@xaypay/tui 0.3.1 → 0.3.2

package/CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to `@xaypay/tui` will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+
+## [0.3.2] - 2026-04-02
+- **FILE** Refactor: pdf / heic / heif validation.
+
 ## [0.3.1] - 2026-03-19
 
 ### Added

package/dist/index.es.js

@@ -2145,20 +2145,17 @@ const File = /*#__PURE__*/forwardRef(({
       const hasTable = names.has("1Table") || names.has("0Table");
       return hasWordDocument && hasTable ? Promise.resolve() : Promise.reject();
     } else if (type === 'pdf') {
+      const text = new TextDecoder().decode(buffer);
+      if (!text.includes("%%EOF")) return Promise.reject();
+      if (!text.startsWith("%PDF-")) return Promise.reject();
+      if (!text.includes("startxref")) return Promise.reject();
       if (dataView.byteLength < 8) {
         return Promise.reject();
       } else {
         if (dataView.getUint8(0) === 0x25 && dataView.getUint8(1) === 0x50 && dataView.getUint8(2) === 0x44 && dataView.getUint8(3) === 0x46) {
           const len = dataView.byteLength;
           let end = len - 1;
-          while (end >= 0 && (dataView.getUint8(end) === 0x0A ||
-          // \n
-          dataView.getUint8(end) === 0x0D ||
-          // \r
-          dataView.getUint8(end) === 0x20 ||
-          // space
-          dataView.getUint8(end) === 0x09 // tab
-          )) {
+          while (end >= 0 && (dataView.getUint8(end) === 0x0A || dataView.getUint8(end) === 0x0D || dataView.getUint8(end) === 0x20 || dataView.getUint8(end) === 0x09)) {
             end--;
           }
           if (end >= 4 && dataView.getUint8(end - 4) === 0x25 && dataView.getUint8(end - 3) === 0x25 && dataView.getUint8(end - 2) === 0x45 && dataView.getUint8(end - 1) === 0x4F && dataView.getUint8(end) === 0x46) {
@@ -2171,23 +2168,57 @@ const File = /*#__PURE__*/forwardRef(({
         }
       }
     } else if (type === 'heic') {
-      if (dataView.byteLength < 12) {
+      const length = dataView.byteLength;
+      if (length < 32) {
         return Promise.reject();
-      } else {
-        if (dataView.getUint8(0) === 0x66 && dataView.getUint8(1) === 0x74 && dataView.getUint8(2) === 0x79 && dataView.getUint8(3) === 0x70) {
-          if (dataView.getUint8(dataView.length - 4) === 0x6D && dataView.getUint8(dataView.length - 3) === 0x64 && dataView.getUint8(dataView.length - 2) === 0x61 && dataView.getUint8(dataView.length - 1) === 0x74) {
-            const majorBrand = String.fromCharCode(dataView.getUint8(4), dataView.getUint8(5), dataView.getUint8(6), dataView.getUint8(7));
-            const heicIdentifiers = ['heic', 'heix', 'mif1', 'msf1', 'heif'];
-            if (heicIdentifiers.includes(majorBrand)) {
-              return Promise.resolve();
-            } else {
-              return Promise.reject();
-            }
-          } else {
-            return Promise.reject();
-          }
+      }
+
+      // --- Check 'ftyp' at offset 4 ---
+      if (dataView.getUint8(4) !== 0x66 ||
+      // f
+      dataView.getUint8(5) !== 0x74 ||
+      // t
+      dataView.getUint8(6) !== 0x79 ||
+      // y
+      dataView.getUint8(7) !== 0x70 // p
+      ) {
+        return Promise.reject();
+      }
+
+      // --- Check major brand ---
+      const majorBrand = String.fromCharCode(dataView.getUint8(8), dataView.getUint8(9), dataView.getUint8(10), dataView.getUint8(11));
+      const validBrands = ['heic', 'heix', 'hevc', 'hevx', 'mif1', 'msf1', 'heif'];
+      if (!validBrands.includes(majorBrand)) {
+        return Promise.reject();
+      }
+
+      // --- Scan boxes (basic ISO BMFF parsing) ---
+      let offset = 0;
+      let foundMeta = false;
+      let foundMdat = false;
+      while (offset + 8 <= length) {
+        const size = dataView.getUint32(offset);
+        const type = String.fromCharCode(dataView.getUint8(offset + 4), dataView.getUint8(offset + 5), dataView.getUint8(offset + 6), dataView.getUint8(offset + 7));
+
+        // Invalid size → corrupted file
+        if (size < 8 || offset + size > length) {
+          return Promise.reject();
         }
+        if (type === "meta") foundMeta = true;
+        if (type === "mdat") foundMdat = true;
+        offset += size;
+      }
+
+      // --- Require at least meta box ---
+      if (!foundMeta) {
+        return Promise.reject();
+      }
+
+      // Optional but recommended
+      if (!foundMdat) {
+        return Promise.reject();
       }
+      return Promise.resolve();
     } else {
       return Promise.reject();
     }

