@syncfusion/ej2-docx 0.0.0-stage → 35.1.39

package/src/core/xml/parse.js

@@ -0,0 +1,382 @@
+var __values = (this && this.__values) || function (o) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator], i = 0;
+    if (m) return m.call(o);
+    return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+};
+import { SecurityError, XmlError } from '../errors/docx-error';
+import { resolveResourceLimits } from '../security/limits';
+import { XML_NAMESPACE, XMLNS_NAMESPACE } from './model';
+var XmlReader = /** @class */ (function () {
+    function XmlReader(source) {
+        this.pos = 0;
+        this.source = source;
+    }
+    XmlReader.prototype.eof = function () {
+        return this.pos >= this.source.length;
+    };
+    XmlReader.prototype.peek = function () {
+        return this.source.charAt(this.pos);
+    };
+    XmlReader.prototype.startsWith = function (value) {
+        return this.source.startsWith(value, this.pos);
+    };
+    XmlReader.prototype.advance = function (count) {
+        if (count === void 0) { count = 1; }
+        this.pos += count;
+    };
+    XmlReader.prototype.skipWhitespace = function () {
+        while (!this.eof()) {
+            var ch = this.peek();
+            if (ch !== ' ' && ch !== '\t' && ch !== '\n' && ch !== '\r') {
+                break;
+            }
+            this.advance();
+        }
+    };
+    return XmlReader;
+}());
+function decodeEntity(reader) {
+    if (!reader.startsWith('&')) {
+        throw new XmlError('xml/malformed', 'Expected entity reference');
+    }
+    var start = reader.pos;
+    reader.advance();
+    if (reader.startsWith('#x') || reader.startsWith('#X')) {
+        reader.advance(2);
+        var hex = '';
+        while (!reader.eof() && /[0-9a-fA-F]/.test(reader.peek())) {
+            hex += reader.peek();
+            reader.advance();
+        }
+        if (!reader.startsWith(';') || hex.length === 0) {
+            throw new XmlError('xml/malformed', 'Invalid numeric character reference');
+        }
+        reader.advance();
+        var code = Number.parseInt(hex, 16);
+        return String.fromCodePoint(code);
+    }
+    if (reader.startsWith('#')) {
+        reader.advance();
+        var dec = '';
+        while (!reader.eof() && /[0-9]/.test(reader.peek())) {
+            dec += reader.peek();
+            reader.advance();
+        }
+        if (!reader.startsWith(';') || dec.length === 0) {
+            throw new XmlError('xml/malformed', 'Invalid numeric character reference');
+        }
+        reader.advance();
+        return String.fromCodePoint(Number.parseInt(dec, 10));
+    }
+    var namedStart = reader.pos;
+    while (!reader.eof() && /[A-Za-z]/.test(reader.peek())) {
+        reader.advance();
+    }
+    var name = reader.source.slice(namedStart, reader.pos);
+    if (!reader.startsWith(';')) {
+        throw new XmlError('xml/malformed', "Unterminated entity at " + String(start));
+    }
+    reader.advance();
+    switch (name) {
+        case 'lt':
+            return '<';
+        case 'gt':
+            return '>';
+        case 'amp':
+            return '&';
+        case 'quot':
+            return '"';
+        case 'apos':
+            return "'";
+        default:
+            throw new XmlError('xml/dtd-forbidden', "Unknown entity &" + name + "; \u2014 DTD-defined entities are not resolved");
+    }
+}
+function readName(reader) {
+    var start = reader.pos;
+    if (reader.eof() || !/[:A-Za-z_]/.test(reader.peek())) {
+        throw new XmlError('xml/malformed', "Invalid XML name at " + String(start));
+    }
+    reader.advance();
+    while (!reader.eof() && /[:A-Za-z0-9._-]/.test(reader.peek())) {
+        reader.advance();
+    }
+    return reader.source.slice(start, reader.pos);
+}
+function splitQName(qname) {
+    var colon = qname.indexOf(':');
+    if (colon === -1) {
+        return { prefix: '', localName: qname };
+    }
+    return { prefix: qname.slice(0, colon), localName: qname.slice(colon + 1) };
+}
+function resolvePrefix(prefix, scope) {
+    if (prefix === 'xml') {
+        return XML_NAMESPACE;
+    }
+    if (prefix === 'xmlns') {
+        return XMLNS_NAMESPACE;
+    }
+    if (prefix === '') {
+        return scope.defaultUri;
+    }
+    var uri = scope.prefixes.get(prefix);
+    if (uri === undefined) {
+        throw new XmlError('xml/malformed', "Unbound namespace prefix " + prefix);
+    }
+    return uri;
+}
+function readQuoted(reader, limits) {
+    var quote = reader.peek();
+    if (quote !== '"' && quote !== "'") {
+        throw new XmlError('xml/malformed', 'Attribute value must be quoted');
+    }
