@zip.js/zip.js 2.8.49 → 2.8.51

package/lib/core/zip-fs.js

@@ -26,7 +26,7 @@
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-/* global WritableStream */
+/* global WritableStream, AbortController, DOMException */
 // deno-lint-ignore-file no-this-alias
 
 import {
@@ -71,6 +71,9 @@ import { toCompatibleReadable, toCompatibleWritable } from "./util/compatible-st
 
 const ERR_ENTRY_EXISTS = "Entry filename already exists";
 const ERR_READABLE_CONSUMED = "Readable stream already consumed";
+const ERR_ABORT_EXPORT = "zipjs-abort-export";
+const ERR_ABORTED = "The operation was aborted";
+const ABORT_ERROR_NAME = "AbortError";
 const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
 const INTERPRETED_EXTRA_FIELD_TYPES = new Set([
 	EXTRAFIELD_TYPE_ZIP64,
@@ -179,8 +182,9 @@ class ZipFileEntry extends ZipEntry {
 			const uncompressedSize = zipEntry.data ? zipEntry.data.uncompressedSize : reader.size;
 			await Promise.all([initStream(reader), initStream(writer, uncompressedSize)]);
 			const { readable } = reader;
+			const { signal } = options;
 			zipEntry.uncompressedSize = reader.size;
-			await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable));
+			await toCompatibleReadable(readable).pipeTo(toCompatibleWritable(writer.writable), { signal });
 			return writer.getData ? writer.getData() : writer.writable;
 		}
 	}
@@ -447,7 +451,7 @@ class ZipDirectoryEntry extends ZipEntry {
 		for (const entry of entries) {
 			let parent = this;
 			try {
-				const path = entry.filename.split("/");
+				const path = entry.filename.split("/").filter(pathPart => pathPart != "" && pathPart != ".");
 				const name = path.pop();
 				path.forEach(pathPart => {
 					const previousParent = parent;
@@ -522,6 +526,10 @@ class ZipDirectoryEntry extends ZipEntry {
 		}
 	}
 
+	getChildren(options = {}) {
+		return collectChildren(this, options.recursive);
+	}
+
 	isPasswordProtected() {
 		const children = this.children;
 		for (let childIndex = 0; childIndex < children.length; childIndex++) {
@@ -613,6 +621,10 @@ class FS {
 		return this.root.getChildByName(name);
 	}
 
+	getChildren(options) {
+		return this.root.getChildren(options);
+	}
+
 	addDirectory(name, options) {
 		return this.root.addDirectory(name, options);
 	}
@@ -721,7 +733,7 @@ class FS {
 }
 
 const fs = { FS, ZipDirectoryEntry, ZipFileEntry };
-export { fs, ERR_ENTRY_EXISTS, ERR_READABLE_CONSUMED };
+export { fs, ERR_ENTRY_EXISTS, ERR_READABLE_CONSUMED, ERR_ABORTED };
 
 function getTotalSize(entries, propertyName) {
 	let size = 0;
@@ -823,6 +835,39 @@ function detach(entry) {
 	}
 }
 
+function forwardAbort(signal, abortController) {
+	if (!signal) {
+		return () => { };
+	}
+	if (signal.aborted) {
+		abortController.abort(signal.reason);
+		return () => { };
+	}
+	const abort = () => abortController.abort(signal.reason);
+	signal.addEventListener("abort", abort, { once: true });
+	return () => signal.removeEventListener("abort", abort);
+}
+
+function isExportAborted(error) {
+	return Boolean(error) && error.message == ERR_ABORT_EXPORT;
+}
+
+function aggregateEntryErrors(errors) {
+	const [error] = errors;
+	const otherErrors = errors
+		.slice(1)
+		.flatMap(otherError => [otherError, ...(otherError && otherError.entryErrors || [])])
+		.filter(otherError => otherError !== error);
+	if (otherErrors.length) {
+		try {
+			error.entryErrors = [...(error.entryErrors || []), ...otherErrors];
+		} catch {
+			// ignored
+		}
+	}
+	return error;
+}
+
 function getUserExtraField(extraField) {
 	if (extraField) {
 		const userExtraField = new Map();
@@ -840,111 +885,110 @@ function getUserExtraField(extraField) {
 async function exportZip(zipWriter, entry, totalSize, options, readers) {
 	const selectedEntry = entry;
 	const entryOffsets = new Map();
-	await process(zipWriter, entry);
+	if (options.bufferedWrite) {
+		await processChildren(entry);
+	} else {
+		for (const child of entry.getChildren({ recursive: true })) {
+			await addChild(child);
+		}
+	}
 
