clear-excel 1.0.2 → 1.0.4

package/dist/ooxml/parts.js

@@ -0,0 +1,94 @@
+import { TextDecoder } from "node:util";
+import { limitExceeded } from "../errors.js";
+function getNodeBufferStream(file) {
+    // JSZip's declarations omit its public internalStream helper, while the
+    // runtime API is required to enforce byte budgets before full inflation.
+    // oxlint-disable-next-line typescript/no-unsafe-type-assertion
+    return file.internalStream("nodebuffer");
+}
+export async function requireXml(zip, partName, budget, partLimitBytes) {
+    const file = zip.file(partName);
+    if (!file) {
+        throw new Error(`Required workbook part is missing: ${partName}`);
+    }
+    return readXmlPart(file, partName, budget, partLimitBytes);
+}
+export async function readXmlPart(file, partName, budget, partLimitBytes) {
+    const chunks = [];
+    await consumePart(file, partName, budget, "maxXmlBytes", (chunk) => chunks.push(Buffer.from(chunk)), partLimitBytes);
+    return decodeXmlBytes(Buffer.concat(chunks), partName);
+}
+export async function validateUncompressedSize(zip, limitBytes) {
+    const budget = { consumedBytes: 0, limitBytes };
+    for (const file of Object.values(zip.files)) {
+        if (!file.dir) {
+            // Reads stay sequential to enforce the shared budget without retaining file contents.
+            // oxlint-disable-next-line no-await-in-loop
+            await consumePart(file, file.name, budget, "maxUncompressedBytes");
+        }
+    }
+}
+function consumePart(file, partName, budget, budgetLimitName, onChunk, partLimitBytes) {
+    return new Promise((resolve, reject) => {
+        const stream = getNodeBufferStream(file);
+        let partBytes = 0;
+        let settled = false;
+        const fail = (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            stream.pause();
+            reject(error);
+        };
+        stream
+            .on("data", (chunk) => {
+            if (settled) {
+                return;
+            }
+            partBytes += chunk.length;
+            budget.consumedBytes += chunk.length;
+            if (partLimitBytes !== undefined && partBytes > partLimitBytes) {
+                fail(limitExceeded("partBytes", partLimitBytes, partBytes, partName));
+                return;
+            }
+            if (budget.consumedBytes > budget.limitBytes) {
+                fail(limitExceeded(budgetLimitName, budget.limitBytes, budget.consumedBytes, partName));
+                return;
+            }
+            onChunk?.(chunk);
+        })
+            .on("error", (error) => fail(error))
+            .on("end", () => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            resolve();
+        })
+            .resume();
+    });
+}
+function decodeXmlBytes(bytes, partName) {
+    let encoding = "utf-8";
+    if ((bytes[0] === 0xff && bytes[1] === 0xfe) || (bytes[0] === 0x3c && bytes[1] === 0x00)) {
+        encoding = "utf-16le";
+    }
+    else if ((bytes[0] === 0xfe && bytes[1] === 0xff) || (bytes[0] === 0x00 && bytes[1] === 0x3c)) {
+        encoding = "utf-16be";
+    }
+    const xml = new TextDecoder(encoding, { fatal: true }).decode(bytes);
+    const declaration = /^<\?xml\s[^?]*\?>/.exec(xml)?.[0];
+    const declaredEncoding = declaration
+        ?.match(/\bencoding\s*=\s*(["'])([^"']+)\1/i)?.[2]
+        ?.toLowerCase();
+    if (declaredEncoding !== undefined &&
+        declaredEncoding !== encoding &&
+        !(declaredEncoding === "utf-16" && encoding.startsWith("utf-16"))) {
+        throw new Error(`Unsupported or inconsistent XML encoding in ${partName}: ${declaredEncoding}`);
+    }
+    return declaration
+        ? xml.replace(declaration, declaration.replace(/(\bencoding\s*=\s*)(["'])[^"']+\2/i, '$1"UTF-8"'))
+        : xml;
+}
+//# sourceMappingURL=parts.js.map

