@syncfusion/ej2-docx 0.0.0-stage → 35.1.39

package/src/core/zip/inflate-raw.js

@@ -0,0 +1,450 @@
+/**
+ * Raw DEFLATE inflater (ZIP method 8 / RFC 1951).
+ * Browser-safe and synchronous: no Node `zlib`. Output is capped so a
+ * zip-bomb still surfaces as `RangeError` (read.ts maps that to a limit).
+ */
+var MAX_BITS = 15;
+var LENGTH_BASE = [
+    3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 15, 17, 19, 23, 27, 31,
+    35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258,
+];
+var LENGTH_EXTRA = [
+    0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 2, 2, 2, 2,
+    3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5, 0,
+];
+var DIST_BASE = [
+    1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
+    257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145, 8193, 12289, 16385, 24577,
+];
+var DIST_EXTRA = [
+    0, 0, 0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6,
+    7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 13, 13,
+];
+var BitReader = /** @class */ (function () {
+    function BitReader(input) {
+        this.input = input;
+        this.buffer = 0;
+        this.bitsLeft = 0;
+        this.offset = 0;
+    }
+    BitReader.prototype.bits = function (count) {
+        while (this.bitsLeft < count) {
+            if (this.offset >= this.input.length) {
+                throw new Error('Truncated DEFLATE stream');
+            }
+            this.buffer |= this.input[this.offset++] << this.bitsLeft;
+            this.bitsLeft += 8;
+        }
+        var value = this.buffer & ((1 << count) - 1);
+        this.buffer >>>= count;
+        this.bitsLeft -= count;
+        return value;
+    };
+    BitReader.prototype.align = function () {
+        this.buffer = 0;
+        this.bitsLeft = 0;
+    };
+    BitReader.prototype.bytes = function (length) {
+        this.align();
+        if (this.offset + length > this.input.length) {
+            throw new Error('Truncated DEFLATE stored block');
+        }
+        var slice = this.input.subarray(this.offset, this.offset + length);
+        this.offset += length;
+        return slice;
+    };
+    BitReader.prototype.u16 = function () {
+        this.align();
+        if (this.offset + 2 > this.input.length) {
+            throw new Error('Truncated DEFLATE stored block');
+        }
+        var value = this.input[this.offset] | (this.input[this.offset + 1] << 8);
+        this.offset += 2;
+        return value;
+    };
+    return BitReader;
+}());
+/** Canonical Huffman table. Codes are decoded MSB-first as RFC 1951 specifies. */
+var Huffman = /** @class */ (function () {
+    function Huffman(lengths) {
+        this.counts = [];
+        this.firstCode = [];
+        this.symbolIndex = [];
+        var counts = [];
+        for (var i = 0; i <= MAX_BITS; i++) {
+            counts[i] = 0;
+        }
+        for (var i = 0; i < lengths.length; i++) {
+            var length_1 = lengths[i];
+            if (length_1 > MAX_BITS) {
+                throw new Error('Invalid DEFLATE Huffman length');
+            }
+            if (length_1 > 0) {
+                counts[length_1] += 1;
+            }
+        }
+        var nextCode = [];
+        var code = 0;
+        counts[0] = 0;
+        for (var bits = 1; bits <= MAX_BITS; bits++) {
+            code = (code + counts[bits - 1]) << 1;
+            nextCode[bits] = code;
+            this.firstCode[bits] = code;
+            this.counts[bits] = counts[bits];
+        }
+        this.symbolIndex = [];
+        for (var bits = 0; bits <= MAX_BITS; bits++) {
+            this.symbolIndex[bits] = 0;
+        }
+        var offset = 0;
+        for (var bits = 1; bits <= MAX_BITS; bits++) {
+            this.symbolIndex[bits] = offset;
+            offset += counts[bits];
+        }
+        this.symbols = [];
+        for (var i = 0; i < lengths.length; i++) {
+            this.symbols[i] = 0;
+        }
+        for (var symbol = 0; symbol < lengths.length; symbol++) {
+            var length_2 = lengths[symbol];
+            if (length_2 !== 0) {
+                var index = this.symbolIndex[length_2] + (nextCode[length_2] - this.firstCode[length_2]);
+                this.symbols[index] = symbol;
+                nextCode[length_2] += 1;
+            }
+        }
+    }
+    Huffman.prototype.decode = function (reader) {
+        var code = 0;
+        for (var length_3 = 1; length_3 <= MAX_BITS; length_3++) {
+            code = (code << 1) | reader.bits(1);
+            var count = this.counts[length_3];
+            if (count === 0) {
+                continue;
+            }
+            var first = this.firstCode[length_3];
+            if (code >= first && code < first + count) {
+                return this.symbols[this.symbolIndex[length_3] + (code - first)];
+            }
+        }
+        throw new Error('Invalid DEFLATE Huffman code');
+    };
+    return Huffman;
+}());
+function fixedLiteral() {
+    var lengths = [];
+    for (var i = 0; i < 288; i++) {
+        lengths[i] = i < 144 ? 8 : i < 256 ? 9 : i < 280 ? 7 : 8;
+    }
+    return new Huffman(lengths);
+}
+function fixedDistance() {
