@zip.js/zip.js 2.14.1 → 2.15.0

package/BENCHMARKS.md

@@ -39,8 +39,11 @@ The page answers four questions, each from one or two scripts of the harness:
   about 2 KB each, and the 8 × 8 MB and 256 MB workloads are text.
 - **Isolation.** In `bench.js` and `bench-backends.js`, each (library, operation, workload)
   combination runs in its own freshly spawned Node process under macOS's `/usr/bin/time -l`, so
-  the libraries never share a heap and peak memory is per library. The codec, encryption and
-  runtime scripts run in-process, with one warmup run before the timed ones.
+  the libraries never share a heap and peak memory is per library. Every row of those two
+  scripts includes what a fresh process pays on its first operation: the JIT warm-up of each
+  library and, for the zip.js WebAssembly rows, the module instantiation, about 20 ms. The
+  codec, encryption and runtime scripts run in-process, with one warmup run before the timed
+  ones.
 - **Timing.** `performance.now()` around the measured operation. Each combination runs 3 times
   (5 in the encryption script) and the tables report the median. Differences of a few percent
   are within run-to-run noise. A bold cell is the best number among the alternatives it is
@@ -59,6 +62,9 @@ The page answers four questions, each from one or two scripts of the harness:
   where they exist; the bundled WebAssembly zlib; and the pure-JavaScript zlib port. The last two
   ship with the library, like the codecs of jszip and fflate, so those rows compare the
   libraries without the host's zlib in the picture.
+- **Checks.** No decompression row verifies the CRC-32 of the entries: zip.js and jszip leave
+  the check off by default, and fflate has none on read. Turning it on in zip.js adds one pass
+  over the output, about 15 ms per 20 MB.
 - **Units.** MB in the tables is 10^6 bytes. The workload sizes (20 MB, 8 MB, 256 MB) and the
   MB/s throughputs use 2^20 bytes.
 
@@ -126,15 +132,17 @@ Peak memory for the same runs (Δ over baseline):
 | fflate | fflate (JavaScript) | **92 MB** | **120 MB** |
 
 On the 20 MB stream `DecompressionStream` takes 66 ms and the WebAssembly inflate 78 ms, then
-fflate 116 ms, jszip 137 ms and the pure-JavaScript port 180 ms. On 5,000 small files the order
-reverses: fflate takes 102 ms, jszip 444 ms and the three zip.js rows 476 to 628 ms, with
-`DecompressionStream` the slowest of them, the same per-entry cost as in compression. fflate
-uses the least memory on both workloads, 34 % of the `DecompressionStream` row on the small
-files, and the WebAssembly and pure-JavaScript rows peak higher than `DecompressionStream`. The
-three zip.js rows allocate the same 800 MB of stream objects over the 5,000 entries, about
-160 KB per entry. The WebAssembly and pure-JavaScript codecs run on the JavaScript thread, so
-V8's incremental marking keeps more of that garbage alive between collections, and that is the
-difference between the rows.
+fflate 116 ms, jszip 137 ms and the pure-JavaScript port 180 ms. The WebAssembly row includes
+the module instantiation a fresh process pays once, about 20 ms. Warm, the two inflates are
+within 6 % of each other in the [Codecs](#codecs-at-equal-output-size) table. On 5,000 small
+files the order reverses: fflate takes 102 ms, jszip 444 ms and the three zip.js rows 476 to
+628 ms, with `DecompressionStream` the slowest of them, the same per-entry cost as in
+compression. fflate uses the least memory on both workloads, 34 % of the `DecompressionStream`
+row on the small files, and the WebAssembly and pure-JavaScript rows peak higher than
+`DecompressionStream`. The three zip.js rows allocate the same 800 MB of stream objects over the
+5,000 entries, about 160 KB per entry. The WebAssembly and pure-JavaScript codecs run on the
+JavaScript thread, so V8's incremental marking keeps more of that garbage alive between
+collections, and that is the difference between the rows.
 
