@zip.js/zip.js 2.8.49 → 2.8.50

package/dist/zip-core-external.js

@@ -108,6 +108,8 @@ const INFINITY_VALUE = Infinity;
 const UNDEFINED_TYPE = "undefined";
 const FUNCTION_TYPE = "function";
 const OBJECT_TYPE = "object";
+const STRING_TYPE = "string";
+const NUMBER_TYPE = "number";
 
 const EMPTY_UINT8_ARRAY = new Uint8Array();
 
@@ -273,7 +275,7 @@ function configureExternalAssets() {
 }
 
 /*
- Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+ Copyright (c) 2026 Gildas Lormeau. All rights reserved.
 
  Redistribution and use in source and binary forms, with or without
  modification, are permitted provided that the following conditions are met:
@@ -301,72 +303,19 @@ function configureExternalAssets() {
  */
 
 
-const ERR_INVALID_CODEC_DEFINITION = "Invalid codec definition";
-const ERR_RESERVED_COMPRESSION_METHOD = "Reserved compression method";
-const ERR_INVALID_CODEC_MODULE = "Invalid codec module";
-
-const STRING_TYPE = "string";
-const RESERVED_COMPRESSION_METHODS = [
-	COMPRESSION_METHOD_STORE,
-	COMPRESSION_METHOD_DEFLATE,
-	COMPRESSION_METHOD_DEFLATE_64,
-	COMPRESSION_METHOD_AES
-];
-
-const registeredCodecs = new Map();
-const codecStreams = new Map();
-
-function registerCodec(codec = {}) {
-	const { compressionMethod, format, codecURI, CompressionStream, DecompressionStream, versionNeeded } = codec;
-	if (!Number.isInteger(compressionMethod) || compressionMethod < 0 || compressionMethod > MAX_16_BITS ||
-		typeof format != STRING_TYPE || !format.length) {
-		throw new Error(ERR_INVALID_CODEC_DEFINITION);
-	}
-	if (RESERVED_COMPRESSION_METHODS.includes(compressionMethod)) {
-		throw new Error(ERR_RESERVED_COMPRESSION_METHOD);
-	}
-	const hasStreams = typeof CompressionStream == FUNCTION_TYPE || typeof DecompressionStream == FUNCTION_TYPE;
-	if (!hasStreams && (typeof codecURI != STRING_TYPE || !codecURI.length)) {
-		throw new Error(ERR_INVALID_CODEC_DEFINITION);
-	}
-	registeredCodecs.set(compressionMethod, { compressionMethod, format, codecURI, versionNeeded });
-	if (hasStreams) {
-		setCodecStreams(format, { CompressionStream, DecompressionStream });
-	}
-}
-
-function unregisterCodec(compressionMethod) {
-	const codec = registeredCodecs.get(compressionMethod);
-	if (codec) {
-		registeredCodecs.delete(compressionMethod);
-		let formatUsed;
-		registeredCodecs.forEach(otherCodec => formatUsed = formatUsed || otherCodec.format == codec.format);
-		if (!formatUsed) {
-			codecStreams.delete(codec.format);
-		}
-	}
-}
-
-function getRegisteredCodec(compressionMethod) {
-	return registeredCodecs.get(compressionMethod);
-}
-
-function getCodecStreams(format) {
-	return codecStreams.get(format);
+function concat(first, second) {
+	const result = new Uint8Array(first.length + second.length);
+	result.set(first);
+	result.set(second, first.length);
+	return result;
 }
 
-function setCodecStreams(format, streams) {
-	const { CompressionStream, DecompressionStream } = streams;
-	if (typeof CompressionStream != FUNCTION_TYPE && typeof DecompressionStream != FUNCTION_TYPE) {
-		throw new Error(ERR_INVALID_CODEC_MODULE);
-	}
-	codecStreams.set(format, { CompressionStream, DecompressionStream });
+function toExactUint8Array(array) {
+	return array.byteOffset || array.byteLength != array.buffer.byteLength ? new Uint8Array(array) : array;
 }
 
-async function ensureCodecStreams(format, codecURI) {
-	if (!codecStreams.has(format) && codecURI) {
-		setCodecStreams(format, await import(/* webpackIgnore: true */ /* @vite-ignore */ codecURI));
-	}
+function getDataView(array) {
+	return new DataView(array.buffer, array.byteOffset, array.byteLength);
 }
 
 /*
@@ -551,50 +500,6 @@ function encodeText(value) {
 	}
 }
 
-/*
- Copyright (c) 2026 Gildas Lormeau. All rights reserved.
-
- Redistribution and use in source and binary forms, with or without
- modification, are permitted provided that the following conditions are met:
-
- 1. Redistributions of source code must retain the above copyright notice,
- this list of conditions and the following disclaimer.
-
- 2. Redistributions in binary form must reproduce the above copyright
- notice, this list of conditions and the following disclaimer in
- the documentation and/or other materials provided with the distribution.
-
- 3. The names of the authors may not be used to endorse or promote products
- derived from this software without specific prior written permission.
-
- THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
- INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
- FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
- INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
- INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
- OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
- EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-function concat(first, second) {
-	const result = new Uint8Array(first.length + second.length);
-	result.set(first);
-	result.set(second, first.length);
-	return result;
-}
-
-function toExactUint8Array(array) {
-	return array.byteOffset || array.byteLength != array.buffer.byteLength ? new Uint8Array(array) : array;
-}
-
-function getDataView(array) {
-	return new DataView(array.buffer, array.byteOffset, array.byteLength);
-}
-
 // Derived from https://github.com/xqdoo00o/jszip/blob/master/lib/sjcl.js and https://github.com/bitwiseshiftleft/sjcl
 
