bare-x-to-pdf 0.3.0 → 0.5.1

package/CMakeLists.txt

@@ -9,7 +9,11 @@ include(cmake/rust.cmake)
 
 bare_target(target)
 
-add_bare_module(simple_converter NAME bare-x-to-pdf-${target})
+if(target STREQUAL "wasi-wasm32")
+  add_bare_module(simple_converter)
+else()
+  add_bare_module(simple_converter NAME bare-x-to-pdf-${target})
+endif()
 
 target_sources(
   ${simple_converter}
@@ -29,10 +33,26 @@ target_link_libraries(
     simple_converter_core
 )
 
+# Bound the linear memory a hostile document can claim, so it traps instead of
+# growing to the 4 GiB limit of wasm32, and give the recursive readers and
+# Typst the 8 MiB stack they get on native threads rather than the 64 KiB
+# default of wasm-ld. The default cap leaves room for the 256 MB images and
+# 128 MB parts that core/src/limits.rs lets through.
+set(SIMPLE_CONVERTER_WASM_MAX_MEMORY 1073741824 CACHE STRING "Linear memory limit of the WebAssembly addon in bytes, a multiple of 65536")
+
+if(target MATCHES "^wasi-")
+  target_link_options(
+    ${simple_converter}_module
+    PRIVATE
+      -Wl,--max-memory=${SIMPLE_CONVERTER_WASM_MAX_MEMORY}
+      -Wl,-z,stack-size=8388608
+  )
+endif()
+
 if(CMAKE_STRIP AND NOT WIN32)
   add_custom_command(
     TARGET ${simple_converter}_module
     POST_BUILD
-    COMMAND ${CMAKE_STRIP} $<IF:$<PLATFORM_ID:Darwin,iOS>,-x,--strip-unneeded> $<TARGET_FILE:${simple_converter}_module>
+    COMMAND ${CMAKE_STRIP} $<IF:$<PLATFORM_ID:Darwin,iOS>,-x,$<IF:$<PLATFORM_ID:WASI>,--strip-all,--strip-unneeded>> $<TARGET_FILE:${simple_converter}_module>
   )
 endif()

package/README.md

@@ -42,22 +42,58 @@ npm install --os=android --cpu=arm64
 npm install --os=ios --cpu=arm64
 ```
 
+### WebAssembly
+
+On Bare 1.36 and later the converter can also run as a WebAssembly addon, sandboxed through
+WASI. The `.wasm` prebuild ships in the main package, so there is nothing extra to install.
+Import with the `wasi-wasm32` host and a WASI provider. The attributes must be written
+inline in the `require` call. The addon needs a random source and read access to the fonts:
+
+```js
+const converter = require('bare-x-to-pdf', {
+  with: { host: 'wasi-wasm32', wasi: './wasi.js' }
+})
+```
+
+```js
+// wasi.js
+const crypto = require('bare-crypto')
+const { DirectorySync } = require('bare-directory')
+const { HostDirectory } = require('bare-wasi/host')
+
+const fonts = require.resolve('bare-x-to-pdf/package').replace(/package\.json$/, 'fonts')
+
+module.exports = (url) => ({
+  version: 'preview1',
+  random: (b) => crypto.randomFillSync(b),
+  preopens: { [fonts]: new HostDirectory(DirectorySync.open(fonts)) }
+})
+```
+
+The WebAssembly addon has only `convertSync`. `convert()` falls back to it, so it blocks the
+calling thread; run conversions in a [`bare-thread`](https://github.com/holepunchto/bare-thread).
+A hostile document can crash the addon with a `RuntimeError` without taking down the process,
+but the addon stays unusable in that thread afterwards, so replace the thread.
+
 ## Usage
 
 ```js
 const converter = require('bare-x-to-pdf')
 