package/dist/ooxml/parts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parts.js","sourceRoot":"","sources":["../../src/ooxml/parts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAIxC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAe7C,SAAS,mBAAmB,CAAC,IAAuB;IAClD,wEAAwE;IACxE,yEAAyE;IACzE,+DAA+D;IAC/D,OAAQ,IAAuC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAU,EACV,QAAgB,EAChB,MAAkB,EAClB,cAAsB;IAEtB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAuB,EACvB,QAAgB,EAChB,MAAkB,EAClB,cAAsB;IAEtB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,WAAW,CACf,IAAI,EACJ,QAAQ,EACR,MAAM,EACN,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC1C,cAAc,CACf,CAAC;IACF,OAAO,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAU,EAAE,UAAkB;IAC3E,MAAM,MAAM,GAAe,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,sFAAsF;YACtF,4CAA4C;YAC5C,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,IAAuB,EACvB,QAAgB,EAChB,MAAkB,EAClB,eAAuD,EACvD,OAAiC,EACjC,cAAuB;IAEvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAQ,EAAE;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QAEF,MAAM;aACH,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC1B,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;YACrC,IAAI,cAAc,KAAK,SAAS,IAAI,SAAS,GAAG,cAAc,EAAE,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7C,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC;aACD,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACnC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACd,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;aACD,MAAM,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,QAAgB;IACrD,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACzF,QAAQ,GAAG,UAAU,CAAC;IACxB,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QAChG,QAAQ,GAAG,UAAU,CAAC;IACxB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,WAAW;QAClC,EAAE,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,EAAE,WAAW,EAAE,CAAC;IAClB,IACE,gBAAgB,KAAK,SAAS;QAC9B,gBAAgB,KAAK,QAAQ;QAC7B,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,QAAQ,KAAK,gBAAgB,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,WAAW;QAChB,CAAC,CAAC,GAAG,CAAC,OAAO,CACT,WAAW,EACX,WAAW,CAAC,OAAO,CAAC,oCAAoC,EAAE,WAAW,CAAC,CACvE;QACH,CAAC,CAAC,GAAG,CAAC;AACV,CAAC","sourcesContent":["import { TextDecoder } from \"node:util\";\n\nimport type JSZip from \"jszip\";\n\nimport { limitExceeded } from \"../errors.js\";\nimport type { ReadBudget } from \"../types.js\";\n\ninterface StreamHelper {\n  on(event: \"data\", listener: (chunk: Buffer) => void): StreamHelper;\n  on(event: \"error\", listener: (error: unknown) => void): StreamHelper;\n  on(event: \"end\", listener: () => void): StreamHelper;\n  pause(): StreamHelper;\n  resume(): StreamHelper;\n}\n\ninterface StreamableZipObject {\n  internalStream(type: \"nodebuffer\"): StreamHelper;\n}\n\nfunction getNodeBufferStream(file: JSZip.JSZipObject): StreamHelper {\n  // JSZip's declarations omit its public internalStream helper, while the\n  // runtime API is required to enforce byte budgets before full inflation.\n  // oxlint-disable-next-line typescript/no-unsafe-type-assertion\n  return (file as unknown as StreamableZipObject).internalStream(\"nodebuffer\");\n}\n\nexport async function requireXml(\n  zip: JSZip,\n  partName: string,\n  budget: ReadBudget,\n  partLimitBytes: number,\n): Promise<string> {\n  const file = zip.file(partName);\n  if (!file) {\n    throw new Error(`Required workbook part is missing: ${partName}`);\n  }\n  return readXmlPart(file, partName, budget, partLimitBytes);\n}\n\nexport async function readXmlPart(\n  file: JSZip.JSZipObject,\n  partName: string,\n  budget: ReadBudget,\n  partLimitBytes: number,\n): Promise<string> {\n  const chunks: Buffer[] = [];\n  await consumePart(\n    file,\n    partName,\n    budget,\n    \"maxXmlBytes\",\n    (chunk) => chunks.push(Buffer.from(chunk)),\n    partLimitBytes,\n  );\n  return decodeXmlBytes(Buffer.concat(chunks), partName);\n}\n\nexport async function validateUncompressedSize(zip: JSZip, limitBytes: number): Promise<void> {\n  const budget: ReadBudget = { consumedBytes: 0, limitBytes };\n  for (const file of Object.values(zip.files)) {\n    if (!file.dir) {\n      // Reads stay sequential to enforce the shared budget without retaining file contents.\n      // oxlint-disable-next-line no-await-in-loop\n      await consumePart(file, file.name, budget, \"maxUncompressedBytes\");\n    }\n  }\n}\n\nfunction consumePart(\n  file: JSZip.JSZipObject,\n  partName: string,\n  budget: ReadBudget,\n  budgetLimitName: \"maxXmlBytes\" | \"maxUncompressedBytes\",\n  onChunk?: (chunk: Buffer) => void,\n  partLimitBytes?: number,\n): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const stream = getNodeBufferStream(file);\n    let partBytes = 0;\n    let settled = false;\n\n    const fail = (error: unknown): void => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      stream.pause();\n      reject(error);\n    };\n\n    stream\n      .on(\"data\", (chunk) => {\n        if (settled) {\n          return;\n        }\n        partBytes += chunk.length;\n        budget.consumedBytes += chunk.length;\n        if (partLimitBytes !== undefined && partBytes > partLimitBytes) {\n          fail(limitExceeded(\"partBytes\", partLimitBytes, partBytes, partName));\n          return;\n        }\n        if (budget.consumedBytes > budget.limitBytes) {\n          fail(limitExceeded(budgetLimitName, budget.limitBytes, budget.consumedBytes, partName));\n          return;\n        }\n        onChunk?.(chunk);\n      })\n      .on(\"error\", (error) => fail(error))\n      .on(\"end\", () => {\n        if (settled) {\n          return;\n        }\n        settled = true;\n        resolve();\n      })\n      .resume();\n  });\n}\n\nfunction decodeXmlBytes(bytes: Buffer, partName: string): string {\n  let encoding = \"utf-8\";\n  if ((bytes[0] === 0xff && bytes[1] === 0xfe) || (bytes[0] === 0x3c && bytes[1] === 0x00)) {\n    encoding = \"utf-16le\";\n  } else if ((bytes[0] === 0xfe && bytes[1] === 0xff) || (bytes[0] === 0x00 && bytes[1] === 0x3c)) {\n    encoding = \"utf-16be\";\n  }\n  const xml = new TextDecoder(encoding, { fatal: true }).decode(bytes);\n  const declaration = /^<\\?xml\\s[^?]*\\?>/.exec(xml)?.[0];\n  const declaredEncoding = declaration\n    ?.match(/\\bencoding\\s*=\\s*([\"'])([^\"']+)\\1/i)?.[2]\n    ?.toLowerCase();\n  if (\n    declaredEncoding !== undefined &&\n    declaredEncoding !== encoding &&\n    !(declaredEncoding === \"utf-16\" && encoding.startsWith(\"utf-16\"))\n  ) {\n    throw new Error(`Unsupported or inconsistent XML encoding in ${partName}: ${declaredEncoding}`);\n  }\n  return declaration\n    ? xml.replace(\n        declaration,\n        declaration.replace(/(\\bencoding\\s*=\\s*)([\"'])[^\"']+\\2/i, '$1\"UTF-8\"'),\n      )\n    : xml;\n}\n"]}

package/dist/ooxml/relationships.d.ts

@@ -18,4 +18,3 @@ export declare function relationshipFileForPart(partName: string): string;
 export declare function sourcePartForRelationshipFile(fileName: string): string | undefined;
 export declare function removeUnreachableParts(zip: JSZip, detachedRoots: Set<string>, readBudget: ReadBudget, limits: Readonly<ExcelSanitizationLimits>): Promise<void>;
 export declare function collectReachableParts(initial: ReadonlySet<string>, graph: ReadonlyMap<string, readonly Relationship[]>): Set<string>;
-//# sourceMappingURL=relationships.d.ts.map

