@stll/folio-core 0.53.0 → 0.54.0

package/dist/docx/server/boundedArchive.d.ts

@@ -1,17 +1,5 @@
 import { XmlResourceLimits } from "../xmlResourceLimits.js";
-import JSZip from "jszip";
 //#region src/docx/server/boundedArchive.d.ts
-declare module "jszip" {
-  interface JSZipObject {
-    /**
-     * Chunked read of the entry content, missing from the published typings.
-     * `nodeStream` is this stream wrapped in a Node.js `Readable`, which
-     * browsers and web workers cannot provide; the stream itself is
-     * platform-neutral.
-     */
-    internalStream(type: "uint8array"): JSZip.JSZipStreamHelper<Uint8Array>;
-  }
-}
 declare const DOCX_MAX_ENTRY_BYTES: number;
 declare const DOCX_MAX_TOTAL_BYTES: number;
 declare const DOCX_MAX_ENTRIES = 4096;
@@ -20,7 +8,7 @@ declare const DocxArchiveError_base: import("better-result").TaggedErrorClass<"D
 /** Error raised when a DOCX archive cannot be loaded within configured limits. */
 declare class DocxArchiveError extends DocxArchiveError_base<{
   message: string;
-  reason: "load-failed" | "input-too-large" | "too-many-entries" | "entry-too-large" | "total-too-large" | "invalid-options";
+  reason: "load-failed" | "input-too-large" | "too-many-entries" | "entry-too-large" | "total-too-large" | "compression-ratio-exceeded" | "invalid-options";
   cause?: unknown;
 }> {}
 type DocxArchiveOptions = {
@@ -28,6 +16,13 @@ type DocxArchiveOptions = {
   maxEntryBytes?: number;
   maxTotalBytes?: number;
   maxEntries?: number;
+  /**
+   * Most inflated bytes allowed per compressed byte, for each markup or text
+   * entry and for the package as a whole. Binary entries are bounded by the
+   * byte limits and the package ratio only, and entries and packages under
+   * 4 MiB inflated are exempt. Defaults to 200.
+   */
+  maxCompressionRatio?: number;
   /**
    * Bounds on parsed XML structure, applied to every XML part this archive
    * hands out as a string.