 ### Streaming a 256 MB file, disk to disk
 

package/deno.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zip-js/zip-js",
-	"version": "2.14.1",
+	"version": "2.15.0",
 	"exports": {
 		".": "./index.js",
 		"./external": "./lib/zip-fs-external.js",

package/dist/zip-core-external.js

@@ -1900,8 +1900,8 @@ class DeflateStream extends TransformStream {
 		let crc32Stream, encryptionStream, gzipCrc32Stream;
 		let readable = super.readable;
 		const codecStreams = format && getCodecStreams(format);
-		const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) &&
-			Boolean(useCompressionStream && CompressionStream);
+		const GzipCompressionStream = getGzipCompressionStream(useCompressionStream, CompressionStream, CompressionStreamFallback);
+		const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) && Boolean(GzipCompressionStream);
 		if ((!encrypted || zipCrypto) && computeCrc32 && !useGzipCrc32) {
 			crc32Stream = new Crc32Stream();
 			readable = pipeThrough(readable, crc32Stream);
@@ -1911,7 +1911,7 @@ class DeflateStream extends TransformStream {
 				readable = pipeThroughBackpressured(readable, createCodecStream(codecStreams.CompressionStream, format, { level, chunkSize, compressionMethod, uncompressedSize: inputSize }));
 			} else if (useGzipCrc32) {
 				gzipCrc32Stream = new GzipToRawDeflateStream();
-				readable = pipeThroughBackpressured(readable, new CompressionStream(FORMAT_GZIP$1));
+				readable = pipeThroughBackpressured(readable, new GzipCompressionStream(FORMAT_GZIP$1, { level, chunkSize }));
 				readable = pipeThrough(readable, gzipCrc32Stream);
 			} else {
 				try {
@@ -1985,8 +1985,7 @@ class GzipToRawDeflateStream extends TransformStream {
 	}
 }
 
-function pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize) {
-	const crc32 = new Crc32();
+function pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, crc32) {
 	let outputLength = 0;
 	let inputDone = false;
 	let watchdogTimeout;
@@ -2060,7 +2059,7 @@ class InflateStream extends TransformStream {
 	constructor(options, { chunkSize, DecompressionStreamFallback, DecompressionStream }) {
 		super({});
 		const { zipCrypto, encrypted, checkCrc32, crc32, compressed, useCompressionStream, deflate64, format, compressionMethod, rawBitFlag, outputSize } = options;
-		let crc32Stream, decryptionStream;
+		let crc32Stream, decryptionStream, gzipCrc32;
 		let readable = super.readable;
 		if (encrypted) {
 			if (zipCrypto) {
@@ -2087,19 +2086,20 @@ class InflateStream extends TransformStream {
 					} catch {
 						throw error;
 					}
-					readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize);
+					gzipCrc32 = new Crc32();
+					readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, gzipCrc32);
 				}
 			}
 			readable = mapInflateStreamError(readable);
 		}
-		if (checkCrc32) {
+		if (checkCrc32 && !gzipCrc32) {
 			crc32Stream = new Crc32Stream();
 			readable = pipeThrough(readable, crc32Stream);
 		}
 		setReadable(this, readable, () => {
 			if (checkCrc32) {
-				const computedCrc32View = new DataView(crc32Stream.value.buffer);
-				if (crc32 != computedCrc32View.getUint32(0, false)) {
+				const computedCrc32 = gzipCrc32 ? gzipCrc32.get() >>> 0 : new DataView(crc32Stream.value.buffer).getUint32(0, false);
+				if (crc32 != computedCrc32) {
 					throw new Error(ERR_INVALID_CRC32);
 				}
 			}
@@ -2155,6 +2155,14 @@ function createCodecStream(CodecStreamClass, format, options) {
 	return new CodecStreamClass(format, options);
 }
 
