@zip.js/zip.js 2.8.30 → 2.8.32

package/lib/core/codec-worker.js

@@ -194,9 +194,6 @@ async function runWorker({ options, readable, writable, onTaskFinished }, config
 			try {
 				await initModule(config);
 			} catch {
-				// The WASM module failed to load. Fall back to the native CompressionStream only if the
-				// zlib codec that would otherwise run depends on that module; a self-contained codec
-				// supplied through config (e.g. the pure-JS port) stays usable and is kept as requested.
 				const ZlibStream = options.codecType.startsWith(CODEC_DEFLATE) ?
 					config.CompressionStreamZlib :
 					config.DecompressionStreamZlib;
@@ -274,7 +271,6 @@ async function runWebWorker(workerData, config) {
 		return resultValue;
 	} catch (error) {
 		await closeWritable();
-		// unblock the pipe watcher if the worker died before closing its end of the stream
 		abortPipe();
 		try {
 			await closed;
@@ -299,8 +295,6 @@ function watchClosedStream(writableSource) {
 	const abortController = new AbortController();
 	const { writable, readable } = new TransformStream();
 	const closed = readable.pipeTo(writableSource, { preventClose: true, preventAbort: true, signal: abortController.signal });
-	// the pipe can fail before `closed` is awaited (e.g. the destination write fails);
-	// mark the rejection as handled so it cannot kill the process in the meantime
 	closed.catch(() => { });
 	return { writable, closed, abortPipe: () => abortController.abort() };
 }
@@ -393,8 +387,6 @@ function onWorkerError(event, workerData) {
 		event.preventDefault();
 	}
 	const { rejectResult, writer, onTaskFinished } = workerData;
-	// the worker is unusable (e.g. its script failed to load); terminate it and
-	// fail the current task instead of letting it hang forever
 	terminateWorker(workerData);
 	if (rejectResult) {
 		rejectResult(event.error || new Error(event.message || ERROR_EVENT_TYPE));
@@ -410,7 +402,7 @@ function sendMessage(message, { worker, writer, transferStreams }) {
 		const { value, readable, writable } = message;
 		const transferables = [];
 		if (value) {
-			message.value = value;
+			message.value = value.byteOffset || value.byteLength != value.buffer.byteLength ? new Uint8Array(value) : value;
 			transferables.push(message.value.buffer);
 		}
 		if (transferStreams && transferStreamsSupported) {
@@ -446,8 +438,6 @@ function sendMessage(message, { worker, writer, transferStreams }) {
 async function onMessage({ data }, workerData) {
 	const { type, value, messageId, result, error } = data;
 	const { reader, writer, resolveResult, rejectResult, onTaskFinished, generation } = workerData;
-	// continuations below can settle after the worker slot has been reassigned to a new
-	// task (e.g. a pending pull read failing late); they must not touch the new task
 	const stale = () => workerData.generation != generation;
 	try {
 		if (error) {

package/lib/core/configuration.js

@@ -55,6 +55,22 @@ const DEFAULT_CONFIGURATION = {
 	DecompressionStream: typeof DecompressionStream != UNDEFINED_TYPE && DecompressionStream
 };
 
+const CONFIGURABLE_PROPERTY_NAMES = [
+	"baseURI",
+	"wasmURI",
+	"workerURI",
+	"chunkSize",
+	"maxWorkers",
+	"terminateWorkerTimeout",
+	"workerStarvationTimeout",
+	"useCompressionStream",
+	"useWebWorkers",
+	"CompressionStream",
+	"DecompressionStream",
+	"CompressionStreamZlib",
+	"DecompressionStreamZlib"
+];
+
 const config = Object.assign({}, DEFAULT_CONFIGURATION);
 