 // deno-lint-ignore-file no-this-alias
@@ -1964,6 +1869,102 @@ function toCompatibleWritable(writable) {
 	});
 }
 
+/*
+ Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the distribution.
+
+ 3. The names of the authors may not be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
+ INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
+ INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+ OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+const ERR_INVALID_CODEC_DEFINITION = "Invalid codec definition";
+const ERR_RESERVED_COMPRESSION_METHOD = "Reserved compression method";
+const ERR_INVALID_CODEC_MODULE = "Invalid codec module";
+
+const RESERVED_COMPRESSION_METHODS = [
+	COMPRESSION_METHOD_STORE,
+	COMPRESSION_METHOD_DEFLATE,
+	COMPRESSION_METHOD_DEFLATE_64,
+	COMPRESSION_METHOD_AES
+];
+
+const registeredCodecs = new Map();
+const codecStreams = new Map();
+
+function registerCodec(codec = {}) {
+	const { compressionMethod, format, codecURI, CompressionStream, DecompressionStream, versionNeeded } = codec;
+	if (!Number.isInteger(compressionMethod) || compressionMethod < 0 || compressionMethod > MAX_16_BITS ||
+		typeof format != STRING_TYPE || !format.length) {
+		throw new Error(ERR_INVALID_CODEC_DEFINITION);
+	}
+	if (RESERVED_COMPRESSION_METHODS.includes(compressionMethod)) {
+		throw new Error(ERR_RESERVED_COMPRESSION_METHOD);
+	}
+	const hasStreams = typeof CompressionStream == FUNCTION_TYPE || typeof DecompressionStream == FUNCTION_TYPE;
+	if (!hasStreams && (typeof codecURI != STRING_TYPE || !codecURI.length)) {
+		throw new Error(ERR_INVALID_CODEC_DEFINITION);
+	}
+	registeredCodecs.set(compressionMethod, { compressionMethod, format, codecURI, versionNeeded });
+	if (hasStreams) {
+		setCodecStreams(format, { CompressionStream, DecompressionStream });
+	}
+}
+
+function unregisterCodec(compressionMethod) {
+	const codec = registeredCodecs.get(compressionMethod);
+	if (codec) {
+		registeredCodecs.delete(compressionMethod);
+		let formatUsed;
+		registeredCodecs.forEach(otherCodec => formatUsed = formatUsed || otherCodec.format == codec.format);
+		if (!formatUsed) {
+			codecStreams.delete(codec.format);
+		}
+	}
+}
+
+function getRegisteredCodec(compressionMethod) {
+	return registeredCodecs.get(compressionMethod);
+}
+
+function getCodecStreams(format) {
+	return codecStreams.get(format);
+}
+
+function setCodecStreams(format, streams) {
+	const { CompressionStream, DecompressionStream } = streams;
+	if (typeof CompressionStream != FUNCTION_TYPE && typeof DecompressionStream != FUNCTION_TYPE) {
+		throw new Error(ERR_INVALID_CODEC_MODULE);
+	}
+	codecStreams.set(format, { CompressionStream, DecompressionStream });
+}
+
+async function ensureCodecStreams(format, codecURI) {
+	if (!codecStreams.has(format) && codecURI) {
+		setCodecStreams(format, await import(/* webpackIgnore: true */ /* @vite-ignore */ codecURI));
+	}
+}
+
 /*
  Copyright (c) 2025 Gildas Lormeau. All rights reserved.
 
@@ -2517,8 +2518,8 @@ class ChunkStream extends TransformStream {
  1. Redistributions of source code must retain the above copyright notice,
  this list of conditions and the following disclaimer.
 
- 2. Redistributions in binary form must reproduce the above copyright 
- notice, this list of conditions and the following disclaimer in 
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
  the documentation and/or other materials provided with the distribution.
 