package/dist/docx/server/boundedArchive.js

@@ -1,3 +1,4 @@
+import { compressionRatioLimitFor, countCentralDirectoryRecords, createInflationBudget, exceedsCompressionRatio, getZipEntrySizes, inflateEntryWithinLimits } from "../archiveInflation.js";
 import { FOLIO_XML_RESOURCE_LIMITS, assertXmlResourceLimits, createXmlPackageBudget } from "../xmlResourceLimits.js";
 import { TaggedError } from "better-result";
 import JSZip from "jszip";
@@ -8,49 +9,26 @@ const DOCX_MAX_ENTRIES = 4096;
 const DOCX_MAX_INPUT_BYTES = 50 * 1024 * 1024;
 /** Error raised when a DOCX archive cannot be loaded within configured limits. */
 var DocxArchiveError = class extends TaggedError("DocxArchiveError") {};
-const concatChunks = (chunks) => {
-	let totalBytes = 0;
-	for (const chunk of chunks) totalBytes += chunk.length;
-	const merged = new Uint8Array(totalBytes);
-	let offset = 0;
-	for (const chunk of chunks) {
-		merged.set(chunk, offset);
-		offset += chunk.length;
+const readLimitError = ({ limit, path, maxEntryBytes, maxTotalBytes, maxCompressionRatio }) => {
+	switch (limit) {
+		case "declared-size": return new DocxArchiveError({
+			message: `DOCX entry "${path}" inflated past its declared size`,
+			reason: "entry-too-large"
+		});
+		case "compression-ratio": return new DocxArchiveError({
+			message: `DOCX entry "${path}" exceeded the ${maxCompressionRatio}:1 compression ratio limit`,
+			reason: "compression-ratio-exceeded"
+		});
+		case "entry": return new DocxArchiveError({
+			message: `DOCX entry "${path}" exceeded the ${maxEntryBytes}-byte limit`,
+			reason: "entry-too-large"
+		});
+		case "total":
+		case "aborted": return new DocxArchiveError({
+			message: `DOCX archive exceeded the ${maxTotalBytes}-byte cumulative limit while reading "${path}"`,
+			reason: "total-too-large"
+		});
 	}
-	return merged;
-};
-/**
-* Accumulate an entry chunk by chunk, checking both caps before each chunk is
-* retained. Pausing the stream abandons a decompression bomb mid-inflate, so
-* the caps bound memory instead of merely reporting the overrun afterwards.
-*/
-const collectStream = async ({ stream, maxEntryBytes, remainingBytes, maxTotalBytes, path }) => await new Promise((resolve, reject) => {
-	const chunks = [];
-	let entryBytes = 0;
-	const fail = (reason, message) => {
-		stream.pause();
-		reject(new DocxArchiveError({
-			message,
-			reason
-		}));
-	};
-	stream.on("data", (chunk) => {
-		entryBytes += chunk.length;
-		if (entryBytes > maxEntryBytes) {
-			fail("entry-too-large", `DOCX entry "${path}" exceeded the ${maxEntryBytes}-byte limit`);
-			return;
-		}
-		if (entryBytes > remainingBytes) {
-			fail("total-too-large", `DOCX archive exceeded the ${maxTotalBytes}-byte cumulative limit while reading "${path}"`);
-			return;
-		}
-		chunks.push(chunk);
-	}).on("end", () => resolve(concatChunks(chunks))).on("error", reject).resume();
-});
-const getDeclaredUncompressedBytes = (entry) => {
-	const data = "_data" in entry ? entry._data : void 0;
-	const declaredBytes = typeof data === "object" && data !== null && "uncompressedSize" in data ? data.uncompressedSize : void 0;
-	return typeof declaredBytes === "number" && Number.isFinite(declaredBytes) ? declaredBytes : null;
 };
 const resolveByteLimit = ({ value, fallback, name }) => {
 	const limit = value ?? fallback;
@@ -60,6 +38,7 @@ const resolveByteLimit = ({ value, fallback, name }) => {
 	});
 	return limit;
 };
+const asBytes = (bytes) => bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
 const loadDocxArchive = async (bytes, options = {}) => {
 	const maxInputBytes = resolveByteLimit({
 		value: options.maxInputBytes,
@@ -81,10 +60,19 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		fallback: DOCX_MAX_ENTRIES,
 		name: "DOCX entry limit"
 	});
+	const maxCompressionRatio = resolveByteLimit({
+		value: options.maxCompressionRatio,
+		fallback: 200,
+		name: "DOCX compression ratio limit"
+	});
 	if (bytes.byteLength > maxInputBytes) throw new DocxArchiveError({
 		message: `DOCX input contains ${bytes.byteLength} bytes (max ${maxInputBytes})`,
 		reason: "input-too-large"
 	});
+	if (countCentralDirectoryRecords(asBytes(bytes), maxEntries) > maxEntries) throw new DocxArchiveError({
+		message: `DOCX archive holds more than ${maxEntries} entries`,
+		reason: "too-many-entries"
+	});
 	let zip;
 	try {
 		zip = await JSZip.loadAsync(bytes);
@@ -101,30 +89,47 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		reason: "too-many-entries"
 	});
 	let declaredTotalBytes = 0;
+	let declaredTotalKnown = true;
 	for (const entry of archiveEntries) {
 		if (entry.dir) continue;
-		const declaredBytes = getDeclaredUncompressedBytes(entry);
-		if (declaredBytes === null) {
-			declaredTotalBytes = NaN;
-			break;
+		const { compressedBytes, uncompressedBytes } = getZipEntrySizes(entry);
+		if (uncompressedBytes === null) {
+			declaredTotalKnown = false;
+			continue;
 		}
-		if (declaredBytes > maxEntryBytes) throw new DocxArchiveError({
-			message: `DOCX entry "${entry.name}" declares ${declaredBytes} bytes (max ${maxEntryBytes})`,
+		if (uncompressedBytes > maxEntryBytes) throw new DocxArchiveError({
+			message: `DOCX entry "${entry.name}" declares ${uncompressedBytes} bytes (max ${maxEntryBytes})`,
 			reason: "entry-too-large"
 		});
-		declaredTotalBytes += declaredBytes;
+		if (exceedsCompressionRatio({
+			inflatedBytes: uncompressedBytes,
+			compressedBytes,
+			maxRatio: compressionRatioLimitFor(entry.name, maxCompressionRatio)
+		})) throw new DocxArchiveError({
+			message: `DOCX entry "${entry.name}" declares more than ${maxCompressionRatio} bytes per compressed byte`,
+			reason: "compression-ratio-exceeded"
+		});
+		declaredTotalBytes += uncompressedBytes;
 	}
-	if (Number.isFinite(declaredTotalBytes) && declaredTotalBytes > maxTotalBytes) throw new DocxArchiveError({
+	if (declaredTotalKnown && declaredTotalBytes > maxTotalBytes) throw new DocxArchiveError({
 		message: `DOCX archive declares ${declaredTotalBytes} cumulative bytes (max ${maxTotalBytes})`,
 		reason: "total-too-large"
 	});
+	if (exceedsCompressionRatio({
+		inflatedBytes: declaredTotalBytes,
+		compressedBytes: bytes.byteLength,
+		maxRatio: maxCompressionRatio
+	})) throw new DocxArchiveError({
+		message: `DOCX archive declares more than ${maxCompressionRatio} bytes per archive byte`,
+		reason: "compression-ratio-exceeded"
+	});
 	const xmlLimits = {
 		...FOLIO_XML_RESOURCE_LIMITS,
 		...options.xmlLimits
 	};
 	const xmlBudget = createXmlPackageBudget();
 	const countedParts = /* @__PURE__ */ new Set();
-	let totalBytesRead = 0;
+	const inflationBudget = createInflationBudget(maxTotalBytes);
 	let readChain = Promise.resolve();
 	const readEntry = async (path, readOptions = {}) => {
 		const requestedMaxBytes = resolveByteLimit({
@@ -135,15 +140,21 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		const work = async () => {
 			const entry = zip.file(path);
 			if (!entry) return null;
-			const content = await collectStream({
-				stream: entry.internalStream("uint8array"),
-				maxEntryBytes: Math.min(requestedMaxBytes, maxEntryBytes),
-				remainingBytes: maxTotalBytes - totalBytesRead,
+			const entryLimit = Math.min(requestedMaxBytes, maxEntryBytes);
+			const result = await inflateEntryWithinLimits({
+				entry,
+				maxEntryBytes: entryLimit,
+				maxCompressionRatio: compressionRatioLimitFor(path, maxCompressionRatio),
+				budget: inflationBudget
+			});
+			if (!result.ok) throw readLimitError({
+				limit: result.limit,
+				path,
+				maxEntryBytes: entryLimit,
 				maxTotalBytes,
-				path
+				maxCompressionRatio
 			});
-			totalBytesRead += content.length;
-			return content;
+			return result.bytes;
 		};
 		const next = readChain.then(work, work);
 		readChain = next.then(() => void 0, () => void 0);
@@ -154,7 +165,7 @@ const loadDocxArchive = async (bytes, options = {}) => {
 		entryMetadata: Object.freeze(archiveEntries.map((entry) => ({
 			path: entry.name,
 			directory: entry.dir,
-			declaredUncompressedBytes: getDeclaredUncompressedBytes(entry)
+			declaredUncompressedBytes: getZipEntrySizes(entry).uncompressedBytes
 		}))),
 		async readEntryString(path) {
 			const content = await readEntry(path);