package/dist/index.js

@@ -2176,20 +2176,17 @@ const File = /*#__PURE__*/React.forwardRef(({
       const hasTable = names.has("1Table") || names.has("0Table");
       return hasWordDocument && hasTable ? Promise.resolve() : Promise.reject();
     } else if (type === 'pdf') {
+      const text = new TextDecoder().decode(buffer);
+      if (!text.includes("%%EOF")) return Promise.reject();
+      if (!text.startsWith("%PDF-")) return Promise.reject();
+      if (!text.includes("startxref")) return Promise.reject();
       if (dataView.byteLength < 8) {
         return Promise.reject();
       } else {
         if (dataView.getUint8(0) === 0x25 && dataView.getUint8(1) === 0x50 && dataView.getUint8(2) === 0x44 && dataView.getUint8(3) === 0x46) {
           const len = dataView.byteLength;
           let end = len - 1;
-          while (end >= 0 && (dataView.getUint8(end) === 0x0A ||
-          // \n
-          dataView.getUint8(end) === 0x0D ||
-          // \r
-          dataView.getUint8(end) === 0x20 ||
-          // space
-          dataView.getUint8(end) === 0x09 // tab
-          )) {
+          while (end >= 0 && (dataView.getUint8(end) === 0x0A || dataView.getUint8(end) === 0x0D || dataView.getUint8(end) === 0x20 || dataView.getUint8(end) === 0x09)) {
             end--;
           }
           if (end >= 4 && dataView.getUint8(end - 4) === 0x25 && dataView.getUint8(end - 3) === 0x25 && dataView.getUint8(end - 2) === 0x45 && dataView.getUint8(end - 1) === 0x4F && dataView.getUint8(end) === 0x46) {
@@ -2202,23 +2199,57 @@ const File = /*#__PURE__*/React.forwardRef(({
         }
       }
     } else if (type === 'heic') {
-      if (dataView.byteLength < 12) {
+      const length = dataView.byteLength;
+      if (length < 32) {
         return Promise.reject();
-      } else {
-        if (dataView.getUint8(0) === 0x66 && dataView.getUint8(1) === 0x74 && dataView.getUint8(2) === 0x79 && dataView.getUint8(3) === 0x70) {
-          if (dataView.getUint8(dataView.length - 4) === 0x6D && dataView.getUint8(dataView.length - 3) === 0x64 && dataView.getUint8(dataView.length - 2) === 0x61 && dataView.getUint8(dataView.length - 1) === 0x74) {
-            const majorBrand = String.fromCharCode(dataView.getUint8(4), dataView.getUint8(5), dataView.getUint8(6), dataView.getUint8(7));
-            const heicIdentifiers = ['heic', 'heix', 'mif1', 'msf1', 'heif'];
-            if (heicIdentifiers.includes(majorBrand)) {
-              return Promise.resolve();
-            } else {
-              return Promise.reject();
-            }
-          } else {
-            return Promise.reject();
-          }
+      }
+
+      // --- Check 'ftyp' at offset 4 ---
+      if (dataView.getUint8(4) !== 0x66 ||
+      // f
+      dataView.getUint8(5) !== 0x74 ||
+      // t
+      dataView.getUint8(6) !== 0x79 ||
+      // y
+      dataView.getUint8(7) !== 0x70 // p
+      ) {
+        return Promise.reject();
+      }
+
+      // --- Check major brand ---
+      const majorBrand = String.fromCharCode(dataView.getUint8(8), dataView.getUint8(9), dataView.getUint8(10), dataView.getUint8(11));
+      const validBrands = ['heic', 'heix', 'hevc', 'hevx', 'mif1', 'msf1', 'heif'];
+      if (!validBrands.includes(majorBrand)) {
+        return Promise.reject();
+      }
+
+      // --- Scan boxes (basic ISO BMFF parsing) ---
+      let offset = 0;
+      let foundMeta = false;
+      let foundMdat = false;
+      while (offset + 8 <= length) {
+        const size = dataView.getUint32(offset);
+        const type = String.fromCharCode(dataView.getUint8(offset + 4), dataView.getUint8(offset + 5), dataView.getUint8(offset + 6), dataView.getUint8(offset + 7));
+
+        // Invalid size → corrupted file
+        if (size < 8 || offset + size > length) {
+          return Promise.reject();
         }
+        if (type === "meta") foundMeta = true;
+        if (type === "mdat") foundMdat = true;
+        offset += size;
+      }
+
+      // --- Require at least meta box ---
+      if (!foundMeta) {
+        return Promise.reject();
+      }
+
+      // Optional but recommended
+      if (!foundMdat) {
+        return Promise.reject();
       }
+      return Promise.resolve();
     } else {
       return Promise.reject();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaypay/tui",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "",
   "main": "dist/index.js",
   "module": "dist/index.es.js",