  3. The names of the authors may not be used to endorse or promote products
@@ -2537,24 +2538,19 @@ class ChunkStream extends TransformStream {
  */
 
 
-const MODULE_WORKER_OPTIONS = { type: "module" };
-const ERROR_EVENT_TYPE = "error";
-const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
 const ERR_WORKER_STARTUP_TIMEOUT = "Worker startup timeout";
 
-let webWorkerSupported, webWorkerSource, webWorkerURI, webWorkerOptions, createWorkerFailed;
-let transferStreamsSupported = true;
-try {
-	transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
-} catch {
-	// ignored
-}
+let webWorkerSupported, createWorkerFailed, webWorkerBackend;
 let initModule$1 = () => { };
 
 function configureWorker({ initModule: initModuleFunction }) {
 	initModule$1 = initModuleFunction;
 }
 
+function setWebWorkerBackend(backend) {
+	webWorkerBackend = backend;
+}
+
 async function supportsDeflate(config) {
 	const { CompressionStream: NativeStream, CompressionStreamFallback: FallbackStream } = config;
 	if (FallbackStream && !FallbackStream.requiresModule) {
@@ -2579,6 +2575,14 @@ function resetWebWorkerSupport() {
 	createWorkerFailed = false;
 }
 
+function disableWebWorker(workerData) {
+	if (workerData.createWorker) {
+		createWorkerFailed = true;
+	} else {
+		webWorkerSupported = false;
+	}
+}
+
 class CodecWorker {
 
 	constructor(workerData, { readable, writable }, { options, config, streamOptions, useWebWorkers, transferStreams, workerURI, createWorker }, onTaskFinished) {
@@ -2631,7 +2635,7 @@ class CodecWorker {
 			// deno-lint-ignore valid-typeof
 			webWorkerSupported = typeof Worker != UNDEFINED_TYPE;
 		}
-		return (useWebWorkers && ((webWorkerSupported && workerURI) || createWorker) ? createWebWorkerInterface : createWorkerInterface)(workerData, config);
+		return (useWebWorkers && webWorkerBackend && ((webWorkerSupported && workerURI) || createWorker) ? webWorkerBackend : createWorkerInterface)(workerData, config);
 	}
 }
 
@@ -2675,60 +2679,6 @@ function createWorkerInterface(workerData, config) {
 	};
 }
 
-function createWebWorkerInterface(workerData, config) {
-	const { baseURI, chunkSize, workerStartupTimeout } = config;
-	let { wasmURI } = config;
-
-	if (!workerData.interface) {
-		// deno-lint-ignore valid-typeof
-		if (typeof wasmURI == FUNCTION_TYPE) {
-			wasmURI = wasmURI();
-		}
-		let worker;
-		try {
-			worker = getWebWorker(workerData.workerURI, baseURI, workerData);
-		} catch {
-			if (workerData.createWorker) {
-				createWorkerFailed = true;
-			} else {
-				webWorkerSupported = false;
-			}
-			return createWorkerInterface(workerData, config);
-		}
-		Object.assign(workerData, {
-			worker,
-			workerAlive: false,
-			terminated: false,
-			interface: {
-				run: async () => {
-					try {
-						return await runWebWorker(workerData, { chunkSize, wasmURI, baseURI, workerStartupTimeout });
-					} catch (error) {
-						if (error && error.workerStartupFailed) {
-							if (workerData.createWorker) {
-								createWorkerFailed = true;
-							} else {
-								webWorkerSupported = false;
-							}
-							releaseWorkerStreams(workerData);
-							return runWorker$1(workerData, config);
-						}
-						if (error && error.codecImportFailed) {
-							if (workerData.reader) {
-								releaseWorkerStreams(workerData);
-								return runWorker$1(workerData, config);
-							}
-							workerData.onTaskFinished();
-						}
-						throw error;
-					}
-				}
-			}
-		});
-	}
-	return workerData.interface;
-}
-
 async function runWorker$1({ options, readable, writable, onTaskFinished }, config) {
 	let codecStream;
 	try {
@@ -2777,6 +2727,95 @@ async function runWorker$1({ options, readable, writable, onTaskFinished }, conf
 	}
 }
 