package/dist/docx/server/extractDocxText.d.ts

@@ -1,3 +1,4 @@
+import { DocxArchiveOptions } from "./boundedArchive.js";
 //#region src/docx/server/extractDocxText.d.ts
 /** Document part containing an extracted paragraph. */
 type DocxParagraphSource = "header" | "body" | "footer";
@@ -59,7 +60,12 @@ type ExtractedDocxText = {
   charCount: number;
   view: "accepted";
 };
+/** Options for {@link extractDocxText}. */
+type ExtractDocxTextOptions = {
+  /** Archive limits, applied before and while each part is inflated. */
+  readonly archive?: DocxArchiveOptions;
+};
 /** Extract paragraph text and formatting metadata from a DOCX archive. */
-declare const extractDocxText: (bytes: ArrayBuffer | Uint8Array) => Promise<ExtractedDocxText>;
+declare const extractDocxText: (bytes: ArrayBuffer | Uint8Array, options?: ExtractDocxTextOptions) => Promise<ExtractedDocxText>;
 //#endregion
-export { DocxParagraphSource, DocxTableRowKind, DocxTableRowPosition, ExtractedDocxParagraph, ExtractedDocxTableCell, ExtractedDocxTableCellParagraph, ExtractedDocxText, extractDocxText };
+export { DocxParagraphSource, DocxTableRowKind, DocxTableRowPosition, ExtractDocxTextOptions, ExtractedDocxParagraph, ExtractedDocxTableCell, ExtractedDocxTableCellParagraph, ExtractedDocxText, extractDocxText };