+    var lengths = [];
+    for (var i = 0; i < 30; i++) {
+        lengths[i] = 5;
+    }
+    return new Huffman(lengths);
+}
+var FIXED_LITERAL = fixedLiteral();
+var FIXED_DISTANCE = fixedDistance();
+function dynamicTables(reader) {
+    var nlen = reader.bits(5) + 257;
+    var ndist = reader.bits(5) + 1;
+    var ncode = reader.bits(4) + 4;
+    if (nlen > 286 || ndist > 30) {
+        throw new Error('Invalid DEFLATE dynamic Huffman header');
+    }
+    var order = [16, 17, 18, 0, 8, 7, 9, 6, 10, 5, 11, 4, 12, 3, 13, 2, 14, 1, 15];
+    var codeLengths = [];
+    for (var i = 0; i < 19; i++) {
+        codeLengths[i] = 0;
+    }
+    for (var i = 0; i < ncode; i++) {
+        codeLengths[order[i]] = reader.bits(3);
+    }
+    var codeTree = new Huffman(codeLengths);
+    var lengths = [];
+    while (lengths.length < nlen + ndist) {
+        var symbol = codeTree.decode(reader);
+        if (symbol < 16) {
+            lengths.push(symbol);
+            continue;
+        }
+        var repeat = 0;
+        var value = 0;
+        if (symbol === 16) {
+            if (lengths.length === 0) {
+                throw new Error('Invalid DEFLATE length repeat');
+            }
+            value = lengths[lengths.length - 1];
+            repeat = reader.bits(2) + 3;
+        }
+        else if (symbol === 17) {
+            repeat = reader.bits(3) + 3;
+        }
+        else {
+            repeat = reader.bits(7) + 11;
+        }
+        if (lengths.length + repeat > nlen + ndist) {
+            throw new Error('Invalid DEFLATE length repeat');
+        }
+        for (var i = 0; i < repeat; i++) {
+            lengths.push(value);
+        }
+    }
+    return {
+        literal: new Huffman(lengths.slice(0, nlen)),
+        distance: new Huffman(lengths.slice(nlen)),
+    };
+}
+var InflateOutput = /** @class */ (function () {
+    function InflateOutput(maxOutputLength) {
+        this.maxOutputLength = maxOutputLength;
+        this.bytes = new Uint8Array(256);
+        this.length = 0;
+    }
+    InflateOutput.prototype.push = function (byte) {
+        this.ensure(1);
+        this.bytes[this.length++] = byte;
+    };
+    InflateOutput.prototype.copy = function (distance, length) {
+        if (distance <= 0 || distance > this.length) {
+            throw new Error('Invalid DEFLATE distance');
+        }
+        this.ensure(length);
+        var start = this.length - distance;
+        for (var i = 0; i < length; i++) {
+            this.bytes[this.length++] = this.bytes[start + i];
+        }
+    };
+    InflateOutput.prototype.finish = function () {
+        return this.bytes.slice(0, this.length);
+    };
+    InflateOutput.prototype.ensure = function (extra) {
+        if (this.length + extra > this.maxOutputLength) {
+            throw new RangeError('Inflated size exceeds limit ' + String(this.maxOutputLength));
+        }
+        if (this.length + extra <= this.bytes.length) {
+            return;
+        }
+        var next = this.bytes.length;
+        while (next < this.length + extra) {
+            next *= 2;
+        }
+        if (next > this.maxOutputLength) {
+            next = this.maxOutputLength;
+        }
+        var grown = new Uint8Array(next);
+        grown.set(this.bytes.subarray(0, this.length));
+        this.bytes = grown;
+    };
+    return InflateOutput;
+}());
+function inflateCodes(reader, output, literal, distance) {
+    for (;;) {
+        var symbol = literal.decode(reader);
+        if (symbol < 256) {
+            output.push(symbol);
+            continue;
+        }
+        if (symbol === 256) {
+            return;
+        }
+        if (symbol > 285) {
+            throw new Error('Invalid DEFLATE length symbol');
+        }
+        var lengthIndex = symbol - 257;
+        var length_4 = LENGTH_BASE[lengthIndex] + reader.bits(LENGTH_EXTRA[lengthIndex]);
+        var distSymbol = distance.decode(reader);
+        if (distSymbol > 29) {
+            throw new Error('Invalid DEFLATE distance symbol');
+        }
+        var dist = DIST_BASE[distSymbol] + reader.bits(DIST_EXTRA[distSymbol]);
+        output.copy(dist, length_4);
+    }
+}
+/**
+ * Inflate a raw DEFLATE payload. Throws `RangeError` when the inflated
+ * size would exceed `maxOutputLength`.
+ */
+export function inflateRaw(compressed, maxOutputLength) {
+    var reader = new BitReader(compressed);
+    var output = new InflateOutput(maxOutputLength);
+    var finalBlock = 0;
+    do {
+        finalBlock = reader.bits(1);
+        var type = reader.bits(2);
+        if (type === 0) {
+            var length_5 = reader.u16();
+            var complement = reader.u16();
+            if ((length_5 ^ 0xffff) !== complement) {
+                throw new Error('Invalid DEFLATE stored-block length');
+            }
+            var bytes = reader.bytes(length_5);
+            for (var i = 0; i < bytes.length; i++) {
+                output.push(bytes[i]);
+            }
+        }
+        else if (type === 1) {
+            inflateCodes(reader, output, FIXED_LITERAL, FIXED_DISTANCE);
+        }
+        else if (type === 2) {
+            var tables = dynamicTables(reader);