+function getGzipCompressionStream(useCompressionStream, CompressionStreamNative, CompressionStreamFallback) {
+	if (useCompressionStream && CompressionStreamNative) {
+		return CompressionStreamNative;
+	} else if (CompressionStreamFallback && CompressionStreamFallback.requiresModule) {
+		return CompressionStreamFallback;
+	}
+}
+
 function pipeThroughCompressionStream(readable, useCompressionStream, options, CompressionStreamNative, CompressionStreamFallback) {
 	const Stream = useCompressionStream && CompressionStreamNative ?
 		CompressionStreamNative :
@@ -2527,10 +2535,12 @@ class CodecWorker {
 							workerData.terminated = true;
 							worker.terminate();
 						}
-						terminateResolvers.forEach(resolve => resolve());
 					}
 					workerData.busy = false;
-					onTaskFinished(workerData);
+					const pendingTasks = onTaskFinished(workerData);
+					if (terminateResolvers) {
+						terminateResolvers.forEach(resolve => resolve(pendingTasks));
+					}
 				}
 			}
 		});
@@ -3215,7 +3225,10 @@ async function runWorker(stream, workerOptions) {
 
 	function onTaskFinished(workerData) {
 		clearStarvationTimeout();
-		if (pendingRequests.length) {
+		if (workerData.terminated) {
+			workerData.terminated = false;
+			return runPendingRequestsInline();
+		} else if (pendingRequests.length) {
 			const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
 			resolve(new CodecWorker(workerData, stream, workerOptions, onTaskFinished));
 			armStarvationTimeout();
@@ -3253,12 +3266,26 @@ function onWorkerStarvation() {
 	starvationTimeout = null;
 	if (pendingRequests.length) {
 		const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
-		const inlineWorkerOptions = Object.assign({}, workerOptions, { useWebWorkers: false, workerURI: UNDEFINED_VALUE, createWorker: UNDEFINED_VALUE });
-		resolve(new CodecWorker({}, stream, inlineWorkerOptions, onInlineTaskFinished));
+		resolve(new CodecWorker({}, stream, getInlineWorkerOptions(workerOptions), onInlineTaskFinished));
 		armStarvationTimeout();
 	}
 }
 
+function runPendingRequestsInline() {
+	const tasks = pendingRequests.splice(0).map(({ resolve, stream, workerOptions }) => new Promise(resolveTask => {
+		resolve(new CodecWorker({}, stream, getInlineWorkerOptions(workerOptions), () => {
+			onInlineTaskFinished();
+			resolveTask();
+		}));
+	}));
+	clearStarvationTimeout();
+	return Promise.all(tasks);
+}
+
+function getInlineWorkerOptions(workerOptions) {
+	return Object.assign({}, workerOptions, { useWebWorkers: false, workerURI: UNDEFINED_VALUE, createWorker: UNDEFINED_VALUE });
+}
+
 function onInlineTaskFinished() {
 	clearStarvationTimeout();
 	armStarvationTimeout();
@@ -3268,18 +3295,14 @@ function terminateWorker(workerData, workerOptions) {
 	const { config } = workerOptions;
 	const { terminateWorkerTimeout } = config;
 	if (Number.isFinite(terminateWorkerTimeout) && terminateWorkerTimeout >= 0) {
-		if (workerData.terminated) {
-			workerData.terminated = false;
-		} else {
-			workerData.terminateTimeout = setTimeout(async () => {
-				pool = pool.filter(data => data != workerData);
-				try {
-					await workerData.terminate();
-				} catch {
-					// ignored
-				}
-			}, terminateWorkerTimeout);
-		}
+		workerData.terminateTimeout = setTimeout(async () => {
+			pool = pool.filter(data => data != workerData);
+			try {
+				await workerData.terminate();
+			} catch {
+				// ignored
+			}
+		}, terminateWorkerTimeout);
 	}
 }
 
@@ -3292,10 +3315,13 @@ function clearTerminateTimeout(workerData) {
 }
 
 async function terminateWorkers() {
-	await Promise.allSettled(pool.map(workerData => {
-		clearTerminateTimeout(workerData);
-		return workerData.terminate();
-	}));
+	await Promise.allSettled([
+		runPendingRequestsInline(),
+		...pool.map(workerData => {
+			clearTerminateTimeout(workerData);
+			return workerData.terminate();
+		})
+	]);
 	resetWebWorkerSupport();
 }
 
@@ -3370,6 +3396,19 @@ function decodeText(value, encoding) {
 	return decode(value, encoding, true);
 }
 