-const pdf = converter.convert(docxBytes, { to: 'pdf' })
+const pdf = await converter.convert(docxBytes, { to: 'pdf' })
 ```
 
-Input is a `Uint8Array` or `ArrayBuffer` and the result is a `Buffer`. Calls are
-synchronous and CPU bound; run them in a `Bare.Thread` when latency matters.
+Input is a `Uint8Array` or `ArrayBuffer` and the result is a `Buffer`. `convert()` runs on
+the libuv thread pool and does not block the JavaScript thread; `convertSync()` runs on the
+calling thread.
 
 ## API
 
-### `convert(input, options)`
+### `const pdf = await convert(input, options)`
 
-Convert `input` and return a `Buffer`.
+Convert `input` off the JavaScript thread and resolve with a `Buffer`. The input is copied,
+so it may be changed or transferred once the call returns. Invalid options and conversion
+errors reject the promise.
 
 - `options.to` — target format, `'pdf'`. Required.
 - `options.from` — source format; sniffed from the bytes when omitted. Markdown has no
@@ -65,6 +101,11 @@ Convert `input` and return a `Buffer`.
   URIs, since the input is bytes with no directory to resolve relative paths against.
 - `options.fontsDir` — a directory of fonts to use instead of the bundled set.
 
+### `const pdf = convertSync(input, options)`
+
+Convert `input` on the calling thread and return a `Buffer`. Takes the same options as
+`convert()`.
+
 ### `detect(input)`
 
 Sniff the format from the bytes and return `'docx'`, `'pptx'`, `'xlsx'`, `'doc'`, `'xls'`,
@@ -82,7 +123,34 @@ Return every supported pair as `{ from, to }`.
 
 ### `FONTS_DIR`
 
-Path to the bundled fonts directory.
+Path to the bundled fonts directory, resolved with `require.asset`.
+
+## Limits
+
+Documents are often untrusted, so the engine caps what a small file can make it allocate or
+lay out. A document past a hard limit is rejected with an error. One past a soft limit still
+converts, with the value clamped.
+
+Rejected:
+
+- An archive part larger than 128 MB uncompressed.
+- XML nested more than 512 elements deep.
+- A spreadsheet that would print more than 30,000 cells.
+
+Clamped:
+
+- Table spans: 1–1,000 columns.
+- Text columns: 1–64.
+- Pages: 72–14,400 pt on each side, with margins scaled to fit.
+- Lengths: NaN and infinity become 0; any other length is held within ±1,000,000 pt.
+- List counters: above 32,767, letter and Roman labels fall back to decimal.
+- Charts: up to 100,000 points per series (in .xls, 32,000 per series and 256,000 per chart).
+- Formulas: nesting depth up to 256.
+- Images: more than 50 megapixels, or ones that cannot be decoded, are drawn as blank
+  space.
+- Tables nested more than 12 deep: the inner tables are flattened into paragraphs.
+
+Spreadsheet pages with no content are not printed, as in LibreOffice Calc.
 
 ## Development
 

package/binding.c

@@ -1,5 +1,5 @@
 #include <assert.h>
-#include <bare.h>
+#include <bare/module.h>
 #include <js.h>
 #include <stdbool.h>
 #include <stdint.h>
@@ -7,12 +7,46 @@
 #include <string.h>
 #include <utf.h>
 
+#ifndef __wasm__
+#include <uv.h>
+#endif
+
 #include "simple_converter.h"
 
+typedef struct {
+  const uint8_t *input;
+  size_t input_len;
+  uint8_t *owned_input;
+  char *from;
+  char *to;
+  char *fonts_dir;
+  sc_buffer_t out;
+  sc_buffer_t error;
+  int status;
+} simple_converter_job_t;
+
+// WebAssembly addons are single threaded and have no event loop, so they