+    reader.advance();
+    var value = '';
+    while (!reader.eof() && reader.peek() !== quote) {
+        if (reader.peek() === '<') {
+            throw new XmlError('xml/malformed', 'Raw < in attribute value');
+        }
+        if (reader.peek() === '&') {
+            value += decodeEntity(reader);
+        }
+        else {
+            value += reader.peek();
+            reader.advance();
+        }
+        if (value.length > limits.textNodeLength) {
+            throw new SecurityError('security/limit-exceeded', 'Attribute value exceeds the text length limit');
+        }
+    }
+    if (reader.peek() !== quote) {
+        throw new XmlError('xml/malformed', 'Unterminated attribute value');
+    }
+    reader.advance();
+    return value;
+}
+function skipCommentOrPi(reader) {
+    if (reader.startsWith('<!--')) {
+        reader.advance(4);
+        var end = reader.source.indexOf('-->', reader.pos);
+        if (end === -1) {
+            throw new XmlError('xml/malformed', 'Unterminated comment');
+        }
+        reader.pos = end + 3;
+        return;
+    }
+    if (reader.startsWith('<?')) {
+        reader.advance(2);
+        var end = reader.source.indexOf('?>', reader.pos);
+        if (end === -1) {
+            throw new XmlError('xml/malformed', 'Unterminated processing instruction');
+        }
+        reader.pos = end + 2;
+        return;
+    }
+}
+function parseElement(reader, scope, depth, limits) {
+    var e_1, _a, e_2, _b;
+    if (depth > limits.xmlNestingDepth) {
+        throw new SecurityError('security/limit-exceeded', "XML nesting depth exceeds " + String(limits.xmlNestingDepth));
+    }
+    if (!reader.startsWith('<')) {
+        throw new XmlError('xml/malformed', 'Expected < to start an element');
+    }
+    reader.advance();
+    if (reader.startsWith('/')) {
+        throw new XmlError('xml/malformed', 'Unexpected end tag');
+    }
+    var qname = readName(reader);
+    var rawAttributes = [];
+    reader.skipWhitespace();
+    while (!reader.eof() && reader.peek() !== '>' && reader.peek() !== '/') {
+        var attrName = readName(reader);
+        reader.skipWhitespace();
+        if (reader.peek() !== '=') {
+            throw new XmlError('xml/malformed', "Expected = after attribute " + attrName);
+        }
+        reader.advance();
+        reader.skipWhitespace();
+        var value = readQuoted(reader, limits);
+        rawAttributes.push({ qname: attrName, value: value });
+        if (rawAttributes.length > limits.xmlAttributeCount) {
+            throw new SecurityError('security/limit-exceeded', 'XML attribute count exceeds the limit');
+        }
+        reader.skipWhitespace();
+    }
+    var nsDecls = [];
+    var defaultUri = scope.defaultUri;
+    var prefixMap = new Map(scope.prefixes);
+    try {
+        for (var rawAttributes_1 = __values(rawAttributes), rawAttributes_1_1 = rawAttributes_1.next(); !rawAttributes_1_1.done; rawAttributes_1_1 = rawAttributes_1.next()) {
+            var attr = rawAttributes_1_1.value;
+            if (attr.qname === 'xmlns') {
+                defaultUri = attr.value;
+                nsDecls.push({ prefix: '', namespaceUri: attr.value });
+            }
+            else if (attr.qname.startsWith('xmlns:')) {
+                var p = attr.qname.slice('xmlns:'.length);
+                prefixMap.set(p, attr.value);
+                nsDecls.push({ prefix: p, namespaceUri: attr.value });
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (rawAttributes_1_1 && !rawAttributes_1_1.done && (_a = rawAttributes_1.return)) _a.call(rawAttributes_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    var childScope = { defaultUri: defaultUri, prefixes: prefixMap };
+    var _c = splitQName(qname), prefix = _c.prefix, localName = _c.localName;
+    var namespaceUri = resolvePrefix(prefix, childScope);
+    var attributes = [];
+    try {
+        for (var rawAttributes_2 = __values(rawAttributes), rawAttributes_2_1 = rawAttributes_2.next(); !rawAttributes_2_1.done; rawAttributes_2_1 = rawAttributes_2.next()) {
+            var attr = rawAttributes_2_1.value;
+            if (attr.qname === 'xmlns' || attr.qname.startsWith('xmlns:')) {
+                continue;
+            }
+            var split = splitQName(attr.qname);
+            attributes.push({
+                prefix: split.prefix,
+                localName: split.localName,
+                namespaceUri: split.prefix === '' ? '' : resolvePrefix(split.prefix, childScope),
+                value: attr.value,
+            });
