheet-engine/rendering/print/bidi-runs.js",
     "./dist/spreadsheet-engine/rendering/print/blank-styles.js",
     "./dist/spreadsheet-engine/rendering/print/border-junctions.js",
     "./dist/spreadsheet-engine/rendering/print/cell-style.js",
+    "./dist/spreadsheet-engine/rendering/print/control-bidi.js",
     "./dist/spreadsheet-engine/rendering/print/diagonal-borders.js",
     "./dist/spreadsheet-engine/rendering/print/font-normalization-data.js",
     "./dist/spreadsheet-engine/rendering/print/font-normalization.js",