+// export only convertSync() and leave running it off the JavaScript thread to
+// the embedder.
+#ifndef __wasm__
+typedef struct {
+  uv_work_t work;
+  js_env_t *env;
+  js_deferred_t *deferred;
+  js_deferred_teardown_t *teardown;
+  bool exiting;
+  simple_converter_job_t job;
+} simple_converter_req_t;
+#endif
+
 static bool
 simple_converter__string(js_env_t *env, js_value_t *value, char **result) {
   int err;
 
+  bool is_string;
+  err = js_is_string(env, value, &is_string);
+  if (err != 0 || !is_string) return false;
+
   size_t len = 0;
   err = js_get_value_string_utf8(env, value, NULL, 0, &len);
   if (err != 0) return false;
@@ -27,14 +61,32 @@ simple_converter__string(js_env_t *env, js_value_t *value, char **result) {
   }
 
   str[len] = '\0';
+
+  if (strlen(str) != len) {
+    free(str);
+    return false;
+  }
+
   *result = str;
   return true;
 }
 
-static js_value_t *
-simple_converter_convert(js_env_t *env, js_callback_info_t *info) {
+static void
+simple_converter__job_release(simple_converter_job_t *job) {
+  free(job->owned_input);
+  free(job->from);
+  free(job->to);
+  free(job->fonts_dir);
+  sc_free(&job->out);
+  sc_free(&job->error);
+}
+
+static bool
+simple_converter__job_init(js_env_t *env, js_callback_info_t *info, bool copy_input, simple_converter_job_t *job) {
   int err;
 
+  memset(job, 0, sizeof(*job));
+
   size_t argc = 4;
   js_value_t *argv[4];
 
@@ -44,68 +96,221 @@ simple_converter_convert(js_env_t *env, js_callback_info_t *info) {
   if (argc < 4) {
     err = js_throw_error(env, NULL, "convert expects (bytes, from, to, fontsDir)");
     assert(err == 0);
-    return NULL;
+    return false;
   }
 
-  uint8_t *input;
-  size_t input_len;
-  err = js_get_typedarray_info(env, argv[0], NULL, (void **) &input, &input_len, NULL, NULL);
-  if (err != 0) {
+  bool is_typedarray;
+  err = js_is_typedarray(env, argv[0], &is_typedarray);
+  assert(err == 0);
+
+  js_typedarray_type_t type = js_int8array;
+  uint8_t *input = NULL;
+  size_t input_len = 0;
+  if (is_typedarray) {
+    err = js_get_typedarray_info(env, argv[0], &type, (void **) &input, &input_len, NULL, NULL);
+  }
+  if (!is_typedarray || err != 0 || type != js_uint8array) {
     err = js_throw_error(env, NULL, "input must be a Uint8Array");
     assert(err == 0);
-    return NULL;
+    return false;
   }
 
-  char *from = NULL;
-  char *to = NULL;
-  char *fonts_dir = NULL;
-
-  bool ok = simple_converter__string(env, argv[1], &from) &&
-            simple_converter__string(env, argv[2], &to) &&
-            simple_converter__string(env, argv[3], &fonts_dir);
+  bool ok = simple_converter__string(env, argv[1], &job->from) &&
+            simple_converter__string(env, argv[2], &job->to) &&
+            simple_converter__string(env, argv[3], &job->fonts_dir);
 
   if (!ok) {
-    free(from);
-    free(to);
-    free(fonts_dir);
-    err = js_throw_error(env, NULL, "from, to and fontsDir must be strings");
+    simple_converter__job_release(job);
+    err = js_throw_error(env, NULL, "from, to and fontsDir must be strings without NUL characters");
     assert(err == 0);
-    return NULL;
+    return false;
   }
 
-  sc_buffer_t out = {NULL, 0};
-  sc_buffer_t error = {NULL, 0};
+  job->input = input;
+  job->input_len = input_len;
 
-  int status = sc_convert(input, input_len, from, to, fonts_dir, &out, &error);
+  if (copy_input && input_len > 0) {