+            inflateCodes(reader, output, tables.literal, tables.distance);
+        }
+        else {
+            throw new Error('Invalid DEFLATE block type');
+        }
+    } while (finalBlock === 0);
+    return output.finish();
+}
+/**
+ * Bit packer for a single fixed-Huffman raw DEFLATE block.
+ * Codes are written LSB-first, matching RFC 1951.
+ */
+var BitWriter = /** @class */ (function () {
+    function BitWriter() {
+        this.bytes = [];
+        this.buffer = 0;
+        this.bitsLeft = 0;
+    }
+    BitWriter.prototype.bits = function (value, count) {
+        this.buffer |= (value & ((1 << count) - 1)) << this.bitsLeft;
+        this.bitsLeft += count;
+        while (this.bitsLeft >= 8) {
+            this.bytes.push(this.buffer & 0xff);
+            this.buffer >>>= 8;
+            this.bitsLeft -= 8;
+        }
+    };
+    /** Write a canonical code MSB-first into the LSB-first bit stream. */
+    BitWriter.prototype.code = function (value, length) {
+        var reversed = 0;
+        for (var i = 0; i < length; i++) {
+            reversed = (reversed << 1) | (value & 1);
+            value >>>= 1;
+        }
+        this.bits(reversed, length);
+    };
+    BitWriter.prototype.finish = function () {
+        if (this.bitsLeft > 0) {
+            this.bytes.push(this.buffer & 0xff);
+        }
+        return Uint8Array.from(this.bytes);
+    };
+    return BitWriter;
+}());
+function fixedLiteralCode(symbol) {
+    if (symbol < 144) {
+        return { code: 0x30 + symbol, length: 8 };
+    }
+    if (symbol < 256) {
+        return { code: 0x190 + (symbol - 144), length: 9 };
+    }
+    if (symbol < 280) {
+        return { code: symbol - 256, length: 7 };
+    }
+    return { code: 0xc0 + (symbol - 280), length: 8 };
+}
+function writeFixedSymbol(writer, symbol) {
+    var encoded = fixedLiteralCode(symbol);
+    writer.code(encoded.code, encoded.length);
+}
+/** Length symbols 257–285. Distance symbol 0 (distance 1) is a 5-bit zero code. */
+function writeMatch(writer, length) {
+    var symbol = 285;
+    var extraBits = 0;
+    var extra = 0;
+    if (length < 258) {
+        for (var index = 0; index < LENGTH_BASE.length; index++) {
+            var base = LENGTH_BASE[index];
+            var bits = LENGTH_EXTRA[index];
+            var span = 1 << bits;
+            if (length >= base && length < base + span) {
+                symbol = 257 + index;
+                extraBits = bits;
+                extra = length - base;
+                break;
+            }
+        }
+    }
+    writeFixedSymbol(writer, symbol);
+    if (extraBits > 0) {
+        writer.bits(extra, extraBits);
+    }
+    writer.code(0, 5);
+}
+/**
+ * Encode `data` as one raw DEFLATE fixed-Huffman block (RFC 1951 type 1)
+ * plus length-3 distance-1 matches for runs. Repeated bytes shrink enough
+ * for the zip-bomb fixture; incompressible input falls back to stored blocks.
+ * OPC save itself writes ZIP method STORE and does not call this.
+ */
+export function deflateRaw(data) {
+    if (data.length === 0) {
+        return Uint8Array.of(0x01, 0x00, 0x00, 0xff, 0xff);
+    }
+    var writer = new BitWriter();
+    writer.bits(1, 1);
+    writer.bits(1, 2);
+    var i = 0;
+    while (i < data.length) {
+        var byte = data[i];
+        var run = 1;
+        while (i + run < data.length && data[i + run] === byte && run < 258) {
+            run += 1;
+        }
+        if (i > 0 && data[i - 1] === byte && run >= 3) {
+            while (run >= 3) {
+                var emit = run > 258 ? 258 : run;
+                writeMatch(writer, emit);
+                i += emit;
+                run -= emit;
+            }
+            continue;
+        }
+        writeFixedSymbol(writer, byte);
+        i += 1;
+        if (run >= 4) {
+            var remaining = run - 1;
+            var emit = remaining > 258 ? 258 : remaining;
+            writeMatch(writer, emit);
+            i += emit;
+        }
+    }
+    writeFixedSymbol(writer, 256);
+    var compressed = writer.finish();
+    if (compressed.length >= data.length) {
+        return storedDeflate(data);
+    }
+    return compressed;
+}
+function storedDeflate(data) {
+    var parts = [];
+    var offset = 0;
+    while (offset < data.length) {
+        var remaining = data.length - offset;
+        var length_6 = remaining > 65535 ? 65535 : remaining;
+        var isLast = offset + length_6 >= data.length;
+        var header = new Uint8Array(5);
+        header[0] = isLast ? 1 : 0;
+        header[1] = length_6 & 0xff;
+        header[2] = (length_6 >> 8) & 0xff;
+        var complement = length_6 ^ 0xffff;
+        header[3] = complement & 0xff;
+        header[4] = (complement >> 8) & 0xff;
+        parts.push(header, data.subarray(offset, offset + length_6));
+        offset += length_6;
+    }
+    var total = 0;
+    for (var i = 0; i < parts.length; i++) {
+        total += parts[i].length;
+    }
+    var out = new Uint8Array(total);
+    var cursor = 0;
+    for (var i = 0; i < parts.length; i++) {
+        out.set(parts[i], cursor);
+        cursor += parts[i].length;
+    }
+    return out;
+}