package/dist/docx/server/extractDocxText.js

@@ -504,8 +504,8 @@ const createEmptyResult = () => ({
 	view: "accepted"
 });
 /** Extract paragraph text and formatting metadata from a DOCX archive. */
-const extractDocxText = async (bytes) => {
-	const archive = await loadDocxArchive(bytes);
+const extractDocxText = async (bytes, options = {}) => {
+	const archive = await loadDocxArchive(bytes, options.archive);
 	const documentXml = await archive.readEntryString("word/document.xml");
 	if (documentXml === null) return createEmptyResult();
 	const root = parseXml(documentXml);

package/dist/docx/server/validateDocxConformance.d.ts

@@ -4,7 +4,7 @@ import { DocxArchiveOptions } from "./boundedArchive.js";
 declare const FOLIO_DOCX_CONFORMANCE_REPORT_VERSION: 1;
 declare const FOLIO_DOCX_CONFORMANCE_PROFILE: "folio-supported-v1";
 declare const FOLIO_DOCX_CONFORMANCE_CHECKS: readonly ["archive-safety", "required-parts", "xml-well-formedness", "package-roots", "conformance-class", "canonical-model"];
-declare const FOLIO_DOCX_CONFORMANCE_ISSUE_CODES: readonly ["archive-load-failed", "archive-invalid-options", "archive-input-too-large", "archive-too-many-entries", "archive-entry-too-large", "archive-total-too-large", "required-part-missing", "xml-doctype-forbidden", "xml-not-well-formed", "xml-read-failed", "required-xml-unreadable", "package-root-invalid", "conformance-class-unknown", "model-invalid", "model-warning", "parser-recovery", "parser-unsupported", "parser-failed", "encrypted-container", "container-not-zip"];
+declare const FOLIO_DOCX_CONFORMANCE_ISSUE_CODES: readonly ["archive-load-failed", "archive-invalid-options", "archive-input-too-large", "archive-too-many-entries", "archive-entry-too-large", "archive-total-too-large", "archive-compression-ratio-exceeded", "required-part-missing", "xml-doctype-forbidden", "xml-not-well-formed", "xml-read-failed", "required-xml-unreadable", "package-root-invalid", "conformance-class-unknown", "model-invalid", "model-warning", "parser-recovery", "parser-unsupported", "parser-failed", "encrypted-container", "container-not-zip"];
 type FolioDocxConformanceCheckId = (typeof FOLIO_DOCX_CONFORMANCE_CHECKS)[number];
 type FolioDocxConformanceIssueCode = (typeof FOLIO_DOCX_CONFORMANCE_ISSUE_CODES)[number];
 type FolioDocxConformanceCheckStatus = "passed" | "failed" | "indeterminate" | "not-run";

package/dist/docx/server/validateDocxConformance.js

@@ -25,6 +25,7 @@ const FOLIO_DOCX_CONFORMANCE_ISSUE_CODES = Object.freeze([
 	"archive-too-many-entries",
 	"archive-entry-too-large",
 	"archive-total-too-large",
+	"archive-compression-ratio-exceeded",
 	"required-part-missing",
 	"xml-doctype-forbidden",
 	"xml-not-well-formed",