 export {
@@ -72,38 +88,10 @@ function getChunkSize(config) {
 }
 
 function configure(configuration) {
-	const {
-		baseURI,
-		chunkSize,
-		maxWorkers,
-		terminateWorkerTimeout,
-		workerStarvationTimeout,
-		useCompressionStream,
-		useWebWorkers,
-		CompressionStream,
-		DecompressionStream,
-		CompressionStreamZlib,
-		DecompressionStreamZlib,
-		workerURI,
-		wasmURI
-	} = configuration;
-	setIfDefined("baseURI", baseURI);
-	setIfDefined("wasmURI", wasmURI);
-	setIfDefined("workerURI", workerURI);
-	setIfDefined("chunkSize", chunkSize);
-	setIfDefined("maxWorkers", maxWorkers);
-	setIfDefined("terminateWorkerTimeout", terminateWorkerTimeout);
-	setIfDefined("workerStarvationTimeout", workerStarvationTimeout);
-	setIfDefined("useCompressionStream", useCompressionStream);
-	setIfDefined("useWebWorkers", useWebWorkers);
-	setIfDefined("CompressionStream", CompressionStream);
-	setIfDefined("DecompressionStream", DecompressionStream);
-	setIfDefined("CompressionStreamZlib", CompressionStreamZlib);
-	setIfDefined("DecompressionStreamZlib", DecompressionStreamZlib);
-}
-
-function setIfDefined(propertyName, propertyValue) {
-	if (propertyValue !== UNDEFINED_VALUE) {
-		config[propertyName] = propertyValue;
+	for (const propertyName of CONFIGURABLE_PROPERTY_NAMES) {
+		const propertyValue = configuration[propertyName];
+		if (propertyValue !== UNDEFINED_VALUE) {
+			config[propertyName] = propertyValue;
+		}
 	}
 }

package/lib/core/constants.js

@@ -104,7 +104,10 @@ const UNDEFINED_TYPE = "undefined";
 const FUNCTION_TYPE = "function";
 const OBJECT_TYPE = "object";
 
+const EMPTY_UINT8_ARRAY = new Uint8Array();
+
 export {
+	EMPTY_UINT8_ARRAY,
 	MAX_32_BITS,
 	MAX_16_BITS,
 	MAX_8_BITS,

package/lib/core/io.js

@@ -33,7 +33,8 @@ import {
 	UNDEFINED_VALUE,
 	INFINITY_VALUE,
 	FUNCTION_TYPE,
-	END_OF_CENTRAL_DIR_LENGTH
+	END_OF_CENTRAL_DIR_LENGTH,
+	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
 
@@ -71,26 +72,24 @@ class Stream {
 class Reader extends Stream {
 
 	get readable() {
+		return this.createReadable();
+	}
+
+	createReadable({ offset = 0, size, diskNumberStart, chunkSize = DEFAULT_CHUNK_SIZE } = {}) {
 		const reader = this;
-		const { chunkSize = DEFAULT_CHUNK_SIZE } = reader;
-		const readable = new ReadableStream({
-			start() {
-				this.chunkOffset = 0;
-			},
+		let chunkOffset = 0;
+		return new ReadableStream({
 			async pull(controller) {
-				const { offset = 0, size, diskNumberStart } = readable;
-				const { chunkOffset } = this;
 				const dataSize = size === UNDEFINED_VALUE ? chunkSize : Math.min(chunkSize, size - chunkOffset);
 				const data = await readUint8Array(reader, offset + chunkOffset, dataSize, diskNumberStart);
 				controller.enqueue(data);
 				if ((chunkOffset + chunkSize > size) || (size === UNDEFINED_VALUE && !data.length && dataSize)) {
 					controller.close();
 				} else {
-					this.chunkOffset += chunkSize;
+					chunkOffset += chunkSize;
 				}
 			}
 		});
-		return readable;
 	}
 }
 
@@ -229,8 +228,6 @@ class BlobWriter extends Stream {
 			}
 		});
 		writer.blob = new Response(transformStream.readable, { headers }).blob();
-		// mark early rejections (e.g. aborted pipe) as handled; awaiting getData() still
-		// surfaces them
 		writer.blob.catch(() => { });
 	}
 
@@ -392,7 +389,7 @@ async function readUint8ArrayHttpReader(httpReader, index, length, sendRequest,
 			return eocdCache;
 		}
 		if (index >= size || length === 0) {
-			return new Uint8Array();
+			return EMPTY_UINT8_ARRAY;
 		} else {
 			if (index + length > size) {
 				length = size - index;
@@ -449,8 +446,6 @@ async function getXMLHttpRequestData(httpReader) {
 async function getRequestData(httpReader, sendRequest) {
 	const response = await sendRequest(HTTP_METHOD_GET, httpReader, getHeaders(httpReader));
 	httpReader.data = new Uint8Array(await response.arrayBuffer());
-	// the downloaded content is authoritative, e.g. the Content-Length response header
-	// of the HEAD request can be the encoded size when the content is compressed
 	httpReader.size = httpReader.data.length;
 }
 