-	async function process(zipWriter, entry) {
-		await exportChild();
+	async function processChildren(entry) {
+		const results = await Promise.allSettled(entry.children.map(async child => {
+			await addChild(child);
+			await processChildren(child);
+		}));
+		const errorResult = results.find(result => result.status == "rejected");
+		if (errorResult) {
+			throw errorResult.reason;
+		}
+	}
 
-		async function exportChild() {
-			if (options.bufferedWrite) {
-				const results = await Promise.allSettled(entry.children.map(processChild));
-				const errorResult = results.find(result => result.status == "rejected");
-				if (errorResult) {
-					throw errorResult.reason;
+	async function addChild(child) {
+		const name = options.relativePath ? child.getRelativeName(selectedEntry) : child.getFullname();
+		const childOptions = child.options || {};
+		let zipEntryOptions = {};
+		if (child.data instanceof Entry) {
+			const {
+				externalFileAttributes,
+				versionMadeBy,
+				comment,
+				lastModDate,
+				creationDate,
+				lastAccessDate,
+				uncompressedSize,
+				encrypted,
+				zipCrypto,
+				crc32,
+				compressionMethod,
+				extraFieldAES,
+				internalFileAttributes,
+				extraField,
+				uid,
+				gid
+			} = child.data;
+			zipEntryOptions = {
+				externalFileAttributes,
+				versionMadeBy,
+				comment,
+				lastModDate,
+				creationDate,
+				lastAccessDate,
+				internalFileAttributes
+			};
+			const userExtraField = getUserExtraField(extraField);
+			if (userExtraField) {
+				zipEntryOptions.extraField = userExtraField;
+			}
+			if (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE) {
+				Object.assign(zipEntryOptions, {
+					uid,
+					gid,
+					unixExtraFieldType: options.unixExtraFieldType || INFOZIP_EXTRA_FIELD_TYPE
+				});
+			}
+			if (child.passThrough) {
+				let level, encryptionStrength;
+				if (compressionMethod === 0) {
+					level = 0;
 				}
-			} else {
-				for (const child of entry.children) {
-					await processChild(child);
+				if (extraFieldAES) {
+					encryptionStrength = extraFieldAES.strength;
 				}
-			}
-		}
-
-		async function processChild(child) {
-			const name = options.relativePath ? child.getRelativeName(selectedEntry) : child.getFullname();
-			const childOptions = child.options || {};
-			let zipEntryOptions = {};
-			if (child.data instanceof Entry) {
-				const {
-					externalFileAttributes,
-					versionMadeBy,
-					comment,
-					lastModDate,
-					creationDate,
-					lastAccessDate,
-					uncompressedSize,
+				zipEntryOptions = Object.assign(zipEntryOptions, {
+					passThrough: true,
 					encrypted,
 					zipCrypto,
 					crc32,
-					compressionMethod,
-					extraFieldAES,
-					internalFileAttributes,
-					extraField,
-					uid,
-					gid
-				} = child.data;
-				zipEntryOptions = {
-					externalFileAttributes,
-					versionMadeBy,
-					comment,
-					lastModDate,
-					creationDate,
-					lastAccessDate,
-					internalFileAttributes
-				};
-				const userExtraField = getUserExtraField(extraField);
-				if (userExtraField) {
-					zipEntryOptions.extraField = userExtraField;
-				}
-				if (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE) {
-					Object.assign(zipEntryOptions, {
-						uid,
-						gid,
-						unixExtraFieldType: options.unixExtraFieldType || INFOZIP_EXTRA_FIELD_TYPE
-					});
-				}
-				if (child.passThrough) {
-					let level, encryptionStrength;
-					if (compressionMethod === 0) {
-						level = 0;
-					}
-					if (extraFieldAES) {
-						encryptionStrength = extraFieldAES.strength;
-					}
-					zipEntryOptions = Object.assign(zipEntryOptions, {
-						passThrough: true,
-						encrypted,
-						zipCrypto,
-						crc32,
-						uncompressedSize,
-						level,
-						encryptionStrength,
-						compressionMethod
-					});
-				}
+					uncompressedSize,
+					level,
+					encryptionStrength,
+					compressionMethod
+				});
 			}
-			await zipWriter.add(name, readers.get(child), Object.assign({}, options, zipEntryOptions, childOptions, {
-				directory: child.directory,
-				onprogress: async indexProgress => {
-					if (options.onprogress) {
-						entryOffsets.set(name, indexProgress);
-						try {
-							await options.onprogress(Array.from(entryOffsets.values()).reduce((previousValue, currentValue) => previousValue + currentValue), totalSize);
-						} catch {
-							// ignored
-						}
+		}
+		await zipWriter.add(name, readers.get(child), Object.assign({}, options, zipEntryOptions, childOptions, {
+			directory: child.directory,
+			onprogress: async indexProgress => {
+				if (options.onprogress) {
+					entryOffsets.set(name, indexProgress);
+					try {
+						await options.onprogress(Array.from(entryOffsets.values()).reduce((previousValue, currentValue) => previousValue + currentValue), totalSize);
+					} catch {
+						// ignored
 					}
 				}
-			}));
-			await process(zipWriter, child);
-		}
+			}
+		}));
 	}
 }
 