+function isUTF8Text(value) {
+	if (value.some(byte => byte > 0x7f)) {
+		try {
+			new TextDecoder("utf-8", { fatal: true }).decode(value);
+			return true;
+		} catch {
+			return false;
+		}
+	} else {
+		return false;
+	}
+}
+
 function decodeTextRemovingBOM(value, encoding) {
 	return decode(value, encoding, false);
 }
@@ -4659,6 +4698,7 @@ const WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD = "mismatched loca
 const WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES = "mismatched local file header (crc32 or sizes)";
 const MAX_KNOWN_VERSION = 63;
 const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
+const PARENT_DIRECTORY_REGEXP = /(^|[\\/])\.\.([\\/]|$)/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
@@ -4911,12 +4951,13 @@ class ZipReader {
 			const versionMadeBy = getUint16$1(directoryView, offset + 4);
 			const msDosCompatible = versionMadeBy >> 8 == 0;
 			const unixCompatible = versionMadeBy >> 8 == 3;
-			const rawFilename = directoryArray.subarray(filenameOffset, extraFieldOffset);
 			const commentLength = getUint16$1(directoryView, offset + 32);
 			const endOffset = commentOffset + commentLength;
-			const rawComment = directoryArray.subarray(commentOffset, endOffset);
-			const filenameUTF8 = languageEncodingFlag;
-			const commentUTF8 = languageEncodingFlag;
+			const rawEntryData = new Uint8Array(directoryArray.subarray(filenameOffset, endOffset));
+			const rawFilename = rawEntryData.subarray(0, fileEntry.filenameLength);
+			const rawComment = rawEntryData.subarray(fileEntry.filenameLength + fileEntry.extraFieldLength);
+			const filenameUTF8 = languageEncodingFlag || (!filenameEncoding && isUTF8Text(rawFilename));
+			const commentUTF8 = languageEncodingFlag || (!commentEncoding && isUTF8Text(rawComment));
 			const externalFileAttributes = getUint32$1(directoryView, offset + 38);
 			const msdosAttributesRaw = externalFileAttributes & MAX_8_BITS;
 			const msdosAttributes = {
@@ -4967,7 +5008,7 @@ class ZipReader {
 				rawFilename,
 				filenameUTF8,
 				commentUTF8,
-				rawExtraField: directoryArray.subarray(extraFieldOffset, commentOffset),
+				rawExtraField: rawEntryData.subarray(fileEntry.filenameLength, fileEntry.filenameLength + fileEntry.extraFieldLength),
 				rawComment,
 				filename,
 				comment
@@ -5475,7 +5516,7 @@ function readDigitalSignature(signatureRecordArray) {
 		if (getUint32$1(signatureRecordView, 0) == DIGITAL_SIGNATURE_RECORD_SIGNATURE) {
 			const signatureDataLength = getUint16$1(signatureRecordView, 4);
 			if (6 + signatureDataLength <= signatureRecordArray.length) {
-				return signatureRecordArray.subarray(6, 6 + signatureDataLength);
+				return new Uint8Array(signatureRecordArray.subarray(6, 6 + signatureDataLength));
 			}
 		}
 	}
@@ -5998,10 +6039,10 @@ function isUnsafeFilename(filename, filenameValidation) {
 	if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
 		pathParts.pop();
 	}
-	if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+	if (PARENT_DIRECTORY_REGEXP.test(filename) || filename.startsWith("/") || filename.startsWith("\\") || DRIVE_LETTER_REGEXP.test(filename)) {
 		return true;
 	}
-	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes("") || filename.includes("\0"));
 }
 
 function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
@@ -6087,7 +6128,7 @@ async function* scanEndOfCentralDirectory(reader, scanLength) {
 }
 
 function getEndOfCentralDirectoryInfo(scanArray, indexByte, offset) {
-	return { offset, buffer: scanArray.slice(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH).buffer };
+	return { offset, buffer: new Uint8Array(scanArray.subarray(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH)).buffer };
 }
 
 async function getCentralDirectoryReachability(reader, view, anchoredOffset, indexByte, offset, size, remoteProbeBudget) {
@@ -8734,7 +8775,7 @@ function formatSupported(StreamClass, format) {
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-const VERSION = "2.14.1";
+const VERSION = "2.15.0";
 
 /*
  Copyright (c) 2025 Gildas Lormeau. All rights reserved.