@@ -515,7 +510,6 @@ class HttpReader extends Reader {
 		super();
 		Object.assign(this, {
 			url,
-			// an explicit fetch implementation takes precedence over useXHR
 			reader: options.useXHR && !options.fetch ? new XHRReader(url, options) : new FetchReader(url, options)
 		});
 	}
@@ -654,7 +648,7 @@ class SplitDataReader extends Reader {
 				}
 			}
 		} else {
-			result = new Uint8Array();
+			result = EMPTY_UINT8_ARRAY;
 		}
 		reader.lastDiskNumber = Math.max(currentDiskNumber, reader.lastDiskNumber);
 		return result;
@@ -699,8 +693,6 @@ class SplitDataWriter extends Stream {
 					writer.diskOffset += diskSourceWriter.size;
 					writer.diskNumber++;
 					diskWriter = null;
-					// the next disk is not opened yet but its space is available; leaving a
-					// stale value here would force a new disk for every subsequent write
 					writer.availableSize = writer.maxSize;
 					if (chunk.length > availableSize) {
 						await this.write(chunk.subarray(availableSize));

package/lib/core/streams/aes-crypto-stream.js

@@ -29,7 +29,7 @@
 /* global crypto, TransformStream */
 // deno-lint-ignore-file no-this-alias
 
-import { UNDEFINED_VALUE, UNDEFINED_TYPE, FUNCTION_TYPE } from "../constants.js";
+import { UNDEFINED_VALUE, UNDEFINED_TYPE, FUNCTION_TYPE, EMPTY_UINT8_ARRAY } from "../constants.js";
 import { encodeText } from "./../util/encode-text.js";
 import {
 	cipher,
@@ -73,12 +73,7 @@ class AESDecryptionStream extends TransformStream {
 	constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly }) {
 		super({
 			start() {
-				Object.assign(this, {
-					ready: new Promise(resolve => this.resolveReady = resolve),
-					password: encodePassword(password, rawPassword),
-					strength: encryptionStrength - 1,
-					pending: new Uint8Array()
-				});
+				initAesCrypto(this, password, rawPassword, encryptionStrength);
 			},
 			async transform(chunk, controller) {
 				const aesCrypto = this;
@@ -113,7 +108,7 @@ class AESDecryptionStream extends TransformStream {
 					await ready;
 					const chunkToDecrypt = subarray(pending, 0, pending.length - SIGNATURE_LENGTH);
 					const originalSignature = subarray(pending, pending.length - SIGNATURE_LENGTH);
-					let decryptedChunkArray = new Uint8Array();
+					let decryptedChunkArray = EMPTY_UINT8_ARRAY;
 					if (chunkToDecrypt.length) {
 						const encryptedChunk = toBits(codecBytes, chunkToDecrypt);
 						hmac.update(encryptedChunk);
@@ -121,8 +116,6 @@ class AESDecryptionStream extends TransformStream {
 						decryptedChunkArray = fromBits(codecBytes, decryptedChunk);
 					}
 					const signature = subarray(fromBits(codecBytes, hmac.digest()), 0, SIGNATURE_LENGTH);
-					// branch-free comparison: accumulate the differences instead of
-					// short-circuiting on the first mismatching byte
 					let invalidSignature = pending.length < SIGNATURE_LENGTH ? 1 : 0;
 					for (let indexSignature = 0; indexSignature < SIGNATURE_LENGTH; indexSignature++) {
 						invalidSignature |= signature[indexSignature] ^ originalSignature[indexSignature];
@@ -144,12 +137,7 @@ class AESEncryptionStream extends TransformStream {
 		let stream;
 		super({
 			start() {
-				Object.assign(this, {
-					ready: new Promise(resolve => this.resolveReady = resolve),
-					password: encodePassword(password, rawPassword),
-					strength: encryptionStrength - 1,
-					pending: new Uint8Array()
-				});
+				initAesCrypto(this, password, rawPassword, encryptionStrength);
 			},
 			async transform(chunk, controller) {
 				const aesCrypto = this;
@@ -159,7 +147,7 @@ class AESEncryptionStream extends TransformStream {
 					resolveReady,
 					ready
 				} = aesCrypto;
-				let preamble = new Uint8Array();
+				let preamble = EMPTY_UINT8_ARRAY;
 				if (password) {
 					preamble = await createEncryptionKeys(aesCrypto, strength, password);
 					resolveReady();
@@ -179,7 +167,7 @@ class AESEncryptionStream extends TransformStream {
 				} = this;
 				if (hmac && ctr) {
 					await ready;
-					let encryptedChunkArray = new Uint8Array();
+					let encryptedChunkArray = EMPTY_UINT8_ARRAY;
 					if (pending.length) {
 						const encryptedChunk = ctr.update(toBits(codecBytes, pending));
 						hmac.update(encryptedChunk);
@@ -196,10 +184,18 @@ class AESEncryptionStream extends TransformStream {
 