package/src/core/zip/names.d.ts

@@ -0,0 +1,6 @@
+/**
+ * ZIP item names map to OPC logical names by adding a leading `/`
+ * (ECMA-376-2 §7.3.5). Reject traversal and filesystem-absolute names before
+ * inflate (`.agent/policies/security.md`).
+ */
+export declare function assertSafeZipItemName(name: string): void;

package/src/core/zip/names.js

@@ -0,0 +1,52 @@
+var __values = (this && this.__values) || function (o) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator], i = 0;
+    if (m) return m.call(o);
+    return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+};
+import { PackageError } from '../errors/docx-error';
+/**
+ * ZIP item names map to OPC logical names by adding a leading `/`
+ * (ECMA-376-2 §7.3.5). Reject traversal and filesystem-absolute names before
+ * inflate (`.agent/policies/security.md`).
+ */
+export function assertSafeZipItemName(name) {
+    var e_1, _a;
+    if (name.length === 0) {
+        throw new PackageError('package/invalid-part-name', 'ZIP item name is empty');
+    }
+    if (name.includes('\0')) {
+        throw new PackageError('package/invalid-part-name', 'ZIP item name contains a NUL');
+    }
+    // split/join: String.replaceAll is ES2021 and is not rewritten by target ES5.
+    var withForwardSlashes = name.split('\\').join('/');
+    if (withForwardSlashes.startsWith('/') || name.startsWith('\\')) {
+        throw new PackageError('package/invalid-part-name', "ZIP item name is an absolute path: " + name);
+    }
+    if (/^[a-zA-Z]:/.test(name)) {
+        throw new PackageError('package/invalid-part-name', "ZIP item name has a drive letter: " + name);
+    }
+    if (withForwardSlashes.startsWith('//')) {
+        throw new PackageError('package/invalid-part-name', "ZIP item name is a UNC path: " + name);
+    }
+    var segments = withForwardSlashes.split('/');
+    try {
+        for (var segments_1 = __values(segments), segments_1_1 = segments_1.next(); !segments_1_1.done; segments_1_1 = segments_1.next()) {
+            var segment = segments_1_1.value;
+            if (segment === '..') {
+                throw new PackageError('package/invalid-part-name', "ZIP item name contains '..': " + name);
+            }
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (segments_1_1 && !segments_1_1.done && (_a = segments_1.return)) _a.call(segments_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+}

package/src/core/zip/read.d.ts

@@ -0,0 +1,8 @@
+import { ResourceLimitOverrides } from '../security/limits';
+import { ZipEntry } from './zip-entry';
+/**
+ * Reads a ZIP archive entirely in memory. Does not write to the filesystem.
+ * ZIP item names are those stored in the archive (ECMA-376-2 §7.3.3), not OPC
+ * logical part names (no leading slash in the ZIP item).
+ */
+export declare function readZip(bytes: Uint8Array, limitOverrides?: ResourceLimitOverrides): ReadonlyArray<ZipEntry>;