@zip.js/zip.js 2.16.0 → 2.16.1

package/dist/zip-fs-core.js

@@ -223,7 +223,7 @@
 	const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 	const ERR_INVALID_PASS_THROUGH_VALUE = "Invalid passThrough option (must be a boolean or 'compressed')";
 	const ERR_ABORTED = "The operation was aborted";
-	const ABORT_ERROR_NAME = "AbortError";
+	const ABORT_ERROR_NAME$1 = "AbortError";
 
 	function checkFunctionOption(value) {
 		if (value && typeof value != FUNCTION_TYPE) {
@@ -241,7 +241,7 @@
 
 	function throwIfAborted(signal) {
 		if (signal && signal.aborted) {
-			throw signal.reason === UNDEFINED_VALUE ? new DOMException(ERR_ABORTED, ABORT_ERROR_NAME) : signal.reason;
+			throw signal.reason === UNDEFINED_VALUE ? new DOMException(ERR_ABORTED, ABORT_ERROR_NAME$1) : signal.reason;
 		}
 	}
 
@@ -1283,12 +1283,12 @@
 	class AESDecryptionStream extends TransformStream {
 
 		constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly, checkAuthenticationCode = true }) {
+			const aesCrypto = {};
 			super({
 				start() {
-					initAesCrypto(this, password, rawPassword, encryptionStrength);
+					initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength);
 				},
 				async transform(chunk, controller) {
-					const aesCrypto = this;
 					const {
 						password,
 						strength,
@@ -1307,6 +1307,9 @@
 					} else {
 						await ready;
 					}
+					if (aesCrypto.discarded) {
+						return;
+					}
 					const output = new Uint8Array(chunk.length - AUTHENTICATION_CODE_LENGTH - ((chunk.length - AUTHENTICATION_CODE_LENGTH) % BLOCK_LENGTH));
 					controller.enqueue(append(aesCrypto, chunk, output, 0, AUTHENTICATION_CODE_LENGTH, true));
 				},
@@ -1315,9 +1318,12 @@
 						engine,
 						pendingInput,
 						ready
-					} = this;
+					} = aesCrypto;
 					if (engine) {
 						await ready;
+						if (aesCrypto.discarded) {
+							return;
+						}
 						const originalAuthenticationCode = subarray(pendingInput, pendingInput.length - AUTHENTICATION_CODE_LENGTH);
 						const decryptedChunkArray = new Uint8Array(subarray(pendingInput, 0, pendingInput.length - AUTHENTICATION_CODE_LENGTH));
 						engine.process(decryptedChunkArray, true);
@@ -1327,27 +1333,26 @@
 							invalidAuthenticationCode |= authenticationCode[indexByte] ^ originalAuthenticationCode[indexByte];
 						}
 						if (invalidAuthenticationCode && checkAuthenticationCode) {
-							throw new Error(ERR_INVALID_AUTHENTICATION_CODE);
+							controller.error(new Error(ERR_INVALID_AUTHENTICATION_CODE));
+							return;
 						}
 						controller.enqueue(decryptedChunkArray);
 					}
-				},
-				cancel() {
-					disposeEngine(this);
 				}
 			});
+			setDisposingReadable(this, aesCrypto);
 		}
 	}
 
 	class AESEncryptionStream extends TransformStream {
 
 		constructor({ password, rawPassword, encryptionStrength }) {
+			const aesCrypto = {};
 			super({
 				start() {
-					initAesCrypto(this, password, rawPassword, encryptionStrength);
+					initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength);
 				},
 				async transform(chunk, controller) {
-					const aesCrypto = this;
 					const {
 						password,
 						strength,
@@ -1361,6 +1366,9 @@
 					} else {
 						await ready;
 					}
+					if (aesCrypto.discarded) {
+						return;
+					}
 					const output = new Uint8Array(preamble.length + chunk.length - (chunk.length % BLOCK_LENGTH));
 					output.set(preamble, 0);
 					controller.enqueue(append(aesCrypto, chunk, output, preamble.length, 0, false));
@@ -1370,19 +1378,20 @@
 						engine,
 						pendingInput,
 						ready
-					} = this;
+					} = aesCrypto;
 					if (engine) {
 						await ready;
+						if (aesCrypto.discarded) {
+							return;
+						}
 						const encryptedChunkArray = new Uint8Array(pendingInput);
 						engine.process(encryptedChunkArray, false);
 						const authenticationCode = subarray(engine.digest(), 0, AUTHENTICATION_CODE_LENGTH);
 						controller.enqueue(concat(encryptedChunkArray, authenticationCode));
 					}
-				},
-				cancel() {
-					disposeEngine(this);
 				}
 			});
+			setDisposingReadable(this, aesCrypto);
 		}
 	}
 
@@ -1391,7 +1400,37 @@
 			ready: new Promise(resolve => aesCrypto.resolveReady = resolve),
 			password: encodePassword(password, rawPassword),
 			strength: encryptionStrength - 1,
-			pendingInput: EMPTY_UINT8_ARRAY
+			pendingInput: EMPTY_UINT8_ARRAY,
+			discarded: false
+		});
+	}
+
+	function setDisposingReadable(stream, aesCrypto) {
+		const reader = stream.readable.getReader();
+		const readable = new ReadableStream({
+			async pull(controller) {
+				try {
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
+				} catch (error) {
+					disposeEngine(aesCrypto);
+					reader.cancel(error).catch(() => { });
+					throw error;
+				}
+			},
+			cancel(reason) {
+				disposeEngine(aesCrypto);
+				return reader.cancel(reason);
+			}
+		});
+		Object.defineProperty(stream, "readable", {
+			get() {
+				return readable;
+			}
 		});
 	}
 
@@ -1424,7 +1463,9 @@
 		}
 	}
 
-	function disposeEngine({ engine }) {
+	function disposeEngine(aesCrypto) {
+		const { engine } = aesCrypto;
+		aesCrypto.discarded = true;
 		if (engine && engine.dispose) {
 			engine.dispose();
 		}
@@ -1441,6 +1482,9 @@
 		const keyLength = KEY_LENGTH[strength];
 		const compositeKey = await deriveKey(password, salt, keyLength * 2 + PASSWORD_VERIFICATION_LENGTH);
 		aesCrypto.engine = createEngine(subarray(compositeKey, 0, keyLength), subarray(compositeKey, keyLength, keyLength * 2));
+		if (aesCrypto.discarded) {
+			disposeEngine(aesCrypto);
+		}
 		return subarray(compositeKey, keyLength * 2);
 	}
 
@@ -1592,11 +1636,11 @@
 	}
 
 	function createKeys(target, password, rawPassword) {
-		const keys = [0x12345678, 0x23456789, 0x34567890];
+		const cryptoKeys = [0x12345678, 0x23456789, 0x34567890];
 		Object.assign(target, {
-			keys,
-			crcKey0: new Crc32(keys[0]),
-			crcKey2: new Crc32(keys[2])
+			cryptoKeys,
+			crcKey0: new Crc32(cryptoKeys[0]),
+			crcKey2: new Crc32(cryptoKeys[2])
 		});
 		if (rawPassword) {
 			for (let index = 0; index < rawPassword.length; index++) {
@@ -1610,17 +1654,17 @@
 	}
 
 	function updateKeys(target, byte) {
-		let [, key1] = target.keys;
+		let [, key1] = target.cryptoKeys;
 		target.crcKey0.append([byte]);
 		const key0 = ~target.crcKey0.get();
 		key1 = getInt32(Math.imul(getInt32(key1 + getInt8(key0)), 134775813) + 1);
 		target.crcKey2.append([key1 >>> 24]);
 		const key2 = ~target.crcKey2.get();
-		target.keys = [key0, key1, key2];
+		target.cryptoKeys = [key0, key1, key2];
 	}
 
 	function getByte(target) {
-		const temp = target.keys[2] | 2;
+		const temp = target.cryptoKeys[2] | 2;
 		return getInt8(Math.imul(temp, (temp ^ 1)) >>> 8);
 	}
 
@@ -1668,11 +1712,16 @@
 		const reader = readable.getReader();
 		return new ReadableStream({
 			async pull(controller) {
-				const { value, done } = await reader.read();
-				if (done) {
-					controller.close();
-				} else {
-					controller.enqueue(value);
+				try {
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
+				} catch (error) {
+					reader.cancel(error).catch(() => { });
+					throw error;
 				}
 			},
 			cancel(reason) {
@@ -1975,28 +2024,25 @@
 		pump();
 		return new ReadableStream({
 			async pull(controller) {
-				let result;
 				try {
-					result = await read();
+					const { value, done } = await read();
+					if (done) {
+						controller.close();
+					} else {
+						outputLength += value.length;
+						if (outputLength > outputSize) {
+							throw new Error(ERR_INVALID_UNCOMPRESSED_SIZE);
+						}
+						if (outputCrc32) {
+							outputCrc32.append(value);
+						}
+						controller.enqueue(value);
+					}
 				} catch (error) {
+					rejectTrailerReady(error);
+					await cancel(reader, error);
 					throw trailerWritten ? getTrailerError(error) : error;
 				}
-				const { value, done } = result;
-				if (done) {
-					controller.close();
-				} else {
-					outputLength += value.length;
-					if (outputLength > outputSize) {
-						const error = new Error(ERR_INVALID_UNCOMPRESSED_SIZE);
-						rejectTrailerReady(error);
-						await cancel(reader, error);
-						throw error;
-					}
-					if (outputCrc32) {
-						outputCrc32.append(value);
-					}
-					controller.enqueue(value);
-				}
 			},
 			cancel(reason) {
 				rejectTrailerReady(reason);
@@ -2275,10 +2321,15 @@
 		const reader = readable.getReader();
 		return new ReadableStream({
 			async pull(controller) {
-				let result;
 				try {
-					result = await reader.read();
+					const { value, done } = await reader.read();
+					if (done) {
+						controller.close();
+					} else {
+						controller.enqueue(value);
+					}
 				} catch (error) {
+					await cancel(reader, error);
 					if (error && error.message) {
 						throw error;
 					}
@@ -2286,12 +2337,6 @@
 					mappedError.cause = error;
 					throw mappedError;
 				}
-				const { value, done } = result;
-				if (done) {
-					controller.close();
-				} else {
-					controller.enqueue(value);
-				}
 			},
 			cancel(reason) {
 				return reader.cancel(reason);
@@ -5366,8 +5411,8 @@
 			const passThroughCompression = Boolean(passThrough);
 			const passThroughEncryption = passThrough === true;
 			checkPasswordOption(password, rawPassword);
-			password = password && password.length && password;
-			rawPassword = rawPassword && rawPassword.length && rawPassword;
+			password = password && password.length ? password : UNDEFINED_VALUE;
+			rawPassword = rawPassword && rawPassword.length ? rawPassword : UNDEFINED_VALUE;
 			if (extraFieldAES) {
 				if (extraFieldAES.originalCompressionMethod != COMPRESSION_METHOD_AES) {
 					throw new Error(ERR_UNSUPPORTED_COMPRESSION);
@@ -6128,7 +6173,7 @@
 	async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 		const { size } = reader;
 		const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
-		const remoteProbeBudget = { count: MAX_END_OF_CENTRAL_DIR_PROBES };
+		const remoteProbeBudget = { remaining: MAX_END_OF_CENTRAL_DIR_PROBES };
 		let endOfDirectoryInfo;
 		let plausibleEndOfDirectoryInfo;
 		let endOfDirectoryReachingEndCount = 0;
@@ -6221,8 +6266,8 @@
 		if (signatureOffset >= anchoredOffset) {
 			return getUint32$1(view, signatureOffset - anchoredOffset);
 		}
-		if (remoteProbeBudget.count > 0) {
-			remoteProbeBudget.count--;
+		if (remoteProbeBudget.remaining > 0) {
+			remoteProbeBudget.remaining--;
 			const signatureArray = await readUint8Array(reader, signatureOffset, 4);
 			return getUint32$1(getDataView(signatureArray), 0);
 		}
@@ -7138,9 +7183,11 @@
 		const passThrough = checkPassThroughOption(getOptionValue(zipWriter, options, OPTION_PASS_THROUGH));
 		const passThroughCompression = Boolean(passThrough);
 		const passThroughEncryption = passThrough === true;
-		const password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
-		const rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+		let password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
+		let rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
 		checkPasswordOption(password, rawPassword);
+		password = password && password.length ? password : UNDEFINED_VALUE;
+		rawPassword = rawPassword && rawPassword.length ? rawPassword : UNDEFINED_VALUE;
 		const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 		const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 		const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
@@ -8936,7 +8983,7 @@
 	 EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 	 */
 
-	const VERSION = "2.16.0";
+	const VERSION = "2.16.1";
 
 	/*
 	 Copyright (c) 2025 Gildas Lormeau. All rights reserved.
@@ -9429,7 +9476,11 @@
 	const ERR_INVALID_PASS_THROUGH = "Invalid passThrough option (use readerOptions.passThrough or set uncompressedSize for each entry)";
 	const ERR_INVALID_READER_OPTIONS = "Invalid readerOptions (must be an object)";
 	const ERR_UNSUPPORTED_PASS_THROUGH_VALUE = "The 'compressed' passThrough option is only supported by Entry#getData() and ZipWriter#add()";
+	const ERR_INVALID_PASSWORDS = "Invalid passwords option (must be an array of strings)";
+	const ERR_INVALID_REQUEST_PASSWORD = "Invalid requestPassword option (must be a function returning a string or undefined)";
 	const ERR_ABORT_EXPORT = "zipjs-abort-export";
+	const ABORT_ERROR_NAME = "AbortError";
+	const EMPTY_RAW_PASSWORD = new Uint8Array(0);
 
 	class ZipEntry {
 
@@ -9802,8 +9853,10 @@
 				zipReader = new ZipReader(reader, options);
 			}
 			checkPassThroughValue(options.passThrough);
+			checkPasswordCandidatesOptions(options);
 			const duplicates = checkDuplicatesOption(options.duplicates);
 			const importedEntries = [];
+			const passwordState = { known: [] };
 			const entries = await zipReader.getEntries(options);
 			for (const entry of entries) {
 				let parent = this;
@@ -9848,7 +9901,7 @@
 						}
 						importedEntries.push(addChild(parent, name, {
 							data: entry,
-							Reader: getZipBlobReader(Object.assign({}, options)),
+							Reader: getZipBlobReader(Object.assign({}, options), passwordState),
 							uncompressedSize: options.passThrough ? entry.compressedSize : entry.uncompressedSize,
 							passThrough: options.passThrough
 						}));
@@ -10177,7 +10230,7 @@
 		};
 	}
 
-	function getZipBlobReader(options) {
+	function getZipBlobReader(options, passwordState) {
 		return class extends Reader {
 
 			constructor(entry, options = {}) {
@@ -10190,12 +10243,12 @@
 				const zipBlobReader = this;
 				const readerOptions = Object.assign({}, options, zipBlobReader.options);
 				const { checkOverlappingEntry, checkOverlappingEntryOnly } = readerOptions;
-				const data = await zipBlobReader.entry.getData(new BlobWriter(), Object.assign(readerOptions, {
+				const data = await readEntryData(zipBlobReader.entry, Object.assign(readerOptions, {
 					checkPasswordOnly: false,
 					checkOverlappingEntry: checkOverlappingEntryOnly || checkOverlappingEntry,
 					checkOverlappingEntryOnly: false,
 					preventClose: false
-				}));
+				}), passwordState);
 				zipBlobReader.data = data;
 				zipBlobReader.blobReader = new BlobReader(data);
 				zipBlobReader.size = data.size;
@@ -10257,10 +10310,9 @@
 				await initStream(reader);
 			} catch (error) {
 				try {
+					error.entry = child;
 					error.entryId = child.id;
-					error.cause = {
-						entry: child
-					};
+					error.entryName = child.getRelativeName(entry);
 				} catch {
 					// ignored
 				}
@@ -10352,10 +10404,136 @@
 		}
 		if (readerOptions) {
 			checkPassThroughValue(readerOptions.passThrough);
+			checkPasswordCandidatesOptions(readerOptions);
 		}
 		return readerOptions;
 	}
 
