@stll/docx-utils 0.1.0 → 0.1.1

package/dist/index.d.ts

@@ -1,5 +1,4 @@
 import JSZip from "jszip";
-
 //#region src/namespaces.d.ts
 /**
  * Common OOXML namespace URIs.

package/dist/index.js

@@ -51,6 +51,12 @@ const extractBinary = async (zip, path) => {
 const repackZip = async (zip) => await zip.generateAsync(DOCX_COMPRESSION);
 //#endregion
 //#region src/relationships.ts
+/**
+* Escape a string for safe use inside a double-quoted XML attribute value.
+* Order matters: `&` must be escaped first so it does not double-escape the
+* entities produced for the other characters.
+*/
+const escapeXmlAttribute = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;");
 /** Find the next available rId in a relationships XML string */
 const findNextRId = (relsXml) => {
 	const matches = relsXml.matchAll(/Id="rId(?<num>\d+)"/gu);
@@ -63,15 +69,17 @@ const findNextRId = (relsXml) => {
 };
 /** Ensure a content type entry exists in [Content_Types].xml */
 const ensureContentType = (contentTypesXml, partName, contentType) => {
-	if (contentTypesXml.includes(`PartName="${partName}"`)) return contentTypesXml;
-	const override = `<Override PartName="${partName}" ContentType="${contentType}"/>`;
-	return contentTypesXml.replace("</Types>", `${override}\n</Types>`);
+	const escapedPartName = escapeXmlAttribute(partName);
+	if (contentTypesXml.includes(`PartName="${escapedPartName}"`)) return contentTypesXml;
+	const override = `<Override PartName="${escapedPartName}" ContentType="${escapeXmlAttribute(contentType)}"/>`;
+	return contentTypesXml.replace("</Types>", () => `${override}\n</Types>`);
 };
 /** Ensure a relationship entry exists */
 const ensureRelationship = (relsXml, rId, type, target) => {
-	if (relsXml.includes(`Id="${rId}"`)) return relsXml;
-	const rel = `<Relationship Id="${rId}" Type="${type}" Target="${target}"/>`;
-	return relsXml.replace("</Relationships>", `${rel}\n</Relationships>`);
+	const escapedRId = escapeXmlAttribute(rId);
+	if (relsXml.includes(`Id="${escapedRId}"`)) return relsXml;
+	const rel = `<Relationship Id="${escapedRId}" Type="${escapeXmlAttribute(type)}" Target="${escapeXmlAttribute(target)}"/>`;
+	return relsXml.replace("</Relationships>", () => `${rel}\n</Relationships>`);
 };
 //#endregion
 export { DOCX_COMPRESSION, OOXML_NS, ensureContentType, ensureRelationship, extractBinary, extractText, findNextRId, loadDocx, repackZip };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stll/docx-utils",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Low-level helpers for reading and writing DOCX/OOXML zip packages: text and binary extraction, relationship and content-type management, and namespace constants.",
   "keywords": [
     "docx",
@@ -40,7 +40,7 @@
     "build": "tsdown",
     "pack:dry-run": "bun pm pack --dry-run",
     "test": "bun test src",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "bun ../../packages/scripts/src/tsc-native.ts --noEmit",
     "lint": "cd ../.. && bun --bun oxlint -c oxlint.config.ts --report-unused-disable-directives-severity=error --deny-warnings --type-aware packages/docx-utils",
     "lint:fix": "cd ../.. && bun --bun oxlint -c oxlint.config.ts --type-aware --fix packages/docx-utils",
     "format": "oxfmt .",
@@ -52,7 +52,7 @@
   "devDependencies": {
     "@stll/typescript-config": "0.0.0",
     "@types/bun": "1.3.14",
-    "tsdown": "0.22.3"
+    "tsdown": "0.22.14"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts"