@zip.js/zip.js 2.8.61 → 2.9.0

package/index.cjs

@@ -489,7 +489,7 @@ function getDataView(array) {
 // Every table MUST stay a PACKED_SMI array: build with array literals (not `new Array(n)`,
 // which is HOLEY) and store the signed int32 XOR result (no `>>> 0`). An unsigned or holey
 // table becomes a V8 FixedDoubleArray whose every hot-loop lookup unboxes a double (~1.6x
-// slower). Signedness is irrelevant to the result — the reads mask/shift it and the final
+// slower). Signedness is irrelevant to the result: the reads mask/shift it and the final
 // `~crc` normalizes it. Do NOT reintroduce `>>> 0` here or switch to `new Array(256)`.
 const T = [[], [], [], [], [], [], [], []];
 for (let n = 0; n < 256; n++) {
@@ -3477,7 +3477,7 @@ async function terminateWorkers() {
 
 /* global TextDecoder */
 
-const CP437 = "\0☺☻♥♦♣♠•◘○◙♂♀♪♫☼►◄↕‼¶§▬↨↑↓→←∟↔▲▼ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~⌂ÇüéâäàåçêëèïîìÄÅÉæÆôöòûùÿÖÜ¢£¥₧ƒáíóúñѪº¿⌐¬½¼¡«»░▒▓│┤╡╢╖╕╣║╗╝╜╛┐└┴┬├─┼╞╟╚╔╩╦╠═╬╧╨╤╥╙╘╒╓╫╪┘┌█▄▌▐▀αßΓπΣσµτΦΘΩδ∞φε∩≡±≥≤⌠⌡÷≈°∙·√ⁿ²■ ".split("");
+const CP437 = "\0\u263A\u263B\u2665\u2666\u2663\u2660\u2022\u25D8\u25CB\u25D9\u2642\u2640\u266A\u266B\u263C\u25BA\u25C4\u2195\u203C\u00B6\u00A7\u25AC\u21A8\u2191\u2193\u2192\u2190\u221F\u2194\u25B2\u25BC !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\u2302\u00C7\u00FC\u00E9\u00E2\u00E4\u00E0\u00E5\u00E7\u00EA\u00EB\u00E8\u00EF\u00EE\u00EC\u00C4\u00C5\u00C9\u00E6\u00C6\u00F4\u00F6\u00F2\u00FB\u00F9\u00FF\u00D6\u00DC\u00A2\u00A3\u00A5\u20A7\u0192\u00E1\u00ED\u00F3\u00FA\u00F1\u00D1\u00AA\u00BA\u00BF\u2310\u00AC\u00BD\u00BC\u00A1\u00AB\u00BB\u2591\u2592\u2593\u2502\u2524\u2561\u2562\u2556\u2555\u2563\u2551\u2557\u255D\u255C\u255B\u2510\u2514\u2534\u252C\u251C\u2500\u253C\u255E\u255F\u255A\u2554\u2569\u2566\u2560\u2550\u256C\u2567\u2568\u2564\u2565\u2559\u2558\u2552\u2553\u256B\u256A\u2518\u250C\u2588\u2584\u258C\u2590\u2580\u03B1\u00DF\u0393\u03C0\u03A3\u03C3\u00B5\u03C4\u03A6\u0398\u03A9\u03B4\u221E\u03C6\u03B5\u2229\u2261\u00B1\u2265\u2264\u2320\u2321\u00F7\u2248\u00B0\u2219\u00B7\u221A\u207F\u00B2\u25A0\u00A0".split("");
 const VALID_CP437 = CP437.length == 256;
 
 function decodeCP437(stringValue) {
@@ -4743,6 +4743,7 @@ const WARNING_UNKNOWN_ZIP64_EXTENSIBLE_DATA = "unknown zip64 extensible data";
 const WARNING_WRAPPED_ENTRIES_COUNT = "wrapped entries count";
 const WARNING_APPENDED_DATA = "appended data";
 const WARNING_PREPENDED_DATA = "prepended data";
+const WARNING_PREPENDED_CENTRAL_DIRECTORY = "prepended central directory";
 const WARNING_TRAILING_CENTRAL_DIRECTORY_DATA = "trailing central directory data";
 const WARNING_DUPLICATE_FILENAME = "duplicate filename";
 const WARNING_MISMATCHED_ZIP64_END_OF_CENTRAL_DIRECTORY = "mismatched zip64 end of central directory record";
@@ -4836,6 +4837,7 @@ class ZipReader {
 		let diskNumber = getUint16$1(endOfDirectoryView, 6);
 		let filesLength = getUint16$1(endOfDirectoryView, 10);
 		let prependedDataLength = 0;
+		let prependedCentralDirectory;
 		let startOffset;
 		let zip64EndOfDirectory;
 		let zip64EndOfDirectoryVersion2;
@@ -4939,6 +4941,7 @@ class ZipReader {
 					directoryDataOffset = expectedDirectoryDataOffset;
 					if (directoryDataOffset > originalDirectoryDataOffset) {
 						prependedDataLength += directoryDataOffset - originalDirectoryDataOffset;
+						prependedCentralDirectory = storedPointsAtDirectory;
 					}
 					directoryArray = await readUint8Array(reader, directoryDataOffset, directoryDataLength);
 					directoryView = getDataView(directoryArray);
@@ -5166,6 +5169,9 @@ class ZipReader {
 		if (prependedDataLength || (filesLength && startOffset > SPLIT_ZIP_FILE_SIGNATURE_LENGTH)) {
 			addWarning(warnings, WARNING_PREPENDED_DATA);
 		}
+		if (prependedCentralDirectory) {
+			addWarning(warnings, WARNING_PREPENDED_CENTRAL_DIRECTORY);
+		}
 		if (extractPrependedData) {
 			zipReader.prependedData = startOffset > splitZipSignatureLength ?
 				await readUint8Array(reader, splitZipSignatureLength, startOffset - splitZipSignatureLength) :
@@ -6226,6 +6232,7 @@ var zipReader = /*#__PURE__*/Object.freeze({
 	WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD: WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD,
 	WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES: WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES,
 	WARNING_MISMATCHED_ZIP64_END_OF_CENTRAL_DIRECTORY: WARNING_MISMATCHED_ZIP64_END_OF_CENTRAL_DIRECTORY,
+	WARNING_PREPENDED_CENTRAL_DIRECTORY: WARNING_PREPENDED_CENTRAL_DIRECTORY,
 	WARNING_PREPENDED_DATA: WARNING_PREPENDED_DATA,
 	WARNING_TRAILING_CENTRAL_DIRECTORY_DATA: WARNING_TRAILING_CENTRAL_DIRECTORY_DATA,
 	WARNING_UNKNOWN_VERSION: WARNING_UNKNOWN_VERSION,
@@ -8617,7 +8624,7 @@ function formatSupported(StreamClass, format) {
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-const VERSION = "2.8.61";
+const VERSION = "2.9.0";
 
 /*
  Copyright (c) 2025 Gildas Lormeau. All rights reserved.
@@ -10989,6 +10996,7 @@ exports.WARNING_MISMATCHED_LOCAL_FILE_HEADER_BIT_FLAG = WARNING_MISMATCHED_LOCAL
 exports.WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD = WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD;
 exports.WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES = WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES;
 exports.WARNING_MISMATCHED_ZIP64_END_OF_CENTRAL_DIRECTORY = WARNING_MISMATCHED_ZIP64_END_OF_CENTRAL_DIRECTORY;
+exports.WARNING_PREPENDED_CENTRAL_DIRECTORY = WARNING_PREPENDED_CENTRAL_DIRECTORY;
 exports.WARNING_PREPENDED_DATA = WARNING_PREPENDED_DATA;
 exports.WARNING_TRAILING_CENTRAL_DIRECTORY_DATA = WARNING_TRAILING_CENTRAL_DIRECTORY_DATA;
 exports.WARNING_UNKNOWN_VERSION = WARNING_UNKNOWN_VERSION;

package/index.d.cts

@@ -1467,8 +1467,10 @@ export class ZipReader<Type> {
    * {@link WARNING_UNKNOWN_VERSION} (the low byte of the "version needed to extract" field exceeds the highest
    * known zip specification version; the high byte is ignored because some writers store a host identifier in it),
    * {@link WARNING_COMPRESSED_PATCHED_DATA} (bit 5 of the general purpose bit flag),
-   * {@link WARNING_MALFORMED_EXTRA_FIELD}, {@link WARNING_UNKNOWN_ZIP64_EXTENSIBLE_DATA} and
-   * {@link WARNING_WRAPPED_ENTRIES_COUNT}. The other reasons are the checks that
+   * {@link WARNING_MALFORMED_EXTRA_FIELD}, {@link WARNING_UNKNOWN_ZIP64_EXTENSIBLE_DATA},
+   * {@link WARNING_WRAPPED_ENTRIES_COUNT} and {@link WARNING_PREPENDED_CENTRAL_DIRECTORY} (the prepended data
+   * holds a central directory of its own, i.e. another archive precedes this one and other readers may report
+   * its entries instead). The other reasons are the checks that
    * `strictness: "strict"` rejects with {@link ERR_AMBIGUOUS_ARCHIVE}: when the effective strictness tolerates
    * one of them and the evidence is already in hand, the same reason string is deposited as a warning instead —
    * {@link WARNING_APPENDED_DATA}, {@link WARNING_PREPENDED_DATA}, {@link WARNING_TRAILING_CENTRAL_DIRECTORY_DATA},
@@ -4842,6 +4844,19 @@ export const WARNING_APPENDED_DATA: string;
  * {@link ERR_AMBIGUOUS_ARCHIVE} under `strictness: "strict"`
  */
 export const WARNING_PREPENDED_DATA: string;
+/**
+ * Warning reason: the data prepended before the zip file holds a central directory of its own, i.e. the zip file
+ * is preceded by another archive rather than by an arbitrary prefix such as a self-extracting stub
+ * (see {@link ZipReader#warnings})
+ *
+ * @remarks
+ * Readers disagree on such files: zip.js reads the last archive, as Info-ZIP `unzip` and Python's `zipfile` do,
+ * whereas 7-Zip reads the first one and reports the rest as data after the end of the archive. The archive is
+ * therefore ambiguous, and the entries reported here may not be the entries another tool reports. It is always
+ * accompanied by {@link WARNING_PREPENDED_DATA}, which alone does not distinguish this case from a benign prefix.
+ * Use `strictness: "strict"` to reject these archives instead, at the cost of also rejecting benign prefixes.
+ */
+export const WARNING_PREPENDED_CENTRAL_DIRECTORY: string;
 /**
  * Warning reason: data lies between the end of the central directory records and the end of central directory
  * record, either inside the declared central directory length or beyond it (see {@link ZipReader#warnings});

package/index.d.ts

@@ -1467,8 +1467,10 @@ export class ZipReader<Type> {
    * {@link WARNING_UNKNOWN_VERSION} (the low byte of the "version needed to extract" field exceeds the highest
    * known zip specification version; the high byte is ignored because some writers store a host identifier in it),
    * {@link WARNING_COMPRESSED_PATCHED_DATA} (bit 5 of the general purpose bit flag),
-   * {@link WARNING_MALFORMED_EXTRA_FIELD}, {@link WARNING_UNKNOWN_ZIP64_EXTENSIBLE_DATA} and
-   * {@link WARNING_WRAPPED_ENTRIES_COUNT}. The other reasons are the checks that
+   * {@link WARNING_MALFORMED_EXTRA_FIELD}, {@link WARNING_UNKNOWN_ZIP64_EXTENSIBLE_DATA},
+   * {@link WARNING_WRAPPED_ENTRIES_COUNT} and {@link WARNING_PREPENDED_CENTRAL_DIRECTORY} (the prepended data
+   * holds a central directory of its own, i.e. another archive precedes this one and other readers may report
+   * its entries instead). The other reasons are the checks that
    * `strictness: "strict"` rejects with {@link ERR_AMBIGUOUS_ARCHIVE}: when the effective strictness tolerates
    * one of them and the evidence is already in hand, the same reason string is deposited as a warning instead —
    * {@link WARNING_APPENDED_DATA}, {@link WARNING_PREPENDED_DATA}, {@link WARNING_TRAILING_CENTRAL_DIRECTORY_DATA},
@@ -4842,6 +4844,19 @@ export const WARNING_APPENDED_DATA: string;
  * {@link ERR_AMBIGUOUS_ARCHIVE} under `strictness: "strict"`
  */
 export const WARNING_PREPENDED_DATA: string;
+/**
+ * Warning reason: the data prepended before the zip file holds a central directory of its own, i.e. the zip file
+ * is preceded by another archive rather than by an arbitrary prefix such as a self-extracting stub
+ * (see {@link ZipReader#warnings})
+ *
+ * @remarks
+ * Readers disagree on such files: zip.js reads the last archive, as Info-ZIP `unzip` and Python's `zipfile` do,
+ * whereas 7-Zip reads the first one and reports the rest as data after the end of the archive. The archive is
+ * therefore ambiguous, and the entries reported here may not be the entries another tool reports. It is always
+ * accompanied by {@link WARNING_PREPENDED_DATA}, which alone does not distinguish this case from a benign prefix.
+ * Use `strictness: "strict"` to reject these archives instead, at the cost of also rejecting benign prefixes.
+ */
+export const WARNING_PREPENDED_CENTRAL_DIRECTORY: string;
 /**
  * Warning reason: data lies between the end of the central directory records and the end of central directory
  * record, either inside the declared central directory length or beyond it (see {@link ZipReader#warnings});