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (rawAttributes_2_1 && !rawAttributes_2_1.done && (_b = rawAttributes_2.return)) _b.call(rawAttributes_2);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    var selfClosing = false;
+    if (reader.startsWith('/>')) {
+        selfClosing = true;
+        reader.advance(2);
+    }
+    else if (reader.startsWith('>')) {
+        reader.advance();
+    }
+    else {
+        throw new XmlError('xml/malformed', "Unterminated start tag " + qname);
+    }
+    var children = [];
+    if (!selfClosing) {
+        parseContent(reader, childScope, depth + 1, limits, qname, children);
+    }
+    return {
+        kind: 'element',
+        namespaceUri: namespaceUri,
+        localName: localName,
+        prefix: prefix,
+        attributes: attributes,
+        namespaceDeclarations: nsDecls,
+        children: children,
+    };
+}
+function parseContent(reader, scope, depth, limits, parentQName, children) {
+    while (!reader.eof()) {
+        if (reader.startsWith('</')) {
+            reader.advance(2);
+            var endName = readName(reader);
+            reader.skipWhitespace();
+            if (!reader.startsWith('>')) {
+                throw new XmlError('xml/malformed', 'Unterminated end tag');
+            }
+            reader.advance();
+            if (endName !== parentQName) {
+                throw new XmlError('xml/malformed', "Mismatched end tag </" + endName + "> for <" + parentQName + ">");
+            }
+            return;
+        }
+        if (reader.startsWith('<!--') || reader.startsWith('<?')) {
+            skipCommentOrPi(reader);
+            continue;
+        }
+        if (reader.startsWith('<![CDATA[')) {
+            reader.advance(9);
+            var end = reader.source.indexOf(']]>', reader.pos);
+            if (end === -1) {
+                throw new XmlError('xml/malformed', 'Unterminated CDATA');
+            }
+            var value = reader.source.slice(reader.pos, end);
+            if (value.length > limits.textNodeLength) {
+                throw new SecurityError('security/limit-exceeded', 'CDATA exceeds the text length limit');
+            }
+            reader.pos = end + 3;
+            children.push({ kind: 'text', value: value });
+            continue;
+        }
+        if (reader.startsWith('<')) {
+            children.push(parseElement(reader, scope, depth, limits));
+            continue;
+        }
+        var text = '';
+        while (!reader.eof() && reader.peek() !== '<') {
+            if (reader.peek() === '&') {
+                text += decodeEntity(reader);
+            }
+            else {
+                text += reader.peek();
+                reader.advance();
+            }
+            if (text.length > limits.textNodeLength) {
+                throw new SecurityError('security/limit-exceeded', 'Text node exceeds the text length limit');
+            }
+        }
+        if (text.length > 0) {
+            children.push({ kind: 'text', value: text });
+        }
+    }
+    throw new XmlError('xml/malformed', "Missing end tag for <" + parentQName + ">");
+}
+/**
+ * Decode OPC/XML part bytes. Supports UTF-8 and UTF-16 (BOM).
+ * Word sometimes writes parts such as `numbering.xml` as UTF-16LE.
+ */
+export function decodeXmlBytes(data) {
+    if (data.length >= 2) {
+        // UTF-16LE BOM
+        if (data[0] === 0xff && data[1] === 0xfe) {
+            return new TextDecoder('utf-16le').decode(data);
+        }
+        // UTF-16BE BOM
+        if (data[0] === 0xfe && data[1] === 0xff) {
+            return new TextDecoder('utf-16be').decode(data);
+        }
+    }
+    return new TextDecoder('utf-8').decode(data);
+}
+/**
+ * Parse XML into a preservation DOM. Namespace URI + local name identify elements;
+ * prefixes are stored only for stable serialization. DTD/ENTITY constructs fail closed.
+ */
+export function parseXml(xml, limitOverrides) {
+    var limits = resolveResourceLimits(limitOverrides);
+    var withoutBom = xml.charCodeAt(0) === 0xfeff ? xml.slice(1) : xml;
+    if (/<!DOCTYPE/i.test(withoutBom) || /<!ENTITY/i.test(withoutBom)) {
+        throw new XmlError('xml/dtd-forbidden', 'DTD and ENTITY declarations are disabled');
+    }
+    var reader = new XmlReader(withoutBom);
+    reader.skipWhitespace();
+    while (reader.startsWith('<?') || reader.startsWith('<!--')) {
+        skipCommentOrPi(reader);
+        reader.skipWhitespace();
+    }
+    var root = parseElement(reader, { defaultUri: '', prefixes: new Map() }, 1, limits);
+    reader.skipWhitespace();
+    if (!reader.eof()) {
+        throw new XmlError('xml/malformed', 'Trailing content after the document element');
+    }
+    return root;
+}