package/dist/ooxml/relationships.js

@@ -0,0 +1,132 @@
+import { posix as packagePath } from "node:path";
+import { readXmlPart, requireXml } from "./parts.js";
+import { findElements, getNamespacedAttribute, removeElements } from "./xml.js";
+const PACKAGE_RELATIONSHIP_NAMESPACES = new Set([
+    "",
+    "http://schemas.openxmlformats.org/package/2006/relationships",
+    "http://purl.oclc.org/ooxml/package/relationships",
+]);
+export function removeRelationships(xml, source, relationshipSuffixes) {
+    const targets = new Set();
+    const removedIds = new Set();
+    for (const relationship of parseRelationships(xml, source)) {
+        if (relationship.targetMode?.toLowerCase() !== "external" &&
+            relationshipSuffixes.some((suffix) => relationship.type.endsWith(suffix))) {
+            removedIds.add(relationship.id);
+            targets.add(relationship.target);
+        }
+    }
+    const cleaned = removeElements(xml, (element) => isRelationshipElement(element) &&
+        removedIds.has(getNamespacedAttribute(element, "Id", [""]) ?? ""));
+    return { xml: cleaned, targets };
+}
+export function parseRelationships(xml, source) {
+    const ids = new Set();
+    return findElements(xml, "Relationship")
+        .filter(isRelationshipElement)
+        .map((element) => {
+        const id = getNamespacedAttribute(element, "Id", [""]);
+        const target = getNamespacedAttribute(element, "Target", [""]);
+        const type = getNamespacedAttribute(element, "Type", [""]);
+        if (!id || !target || !type) {
+            throw new Error(`Invalid relationship in ${source || "package root"}`);
+        }
+        if (ids.has(id)) {
+            throw new Error(`Duplicate relationship ID in ${source || "package root"}: ${id}`);
+        }
+        ids.add(id);
+        const targetMode = getNamespacedAttribute(element, "TargetMode", [""]);
+        if (targetMode !== undefined &&
+            !["internal", "external"].includes(targetMode.toLowerCase())) {
+            throw new Error(`Invalid relationship target mode: ${targetMode}`);
+        }
+        return {
+            id,
+            target: targetMode?.toLowerCase() === "external" ? target : resolveTarget(source, target),
+            targetMode,
+            type,
+        };
+    });
+}
+function isRelationshipElement(element) {
+    return (element.localName === "Relationship" &&
+        PACKAGE_RELATIONSHIP_NAMESPACES.has(element.namespaceUri));
+}
+export function resolveTarget(source, target) {
+    const resolved = target.startsWith("/")
+        ? packagePath.normalize(target.slice(1))
+        : packagePath.normalize(packagePath.join(packagePath.dirname(source), target));
+    if (resolved === ".." || resolved.startsWith("../")) {
+        throw new Error(`Relationship target escapes package: ${target}`);
+    }
+    return resolved;
+}
+export function relationshipFileForPart(partName) {
+    return packagePath.join(packagePath.dirname(partName), "_rels", `${packagePath.basename(partName)}.rels`);
+}
+export function sourcePartForRelationshipFile(fileName) {
+    if (fileName === "_rels/.rels") {
+        return "";
+    }
+    const match = fileName.match(/^(.*\/)_rels\/([^/]+)\.rels$/);
+    return match ? `${match[1]}${match[2]}` : undefined;
+}
+export async function removeUnreachableParts(zip, detachedRoots, readBudget, limits) {
+    if (detachedRoots.size === 0) {
+        return;
+    }
+    const graph = await buildRelationshipGraph(zip, readBudget, limits);
+    const candidates = collectReachableParts(detachedRoots, graph);
+    const packageReachable = collectReachableParts(new Set([""]), graph);
+    packageReachable.delete("");
+    const deletedParts = new Set([...candidates].filter((partName) => !packageReachable.has(partName)));
+    for (const partName of deletedParts) {
+        zip.remove(partName);
+        zip.remove(relationshipFileForPart(partName));
+    }
+    const contentTypes = await requireXml(zip, "[Content_Types].xml", readBudget, limits.maxMetadataXmlBytes);
+    zip.file("[Content_Types].xml", removeElements(contentTypes, (element) => {
+        if (element.localName !== "Override" ||
+            !["", "http://schemas.openxmlformats.org/package/2006/content-types"].includes(element.namespaceUri)) {
+            return false;
+        }
+        const partName = getNamespacedAttribute(element, "PartName", [""])?.replace(/^\//, "");
+        return partName !== undefined && deletedParts.has(partName);
+    }));
+}
+async function buildRelationshipGraph(zip, readBudget, limits) {
+    const graph = new Map();
+    for (const fileName of Object.keys(zip.files)) {
+        if (!fileName.endsWith(".rels")) {
+            continue;
+        }
+        const source = sourcePartForRelationshipFile(fileName);
+        const file = zip.file(fileName);
+        if (source !== undefined && file) {
+            graph.set(source, parseRelationships(
+            // Reads intentionally stay sequential because they share a mutable byte budget.
+            // oxlint-disable-next-line no-await-in-loop
+            await readXmlPart(file, fileName, readBudget, limits.maxRelationshipsXmlBytes), source));
+        }
+    }
+    return graph;
+}
+export function collectReachableParts(initial, graph) {
+    const reachable = new Set(initial);
+    const pending = [...initial];
+    while (pending.length > 0) {
+        const source = pending.pop();
+        if (source === undefined) {
+            continue;
+        }
+        for (const relationship of graph.get(source) ?? []) {
+            if (relationship.targetMode?.toLowerCase() !== "external" &&
+                !reachable.has(relationship.target)) {
+                reachable.add(relationship.target);
+                pending.push(relationship.target);
+            }
+        }
+    }
+    return reachable;
+}
+//# sourceMappingURL=relationships.js.map