package/dist/docx/unzip.d.ts

@@ -25,6 +25,13 @@ type DocxUnzipLimits = {
    * memory as bytes, not on what the parsed structure retains.
    */
   maxTotalUncompressedBytes: number;
+  /**
+   * Inflated bytes allowed per compressed byte, for each markup or text entry
+   * and for the package as a whole. Binary entries are bounded by the byte
+   * limits and the package ratio only, and entries and packages under 4 MiB
+   * inflated are exempt.
+   */
+  maxCompressionRatio: number;
   /** Elements allowed in one XML part, counted before any tree is built. */
   maxXmlElementsPerPart: number;
   /** Attributes allowed in one XML part, counted before any tree is built. */
@@ -75,13 +82,23 @@ type RawDocxContent = {
   /** True when the input was a password-protected CFB container. */
   wasEncrypted: boolean;
 };
+/** How {@link unzipDocx} treats the parts it does not extract. */
+type UnzipDocxBehavior = {
+  /**
+   * Inflate every part the unzip does not extract, within its declared size,
+   * so a later read of the returned package can trust that size. Callers
+   * that discard the package after reading the extracted parts can skip it.
+   * Defaults to `true`.
+   */
+  verifyUnreadEntries?: boolean;
+};
 /**
  * Extract all content from a DOCX file
  *
  * @param buffer - DOCX file as ArrayBuffer
  * @returns Promise resolving to extracted content
  */
-declare function unzipDocx(buffer: ArrayBuffer, options?: DocxUnzipOptions): Promise<RawDocxContent>;
+declare function unzipDocx(buffer: ArrayBuffer, options?: DocxUnzipOptions, { verifyUnreadEntries }?: UnzipDocxBehavior): Promise<RawDocxContent>;
 declare function getEntryUncompressedSize(file: JSZip.JSZipObject): number | null;
 /**
  * Get a list of all files in the DOCX
@@ -143,4 +160,4 @@ declare function getContentSummary(content: RawDocxContent): {
   totalFiles: number;
 };
 //#endregion
-export { DocxSecurityError, DocxUnzipLimits, DocxUnzipOptions, RawDocxContent, extractFile, getContentSummary, getEntryUncompressedSize, getFileList, getMediaMimeType, hasFile, mediaToDataUrl, unzipDocx };
+export { DocxSecurityError, DocxUnzipLimits, DocxUnzipOptions, RawDocxContent, UnzipDocxBehavior, extractFile, getContentSummary, getEntryUncompressedSize, getFileList, getMediaMimeType, hasFile, mediaToDataUrl, unzipDocx };