 function addFileSystemHandle(zipEntry, handle, options) {
 	return addFile(zipEntry, handle, []);
 
-	async function addFile(parentEntry, handle, addedEntries) {
+	async function addFile(parentEntry, handle, addedEntries, parentName = "") {
 		if (handle) {
+			const entryName = parentName ? parentName + "/" + handle.name : handle.name;
 			try {
 				if (handle.isFile || handle.isDirectory) {
 					handle = await transformToFileSystemhandle(handle);
@@ -966,12 +1010,18 @@ function addFileSystemHandle(zipEntry, handle, options) {
 					const directoryEntry = parentEntry.addDirectory(handle.name);
 					addedEntries.push(directoryEntry);
 					for await (const childHandle of handle.values()) {
-						await addFile(directoryEntry, childHandle, addedEntries);
+						await addFile(directoryEntry, childHandle, addedEntries, entryName);
 					}
 				}
 			} catch (error) {
-				const message = error.message + (handle ? " (" + handle.name + ")" : "");
-				throw new Error(message, { cause: error });
+				try {
+					if (error.entryName === UNDEFINED_VALUE) {
+						error.entryName = entryName;
+					}
+				} catch {
+					// ignored
+				}
+				throw error;
 			}
 		}
 		return addedEntries;
@@ -981,15 +1031,33 @@ function addFileSystemHandle(zipEntry, handle, options) {
 async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 	const totalSize = getTotalSize([zipEntry], "uncompressedSize");
 	const writtenSizes = new Map();
-	await exportChildren(zipEntry, directoryHandle);
+	const abortController = new AbortController();
+	const { signal } = abortController;
+	const releaseSignal = forwardAbort(options.signal, abortController);
+	const exportedEntryNames = [];
+	let exportAborted = false;
+	try {
+		await exportChildren(zipEntry, directoryHandle);
+	} catch (error) {
+		try {
+			error.exportedEntryNames = exportedEntryNames;
+		} catch {
+			// ignored
+		}
+		throw error;
+	} finally {
+		releaseSignal();
+	}
 	return directoryHandle;
 
 	async function exportChildren(entry, parentHandle) {
 		if (options.concurrent) {
 			const results = await Promise.allSettled(entry.children.map(child => exportChild(child, parentHandle)));
-			const failedResult = results.find(result => result.status == "rejected");
-			if (failedResult) {
-				throw failedResult.reason;
+			const rejectedResults = results.filter(result => result.status == "rejected");
+			if (rejectedResults.length) {
+				const failedResults = rejectedResults.filter(result => !isExportAborted(result.reason));
+				const reportedResults = failedResults.length ? failedResults : rejectedResults;
+				throw aggregateEntryErrors(reportedResults.map(result => result.reason));
 			}
 		} else {
 			for (const child of entry.children) {
@@ -999,6 +1067,12 @@ async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 	}
 
 	async function exportChild(child, parentHandle) {
+		if (signal.aborted) {
+			if (exportAborted || isExportAborted(signal.reason)) {
+				return;
+			}
+			throw signal.reason === UNDEFINED_VALUE ? new DOMException(ERR_ABORTED, ABORT_ERROR_NAME) : signal.reason;
+		}
 		try {
 			if (child.directory) {
 				const childDirectoryHandle = await parentHandle.getDirectoryHandle(child.name, { create: true });
@@ -1006,21 +1080,37 @@ async function exportFileSystemHandle(zipEntry, directoryHandle, options) {
 			} else {
 				const fileHandle = await parentHandle.getFileHandle(child.name, { create: true });
 				const writable = await fileHandle.createWritable();
-				await child.getData({ writable }, Object.assign({}, options, {
-					onprogress: async progress => {
-						if (options.onprogress) {
-							writtenSizes.set(child.id, progress);
-							try {
-								await options.onprogress(Array.from(writtenSizes.values()).reduce((previousValue, currentValue) => previousValue + currentValue, 0), totalSize);
-							} catch {
-								// ignored
+				try {
+					await child.getData({ writable }, Object.assign({}, options, {
+						signal,
+						onprogress: async progress => {
+							if (options.onprogress) {
+								writtenSizes.set(child.id, progress);
+								try {
+									await options.onprogress(Array.from(writtenSizes.values()).reduce((previousValue, currentValue) => previousValue + currentValue, 0), totalSize);
+								} catch {
+									// ignored
+								}
 							}
 						}
-					}
-				}));
+					}));
+				} catch (error) {
+					throw exportAborted ? new Error(ERR_ABORT_EXPORT) : error;
+				}
+				exportedEntryNames.push(child.getRelativeName(zipEntry));
 			}
 		} catch (error) {
-			throw new Error(error.message + (child ? " (" + child.name + ")" : ""), { cause: error });
+			exportAborted = true;
+			abortController.abort(new Error(ERR_ABORT_EXPORT));
+			try {
+				if (error.entryName === UNDEFINED_VALUE) {
+					error.entryName = child.getRelativeName(zipEntry);
+					error.entryId = child.id;
+				}
+			} catch {
+				// ignored
+			}
+			throw error;
 		}
 	}
 }
@@ -1082,6 +1172,21 @@ function resetFS(fs) {
 	fs.root = new ZipDirectoryEntry(fs);
 }
 
+function collectChildren(directory, recursive) {
+	const children = [];
+	const pendingDirectories = [directory];
+	let directoryIndex = 0;
+	while (directoryIndex < pendingDirectories.length) {
+		for (const child of pendingDirectories[directoryIndex++].children) {
+			children.push(child);
+			if (recursive) {
+				pendingDirectories.push(child);
+			}
+		}
+	}
+	return children;
+}
+
 function registerEntries(fs, entry) {
 	const pendingEntries = [entry];
 	while (pendingEntries.length) {

package/lib/core/zip-reader.js

@@ -88,6 +88,8 @@ import {
 	FILE_ATTR_UNIX_SETUID_MASK,
 	FILE_ATTR_UNIX_SETGID_MASK,
 	FILE_ATTR_UNIX_STICKY_MASK,
+	NUMBER_TYPE,
+	STRING_TYPE,
 	EMPTY_UINT8_ARRAY
 } from "./constants.js";
 import { getConfiguration } from "./configuration.js";
@@ -150,8 +152,12 @@ import {
 	OPTION_CHECK_CRC32,
 	OPTION_CHECK_AUTHENTICATION_CODE,
 	OPTION_STRICTNESS,
+	OPTION_FILENAME_VALIDATION,
+	OPTION_NORMALIZE_FILENAME,
 	OPTION_MAX_APPENDED_DATA_SIZE,
 	OPTION_DECRYPT_CENTRAL_DIRECTORY,
+	TEXT_TYPE_FILENAME,
+	TEXT_TYPE_COMMENT,
 	STRICTNESS_STRICT,
 	STRICTNESS_BALANCED,
 	STRICTNESS_TOLERANT,
@@ -174,6 +180,11 @@ const ERR_SPLIT_ZIP_FILE = "Split zip file";
 const ERR_OVERLAPPING_ENTRY = "Overlapping entry found";
 const ERR_AMBIGUOUS_ARCHIVE = "Ambiguous archive";
 const ERR_ENCRYPTED_CENTRAL_DIRECTORY = "Encrypted central directory is not supported";
+const ERR_UNSAFE_FILENAME = "Unsafe filename";
+const ERR_INVALID_STRICTNESS = "Invalid strictness (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_FILENAME_VALIDATION = "Invalid filenameValidation (must be 'strict', 'balanced' or 'tolerant')";
+const ERR_INVALID_MAX_APPENDED_DATA_SIZE = "Invalid maxAppendedDataSize (must be a number greater than or equal to 0)";
+const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
@@ -195,6 +206,10 @@ const ZIP64_EXTRACTION = {
 		bytes: 8
 	}
 };
+const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
+const CENTRAL_DIRECTORY_UNREACHABLE = 0;
+const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
+const CENTRAL_DIRECTORY_REACHABLE = 2;
 
 class ZipReader {
 
@@ -223,6 +238,8 @@ class ZipReader {
 		const checkAmbiguity = strictness == STRICTNESS_STRICT;
 		const rejectAmbiguousEndOfDirectory = strictness != STRICTNESS_TOLERANT;
 		const maxAppendedDataSize = getMaxAppendedDataSize(getOptionValue(zipReader, options, OPTION_MAX_APPENDED_DATA_SIZE), strictness);
+		const filenameValidation = getFilenameValidation(getOptionValue(zipReader, options, OPTION_FILENAME_VALIDATION), strictness);
+		const normalizeFilename = getOptionValue(zipReader, options, OPTION_NORMALIZE_FILENAME);
 		const { endOfDirectoryInfo, endOfDirectoryReachingEndCount } = await findEndOfCentralDirectory(reader, rejectAmbiguousEndOfDirectory, maxAppendedDataSize);
 		if (!endOfDirectoryInfo) {
 			const signatureArray = await readUint8Array(reader, 0, 4);
@@ -416,11 +433,22 @@ class ZipReader {
 			const decode = getOptionValue(zipReader, options, OPTION_DECODE_TEXT) || decodeText;
 			const rawFilenameEncoding = filenameUTF8 ? CHARSET_UTF8 : filenameEncoding || CHARSET_CP437;
 			const rawCommentEncoding = commentUTF8 ? CHARSET_UTF8 : commentEncoding || CHARSET_CP437;
-			let filename = decode(rawFilename, rawFilenameEncoding);
+			let filename = decode(rawFilename, rawFilenameEncoding, TEXT_TYPE_FILENAME);
 			if (filename === UNDEFINED_VALUE) {
 				filename = decodeText(rawFilename, rawFilenameEncoding);
 			}
-			let comment = decode(rawComment, rawCommentEncoding);
+			if (normalizeFilename) {
+				const normalizedFilename = normalizeFilename(filename);
+				if (normalizedFilename !== UNDEFINED_VALUE) {
+					filename = normalizedFilename;
+				}
+			}
+			if (isUnsafeFilename(filename, filenameValidation)) {
+				const error = new Error(ERR_UNSAFE_FILENAME);
+				error.filename = filename;
+				throw error;
+			}
+			let comment = decode(rawComment, rawCommentEncoding, TEXT_TYPE_COMMENT);
 			if (comment === UNDEFINED_VALUE) {
 				comment = decodeText(rawComment, rawCommentEncoding);
 			}
@@ -481,10 +509,10 @@ class ZipReader {
 			entry.getData = (writer, options) => fileEntry.getData(writer, entry, zipReader.readRanges, options);
 			entry.arrayBuffer = async options => {
 				const writer = new TransformStream();
-				const [arrayBuffer] = await Promise.all([
-					streamToBlob(writer.readable).then(blob => blob.arrayBuffer()),
-					fileEntry.getData(writer, entry, zipReader.readRanges, options)]);
-				return arrayBuffer;
+				const arrayBufferPromise = streamToBlob(writer.readable).then(blob => blob.arrayBuffer());
+				arrayBufferPromise.catch(() => { });
+				await fileEntry.getData(writer, entry, zipReader.readRanges, options);
+				return arrayBufferPromise;
 			};
 			offset = endOffset;
 			const { onprogress } = options;
@@ -600,6 +628,10 @@ export {
 	ERR_OVERLAPPING_ENTRY,
 	ERR_AMBIGUOUS_ARCHIVE,
 	ERR_ENCRYPTED_CENTRAL_DIRECTORY,
+	ERR_UNSAFE_FILENAME,
+	ERR_INVALID_STRICTNESS,
+	ERR_INVALID_FILENAME_VALIDATION,
+	ERR_INVALID_MAX_APPENDED_DATA_SIZE,
 	ERR_WORKER_STARTUP_TIMEOUT
 };
 