package/dist/ooxml/relationships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.js","sourceRoot":"","sources":["../../src/ooxml/relationships.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAKjD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,cAAc,EAAmB,MAAM,UAAU,CAAC;AAEjG,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,EAAE;IACF,8DAA8D;IAC9D,kDAAkD;CACnD,CAAC,CAAC;AAgBH,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAAc,EACd,oBAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,YAAY,IAAI,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,IACE,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU;YACrD,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EACzE,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAC5B,GAAG,EACH,CAAC,OAAO,EAAE,EAAE,CACV,qBAAqB,CAAC,OAAO,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CACpE,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,OAAO,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC;SACrC,MAAM,CAAC,qBAAqB,CAAC;SAC7B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,IAAI,cAAc,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,IACE,UAAU,KAAK,SAAS;YACxB,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAC5D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO;YACL,EAAE;YACF,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;YACzF,UAAU;YACV,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAmB;IAChD,OAAO,CACL,OAAO,CAAC,SAAS,KAAK,cAAc;QACpC,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QACrC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,OAAO,WAAW,CAAC,IAAI,CACrB,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC7B,OAAO,EACP,GAAG,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAgB;IAC5D,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAU,EACV,aAA0B,EAC1B,UAAsB,EACtB,MAAyC;IAEzC,IAAI,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,qBAAqB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CACtE,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrB,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,GAAG,EACH,qBAAqB,EACrB,UAAU,EACV,MAAM,CAAC,mBAAmB,CAC3B,CAAC;IACF,GAAG,CAAC,IAAI,CACN,qBAAqB,EACrB,cAAc,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;QACvC,IACE,OAAO,CAAC,SAAS,KAAK,UAAU;YAChC,CAAC,CAAC,EAAE,EAAE,8DAA8D,CAAC,CAAC,QAAQ,CAC5E,OAAO,CAAC,YAAY,CACrB,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvF,OAAO,QAAQ,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,GAAU,EACV,UAAsB,EACtB,MAAyC;IAEzC,MAAM,KAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC3C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CACP,MAAM,EACN,kBAAkB;YAChB,gFAAgF;YAChF,4CAA4C;YAC5C,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,wBAAwB,CAAC,EAC9E,MAAM,CACP,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,KAAmD;IAEnD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACnD,IACE,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU;gBACrD,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,EACnC,CAAC;gBACD,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { posix as packagePath } from \"node:path\";\n\nimport type JSZip from \"jszip\";\n\nimport type { ExcelSanitizationLimits, ReadBudget } from \"../types.js\";\nimport { readXmlPart, requireXml } from \"./parts.js\";\nimport { findElements, getNamespacedAttribute, removeElements, type XmlElement } from \"./xml.js\";\n\nconst PACKAGE_RELATIONSHIP_NAMESPACES = new Set([\n  \"\",\n  \"http://schemas.openxmlformats.org/package/2006/relationships\",\n  \"http://purl.oclc.org/ooxml/package/relationships\",\n]);\n\nexport interface Relationship {\n  id: string;\n  target: string;\n  targetMode: string | undefined;\n  type: string;\n}\n\nexport type RelationshipGraph = Map<string, Relationship[]>;\n\nexport interface RemovedRelationships {\n  xml: string;\n  targets: Set<string>;\n}\n\nexport function removeRelationships(\n  xml: string,\n  source: string,\n  relationshipSuffixes: readonly string[],\n): RemovedRelationships {\n  const targets = new Set<string>();\n  const removedIds = new Set<string>();\n  for (const relationship of parseRelationships(xml, source)) {\n    if (\n      relationship.targetMode?.toLowerCase() !== \"external\" &&\n      relationshipSuffixes.some((suffix) => relationship.type.endsWith(suffix))\n    ) {\n      removedIds.add(relationship.id);\n      targets.add(relationship.target);\n    }\n  }\n  const cleaned = removeElements(\n    xml,\n    (element) =>\n      isRelationshipElement(element) &&\n      removedIds.has(getNamespacedAttribute(element, \"Id\", [\"\"]) ?? \"\"),\n  );\n  return { xml: cleaned, targets };\n}\n\nexport function parseRelationships(xml: string, source: string): Relationship[] {\n  const ids = new Set<string>();\n  return findElements(xml, \"Relationship\")\n    .filter(isRelationshipElement)\n    .map((element) => {\n      const id = getNamespacedAttribute(element, \"Id\", [\"\"]);\n      const target = getNamespacedAttribute(element, \"Target\", [\"\"]);\n      const type = getNamespacedAttribute(element, \"Type\", [\"\"]);\n      if (!id || !target || !type) {\n        throw new Error(`Invalid relationship in ${source || \"package root\"}`);\n      }\n      if (ids.has(id)) {\n        throw new Error(`Duplicate relationship ID in ${source || \"package root\"}: ${id}`);\n      }\n      ids.add(id);\n      const targetMode = getNamespacedAttribute(element, \"TargetMode\", [\"\"]);\n      if (\n        targetMode !== undefined &&\n        ![\"internal\", \"external\"].includes(targetMode.toLowerCase())\n      ) {\n        throw new Error(`Invalid relationship target mode: ${targetMode}`);\n      }\n      return {\n        id,\n        target: targetMode?.toLowerCase() === \"external\" ? target : resolveTarget(source, target),\n        targetMode,\n        type,\n      };\n    });\n}\n\nfunction isRelationshipElement(element: XmlElement): boolean {\n  return (\n    element.localName === \"Relationship\" &&\n    PACKAGE_RELATIONSHIP_NAMESPACES.has(element.namespaceUri)\n  );\n}\n\nexport function resolveTarget(source: string, target: string): string {\n  const resolved = target.startsWith(\"/\")\n    ? packagePath.normalize(target.slice(1))\n    : packagePath.normalize(packagePath.join(packagePath.dirname(source), target));\n  if (resolved === \"..\" || resolved.startsWith(\"../\")) {\n    throw new Error(`Relationship target escapes package: ${target}`);\n  }\n  return resolved;\n}\n\nexport function relationshipFileForPart(partName: string): string {\n  return packagePath.join(\n    packagePath.dirname(partName),\n    \"_rels\",\n    `${packagePath.basename(partName)}.rels`,\n  );\n}\n\nexport function sourcePartForRelationshipFile(fileName: string): string | undefined {\n  if (fileName === \"_rels/.rels\") {\n    return \"\";\n  }\n  const match = fileName.match(/^(.*\\/)_rels\\/([^/]+)\\.rels$/);\n  return match ? `${match[1]}${match[2]}` : undefined;\n}\n\nexport async function removeUnreachableParts(\n  zip: JSZip,\n  detachedRoots: Set<string>,\n  readBudget: ReadBudget,\n  limits: Readonly<ExcelSanitizationLimits>,\n): Promise<void> {\n  if (detachedRoots.size === 0) {\n    return;\n  }\n\n  const graph = await buildRelationshipGraph(zip, readBudget, limits);\n  const candidates = collectReachableParts(detachedRoots, graph);\n  const packageReachable = collectReachableParts(new Set([\"\"]), graph);\n  packageReachable.delete(\"\");\n  const deletedParts = new Set(\n    [...candidates].filter((partName) => !packageReachable.has(partName)),\n  );\n  for (const partName of deletedParts) {\n    zip.remove(partName);\n    zip.remove(relationshipFileForPart(partName));\n  }\n\n  const contentTypes = await requireXml(\n    zip,\n    \"[Content_Types].xml\",\n    readBudget,\n    limits.maxMetadataXmlBytes,\n  );\n  zip.file(\n    \"[Content_Types].xml\",\n    removeElements(contentTypes, (element) => {\n      if (\n        element.localName !== \"Override\" ||\n        ![\"\", \"http://schemas.openxmlformats.org/package/2006/content-types\"].includes(\n          element.namespaceUri,\n        )\n      ) {\n        return false;\n      }\n      const partName = getNamespacedAttribute(element, \"PartName\", [\"\"])?.replace(/^\\//, \"\");\n      return partName !== undefined && deletedParts.has(partName);\n    }),\n  );\n}\n\nasync function buildRelationshipGraph(\n  zip: JSZip,\n  readBudget: ReadBudget,\n  limits: Readonly<ExcelSanitizationLimits>,\n): Promise<RelationshipGraph> {\n  const graph: RelationshipGraph = new Map();\n  for (const fileName of Object.keys(zip.files)) {\n    if (!fileName.endsWith(\".rels\")) {\n      continue;\n    }\n    const source = sourcePartForRelationshipFile(fileName);\n    const file = zip.file(fileName);\n    if (source !== undefined && file) {\n      graph.set(\n        source,\n        parseRelationships(\n          // Reads intentionally stay sequential because they share a mutable byte budget.\n          // oxlint-disable-next-line no-await-in-loop\n          await readXmlPart(file, fileName, readBudget, limits.maxRelationshipsXmlBytes),\n          source,\n        ),\n      );\n    }\n  }\n  return graph;\n}\n\nexport function collectReachableParts(\n  initial: ReadonlySet<string>,\n  graph: ReadonlyMap<string, readonly Relationship[]>,\n): Set<string> {\n  const reachable = new Set(initial);\n  const pending = [...initial];\n  while (pending.length > 0) {\n    const source = pending.pop();\n    if (source === undefined) {\n      continue;\n    }\n    for (const relationship of graph.get(source) ?? []) {\n      if (\n        relationship.targetMode?.toLowerCase() !== \"external\" &&\n        !reachable.has(relationship.target)\n      ) {\n        reachable.add(relationship.target);\n        pending.push(relationship.target);\n      }\n    }\n  }\n  return reachable;\n}\n"]}

package/dist/ooxml/styles.d.ts

@@ -4,4 +4,3 @@ export declare function removeUnusedCellStyles(zip: JSZip, worksheets: ReadonlyM
 export declare function collectStyleReferences(xml: string, references: Set<number>): void;
 export declare function remapWorksheetStyles(xml: string, indexMap: ReadonlyMap<number, number>): string;
 export declare function remapNumericAttribute(tag: string, attributeName: string, indexMap: ReadonlyMap<number, number>): string;
-//# sourceMappingURL=styles.d.ts.map