+/*
+ Copyright (c) 2025 Gildas Lormeau. All rights reserved.
+
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions are met:
+
+ 1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+ 2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the distribution.
+
+ 3. The names of the authors may not be used to endorse or promote products
+ derived from this software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED ''AS IS'' AND ANY EXPRESSED OR IMPLIED WARRANTIES,
+ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JCRAFT,
+ INC. OR ANY CONTRIBUTORS TO THIS SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT,
+ INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
+ OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+const MODULE_WORKER_OPTIONS = { type: "module" };
+const ERROR_EVENT_TYPE = "error";
+const MESSAGE_ERROR_EVENT_TYPE = "messageerror";
+
+let webWorkerSource, webWorkerURI, webWorkerOptions;
+let transferStreamsSupported = true;
+try {
+	transferStreamsSupported = typeof structuredClone == FUNCTION_TYPE && structuredClone(new DOMException("", "AbortError")).code !== UNDEFINED_VALUE;
+} catch {
+	// ignored
+}
+
+setWebWorkerBackend(createWebWorkerInterface);
+
+function createWebWorkerInterface(workerData, config) {
+	const { baseURI, chunkSize, workerStartupTimeout } = config;
+	let { wasmURI } = config;
+
+	if (!workerData.interface) {
+		// deno-lint-ignore valid-typeof
+		if (typeof wasmURI == FUNCTION_TYPE) {
+			wasmURI = wasmURI();
+		}
+		let worker;
+		try {
+			worker = getWebWorker(workerData.workerURI, baseURI, workerData);
+		} catch {
+			disableWebWorker(workerData);
+			return createWorkerInterface(workerData, config);
+		}
+		Object.assign(workerData, {
+			worker,
+			workerAlive: false,
+			terminated: false,
+			interface: {
+				run: async () => {
+					try {
+						return await runWebWorker(workerData, { chunkSize, wasmURI, baseURI, workerStartupTimeout });
+					} catch (error) {
+						if (error && error.workerStartupFailed) {
+							disableWebWorker(workerData);
+							releaseWorkerStreams(workerData);
+							return runWorker$1(workerData, config);
+						}
+						if (error && error.codecImportFailed) {
+							if (workerData.reader) {
+								releaseWorkerStreams(workerData);
+								return runWorker$1(workerData, config);
+							}
+							workerData.onTaskFinished();
+						}
+						throw error;
+					}
+				}
+			}
+		});
+	}
+	return workerData.interface;
+}
+
 async function runWebWorker(workerData, config) {
 	let resolveResult, rejectResult;
 	const result = new Promise((resolve, reject) => {
@@ -3653,7 +3692,7 @@ async function initHttpReader(httpReader, sendRequest, getRequestData) {
 		forceRangeRequests,
 		combineSizeEocd
 	} = httpReader;
-	if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == "undefined" || preventHeadRequest)) {
+	if (isHttpFamily(url) && (useRangeHeader || forceRangeRequests) && (typeof preventHeadRequest == UNDEFINED_TYPE || preventHeadRequest)) {
 		const response = await sendRequest(HTTP_METHOD_GET, httpReader, getRangeHeaders(httpReader, combineSizeEocd ? -END_OF_CENTRAL_DIR_LENGTH : undefined));
 		const acceptRanges = response.headers.get(HTTP_HEADER_ACCEPT_RANGES);
 		if (!forceRangeRequests && (!acceptRanges || acceptRanges.toLowerCase() != HTTP_RANGE_UNIT)) {
@@ -4506,9 +4545,13 @@ const OPTION_USDZ = "usdz";
 const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
 const OPTION_LOCAL_EXTRA_FIELD = "localExtraField";
 const OPTION_STRICTNESS = "strictness";
+const OPTION_FILENAME_VALIDATION = "filenameValidation";
+const OPTION_NORMALIZE_FILENAME = "normalizeFilename";
 const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
 const OPTION_DECRYPT_CENTRAL_DIRECTORY = "decryptCentralDirectory";
 const OPTION_SIGN_CENTRAL_DIRECTORY = "signCentralDirectory";
+const TEXT_TYPE_FILENAME = "filename";
+const TEXT_TYPE_COMMENT = "comment";
 const STRICTNESS_STRICT = "strict";
 const STRICTNESS_BALANCED = "balanced";
 const STRICTNESS_TOLERANT = "tolerant";
@@ -4555,6 +4598,11 @@ const ERR_SPLIT_ZIP_FILE = "Split zip file";
 const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
 const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
+const ERR_UNSAFE_FILENAME = "Unsafe filename";
+const ERR_INVALID_STRICTNESS = "Invalid strictness (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_FILENAME_VALIDATION = "Invalid filenameValidation (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_MAX_APPENDED_DATA_SIZE = "Invalid maxAppendedDataSize (must be a number greater than or equal to 0)";
+const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
@@ -4576,6 +4624,10 @@ const ZIP64_EXTRACTION = {
 		bytes: 8
 	}
 };
+const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+const CENTRAL_DIRECTORY_REACHABLE = 2;
 