 export {
 	AESDecryptionStream,
-	AESEncryptionStream,
-	ERR_INVALID_PASSWORD
+	AESEncryptionStream
 };
 
+function initAesCrypto(aesCrypto, password, rawPassword, encryptionStrength) {
+	Object.assign(aesCrypto, {
+		ready: new Promise(resolve => aesCrypto.resolveReady = resolve),
+		password: encodePassword(password, rawPassword),
+		strength: encryptionStrength - 1,
+		pending: EMPTY_UINT8_ARRAY
+	});
+}
+
 function append(aesCrypto, input, output, paddingStart, paddingEnd, verifySignature) {
 	const {
 		ctr,

package/lib/core/streams/common-crypto.js

@@ -48,8 +48,6 @@ function getRandomValues(array) {
 	if (GET_RANDOM_VALUES_SUPPORTED) {
 		return crypto.getRandomValues(array);
 	} else {
-		// all supported runtimes expose crypto.getRandomValues; failing hard beats
-		// silently generating predictable encryption salts
 		throw new Error(ERR_UNSUPPORTED_CRYPTO_API);
 	}
 }

package/lib/core/streams/zip-crypto-stream.js

@@ -43,20 +43,13 @@ class ZipCryptoDecryptionStream extends TransformStream {
 	constructor({ password, rawPassword, passwordVerification, checkPasswordOnly }) {
 		super({
 			start() {
-				Object.assign(this, {
-					password,
-					rawPassword,
-					passwordVerification
-				});
-				createKeys(this, password, rawPassword);
+				initZipCrypto(this, password, rawPassword, passwordVerification);
 			},
 			transform(chunk, controller) {
 				const zipCrypto = this;
 				if (zipCrypto.password || zipCrypto.rawPassword) {
 					const decryptedHeader = decrypt(zipCrypto, chunk.subarray(0, HEADER_LENGTH));
 					zipCrypto.password = zipCrypto.rawPassword = null;
-					// verify the password with a branch-free comparison of the verification byte, mirroring
-					// the constant-time AES HMAC signature check
 					if ((decryptedHeader.at(-1) ^ zipCrypto.passwordVerification) != 0) {
 						throw new Error(ERR_INVALID_PASSWORD);
 					}
@@ -77,12 +70,7 @@ class ZipCryptoEncryptionStream extends TransformStream {
 	constructor({ password, rawPassword, passwordVerification }) {
 		super({
 			start() {
-				Object.assign(this, {
-					password,
-					rawPassword,
-					passwordVerification
-				});
-				createKeys(this, password, rawPassword);
+				initZipCrypto(this, password, rawPassword, passwordVerification);
 			},
 			transform(chunk, controller) {
 				const zipCrypto = this;
@@ -108,10 +96,18 @@ class ZipCryptoEncryptionStream extends TransformStream {
 
 export {
 	ZipCryptoDecryptionStream,
-	ZipCryptoEncryptionStream,
-	ERR_INVALID_PASSWORD
+	ZipCryptoEncryptionStream
 };
 
+function initZipCrypto(zipCrypto, password, rawPassword, passwordVerification) {
+	Object.assign(zipCrypto, {
+		password,
+		rawPassword,
+		passwordVerification
+	});
+	createKeys(zipCrypto, password, rawPassword);
+}
+
 function decrypt(target, input) {
 	const output = new Uint8Array(input.length);
 	for (let index = 0; index < input.length; index++) {