package/src/core/xml/serialize.d.ts

@@ -0,0 +1,6 @@
+import { OpenXmlElement } from './model';
+/**
+ * Serialize a preservation element. Prefixes on the node are reused; namespace
+ * declarations stored on the element are emitted as xmlns attributes.
+ */
+export declare function serializeXml(element: OpenXmlElement): string;

package/src/core/xml/serialize.js

@@ -0,0 +1,93 @@
+var __values = (this && this.__values) || function (o) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator], i = 0;
+    if (m) return m.call(o);
+    return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+};
+import { XML_NAMESPACE } from './model';
+function replaceAllLiteral(value, search, replacement) {
+    // String.replaceAll is ES2021 and is not rewritten by target ES5.
+    return value.split(search).join(replacement);
+}
+function escapeText(value) {
+    return replaceAllLiteral(replaceAllLiteral(replaceAllLiteral(value, '&', '&amp;'), '<', '&lt;'), '>', '&gt;');
+}
+function escapeAttr(value) {
+    return replaceAllLiteral(escapeText(value), '"', '&quot;');
+}
+function attributeName(attr) {
+    return attr.prefix === '' ? attr.localName : attr.prefix + ':' + attr.localName;
+}
+function serializeChild(node) {
+    if (node.kind === 'text') {
+        return escapeText(node.value);
+    }
+    return serializeXml(node);
+}
+/**
+ * Serialize a preservation element. Prefixes on the node are reused; namespace
+ * declarations stored on the element are emitted as xmlns attributes.
+ */
+export function serializeXml(element) {
+    var e_1, _a, e_2, _b, e_3, _c;
+    var name = element.prefix === '' ? element.localName : element.prefix + ':' + element.localName;
+    var pieces = ['<', name];
+    try {
+        for (var _d = __values(element.namespaceDeclarations), _e = _d.next(); !_e.done; _e = _d.next()) {
+            var decl = _e.value;
+            if (decl.prefix === '') {
+                pieces.push(' xmlns="', escapeAttr(decl.namespaceUri), '"');
+            }
+            else {
+                pieces.push(' xmlns:', decl.prefix, '="', escapeAttr(decl.namespaceUri), '"');
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (_e && !_e.done && (_a = _d.return)) _a.call(_d);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    try {
+        for (var _f = __values(element.attributes), _g = _f.next(); !_g.done; _g = _f.next()) {
+            var attr = _g.value;
+            var qname = attr.namespaceUri === XML_NAMESPACE && attr.prefix === ''
+                ? 'xml:' + attr.localName
+                : attributeName(attr);
+            pieces.push(' ', qname, '="', escapeAttr(attr.value), '"');
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (_g && !_g.done && (_b = _f.return)) _b.call(_f);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    if (element.children.length === 0) {
+        pieces.push('/>');
+        return pieces.join('');
+    }
+    pieces.push('>');
+    try {
+        for (var _h = __values(element.children), _j = _h.next(); !_j.done; _j = _h.next()) {
+            var child = _j.value;
+            pieces.push(serializeChild(child));
+        }
+    }
+    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+    finally {
+        try {
+            if (_j && !_j.done && (_c = _h.return)) _c.call(_h);
+        }
+        finally { if (e_3) throw e_3.error; }
+    }
+    pieces.push('</', name, '>');
+    return pieces.join('');
+}