+    job->owned_input = malloc(input_len);
+    if (job->owned_input == NULL) {
+      simple_converter__job_release(job);
+      err = js_throw_error(env, NULL, "out of memory");
+      assert(err == 0);
+      return false;
+    }
+    memcpy(job->owned_input, input, input_len);
+    job->input = job->owned_input;
+  }
+
+  return true;
+}
+
+static void
+simple_converter__run(simple_converter_job_t *job) {
+  job->status = sc_convert(job->input, job->input_len, job->from, job->to, job->fonts_dir, &job->out, &job->error);
+}
+
+static void
+simple_converter__finalize_output(js_env_t *env, void *data, void *finalize_hint) {
+  sc_buffer_t *buffer = finalize_hint;
+  sc_free(buffer);
+  free(buffer);
+}
 
-  free(from);
-  free(to);
-  free(fonts_dir);
+static js_value_t *
+simple_converter__output(js_env_t *env, simple_converter_job_t *job) {
+  int err;
 
-  if (status != 0) {
-    char *message = malloc(error.len + 1);
-    if (message != NULL) {
-      memcpy(message, error.data, error.len);
-      message[error.len] = '\0';
+  js_value_t *result;
+
+  sc_buffer_t *owned = job->out.len > 0 ? malloc(sizeof(sc_buffer_t)) : NULL;
+
+  if (owned != NULL) {
+    *owned = job->out;
+    err = js_create_external_arraybuffer(env, owned->data, owned->len, simple_converter__finalize_output, owned, &result);
+    if (err == 0) {
+      job->out.data = NULL;
+      job->out.len = 0;
+      return result;
     }
-    sc_free(&error);
-    err = js_throw_error(env, NULL, message ? message : "conversion failed");
-    assert(err == 0);
-    free(message);
-    return NULL;
+    free(owned);
   }
 
-  js_value_t *result;
   void *data;
-  err = js_create_arraybuffer(env, out.len, &data, &result);
+  err = js_create_arraybuffer(env, job->out.len, &data, &result);
   assert(err == 0);
 
-  if (out.len > 0) memcpy(data, out.data, out.len);
-  sc_free(&out);
+  if (job->out.len > 0) memcpy(data, job->out.data, job->out.len);
 
   return result;
 }
 
+static js_value_t *
+simple_converter__error(js_env_t *env, simple_converter_job_t *job) {
+  int err;
+
+  js_value_t *message;
+  if (job->error.len > 0) {
+    err = js_create_string_utf8(env, (utf8_t *) job->error.data, job->error.len, &message);
+  } else {
+    err = js_create_string_utf8(env, (utf8_t *) "conversion failed", (size_t) -1, &message);
+  }
+  assert(err == 0);
+
+  js_value_t *error;
+  err = js_create_error(env, NULL, message, &error);
+  assert(err == 0);
+
+  return error;
+}
+
+static js_value_t *
+simple_converter_convert_sync(js_env_t *env, js_callback_info_t *info) {
+  int err;
+
+  simple_converter_job_t job;
+  if (!simple_converter__job_init(env, info, false, &job)) return NULL;
+
+  simple_converter__run(&job);
+
+  js_value_t *result = NULL;
+
+  if (job.status == 0) {
+    result = simple_converter__output(env, &job);
+  } else {
+    err = js_throw(env, simple_converter__error(env, &job));
+    assert(err == 0);
+  }
+
+  simple_converter__job_release(&job);
+
+  return result;
+}
+
+#ifndef __wasm__
+static void
+simple_converter__on_work(uv_work_t *work) {
+  simple_converter_req_t *req = (simple_converter_req_t *) work;
+
+  simple_converter__run(&req->job);
+}
+
+static void
+simple_converter__on_after_work(uv_work_t *work, int status) {
+  int err;
+
+  simple_converter_req_t *req = (simple_converter_req_t *) work;
+
+  js_env_t *env = req->env;
+
+  if (!req->exiting) {
+    js_handle_scope_t *scope;