 class ZipReader {
 
@@ -4604,6 +4656,8 @@ class ZipReader {
 		const checkAmbiguity = strictness == STRICTNESS_STRICT;
 		const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
 		const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue$1(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+		const filenameValidation = getFilenameValidation(getOptionValue$1(zipReader, options, OPTION_FILENAME_VALIDATION), strictness);
+		const normalizeFilename = getOptionValue$1(zipReader, options, OPTION_NORMALIZE_FILENAME);
 		const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 		if (!endOfDirectoryInfo) {
 			const signatureArray = await readUint8Array(reader, 0, 4);
@@ -4797,11 +4851,22 @@ class ZipReader {
 			const decode = getOptionValue$1(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 			const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 			const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
-			let filename = decode(rawFilename, rawFilenameEncoding);
+			let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
 			if (filename === UNDEFINED_VALUE) {
 				filename = decodeText(rawFilename, rawFilenameEncoding);
 			}
-			let comment = decode(rawComment, rawCommentEncoding);
+			if (normalizeFilename) {
+				const normalizedFilename = normalizeFilename(filename);
+				if (normalizedFilename !== UNDEFINED_VALUE) {
+					filename = normalizedFilename;
+				}
+			}
+			if (isUnsafeFilename(filename, filenameValidation)) {
+				const error = new Error(ERR_UNSAFE_FILENAME);
+				error.filename = filename;
+				throw error;
+			}
+			let comment = decode(rawComment, rawCommentEncoding, TEXT_TYPE_COMMENT);
 			if (comment === UNDEFINED_VALUE) {
 				comment = decodeText(rawComment, rawCommentEncoding);
 			}
@@ -4862,10 +4927,10 @@ class ZipReader {
 			entry.getData = (writer, options) => fileEntry.getData(writer, entry, zipReader.readRanges, options);
 			entry.arrayBuffer = async options => {
 				const writer = new TransformStream();
-				const [arrayBuffer] = await Promise.all([
-					streamToBlob(writer.readable).then(blob => blob.arrayBuffer()),
-					fileEntry.getData(writer, entry, zipReader.readRanges, options)]);
-				return arrayBuffer;
+				const arrayBufferPromise = streamToBlob(writer.readable).then(blob => blob.arrayBuffer());
+				arrayBufferPromise.catch(() => { });
+				await fileEntry.getData(writer, entry, zipReader.readRanges, options);
+				return arrayBufferPromise;
 			};
 			offset = endOffset;
 			const { onprogress } = options;
@@ -5116,7 +5181,7 @@ class ZipEntry {
 				readRanges
 			});
 		}
-		let writable;
+		let writable, abortError;
 		try {
 			if (!checkOverlappingEntryOnly) {
 				if (checkPasswordOnly) {
@@ -5136,12 +5201,22 @@ class ZipEntry {
 				writer.size += error.outputSize;
 			}
 			if (!checkPasswordOnly || error.message != ERR_ABORT_CHECK_PASSWORD) {
+				abortError = error;
 				throw error;
 			}
 		} finally {
 			const preventClose = getOptionValue$1(zipEntry, options, OPTION_PREVENT_CLOSE);
 			if (!preventClose && writable && !writable.locked) {
-				await writable.getWriter().close();
+				const writableWriter = writable.getWriter();
+				if (abortError) {
+					try {
+						await writableWriter.abort(abortError);
+					} catch {
+						// the error being propagated is more relevant; ignored
+					}
+				} else {
+					await writableWriter.close();
+				}
 			}
 		}
 		return checkPasswordOnly || checkOverlappingEntryOnly ? UNDEFINED_VALUE : writer.getData ? writer.getData() : writable;
@@ -5521,16 +5596,51 @@ function getDiskOffset$1(reader, diskNumber) {
 	return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 }
 
+function isStrictnessValue(value) {
+	return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
+}
+
 function getStrictness(strictness, checkAmbiguity) {
 	if (strictness === UNDEFINED_VALUE) {
 		return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
 	}
+	if (!isStrictnessValue(strictness)) {
+		throw new Error(ERR_INVALID_STRICTNESS);
+	}
 	return strictness;
 }
 
+function getFilenameValidation(filenameValidation, strictness) {
+	if (filenameValidation === UNDEFINED_VALUE) {
+		return strictness;
+	}
+	if (!isStrictnessValue(filenameValidation)) {
+		throw new Error(ERR_INVALID_FILENAME_VALIDATION);
+	}
+	return filenameValidation;
+}
+
+function isUnsafeFilename(filename, filenameValidation) {
+	if (filenameValidation == STRICTNESS_TOLERANT) {
+		return false;
+	}
+	const pathParts = filename.split("/");
+	if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
+		pathParts.pop();
+	}
+	if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+		return true;
+	}
+	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+}
+
 function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	if (maxAppendedDataSize !== UNDEFINED_VALUE) {
-		return maxAppendedDataSize;
+		const size = toNumber$1(maxAppendedDataSize);
+		if (typeof size != NUMBER_TYPE || Number.isNaN(size) || size < 0) {
+			throw new Error(ERR_INVALID_MAX_APPENDED_DATA_SIZE);
+		}
+		return size;
 	}
 	if (strictness == STRICTNESS_STRICT) {
 		return 0;
@@ -5541,12 +5651,6 @@ function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	return MAX_16_BITS;
 }
 
-const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
-
-const CENTRAL_DIRECTORY_UNREACHABLE = 0;
-const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
-const CENTRAL_DIRECTORY_REACHABLE = 2;
-
 async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 	const { size } = reader;
 	const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
@@ -5682,6 +5786,10 @@ function getOptionValue$1(zipReader, options, name) {
 	return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 }
 