package/dist/ooxml/styles.js

@@ -0,0 +1,67 @@
+import { readXmlPart } from "./parts.js";
+import { findCollection, findElements, getAttribute, isSpreadsheetElement, mapOpeningElements, replaceAttribute, replaceCollection, } from "./xml.js";
+export async function removeUnusedCellStyles(zip, worksheets, readBudget, limits) {
+    const stylesFile = zip.file("xl/styles.xml");
+    if (!stylesFile) {
+        return;
+    }
+    const usedStyles = new Set([0]);
+    for (const xml of worksheets.values()) {
+        collectStyleReferences(xml, usedStyles);
+    }
+    const stylesXml = await readXmlPart(stylesFile, "xl/styles.xml", readBudget, limits.maxStylesXmlBytes);
+    const cellXfs = findCollection(stylesXml, "cellXfs");
+    if (!cellXfs) {
+        return;
+    }
+    const xfs = findElements(stylesXml, "xf")
+        .filter((element) => isSpreadsheetElement(element) && element.parent?.start === cellXfs.element.start)
+        .map((element) => stylesXml.slice(element.start, element.end));
+    // The spread already creates a fresh array, so this sort cannot mutate the source set.
+    // oxlint-disable-next-line unicorn/no-array-sort
+    const retainedIndexes = [...usedStyles].sort((left, right) => left - right);
+    validateStyleIndexes(retainedIndexes, xfs.length);
+    const indexMap = new Map(retainedIndexes.map((oldIndex, newIndex) => [oldIndex, newIndex]));
+    const retainedStyles = retainedIndexes.map((index) => {
+        const style = xfs[index];
+        if (style === undefined) {
+            throw new Error(`Worksheet references an invalid style index: ${index}`);
+        }
+        return style;
+    });
+    zip.file("xl/styles.xml", replaceCollection(stylesXml, "cellXfs", retainedStyles.join(""), retainedIndexes.length));
+    for (const [worksheetPath, xml] of worksheets) {
+        zip.file(worksheetPath, remapWorksheetStyles(xml, indexMap));
+    }
+}
+function validateStyleIndexes(indexes, styleCount) {
+    if (indexes.some((index) => !Number.isInteger(index) || index < 0 || index >= styleCount)) {
+        throw new Error(`Worksheet references an invalid style index (${indexes.join(",")} of ${styleCount})`);
+    }
+}
+export function collectStyleReferences(xml, references) {
+    mapOpeningElements(xml, (element, tag) => {
+        const attribute = element.localName === "col" ? "style" : "s";
+        if (isSpreadsheetElement(element) && ["c", "row", "col"].includes(element.localName)) {
+            const value = getAttribute(tag, attribute);
+            if (value !== undefined) {
+                references.add(Number(value));
+            }
+        }
+        return tag;
+    });
+}
+export function remapWorksheetStyles(xml, indexMap) {
+    return mapOpeningElements(xml, (element, tag) => {
+        if (!isSpreadsheetElement(element) || !["c", "row", "col"].includes(element.localName)) {
+            return tag;
+        }
+        return remapNumericAttribute(tag, element.localName === "col" ? "style" : "s", indexMap);
+    });
+}
+export function remapNumericAttribute(tag, attributeName, indexMap) {
+    const value = getAttribute(tag, attributeName);
+    const remapped = value === undefined ? undefined : indexMap.get(Number(value));
+    return remapped === undefined ? tag : replaceAttribute(tag, attributeName, String(remapped));
+}
+//# sourceMappingURL=styles.js.map

package/dist/ooxml/styles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.js","sourceRoot":"","sources":["../../src/ooxml/styles.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,UAAU,CAAC;AAElB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAU,EACV,UAAuC,EACvC,UAAsB,EACtB,MAAyC;IAEzC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,sBAAsB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,WAAW,CACjC,UAAU,EACV,eAAe,EACf,UAAU,EACV,MAAM,CAAC,iBAAiB,CACzB,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC;SACtC,MAAM,CACL,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,KAAK,CAC9F;SACA,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,uFAAuF;IACvF,iDAAiD;IACjD,MAAM,eAAe,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAC5E,oBAAoB,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CACN,eAAe,EACf,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,MAAM,CAAC,CACzF,CAAC;IACF,KAAK,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,UAAU,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA0B,EAAE,UAAkB;IAC1E,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,UAAU,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CACb,gDAAgD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,UAAU,GAAG,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,UAAuB;IACzE,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,QAAqC;IACrF,OAAO,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;QAC9C,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACvF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,aAAqB,EACrB,QAAqC;IAErC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/E,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/F,CAAC","sourcesContent":["import type JSZip from \"jszip\";\n\nimport type { ExcelSanitizationLimits, ReadBudget } from \"../types.js\";\nimport { readXmlPart } from \"./parts.js\";\nimport {\n  findCollection,\n  findElements,\n  getAttribute,\n  isSpreadsheetElement,\n  mapOpeningElements,\n  replaceAttribute,\n  replaceCollection,\n} from \"./xml.js\";\n\nexport async function removeUnusedCellStyles(\n  zip: JSZip,\n  worksheets: ReadonlyMap<string, string>,\n  readBudget: ReadBudget,\n  limits: Readonly<ExcelSanitizationLimits>,\n): Promise<void> {\n  const stylesFile = zip.file(\"xl/styles.xml\");\n  if (!stylesFile) {\n    return;\n  }\n\n  const usedStyles = new Set([0]);\n  for (const xml of worksheets.values()) {\n    collectStyleReferences(xml, usedStyles);\n  }\n\n  const stylesXml = await readXmlPart(\n    stylesFile,\n    \"xl/styles.xml\",\n    readBudget,\n    limits.maxStylesXmlBytes,\n  );\n  const cellXfs = findCollection(stylesXml, \"cellXfs\");\n  if (!cellXfs) {\n    return;\n  }\n\n  const xfs = findElements(stylesXml, \"xf\")\n    .filter(\n      (element) => isSpreadsheetElement(element) && element.parent?.start === cellXfs.element.start,\n    )\n    .map((element) => stylesXml.slice(element.start, element.end));\n  // The spread already creates a fresh array, so this sort cannot mutate the source set.\n  // oxlint-disable-next-line unicorn/no-array-sort\n  const retainedIndexes = [...usedStyles].sort((left, right) => left - right);\n  validateStyleIndexes(retainedIndexes, xfs.length);\n  const indexMap = new Map(retainedIndexes.map((oldIndex, newIndex) => [oldIndex, newIndex]));\n  const retainedStyles = retainedIndexes.map((index) => {\n    const style = xfs[index];\n    if (style === undefined) {\n      throw new Error(`Worksheet references an invalid style index: ${index}`);\n    }\n    return style;\n  });\n\n  zip.file(\n    \"xl/styles.xml\",\n    replaceCollection(stylesXml, \"cellXfs\", retainedStyles.join(\"\"), retainedIndexes.length),\n  );\n  for (const [worksheetPath, xml] of worksheets) {\n    zip.file(worksheetPath, remapWorksheetStyles(xml, indexMap));\n  }\n}\n\nfunction validateStyleIndexes(indexes: readonly number[], styleCount: number): void {\n  if (indexes.some((index) => !Number.isInteger(index) || index < 0 || index >= styleCount)) {\n    throw new Error(\n      `Worksheet references an invalid style index (${indexes.join(\",\")} of ${styleCount})`,\n    );\n  }\n}\n\nexport function collectStyleReferences(xml: string, references: Set<number>): void {\n  mapOpeningElements(xml, (element, tag) => {\n    const attribute = element.localName === \"col\" ? \"style\" : \"s\";\n    if (isSpreadsheetElement(element) && [\"c\", \"row\", \"col\"].includes(element.localName)) {\n      const value = getAttribute(tag, attribute);\n      if (value !== undefined) {\n        references.add(Number(value));\n      }\n    }\n    return tag;\n  });\n}\n\nexport function remapWorksheetStyles(xml: string, indexMap: ReadonlyMap<number, number>): string {\n  return mapOpeningElements(xml, (element, tag) => {\n    if (!isSpreadsheetElement(element) || ![\"c\", \"row\", \"col\"].includes(element.localName)) {\n      return tag;\n    }\n    return remapNumericAttribute(tag, element.localName === \"col\" ? \"style\" : \"s\", indexMap);\n  });\n}\n\nexport function remapNumericAttribute(\n  tag: string,\n  attributeName: string,\n  indexMap: ReadonlyMap<number, number>,\n): string {\n  const value = getAttribute(tag, attributeName);\n  const remapped = value === undefined ? undefined : indexMap.get(Number(value));\n  return remapped === undefined ? tag : replaceAttribute(tag, attributeName, String(remapped));\n}\n"]}