@@ -760,7 +792,7 @@ class ZipEntry {
 				readRanges
 			});
 		}
-		let writable;
+		let writable, abortError;
 		try {
 			if (!checkOverlappingEntryOnly) {
 				if (checkPasswordOnly) {
@@ -780,12 +812,22 @@ class ZipEntry {
 				writer.size += error.outputSize;
 			}
 			if (!checkPasswordOnly || error.message != ERR_ABORT_CHECK_PASSWORD) {
+				abortError = error;
 				throw error;
 			}
 		} finally {
 			const preventClose = getOptionValue(zipEntry, options, OPTION_PREVENT_CLOSE);
 			if (!preventClose && writable && !writable.locked) {
-				await writable.getWriter().close();
+				const writableWriter = writable.getWriter();
+				if (abortError) {
+					try {
+						await writableWriter.abort(abortError);
+					} catch {
+						// the error being propagated is more relevant; ignored
+					}
+				} else {
+					await writableWriter.close();
+				}
 			}
 		}
 		return checkPasswordOnly || checkOverlappingEntryOnly ? UNDEFINED_VALUE : writer.getData ? writer.getData() : writable;
@@ -1165,16 +1207,51 @@ function getDiskOffset(reader, diskNumber) {
 	return reader.getDiskOffset ? reader.getDiskOffset(diskNumber) : 0;
 }
 
+function isStrictnessValue(value) {
+	return value === STRICTNESS_STRICT || value === STRICTNESS_BALANCED || value === STRICTNESS_TOLERANT;
+}
+
 function getStrictness(strictness, checkAmbiguity) {
 	if (strictness === UNDEFINED_VALUE) {
 		return checkAmbiguity ? STRICTNESS_STRICT : STRICTNESS_BALANCED;
 	}
+	if (!isStrictnessValue(strictness)) {
+		throw new Error(ERR_INVALID_STRICTNESS);
+	}
 	return strictness;
 }
 
+function getFilenameValidation(filenameValidation, strictness) {
+	if (filenameValidation === UNDEFINED_VALUE) {
+		return strictness;
+	}
+	if (!isStrictnessValue(filenameValidation)) {
+		throw new Error(ERR_INVALID_FILENAME_VALIDATION);
+	}
+	return filenameValidation;
+}
+
+function isUnsafeFilename(filename, filenameValidation) {
+	if (filenameValidation == STRICTNESS_TOLERANT) {
+		return false;
+	}
+	const pathParts = filename.split("/");
+	if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
+		pathParts.pop();
+	}
+	if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+		return true;
+	}
+	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+}
+
 function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	if (maxAppendedDataSize !== UNDEFINED_VALUE) {
-		return maxAppendedDataSize;
+		const size = toNumber(maxAppendedDataSize);
+		if (typeof size != NUMBER_TYPE || Number.isNaN(size) || size < 0) {
+			throw new Error(ERR_INVALID_MAX_APPENDED_DATA_SIZE);
+		}
+		return size;
 	}
 	if (strictness == STRICTNESS_STRICT) {
 		return 0;
@@ -1185,12 +1262,6 @@ function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
 	return MAX_16_BITS;
 }
 
-const MAX_END_OF_CENTRAL_DIR_PROBES = 64;
-
-const CENTRAL_DIRECTORY_UNREACHABLE = 0;
-const CENTRAL_DIRECTORY_PLAUSIBLE = 1;
-const CENTRAL_DIRECTORY_REACHABLE = 2;
-
 async function findEndOfCentralDirectory(reader, rejectAmbiguous, maxAppendedDataSize) {
 	const { size } = reader;
 	const anchoredLength = Math.min(size, END_OF_CENTRAL_DIR_LENGTH + MAX_16_BITS);
@@ -1326,6 +1397,10 @@ function getOptionValue(zipReader, options, name) {
 	return options[name] === UNDEFINED_VALUE ? zipReader.options[name] : options[name];
 }
 
+function toNumber(value) {
+	return typeof value == STRING_TYPE && value.trim() ? Number(value) : value;
+}
+
 function getDate(timeRaw) {
 	const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
 	return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
@@ -1350,4 +1425,3 @@ function getUint32(view, offset) {
 function getBigUint64(view, offset) {
 	return Number(view.getBigUint64(offset, true));
 }
-