package/src/core/zip/crc32.d.ts

@@ -0,0 +1,2 @@
+/** IEEE CRC-32 used by ZIP local/central headers. */
+export declare function crc32(data: Uint8Array): number;

package/src/core/zip/crc32.js

@@ -0,0 +1,25 @@
+var CRC_TABLE = new Uint32Array(256);
+for (var i = 0; i < 256; i += 1) {
+    var c = i;
+    for (var k = 0; k < 8; k += 1) {
+        c = (c & 1) === 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    }
+    CRC_TABLE[i] = c >>> 0;
+}
+/** IEEE CRC-32 used by ZIP local/central headers. */
+export function crc32(data) {
+    var crc = 0xffffffff;
+    for (var i = 0; i < data.length; i += 1) {
+        var byte = data[i];
+        if (byte === undefined) {
+            break;
+        }
+        var index = (crc ^ byte) & 0xff;
+        var tableValue = CRC_TABLE[index];
+        if (tableValue === undefined) {
+            break;
+        }
+        crc = tableValue ^ (crc >>> 8);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}

package/src/core/zip/deflate.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Raw DEFLATE as required for ZIP method 8 (ECMA-376-2 §7.3.6: DEFLATE only).
+ * Browser implementation — no Node `zlib`. `DecompressionStream` is not used:
+ * gulp product emit targets ES5 and those stream APIs are asynchronous.
+ */
+export { deflateRaw, inflateRaw } from './inflate-raw';

package/src/core/zip/deflate.js

@@ -0,0 +1,6 @@
+/**
+ * Raw DEFLATE as required for ZIP method 8 (ECMA-376-2 §7.3.6: DEFLATE only).
+ * Browser implementation — no Node `zlib`. `DecompressionStream` is not used:
+ * gulp product emit targets ES5 and those stream APIs are asynchronous.
+ */
+export { deflateRaw, inflateRaw } from './inflate-raw';

package/src/core/zip/index.d.ts

@@ -0,0 +1,10 @@
+export { DEFAULT_RESOURCE_LIMITS, resolveResourceLimits } from '../security/limits';
+/**
+ * @private
+ */
+export { ResourceLimits } from '../security/limits';
+export { ResourceLimitOverrides } from '../security/limits';
+export { readZip } from './read';
+export { writeZip } from './write';
+export { ZipEntry } from './zip-entry';
+export { assertSafeZipItemName } from './names';

package/src/core/zip/index.js

@@ -0,0 +1,4 @@
+export { DEFAULT_RESOURCE_LIMITS, resolveResourceLimits } from '../security/limits';
+export { readZip } from './read';
+export { writeZip } from './write';
+export { assertSafeZipItemName } from './names';

package/src/core/zip/inflate-raw.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Raw DEFLATE inflater (ZIP method 8 / RFC 1951).
+ * Browser-safe and synchronous: no Node `zlib`. Output is capped so a
+ * zip-bomb still surfaces as `RangeError` (read.ts maps that to a limit).
+ */
+/**
+ * Inflate a raw DEFLATE payload. Throws `RangeError` when the inflated
+ * size would exceed `maxOutputLength`.
+ */
+export declare function inflateRaw(compressed: Uint8Array, maxOutputLength: number): Uint8Array;
+/**
+ * Encode `data` as one raw DEFLATE fixed-Huffman block (RFC 1951 type 1)
+ * plus length-3 distance-1 matches for runs. Repeated bytes shrink enough
+ * for the zip-bomb fixture; incompressible input falls back to stored blocks.
+ * OPC save itself writes ZIP method STORE and does not call this.
+ */
+export declare function deflateRaw(data: Uint8Array): Uint8Array;