+function toNumber$1(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getDate(timeRaw) {
 	const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 	return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
@@ -5720,12 +5828,16 @@ var zipReader = /*#__PURE__*/Object.freeze({
 	ERR_INVALID_AUTHENTICATION_CODE: ERR_INVALID_AUTHENTICATION_CODE,
 	ERR_INVALID_COMPRESSED_DATA: ERR_INVALID_COMPRESSED_DATA,
 	ERR_INVALID_CRC32: ERR_INVALID_CRC32,
+	ERR_INVALID_FILENAME_VALIDATION: ERR_INVALID_FILENAME_VALIDATION,
+	ERR_INVALID_MAX_APPENDED_DATA_SIZE: ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 	ERR_INVALID_PASSWORD: ERR_INVALID_PASSWORD,
 	ERR_INVALID_SIGNATURE: ERR_INVALID_SIGNATURE,
+	ERR_INVALID_STRICTNESS: ERR_INVALID_STRICTNESS,
 	ERR_INVALID_UNCOMPRESSED_SIZE: ERR_INVALID_UNCOMPRESSED_SIZE,
 	ERR_LOCAL_FILE_HEADER_NOT_FOUND: ERR_LOCAL_FILE_HEADER_NOT_FOUND,
 	ERR_OVERLAPPING_ENTRY: ERR_OVERLAPPING_ENTRY,
 	ERR_SPLIT_ZIP_FILE: ERR_SPLIT_ZIP_FILE,
+	ERR_UNSAFE_FILENAME: ERR_UNSAFE_FILENAME,
 	ERR_UNSUPPORTED_COMPRESSION: ERR_UNSUPPORTED_COMPRESSION$1,
 	ERR_UNSUPPORTED_ENCRYPTION: ERR_UNSUPPORTED_ENCRYPTION,
 	ERR_WORKER_STARTUP_TIMEOUT: ERR_WORKER_STARTUP_TIMEOUT,
@@ -5787,6 +5899,8 @@ const ERR_INVALID_UNIX_EXTRA_FIELD_TYPE = "Invalid unixExtraFieldType (must be '
 const ERR_INVALID_UNIX_ID_SIZE = "uid/gid must be 0..65535 for unixExtraFieldType 'unix' (use 'infozip' for larger ids)";
 const ERR_INVALID_MSDOS_ATTRIBUTES = "Invalid msdosAttributesRaw (must be integer 0..255)";
 const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
+const ERR_INVALID_LEVEL = "Invalid level (must be integer 0..9)";
+const ERR_INVALID_PASSWORD_TYPE = "Invalid password (password must be a string, rawPassword must be a Uint8Array)";
 const ERR_INVALID_SIGNATURE_DATA = "Signature data exceeds 64KB";
 
 const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
@@ -5794,6 +5908,7 @@ const EXTRAFIELD_OFFSET_AES_VENDOR_VERSION = 4;
 const VENDOR_VERSION_AE_1 = 1;
 const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 const UNIX_EXTRA_FIELD_TYPE = "unix";
+const MAX_LEVEL = 9;
 
 let workers = 0;
 const pendingEntries = [];
@@ -5956,7 +6071,8 @@ class ZipWriter {
 
 	remove(entry) {
 		const { filenames, files } = this;
-		if (typeof entry == "string") {
+		// deno-lint-ignore valid-typeof
+		if (typeof entry == STRING_TYPE) {
 			entry = files.get(entry);
 		}
 		if (entry && entry.filename !== UNDEFINED_VALUE) {
@@ -6094,20 +6210,20 @@ function resolveAttributes(zipWriter, name, options) {
 	let msDosCompatible = getOptionValue(zipWriter, options, PROPERTY_NAME_MS_DOS_COMPATIBLE);
 	let versionMadeBy = getOptionValue(zipWriter, options, PROPERTY_NAME_VERSION_MADE_BY, msDosCompatible ? 20 : 768);
 	const executable = getOptionValue(zipWriter, options, PROPERTY_NAME_EXECUTABLE);
-	const uid = getOptionValue(zipWriter, options, PROPERTY_NAME_UID);
-	const gid = getOptionValue(zipWriter, options, PROPERTY_NAME_GID);
-	let unixMode = getOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
+	const uid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UID);
+	const gid = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_GID);
+	let unixMode = getNumberOptionValue(zipWriter, options, PROPERTY_NAME_UNIX_MODE);
 	let unixExtraFieldType = getOptionValue(zipWriter, options, OPTION_UNIX_EXTRA_FIELD_TYPE);
 	let setuid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETUID);
 	let setgid = getOptionValue(zipWriter, options, PROPERTY_NAME_SETGID);
 	let sticky = getOptionValue(zipWriter, options, PROPERTY_NAME_STICKY);
-	if (uid !== UNDEFINED_VALUE && (uid < 0 || uid > MAX_32_BITS)) {
+	if (uid !== UNDEFINED_VALUE && (!Number.isInteger(uid) || uid < 0 || uid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_UID);
 	}
-	if (gid !== UNDEFINED_VALUE && (gid < 0 || gid > MAX_32_BITS)) {
+	if (gid !== UNDEFINED_VALUE && (!Number.isInteger(gid) || gid < 0 || gid > MAX_32_BITS)) {
 		throw new Error(ERR_INVALID_GID);
 	}
-	if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
+	if (unixMode !== UNDEFINED_VALUE && (!Number.isInteger(unixMode) || unixMode < 0 || unixMode > MAX_16_BITS)) {
 		throw new Error(ERR_INVALID_UNIX_MODE);
 	}
 	if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
@@ -6219,7 +6335,7 @@ function resolveAttributes(zipWriter, name, options) {
 