package/lib/core/streams/zip-entry-stream.js

@@ -60,14 +60,6 @@ class DeflateStream extends TransformStream {
 		const stream = this;
 		let crc32Stream, encryptionStream, gzipCrc32Stream;
 		let readable = super.readable;
-		// The gzip trailer carries a CRC-32 of the uncompressed data (same polynomial as zip),
-		// computed in native code for free during compression. On the native CompressionStream,
-		// harvest it instead of running a separate CRC pass: compress as gzip, then strip the
-		// fixed 10-byte header and 8-byte trailer to recover the exact raw-deflate payload
-		// (byte-identical to a deflate-raw compression) while capturing the CRC. The CRC becomes
-		// available at end-of-stream, exactly like Crc32Stream, so nothing downstream (data
-		// descriptor, central directory, ZipCrypto) needs it any earlier. Not applied for the
-		// pure-JS/WASM ports (a separate slice-by-8 CRC pass is as fast or faster there).
 		const useGzipCrc32 = signed && compressed && !deflate64 && (!encrypted || zipCrypto) &&
 			Boolean(useCompressionStream && CompressionStream);
 		if ((!encrypted || zipCrypto) && signed && !useGzipCrc32) {
@@ -104,12 +96,6 @@ class DeflateStream extends TransformStream {
 	}
 }
 
-// Converts a gzip stream into its raw-deflate payload while capturing the CRC-32 from the gzip
-// trailer. The CompressionStream gzip header is always the fixed 10-byte form (FLG=0, no optional
-// fields) per the Compression Streams spec, so it is stripped by length; the trailer is the last
-// 8 bytes (CRC-32 LE, then ISIZE LE). Bounded memory: at most GZIP_TRAILER_LENGTH bytes are held
-// back across chunks. The signature is read big-endian-agnostically as a number, matching the
-// value Crc32Stream produces, so the writer path is unchanged.
 class GzipToRawDeflateStream extends TransformStream {
 
 	constructor() {
@@ -135,10 +121,6 @@ class GzipToRawDeflateStream extends TransformStream {
 					tail = pending;
 					return;
 				}
-				// Emit everything except the trailing GZIP_TRAILER_LENGTH bytes as a standalone,
-				// right-sized Uint8Array. Consumers may read chunk.buffer directly (e.g. custom
-				// writers), so an aliased subarray of a larger buffer would leak the held-back
-				// trailer bytes. Bytes are copied exactly once, into `output` or `tail`.
 				const emitLength = available - GZIP_TRAILER_LENGTH;
 				const output = new Uint8Array(emitLength);
 				const fromTail = Math.min(emitLength, tail.length);
@@ -237,11 +219,6 @@ function pipeThroughCommpressionStream(readable, useCompressionStream, options,
 			throw error;
 		}
 	}
-	// The native CompressionStream/DecompressionStream and the pure-JS zlib port do not signal
-	// backpressure on their writable side (their `ready` never pends), so a plain pipeThrough drains
-	// the whole source into them and peak memory grows with the entry size. Awaiting each write()
-	// paces the source to the codec's consumption rate, keeping streaming memory bounded. The WASM
-	// codec already backpressures, so this is a no-op cost for it.
 	return pipeThroughBackpressured(readable, codecStream);
 }
 
@@ -249,10 +226,6 @@ function pipeThrough(readable, transformStream) {
 	return readable.pipeThrough(transformStream);
 }
 
-// Like readable.pipeThrough(transformStream), but drives the writable side manually and awaits each
-// write() so that a codec which under-reports backpressure cannot pull the whole source into memory.
-// Errors propagate in both directions: a source error aborts the codec; a downstream cancel/error
-// (surfaced through the codec's writable rejecting) cancels the source.
 function pipeThroughBackpressured(readable, transformStream) {
 	const writer = transformStream.writable.getWriter();
 	const reader = readable.getReader();
@@ -281,7 +254,7 @@ async function abort(writer, error) {
 	try {
 		await writer.abort(error);
 	} catch {
-		// the writable may already be errored/closed
+		// ignored: the writable may already be errored/closed
 	}
 }
 
@@ -289,13 +262,10 @@ async function cancel(reader, error) {
 	try {
 		await reader.cancel(error);
 	} catch {
-		// the readable may already be errored/closed
+		// ignored: the readable may already be errored/closed
 	}
 }
 
-// DecompressionStream implementations can fail with a message-less TypeError on malformed
-// input; give these errors an identifiable message (errors raised by the other stages of
-// the pipeline, e.g. ERR_INVALID_PASSWORD, always carry a message and pass through as-is)
 function mapInflateStreamError(readable) {
 	const reader = readable.getReader();
 	return new ReadableStream({