+	function checkPasswordCandidatesOptions(options) {
+		const { passwords, requestPassword } = options;
+		if (passwords && (!Array.isArray(passwords) || passwords.some(password => typeof password != STRING_TYPE))) {
+			throw new Error(ERR_INVALID_PASSWORDS);
+		}
+		if (requestPassword && typeof requestPassword != FUNCTION_TYPE) {
+			throw new Error(ERR_INVALID_REQUEST_PASSWORD);
+		}
+	}
+
+	async function readEntryData(entry, options, passwordState) {
+		checkPasswordCandidatesOptions(options);
+		const { passwords, requestPassword, signal } = options;
+		options = Object.assign({}, options);
+		delete options.passwords;
+		delete options.requestPassword;
+		if (!entry.encrypted || options.passThrough || (!passwords && !requestPassword)) {
+			return entry.getData(new BlobWriter(), options);
+		}
+		const tried = new Set();
+		let error;
+		while (true) {
+			for (const candidate of getPasswordCandidates(options, passwordState, passwords)) {
+				if (!tried.has(candidate.key)) {
+					const result = await tryPasswordCandidate(candidate);
+					if (result.done) {
+						return result.data;
+					}
+					error = result.error;
+				}
+			}
+			if (!requestPassword) {
+				break;
+			}
+			if (passwordState.pendingPrompt) {
+				await passwordState.pendingPrompt;
+				continue;
+			}
+			let release;
+			passwordState.pendingPrompt = new Promise(resolve => release = resolve);
+			try {
+				const answer = await requestPassword(entry, error);
+				if (answer === UNDEFINED_VALUE || answer === null) {
+					break;
+				}
+				// deno-lint-ignore valid-typeof
+				if (typeof answer != STRING_TYPE) {
+					throw new Error(ERR_INVALID_REQUEST_PASSWORD);
+				}
+				const result = await tryPasswordCandidate(getPasswordCandidate(answer));
+				if (result.done) {
+					return result.data;
+				}
+				error = result.error;
+			} finally {
+				passwordState.pendingPrompt = UNDEFINED_VALUE;
+				release();
+			}
+		}
+		throw new Error(tried.size ? ERR_INVALID_PASSWORD : ERR_ENCRYPTED);
+
+		async function tryPasswordCandidate(candidate) {
+			tried.add(candidate.key);
+			const candidateOptions = Object.assign({}, options, candidate.options);
+			if (entry.zipCrypto) {
+				candidateOptions.checkCrc32 = true;
+				try {
+					await entry.getData(null, Object.assign({}, candidateOptions, { checkPasswordOnly: true }));
+				} catch (probeError) {
+					if (isInvalidPasswordError(probeError)) {
+						return { done: false, error: probeError };
+					}
+					throw probeError;
+				}
+			}
+			try {
+				const data = await entry.getData(new BlobWriter(), candidateOptions);
+				rememberPassword(passwordState, candidate);
+				return { done: true, data };
+			} catch (readError) {
+				if (isAbortError(readError, signal) || (!entry.zipCrypto && !isInvalidPasswordError(readError))) {
+					throw readError;
+				}
+				return { done: false, error: readError };
+			}
+		}
+	}
+
+	function isInvalidPasswordError(error) {
+		return isErrorObject(error) && error.message == ERR_INVALID_PASSWORD;
+	}
+
+	function isAbortError(error, signal) {
+		return Boolean(signal && signal.aborted) || (isErrorObject(error) && error.name == ABORT_ERROR_NAME);
+	}
+
+	function getPasswordCandidates(options, passwordState, passwords) {
+		const candidates = [];
+		const { password, rawPassword } = options;
+		if (rawPassword && rawPassword.length) {
+			candidates.push({ key: rawPassword, options: { password: "", rawPassword } });
+		}
+		if (password) {
+			candidates.push(getPasswordCandidate(password));
+		}
+		candidates.push(...passwordState.known);
+		if (passwords) {
+			candidates.push(...passwords.filter(password => password).map(getPasswordCandidate));
+		}
+		return candidates;
+	}
+
+	function getPasswordCandidate(password) {
+		return { key: password, options: { password, rawPassword: EMPTY_RAW_PASSWORD } };
+	}
+
+	function rememberPassword(passwordState, candidate) {
+		const { known } = passwordState;
+		const index = known.findIndex(knownCandidate => knownCandidate.key === candidate.key);
+		if (index != -1) {
+			known.splice(index, 1);
+		}
+		known.unshift(candidate);
+	}
+
 	function checkPassThroughValue(passThrough) {
 		if (checkPassThroughOption(passThrough) === PASS_THROUGH_COMPRESSED) {
 			throw new Error(ERR_UNSUPPORTED_PASS_THROUGH_VALUE);
@@ -10493,6 +10671,7 @@
 	async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 		const { onstart, onprogress, onend } = options;
 		checkPassThroughValue(options.passThrough);
+		checkPasswordCandidatesOptions(options);
 		const readerOptions = checkReaderOptions(options.readerOptions);
 		const abortController = new AbortController();
 		const { signal } = abortController;
@@ -10791,11 +10970,13 @@
 	exports.ERR_INVALID_MSDOS_ATTRIBUTES = ERR_INVALID_MSDOS_ATTRIBUTES;
 	exports.ERR_INVALID_MSDOS_DATA = ERR_INVALID_MSDOS_DATA;
 	exports.ERR_INVALID_PASSWORD = ERR_INVALID_PASSWORD;
+	exports.ERR_INVALID_PASSWORDS = ERR_INVALID_PASSWORDS;
 	exports.ERR_INVALID_PASSWORD_TYPE = ERR_INVALID_PASSWORD_TYPE;
 	exports.ERR_INVALID_PASS_THROUGH = ERR_INVALID_PASS_THROUGH;
 	exports.ERR_INVALID_PASS_THROUGH_VALUE = ERR_INVALID_PASS_THROUGH_VALUE;
 	exports.ERR_INVALID_READER = ERR_INVALID_READER;
 	exports.ERR_INVALID_READER_OPTIONS = ERR_INVALID_READER_OPTIONS;
+	exports.ERR_INVALID_REQUEST_PASSWORD = ERR_INVALID_REQUEST_PASSWORD;
 	exports.ERR_INVALID_SIGNAL = ERR_INVALID_SIGNAL;
 	exports.ERR_INVALID_SIGNATURE_DATA = ERR_INVALID_SIGNATURE_DATA;
 	exports.ERR_INVALID_STRICTNESS = ERR_INVALID_STRICTNESS;