package/dist/docx/unzip.js

@@ -1,4 +1,5 @@
 import { bytesToDataUrl } from "../utils/base64.js";
+import { compressionRatioLimitFor, countCentralDirectoryRecords, createInflationBudget, exceedsCompressionRatio, getZipEntrySizes, inflateEntryWithinLimits, isStoredZipEntry } from "./archiveInflation.js";
 import { DOCX_CONTAINER_TYPES, detectDocxContainerType } from "./encryption/containerFormat.js";
 import { openDocxBuffer } from "./encryption/openEncryptedDocx.js";
 import { decodeXmlBytes } from "./xmlEncoding.js";
@@ -60,6 +61,7 @@ const DEFAULT_UNZIP_LIMITS = {
 	maxMediaBytes: 25 * MEBIBYTE,
 	maxFontBytes: 10 * MEBIBYTE,
 	maxTotalUncompressedBytes: 250 * MEBIBYTE,
+	maxCompressionRatio: 200,
 	maxXmlElementsPerPart: FOLIO_XML_RESOURCE_LIMITS.maxElementsPerPart,
 	maxXmlAttributesPerPart: FOLIO_XML_RESOURCE_LIMITS.maxAttributesPerPart,
 	maxXmlElementsPerPackage: FOLIO_XML_RESOURCE_LIMITS.maxElementsPerPackage,
@@ -101,19 +103,23 @@ const ZIP_CENTRAL_DIRECTORY_FILE_HEADER_SIGNATURE = 33639248;
 const ZIP_END_OF_CENTRAL_DIRECTORY_SIZE = 22;
 const ZIP_END_OF_CENTRAL_DIRECTORY_WITH_COUNTS_SIZE = 12;
 const ZIP_CENTRAL_DIRECTORY_FILE_HEADER_SIZE = 46;
+/** Entries inflated at once; the rest wait for a slot. */
+const EXTRACTION_CONCURRENCY = 6;
 /**
 * Extract all content from a DOCX file
 *
 * @param buffer - DOCX file as ArrayBuffer
 * @returns Promise resolving to extracted content
 */
-async function unzipDocx(buffer, options = {}) {
+async function unzipDocx(buffer, options = {}, { verifyUnreadEntries = true } = {}) {
 	const limits = createUnzipLimits(options);
 	if (buffer.byteLength > limits.maxInputBytes) throw new DocxSecurityError("DOCX file exceeds the maximum allowed size");
 	const containerType = detectDocxContainerType(buffer);
 	const zipBuffer = containerType === DOCX_CONTAINER_TYPES.ZIP ? buffer : await openDocxBuffer(buffer, { password: options.password });
 	if (zipBuffer.byteLength > limits.maxInputBytes) throw new DocxSecurityError("DOCX file exceeds the maximum allowed size");
 	const wasEncrypted = containerType === DOCX_CONTAINER_TYPES.CFB;
+	const maxRecords = limits.maxFiles * 2;
+	if (countCentralDirectoryRecords(new Uint8Array(zipBuffer), maxRecords) > maxRecords) throw new DocxSecurityError("DOCX file contains too many entries");
 	const loaded = await loadDocxZip(zipBuffer, limits.maxFiles);
 	if (loaded.buffer.byteLength > limits.maxInputBytes) throw new DocxSecurityError("DOCX file exceeds the maximum allowed size");
 	const { zip } = loaded;
@@ -149,40 +155,78 @@ async function unzipDocx(buffer, options = {}) {
 		wasEncrypted
 	};
 	let totalUncompressedBytes = 0;
+	const inflationBudget = createInflationBudget(limits.maxTotalUncompressedBytes);
 	const extractionTasks = [];
+	const verifyEntry = (file, path) => {
+		if (!verifyUnreadEntries || isStoredZipEntry(file)) return;
+		extractionTasks.push(async () => {
+			await verifyEntryWithinLimits({
+				file,
+				path,
+				limits,
+				budget: inflationBudget
+			});
+			return null;
+		});
+	};
+	const inflate = async (file, maxEntryBytes) => await inflateEntryWithinLimits({
+		entry: file,
+		maxEntryBytes,
+		maxCompressionRatio: compressionRatioLimitFor(file.name, limits.maxCompressionRatio),
+		budget: inflationBudget
+	});
 	for (const [path, file] of entries) {
 		if (!isSafeDocxPath(path)) throw new DocxSecurityError("DOCX file contains an unsafe entry path");
-		const declaredSize = getEntryUncompressedSize(file);
+		const { compressedBytes, uncompressedBytes: declaredSize } = getZipEntrySizes(file);
 		if (declaredSize !== null) {
 			totalUncompressedBytes += declaredSize;
 			if (totalUncompressedBytes > limits.maxTotalUncompressedBytes) throw new DocxSecurityError("DOCX file expands beyond the maximum allowed size");
+			if (exceedsCompressionRatio({
+				inflatedBytes: declaredSize,
+				compressedBytes,
+				maxRatio: compressionRatioLimitFor(path, limits.maxCompressionRatio)
+			})) throw new DocxSecurityError(`DOCX entry exceeds the maximum compression ratio: ${path}`);
+		}
+		if (!isParsedDocxEntry(path)) {
+			verifyEntry(file, path);