 function resolveMetadata(zipWriter, name, options) {
 	const encode = getOptionValue(zipWriter, options, OPTION_ENCODE_TEXT, encodeText);
-	let rawFilename = encode(name);
+	let rawFilename = encode(name, TEXT_TYPE_FILENAME);
 	if (rawFilename === UNDEFINED_VALUE) {
 		rawFilename = encodeText(name);
 	}
@@ -6227,7 +6343,7 @@ function resolveMetadata(zipWriter, name, options) {
 		throw new Error(ERR_INVALID_ENTRY_NAME);
 	}
 	const comment = options[PROPERTY_NAME_COMMENT] || "";
-	let rawComment = encode(comment);
+	let rawComment = encode(comment, TEXT_TYPE_COMMENT);
 	if (rawComment === UNDEFINED_VALUE) {
 		rawComment = encodeText(comment);
 	}
@@ -6247,8 +6363,11 @@ function resolveMetadata(zipWriter, name, options) {
 	if (!passThrough) {
 		password = getOptionValue(zipWriter, options, OPTION_PASSWORD);
 		rawPassword = getOptionValue(zipWriter, options, OPTION_RAW_PASSWORD);
+		if ((password && typeof password != STRING_TYPE) || (rawPassword && !(rawPassword instanceof Uint8Array))) {
+			throw new Error(ERR_INVALID_PASSWORD_TYPE);
+		}
 	}
-	const encryptionStrength = getOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
+	const encryptionStrength = getNumberOptionValue(zipWriter, options, OPTION_ENCRYPTION_STRENGTH, 3);
 	const zipCrypto = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIPCRYPTO);
 	const extendedTimestamp = getOptionValue(zipWriter, options, OPTION_EXTENDED_TIMESTAMP, true);
 	const ntfsTimestamp = getOptionValue(zipWriter, options, OPTION_NTFS_TIMESTAMP);
@@ -6266,7 +6385,10 @@ function resolveMetadata(zipWriter, name, options) {
 		compressionMethod !== COMPRESSION_METHOD_STORE && compressionMethod !== COMPRESSION_METHOD_DEFLATE && !registeredCodec) {
 		throw new Error(ERR_UNSUPPORTED_COMPRESSION);
 	}
-	let level = getOptionValue(zipWriter, options, OPTION_LEVEL);
+	let level = getNumberOptionValue(zipWriter, options, OPTION_LEVEL);
+	if (level !== UNDEFINED_VALUE && (!Number.isInteger(level) || level < 0 || level > MAX_LEVEL)) {
+		throw new Error(ERR_INVALID_LEVEL);
+	}
 	if (zipWriter.options[OPTION_USDZ]) {
 		if (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) {
 			throw new Error(ERR_UNSUPPORTED_ENCRYPTION_USDZ);
@@ -6287,7 +6409,7 @@ function resolveMetadata(zipWriter, name, options) {
 		useCompressionStream = false;
 	}
 	const zip64 = getOptionValue(zipWriter, options, PROPERTY_NAME_ZIP64);
-	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
+	if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(Number.isInteger(encryptionStrength) && encryptionStrength >= 1 && encryptionStrength <= 3)) {
 		throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 	}
 	const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
@@ -7481,6 +7603,14 @@ function getOptionValue(zipWriter, options, name, defaultValue) {
 	return result === UNDEFINED_VALUE ? defaultValue : result;
 }
 
+function getNumberOptionValue(zipWriter, options, name, defaultValue) {
+	return toNumber(getOptionValue(zipWriter, options, name, defaultValue));
+}
+
+function toNumber(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getMaximumCompressedSize(uncompressedSize) {
 	return uncompressedSize + (5 * (Math.floor(uncompressedSize / 16383) + 1));
 }
@@ -8439,4 +8569,4 @@ function terminateWorkersAndModule() {
 
 configureExternalAssets();
 