package/dist/ooxml/workbook.d.ts

@@ -1,3 +1,2 @@
 import type { NormalizedSanitizeOptions } from "../types.js";
 export declare function sanitizeOoxmlWorkbook(buffer: Buffer, options: NormalizedSanitizeOptions): Promise<Buffer>;
-//# sourceMappingURL=workbook.d.ts.map

package/dist/ooxml/workbook.js

@@ -0,0 +1,119 @@
+import JSZip from "jszip";
+import { createError } from "../errors.js";
+import { hasZipSignature, validateZipCentralDirectory } from "../zip/central-directory.js";
+import { removeThreadedCommentExtensions, removeWorksheetDrawingMarkup } from "./cleanup.js";
+import { DRAWING_RELATIONSHIP_SUFFIXES, PERSON_RELATIONSHIP_SUFFIXES } from "./constants.js";
+import { readXmlPart, requireXml, validateUncompressedSize } from "./parts.js";
+import { parseRelationships, relationshipFileForPart, removeRelationships, removeUnreachableParts, } from "./relationships.js";
+import { removeUnusedCellStyles } from "./styles.js";
+import { findElements, getNamespacedAttribute, isSpreadsheetElement } from "./xml.js";
+const WORKBOOK_PATH = "xl/workbook.xml";
+const WORKBOOK_RELATIONSHIPS_PATH = "xl/_rels/workbook.xml.rels";
+const CONTENT_TYPES_PATH = "[Content_Types].xml";
+export async function sanitizeOoxmlWorkbook(buffer, options) {
+    if (!hasZipSignature(buffer)) {
+        throw new Error("Invalid OOXML ZIP container");
+    }
+    validateZipCentralDirectory(buffer, options.limits);
+    const context = await loadWorkbookContext(buffer, options);
+    const worksheetPaths = findWorksheetPaths(context.workbookXml, context.workbookRelationships, options.requireSingleWorksheet);
+    const detachedRoots = cleanWorkbookRelationships(context);
+    const worksheetXmlByPath = await cleanWorksheets(context, worksheetPaths, detachedRoots, options);
+    await removeUnreachableParts(context.zip, detachedRoots, context.readBudget, options.limits);
+    await removeUnusedCellStyles(context.zip, worksheetXmlByPath, context.readBudget, options.limits);
+    await validateUncompressedSize(context.zip, options.limits.maxUncompressedBytes);
+    return context.zip.generateAsync({
+        type: "nodebuffer",
+        compression: "DEFLATE",
+        compressionOptions: { level: 6 },
+    });
+}
+async function loadWorkbookContext(buffer, options) {
+    const readBudget = {
+        consumedBytes: 0,
+        limitBytes: options.limits.maxXmlBytes,
+    };
+    // CRC verification eagerly inflates every archive entry. Required XML parts
+    // are instead inflated lazily below and constrained by per-part budgets.
+    const zip = await JSZip.loadAsync(buffer);
+    const workbookXml = await requireXml(zip, WORKBOOK_PATH, readBudget, options.limits.maxMetadataXmlBytes);
+    const workbookRelationshipsXml = await requireXml(zip, WORKBOOK_RELATIONSHIPS_PATH, readBudget, options.limits.maxRelationshipsXmlBytes);
+    await requireXml(zip, CONTENT_TYPES_PATH, readBudget, options.limits.maxMetadataXmlBytes);
+    // readXmlPart normalizes encoding declarations; persist the decoded metadata as UTF-8.
+    zip.file(WORKBOOK_PATH, workbookXml);
+    return {
+        zip,
+        readBudget,
+        workbookXml,
+        workbookRelationshipsXml,
+        workbookRelationships: parseRelationships(workbookRelationshipsXml, WORKBOOK_PATH),
+    };
+}
+function findWorksheetPaths(workbookXml, workbookRelationships, requireSingleWorksheet) {
+    const sheets = findElements(workbookXml, "sheet").filter((element) => isSpreadsheetElement(element) &&
+        element.parent !== undefined &&
+        isSpreadsheetElement(element.parent, "sheets"));
+    enforceWorksheetCount(sheets.length, requireSingleWorksheet);
+    if (sheets.length === 0) {
+        throw new Error("Workbook contains no sheets");
+    }
+    const relationshipsById = new Map(workbookRelationships.map((relationship) => [relationship.id, relationship]));
+    const worksheetPaths = sheets.flatMap((sheet) => {
+        const id = getNamespacedAttribute(sheet, "id", [
+            "http://schemas.openxmlformats.org/officeDocument/2006/relationships",
+            "http://purl.oclc.org/ooxml/officeDocument/relationships",
+        ]);
+        const relationship = id ? relationshipsById.get(id) : undefined;
+        if (!relationship || relationship.targetMode?.toLowerCase() === "external") {
+            throw new Error(`Missing or invalid workbook sheet relationship: ${id ?? "no relationship ID"}`);
+        }
+        if (!["/worksheet", "/chartsheet", "/dialogsheet", "/macrosheet", "/intlMacrosheet"].some((suffix) => relationship.type.endsWith(suffix))) {
+            throw new Error(`Invalid workbook sheet relationship type: ${relationship.type}`);
+        }
+        return relationship.type.endsWith("/worksheet") ? [relationship.target] : [];
+    });
+    if (worksheetPaths.length === 0) {
+        throw new Error("Workbook contains no worksheets");
+    }
+    return worksheetPaths;
+}
+function cleanWorkbookRelationships(context) {
+    const cleaned = removeRelationships(context.workbookRelationshipsXml, WORKBOOK_PATH, PERSON_RELATIONSHIP_SUFFIXES);
+    context.zip.file(WORKBOOK_RELATIONSHIPS_PATH, cleaned.xml);
+    return cleaned.targets;
+}
+async function cleanWorksheets(context, worksheetPaths, detachedRoots, options) {
+    const worksheetXmlByPath = new Map();
+    for (const worksheetPath of worksheetPaths) {
+        // Reads intentionally stay sequential because they share a mutable byte budget.
+        // oxlint-disable-next-line no-await-in-loop
+        const worksheetXml = await requireXml(context.zip, worksheetPath, context.readBudget, options.limits.maxWorksheetXmlBytes);
+        const cleanedWorksheetXml = removeThreadedCommentExtensions(removeWorksheetDrawingMarkup(worksheetXml));
+        worksheetXmlByPath.set(worksheetPath, cleanedWorksheetXml);
+        context.zip.file(worksheetPath, cleanedWorksheetXml);
+        // Relationship reads consume the same shared byte budget as worksheet reads.
+        // oxlint-disable-next-line no-await-in-loop
+        await cleanWorksheetRelationships(context, worksheetPath, detachedRoots, options);
+    }
+    return worksheetXmlByPath;
+}
+async function cleanWorksheetRelationships(context, worksheetPath, detachedRoots, options) {
+    const relationshipsPath = relationshipFileForPart(worksheetPath);
+    const relationshipsFile = context.zip.file(relationshipsPath);
+    if (!relationshipsFile) {
+        return;
+    }
+    const cleaned = removeRelationships(await readXmlPart(relationshipsFile, relationshipsPath, context.readBudget, options.limits.maxRelationshipsXmlBytes), worksheetPath, DRAWING_RELATIONSHIP_SUFFIXES);
+    context.zip.file(relationshipsPath, cleaned.xml);
+    for (const target of cleaned.targets) {
+        detachedRoots.add(target);
+    }
+}
+function enforceWorksheetCount(count, required) {
+    if (required && count !== 1) {
+        throw createError("ERR_WORKSHEET_COUNT", {
+            details: { expected: 1, actual: count },
+        });
+    }
+}
+//# sourceMappingURL=workbook.js.map