+			continue;
 		}
-		if (!isParsedDocxEntry(path)) continue;
 		const lowerPath = path.toLowerCase();
 		if (lowerPath.endsWith(".xml") || lowerPath.endsWith(".rels")) {
 			assertEntrySize(path, declaredSize, limits.maxXmlBytes);
-			if (options.extractAllXml === false && !shouldExtractXmlPart(lowerPath)) continue;
-			extractionTasks.push(() => file.async("uint8array").then((xmlBytes) => {
-				assertExtractedSize(path, xmlBytes.byteLength, limits.maxXmlBytes);
+			if (options.extractAllXml === false && !shouldExtractXmlPart(lowerPath)) {
+				verifyEntry(file, path);
+				continue;
+			}
+			extractionTasks.push(async () => {
+				const result = await inflate(file, limits.maxXmlBytes);
+				if (!result.ok) throw inflationLimitError(result.limit, path);
 				return {
 					type: "xml",
 					path,
 					lowerPath,
-					content: decodeXmlBytes(xmlBytes)
+					content: decodeXmlBytes(result.bytes)
 				};
-			}));
+			});
 		} else if (lowerPath.startsWith("word/media/")) {
 			const mimeType = getMediaMimeType(path);
-			if (!limits.allowedMediaMimeTypes.has(mimeType)) continue;
+			if (!limits.allowedMediaMimeTypes.has(mimeType)) {
+				verifyEntry(file, path);
+				continue;
+			}
 			if (isEntryTooLarge(declaredSize, limits.maxMediaBytes)) {
 				content.warnings.push(`Skipped oversized media file: ${path}; original entry preserved for round-trip.`);
+				verifyEntry(file, path);
 				continue;
 			}
-			extractionTasks.push(() => file.async("arraybuffer").then((binaryContent) => {
-				if (binaryContent.byteLength > limits.maxMediaBytes) {
+			extractionTasks.push(async () => {
+				const result = await inflate(file, limits.maxMediaBytes);
+				if (!result.ok) {
+					if (result.limit !== "entry") throw inflationLimitError(result.limit, path);
 					content.warnings.push(`Skipped oversized media file: ${path}; original entry preserved for round-trip.`);
 					return null;
 				}
+				const binaryContent = result.bytes.buffer;
 				if (!isMediaContentAllowed(binaryContent, mimeType)) return null;
 				return {
 					type: "media",
@@ -190,21 +234,33 @@ async function unzipDocx(buffer, options = {}) {
 					mimeType,
 					content: binaryContent
 				};
-			}));
+			});
 		} else if (lowerPath.startsWith("word/fonts/")) {
-			if (isEntryTooLarge(declaredSize, limits.maxFontBytes)) continue;
-			extractionTasks.push(() => file.async("arraybuffer").then((binaryContent) => {
-				if (binaryContent.byteLength > limits.maxFontBytes) return null;
+			if (isEntryTooLarge(declaredSize, limits.maxFontBytes)) {
+				verifyEntry(file, path);
+				continue;
+			}
+			extractionTasks.push(async () => {
+				const result = await inflate(file, limits.maxFontBytes);
+				if (!result.ok) {
+					if (result.limit !== "entry") throw inflationLimitError(result.limit, path);
+					return null;
+				}
 				return {
 					type: "font",
 					path,
-					content: binaryContent
+					content: result.bytes.buffer
 				};
-			}));
-		}
+			});
+		} else verifyEntry(file, path);
 	}
+	if (exceedsCompressionRatio({
+		inflatedBytes: totalUncompressedBytes,
+		compressedBytes: loaded.buffer.byteLength,
+		maxRatio: limits.maxCompressionRatio
+	})) throw new DocxSecurityError("DOCX file exceeds the maximum compression ratio");
 	const xmlBudget = createXmlPackageBudget();
-	for (const extracted of await Promise.all(extractionTasks.map((extract) => extract()))) {
+	for (const extracted of await runExtractionTasks(extractionTasks, inflationBudget)) {
 		if (!extracted) continue;
 		if (extracted.type === "xml") {
 			assignXmlContent(content, extracted, limits, xmlBudget);
@@ -262,6 +318,62 @@ function assignXmlContent(content, { path, lowerPath, content: xmlContent }, lim
 		content.footers.set(filename, xmlContent);
 	}
 }
+function inflationLimitError(limit, path) {
+	switch (limit) {
+		case "declared-size": return new DocxSecurityError(`DOCX entry inflates past its declared size: ${path}`);
+		case "compression-ratio": return new DocxSecurityError(`DOCX entry exceeds the maximum compression ratio: ${path}`);
+		case "entry": return new DocxSecurityError(`DOCX entry exceeds maximum size: ${path}`);