-export { BlobReader, BlobWriter, Data64URIReader, Data64URIWriter, ERR_AMBIGUOUS_ARCHIVE, ERR_BAD_FORMAT, ERR_CENTRAL_DIRECTORY_NOT_FOUND, ERR_DUPLICATED_NAME, ERR_ENCRYPTED, ERR_ENCRYPTED_CENTRAL_DIRECTORY, ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND, ERR_EOCDR_NOT_FOUND, ERR_EXTRAFIELD_ZIP64_NOT_FOUND, ERR_HTTP_RANGE, ERR_HTTP_RESOURCE_CHANGED, ERR_INVALID_AUTHENTICATION_CODE, ERR_INVALID_CODEC_DEFINITION, ERR_INVALID_CODEC_MODULE, ERR_INVALID_COMMENT, ERR_INVALID_COMPRESSED_DATA, ERR_INVALID_CRC32, ERR_INVALID_ENCRYPTION_STRENGTH, ERR_INVALID_ENTRY_COMMENT, ERR_INVALID_ENTRY_NAME, ERR_INVALID_EXTRAFIELD_DATA, ERR_INVALID_EXTRAFIELD_TYPE, ERR_INVALID_GID, ERR_INVALID_MSDOS_ATTRIBUTES, ERR_INVALID_MSDOS_DATA, ERR_INVALID_PASSWORD, ERR_INVALID_SIGNATURE, ERR_INVALID_SIGNATURE_DATA, ERR_INVALID_UID, ERR_INVALID_UNCOMPRESSED_SIZE, ERR_INVALID_UNIX_EXTRA_FIELD_TYPE, ERR_INVALID_UNIX_ID_SIZE, ERR_INVALID_UNIX_MODE, ERR_INVALID_VERSION, ERR_ITERATOR_COMPLETED_TOO_SOON, ERR_LOCAL_FILE_HEADER_NOT_FOUND, ERR_OVERLAPPING_ENTRY, ERR_RESERVED_COMPRESSION_METHOD, ERR_SPLIT_ZIP_FILE, ERR_UNDEFINED_READER, ERR_UNDEFINED_UNCOMPRESSED_SIZE, ERR_UNSUPPORTED_COMPRESSION$1 as ERR_UNSUPPORTED_COMPRESSION, ERR_UNSUPPORTED_CONTEXT, ERR_UNSUPPORTED_CRYPTO_API, ERR_UNSUPPORTED_ENCRYPTION, ERR_UNSUPPORTED_ENCRYPTION_USDZ, ERR_UNSUPPORTED_FORMAT, ERR_WORKER_STARTUP_TIMEOUT, ERR_WRITER_NOT_INITIALIZED, ERR_ZIP_NOT_EMPTY, HttpRangeReader, HttpReader, Reader, SplitDataReader, SplitDataWriter, TextReader, TextWriter, Uint8ArrayReader, Uint8ArrayWriter, Writer, ZipReader, ZipReaderStream, ZipWriter, ZipWriterStream, configure, createBlobTempStream, createOPFSTempStream, createSyncAccessHandleTempStream, getMimeType, registerCodec, resetConfiguration, terminateWorkersAndModule as terminateWorkers, unregisterCodec };
+export { BlobReader, BlobWriter, Data64URIReader, Data64URIWriter, ERR_AMBIGUOUS_ARCHIVE, ERR_BAD_FORMAT, ERR_CENTRAL_DIRECTORY_NOT_FOUND, ERR_DUPLICATED_NAME, ERR_ENCRYPTED, ERR_ENCRYPTED_CENTRAL_DIRECTORY, ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND, ERR_EOCDR_NOT_FOUND, ERR_EXTRAFIELD_ZIP64_NOT_FOUND, ERR_HTTP_RANGE, ERR_HTTP_RESOURCE_CHANGED, ERR_INVALID_AUTHENTICATION_CODE, ERR_INVALID_CODEC_DEFINITION, ERR_INVALID_CODEC_MODULE, ERR_INVALID_COMMENT, ERR_INVALID_COMPRESSED_DATA, ERR_INVALID_CRC32, ERR_INVALID_ENCRYPTION_STRENGTH, ERR_INVALID_ENTRY_COMMENT, ERR_INVALID_ENTRY_NAME, ERR_INVALID_EXTRAFIELD_DATA, ERR_INVALID_EXTRAFIELD_TYPE, ERR_INVALID_FILENAME_VALIDATION, ERR_INVALID_GID, ERR_INVALID_LEVEL, ERR_INVALID_MAX_APPENDED_DATA_SIZE, ERR_INVALID_MSDOS_ATTRIBUTES, ERR_INVALID_MSDOS_DATA, ERR_INVALID_PASSWORD, ERR_INVALID_PASSWORD_TYPE, ERR_INVALID_SIGNATURE, ERR_INVALID_SIGNATURE_DATA, ERR_INVALID_STRICTNESS, ERR_INVALID_UID, ERR_INVALID_UNCOMPRESSED_SIZE, ERR_INVALID_UNIX_EXTRA_FIELD_TYPE, ERR_INVALID_UNIX_ID_SIZE, ERR_INVALID_UNIX_MODE, ERR_INVALID_VERSION, ERR_ITERATOR_COMPLETED_TOO_SOON, ERR_LOCAL_FILE_HEADER_NOT_FOUND, ERR_OVERLAPPING_ENTRY, ERR_RESERVED_COMPRESSION_METHOD, ERR_SPLIT_ZIP_FILE, ERR_UNDEFINED_READER, ERR_UNDEFINED_UNCOMPRESSED_SIZE, ERR_UNSAFE_FILENAME, ERR_UNSUPPORTED_COMPRESSION$1 as ERR_UNSUPPORTED_COMPRESSION, ERR_UNSUPPORTED_CONTEXT, ERR_UNSUPPORTED_CRYPTO_API, ERR_UNSUPPORTED_ENCRYPTION, ERR_UNSUPPORTED_ENCRYPTION_USDZ, ERR_UNSUPPORTED_FORMAT, ERR_WORKER_STARTUP_TIMEOUT, ERR_WRITER_NOT_INITIALIZED, ERR_ZIP_NOT_EMPTY, HttpRangeReader, HttpReader, Reader, SplitDataReader, SplitDataWriter, TextReader, TextWriter, Uint8ArrayReader, Uint8ArrayWriter, Writer, ZipReader, ZipReaderStream, ZipWriter, ZipWriterStream, configure, createBlobTempStream, createOPFSTempStream, createSyncAccessHandleTempStream, getMimeType, registerCodec, resetConfiguration, terminateWorkersAndModule as terminateWorkers, unregisterCodec };