package/dist/ooxml/workbook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workbook.js","sourceRoot":"","sources":["../../src/ooxml/workbook.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,6BAA6B,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAEtF,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,2BAA2B,GAAG,4BAA4B,CAAC;AACjE,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AAUjD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,OAAkC;IAElC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,2BAA2B,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,kBAAkB,CACvC,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,sBAAsB,CAC/B,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,kBAAkB,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAElG,MAAM,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7F,MAAM,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClG,MAAM,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC/B,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,SAAS;QACtB,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;KACjC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAc,EACd,OAAkC;IAElC,MAAM,UAAU,GAAe;QAC7B,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;KACvC,CAAC;IAEF,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,MAAM,UAAU,CAClC,GAAG,EACH,aAAa,EACb,UAAU,EACV,OAAO,CAAC,MAAM,CAAC,mBAAmB,CACnC,CAAC;IACF,MAAM,wBAAwB,GAAG,MAAM,UAAU,CAC/C,GAAG,EACH,2BAA2B,EAC3B,UAAU,EACV,OAAO,CAAC,MAAM,CAAC,wBAAwB,CACxC,CAAC;IACF,MAAM,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1F,uFAAuF;IACvF,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAErC,OAAO;QACL,GAAG;QACH,UAAU;QACV,WAAW;QACX,wBAAwB;QACxB,qBAAqB,EAAE,kBAAkB,CAAC,wBAAwB,EAAE,aAAa,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAmB,EACnB,qBAA8C,EAC9C,sBAA+B;IAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,MAAM,CACtD,CAAC,OAAO,EAAE,EAAE,CACV,oBAAoB,CAAC,OAAO,CAAC;QAC7B,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CACjD,CAAC;IACF,qBAAqB,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,qBAAqB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9C,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE;YAC7C,qEAAqE;YACrE,yDAAyD;SAC1D,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,UAAU,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CACb,mDAAmD,EAAE,IAAI,oBAAoB,EAAE,CAChF,CAAC;QACJ,CAAC;QACD,IACE,CAAC,CAAC,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACnF,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,EACD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAwB;IAC1D,MAAM,OAAO,GAAG,mBAAmB,CACjC,OAAO,CAAC,wBAAwB,EAChC,aAAa,EACb,4BAA4B,CAC7B,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAwB,EACxB,cAAiC,EACjC,aAA0B,EAC1B,OAAkC;IAElC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,gFAAgF;QAChF,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,UAAU,CACnC,OAAO,CAAC,GAAG,EACX,aAAa,EACb,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,MAAM,CAAC,oBAAoB,CACpC,CAAC;QACF,MAAM,mBAAmB,GAAG,+BAA+B,CACzD,4BAA4B,CAAC,YAAY,CAAC,CAC3C,CAAC;QACF,kBAAkB,CAAC,GAAG,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAErD,6EAA6E;QAC7E,4CAA4C;QAC5C,MAAM,2BAA2B,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAwB,EACxB,aAAqB,EACrB,aAA0B,EAC1B,OAAkC;IAElC,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CACjC,MAAM,WAAW,CACf,iBAAiB,EACjB,iBAAiB,EACjB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,MAAM,CAAC,wBAAwB,CACxC,EACD,aAAa,EACb,6BAA6B,CAC9B,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,QAAiB;IAC7D,IAAI,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,CAAC,qBAAqB,EAAE;YACvC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;SACxC,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import JSZip from \"jszip\";\n\nimport { createError } from \"../errors.js\";\nimport type { NormalizedSanitizeOptions, ReadBudget } from \"../types.js\";\nimport { hasZipSignature, validateZipCentralDirectory } from \"../zip/central-directory.js\";\nimport { removeThreadedCommentExtensions, removeWorksheetDrawingMarkup } from \"./cleanup.js\";\nimport { DRAWING_RELATIONSHIP_SUFFIXES, PERSON_RELATIONSHIP_SUFFIXES } from \"./constants.js\";\nimport { readXmlPart, requireXml, validateUncompressedSize } from \"./parts.js\";\nimport {\n  parseRelationships,\n  relationshipFileForPart,\n  removeRelationships,\n  removeUnreachableParts,\n  type Relationship,\n} from \"./relationships.js\";\nimport { removeUnusedCellStyles } from \"./styles.js\";\nimport { findElements, getNamespacedAttribute, isSpreadsheetElement } from \"./xml.js\";\n\nconst WORKBOOK_PATH = \"xl/workbook.xml\";\nconst WORKBOOK_RELATIONSHIPS_PATH = \"xl/_rels/workbook.xml.rels\";\nconst CONTENT_TYPES_PATH = \"[Content_Types].xml\";\n\ninterface WorkbookContext {\n  zip: JSZip;\n  readBudget: ReadBudget;\n  workbookXml: string;\n  workbookRelationshipsXml: string;\n  workbookRelationships: Relationship[];\n}\n\nexport async function sanitizeOoxmlWorkbook(\n  buffer: Buffer,\n  options: NormalizedSanitizeOptions,\n): Promise<Buffer> {\n  if (!hasZipSignature(buffer)) {\n    throw new Error(\"Invalid OOXML ZIP container\");\n  }\n  validateZipCentralDirectory(buffer, options.limits);\n\n  const context = await loadWorkbookContext(buffer, options);\n  const worksheetPaths = findWorksheetPaths(\n    context.workbookXml,\n    context.workbookRelationships,\n    options.requireSingleWorksheet,\n  );\n  const detachedRoots = cleanWorkbookRelationships(context);\n  const worksheetXmlByPath = await cleanWorksheets(context, worksheetPaths, detachedRoots, options);\n\n  await removeUnreachableParts(context.zip, detachedRoots, context.readBudget, options.limits);\n  await removeUnusedCellStyles(context.zip, worksheetXmlByPath, context.readBudget, options.limits);\n  await validateUncompressedSize(context.zip, options.limits.maxUncompressedBytes);\n  return context.zip.generateAsync({\n    type: \"nodebuffer\",\n    compression: \"DEFLATE\",\n    compressionOptions: { level: 6 },\n  });\n}\n\nasync function loadWorkbookContext(\n  buffer: Buffer,\n  options: NormalizedSanitizeOptions,\n): Promise<WorkbookContext> {\n  const readBudget: ReadBudget = {\n    consumedBytes: 0,\n    limitBytes: options.limits.maxXmlBytes,\n  };\n\n  // CRC verification eagerly inflates every archive entry. Required XML parts\n  // are instead inflated lazily below and constrained by per-part budgets.\n  const zip = await JSZip.loadAsync(buffer);\n  const workbookXml = await requireXml(\n    zip,\n    WORKBOOK_PATH,\n    readBudget,\n    options.limits.maxMetadataXmlBytes,\n  );\n  const workbookRelationshipsXml = await requireXml(\n    zip,\n    WORKBOOK_RELATIONSHIPS_PATH,\n    readBudget,\n    options.limits.maxRelationshipsXmlBytes,\n  );\n  await requireXml(zip, CONTENT_TYPES_PATH, readBudget, options.limits.maxMetadataXmlBytes);\n  // readXmlPart normalizes encoding declarations; persist the decoded metadata as UTF-8.\n  zip.file(WORKBOOK_PATH, workbookXml);\n\n  return {\n    zip,\n    readBudget,\n    workbookXml,\n    workbookRelationshipsXml,\n    workbookRelationships: parseRelationships(workbookRelationshipsXml, WORKBOOK_PATH),\n  };\n}\n\nfunction findWorksheetPaths(\n  workbookXml: string,\n  workbookRelationships: readonly Relationship[],\n  requireSingleWorksheet: boolean,\n): string[] {\n  const sheets = findElements(workbookXml, \"sheet\").filter(\n    (element) =>\n      isSpreadsheetElement(element) &&\n      element.parent !== undefined &&\n      isSpreadsheetElement(element.parent, \"sheets\"),\n  );\n  enforceWorksheetCount(sheets.length, requireSingleWorksheet);\n  if (sheets.length === 0) {\n    throw new Error(\"Workbook contains no sheets\");\n  }\n\n  const relationshipsById = new Map(\n    workbookRelationships.map((relationship) => [relationship.id, relationship]),\n  );\n  const worksheetPaths = sheets.flatMap((sheet) => {\n    const id = getNamespacedAttribute(sheet, \"id\", [\n      \"http://schemas.openxmlformats.org/officeDocument/2006/relationships\",\n      \"http://purl.oclc.org/ooxml/officeDocument/relationships\",\n    ]);\n    const relationship = id ? relationshipsById.get(id) : undefined;\n    if (!relationship || relationship.targetMode?.toLowerCase() === \"external\") {\n      throw new Error(\n        `Missing or invalid workbook sheet relationship: ${id ?? \"no relationship ID\"}`,\n      );\n    }\n    if (\n      ![\"/worksheet\", \"/chartsheet\", \"/dialogsheet\", \"/macrosheet\", \"/intlMacrosheet\"].some(\n        (suffix) => relationship.type.endsWith(suffix),\n      )\n    ) {\n      throw new Error(`Invalid workbook sheet relationship type: ${relationship.type}`);\n    }\n    return relationship.type.endsWith(\"/worksheet\") ? [relationship.target] : [];\n  });\n  if (worksheetPaths.length === 0) {\n    throw new Error(\"Workbook contains no worksheets\");\n  }\n  return worksheetPaths;\n}\n\nfunction cleanWorkbookRelationships(context: WorkbookContext): Set<string> {\n  const cleaned = removeRelationships(\n    context.workbookRelationshipsXml,\n    WORKBOOK_PATH,\n    PERSON_RELATIONSHIP_SUFFIXES,\n  );\n  context.zip.file(WORKBOOK_RELATIONSHIPS_PATH, cleaned.xml);\n  return cleaned.targets;\n}\n\nasync function cleanWorksheets(\n  context: WorkbookContext,\n  worksheetPaths: readonly string[],\n  detachedRoots: Set<string>,\n  options: NormalizedSanitizeOptions,\n): Promise<Map<string, string>> {\n  const worksheetXmlByPath = new Map<string, string>();\n  for (const worksheetPath of worksheetPaths) {\n    // Reads intentionally stay sequential because they share a mutable byte budget.\n    // oxlint-disable-next-line no-await-in-loop\n    const worksheetXml = await requireXml(\n      context.zip,\n      worksheetPath,\n      context.readBudget,\n      options.limits.maxWorksheetXmlBytes,\n    );\n    const cleanedWorksheetXml = removeThreadedCommentExtensions(\n      removeWorksheetDrawingMarkup(worksheetXml),\n    );\n    worksheetXmlByPath.set(worksheetPath, cleanedWorksheetXml);\n    context.zip.file(worksheetPath, cleanedWorksheetXml);\n\n    // Relationship reads consume the same shared byte budget as worksheet reads.\n    // oxlint-disable-next-line no-await-in-loop\n    await cleanWorksheetRelationships(context, worksheetPath, detachedRoots, options);\n  }\n  return worksheetXmlByPath;\n}\n\nasync function cleanWorksheetRelationships(\n  context: WorkbookContext,\n  worksheetPath: string,\n  detachedRoots: Set<string>,\n  options: NormalizedSanitizeOptions,\n): Promise<void> {\n  const relationshipsPath = relationshipFileForPart(worksheetPath);\n  const relationshipsFile = context.zip.file(relationshipsPath);\n  if (!relationshipsFile) {\n    return;\n  }\n\n  const cleaned = removeRelationships(\n    await readXmlPart(\n      relationshipsFile,\n      relationshipsPath,\n      context.readBudget,\n      options.limits.maxRelationshipsXmlBytes,\n    ),\n    worksheetPath,\n    DRAWING_RELATIONSHIP_SUFFIXES,\n  );\n  context.zip.file(relationshipsPath, cleaned.xml);\n  for (const target of cleaned.targets) {\n    detachedRoots.add(target);\n  }\n}\n\nfunction enforceWorksheetCount(count: number, required: boolean): void {\n  if (required && count !== 1) {\n    throw createError(\"ERR_WORKSHEET_COUNT\", {\n      details: { expected: 1, actual: count },\n    });\n  }\n}\n"]}