+		case "total": return new DocxSecurityError("DOCX file expands beyond the maximum allowed size");
+		case "aborted": return new DocxSecurityError(`DOCX entry was not read after another entry failed: ${path}`);
+	}
+}
+/**
+* Run extraction tasks a few at a time, in order, keeping their results in
+* task order. The first failure marks the shared budget aborted, which stops
+* the streams still running at their next chunk and leaves the queued tasks
+* unstarted.
+*/
+async function runExtractionTasks(tasks, budget) {
+	const results = Array.from({ length: tasks.length }, () => null);
+	let next = 0;
+	const worker = async () => {
+		while (next < tasks.length && !budget.aborted) {
+			const index = next;
+			next += 1;
+			const task = tasks[index];
+			if (!task) return;
+			try {
+				results[index] = await task();
+			} catch (error) {
+				budget.aborted = true;
+				throw error;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(EXTRACTION_CONCURRENCY, tasks.length) }, async () => await worker()));
+	return results;
+}
+/**
+* Inflate an entry without keeping it, to bound what a later read of it can
+* produce. A limit refuses the package. A corrupt entry does not: it was never
+* going to be read here, a later read stops at the same byte, and refusing
+* the whole document over a part folio does not model would be a regression.
+*/
+async function verifyEntryWithinLimits({ file, path, limits, budget }) {
+	let result;
+	try {
+		result = await inflateEntryWithinLimits({
+			entry: file,
+			maxEntryBytes: Number.POSITIVE_INFINITY,
+			maxCompressionRatio: compressionRatioLimitFor(path, limits.maxCompressionRatio),
+			budget,
+			retain: false
+		});
+	} catch {
+		return;
+	}
+	if (!result.ok) throw inflationLimitError(result.limit, path);
+}
 async function loadDocxZip(buffer, maxFiles) {
 	try {
 		return {
@@ -336,9 +448,12 @@ function findLastSignature(view, byteLength, signature) {
 	return -1;
 }
 function createUnzipLimits(options) {
+	const { maxCompressionRatio } = options;
+	if (maxCompressionRatio !== void 0 && (!Number.isSafeInteger(maxCompressionRatio) || maxCompressionRatio < 0)) throw new RangeError("DOCX compression ratio limit must be a non-negative safe integer");
 	return {
 		...DEFAULT_UNZIP_LIMITS,
 		...options,
+		maxCompressionRatio: maxCompressionRatio ?? DEFAULT_UNZIP_LIMITS.maxCompressionRatio,
 		allowedMediaMimeTypes: options.allowedMediaMimeTypes ? new Set(options.allowedMediaMimeTypes) : DEFAULT_UNZIP_LIMITS.allowedMediaMimeTypes
 	};
 }
@@ -375,8 +490,7 @@ function isParsedDocxEntry(path) {
 	return lowerPath === "[content_types].xml" || lowerPath.startsWith("_rels/") || lowerPath.startsWith("docprops/") || lowerPath.startsWith("word/") || lowerPath.startsWith("customxml/");
 }
 function getEntryUncompressedSize(file) {
-	const metadata = file._data;
-	return typeof metadata?.uncompressedSize === "number" ? metadata.uncompressedSize : null;
+	return getZipEntrySizes(file).uncompressedBytes;
 }
 function assertEntrySize(path, declaredSize, maxBytes) {
 	if (isEntryTooLarge(declaredSize, maxBytes)) throw new DocxSecurityError(`DOCX entry exceeds maximum size: ${path}`);
@@ -384,9 +498,6 @@ function assertEntrySize(path, declaredSize, maxBytes) {
 function isEntryTooLarge(declaredSize, maxBytes) {
 	return declaredSize !== null && declaredSize > maxBytes;
 }
-function assertExtractedSize(path, byteLength, maxBytes) {
-	if (byteLength > maxBytes) throw new DocxSecurityError(`DOCX entry exceeds maximum size: ${path}`);
-}
 function isMediaContentAllowed(data, mimeType) {
 	const bytes = new Uint8Array(data);
 	switch (mimeType) {

package/dist/fonts/embeddedFonts.js

@@ -130,7 +130,7 @@ function findFontTableRels(allXml) {
 * embedded fonts. See {@link getEmbeddedFontFaces} for `docNonce`.
 */
 async function extractEmbeddedFonts(buffer, docNonce = generateHexId()) {
-	const raw = await unzipDocx(buffer);
+	const raw = await unzipDocx(buffer, {}, { verifyUnreadEntries: false });
 	return getEmbeddedFontFaces({
 		fontTableXml: raw.fontTableXml,
 		fontTableRelsXml: findFontTableRels(raw.allXml),