+    err = js_open_handle_scope(env, &scope);
+    assert(err == 0);
+
+    if (status == 0 && req->job.status == 0) {
+      err = js_resolve_deferred(env, req->deferred, simple_converter__output(env, &req->job));
+    } else {
+      err = js_reject_deferred(env, req->deferred, simple_converter__error(env, &req->job));
+    }
+    assert(err == 0);
+
+    err = js_close_handle_scope(env, scope);
+    assert(err == 0);
+  }
+
+  err = js_finish_deferred_teardown_callback(req->teardown);
+  assert(err == 0);
+
+  simple_converter__job_release(&req->job);
+  free(req);
+}
+
+static void
+simple_converter__on_teardown(js_deferred_teardown_t *teardown, void *data) {
+  simple_converter_req_t *req = data;
+
+  req->exiting = true;
+
+  uv_cancel((uv_req_t *) &req->work);
+}
+
+static js_value_t *
+simple_converter_convert(js_env_t *env, js_callback_info_t *info) {
+  int err;
+
+  simple_converter_req_t *req = malloc(sizeof(simple_converter_req_t));
+  if (req == NULL) {
+    err = js_throw_error(env, NULL, "out of memory");
+    assert(err == 0);
+    return NULL;
+  }
+
+  if (!simple_converter__job_init(env, info, true, &req->job)) {
+    free(req);
+    return NULL;
+  }
+
+  req->env = env;
+  req->exiting = false;
+
+  js_value_t *promise;
+  err = js_create_promise(env, &req->deferred, &promise);
+  assert(err == 0);
+
+  uv_loop_t *loop;
+  err = js_get_env_loop(env, &loop);
+  assert(err == 0);
+
+  err = uv_queue_work(loop, &req->work, simple_converter__on_work, simple_converter__on_after_work);
+  assert(err == 0);
+
+  err = js_add_deferred_teardown_callback(env, simple_converter__on_teardown, req, &req->teardown);
+  assert(err == 0);
+
+  return promise;
+}
+#endif
+
 static js_value_t *
 simple_converter_exports(js_env_t *env, js_value_t *exports) {
   int err;
@@ -119,7 +324,10 @@ simple_converter_exports(js_env_t *env, js_value_t *exports) {
     assert(err == 0); \
   }
 
+#ifndef __wasm__
   V("convert", simple_converter_convert)
+#endif
+  V("convertSync", simple_converter_convert_sync)
 #undef V
 
   return exports;

package/cmake/rust.cmake

@@ -1,6 +1,6 @@
 include_guard(GLOBAL)
 
-set(CORROSION_VERSION "v0.6.1" CACHE STRING "Corrosion release tag")
+set(CORROSION_COMMIT "1499b14e4906a2890f5cee1547c8848db261753d" CACHE STRING "Corrosion commit (v0.6.1)")
 
 bare_platform(_sys)
 bare_arch(_arch)
@@ -43,16 +43,26 @@ elseif(_sys STREQUAL "win32")
   else()
     set(_triple x86_64-pc-windows-msvc)
   endif()
+elseif(_sys STREQUAL "wasi")
+  set(_triple wasm32-wasip1)
 else()
   message(FATAL_ERROR "simple-converter: no Rust target for '${_sys}/${_arch}'")
 endif()
 
 set(Rust_CARGO_TARGET "${_triple}" CACHE STRING "Rust target triple")
 
-fetch_package("github:corrosion-rs/corrosion#${CORROSION_VERSION}")
+fetch_package("github:corrosion-rs/corrosion#${CORROSION_COMMIT}")
 
 corrosion_import_crate(
   MANIFEST_PATH "${CMAKE_CURRENT_SOURCE_DIR}/core/Cargo.toml"
   CRATE_TYPES staticlib
   PROFILE release
 )
+
+# Corrosion 0.6.1 adds the Command Line Tools SDK as a link directory on macOS.
+# The linker searches it before CMAKE_OSX_SYSROOT, so -lSystem resolves against
+# the wrong SDK and fails when the two differ (corrosion-rs/corrosion#686, fixed
+# upstream after 0.6.1). Drop this once the pin moves past that fix.
+if(APPLE)
+  set_property(TARGET simple_converter_core-static PROPERTY INTERFACE_LINK_DIRECTORIES "")
+endif()