package/dist/ooxml/xml.d.ts

@@ -1,12 +1,36 @@
+interface XmlAttribute {
+    name: string;
+    localName: string;
+    namespaceUri: string;
+    value: string;
+    valueStart: number;
+    valueEnd: number;
+}
+export interface XmlElement {
+    name: string;
+    localName: string;
+    namespaceUri: string;
+    attributes: XmlAttribute[];
+    start: number;
+    openingEnd: number;
+    closingStart: number;
+    end: number;
+    parent: XmlElement | undefined;
+}
 interface XmlCollection {
     body: string;
     full: string;
     opening: string;
+    element: XmlElement;
 }
 export declare function getAttribute(xml: string, name: string): string | undefined;
+export declare function replaceAttribute(xml: string, name: string, value: string): string;
+export declare function getNamespacedAttribute(element: XmlElement, name: string, namespaceUris: readonly string[]): string | undefined;
 export declare function decodeXml(value: string): string;
+export declare function isSpreadsheetElement(element: XmlElement, name?: string): boolean;
+export declare function findElements(xml: string, name: string): XmlElement[];
+export declare function mapOpeningElements(xml: string, transform: (element: XmlElement, opening: string) => string): string;
+export declare function removeElements(xml: string, predicate: (element: XmlElement) => boolean): string;
 export declare function findCollection(xml: string, name: string): XmlCollection | undefined;
 export declare function replaceCollection(xml: string, name: string, body: string, count: number): string;
-export declare function matchElements(xml: string, name: string): string[];
 export {};
-//# sourceMappingURL=xml.d.ts.map