handsontable 18.1.1 → 18.1.2-rc2

package/utils/entitlementLicenseKey/extractKeyData.mjs

@@ -1,14 +1,90 @@
-import { CHECKSUM_LENGTH, DATE_FIELDS } from './constants.mjs';
+import { CHECKSUM_LENGTH, DATE_FIELDS, PROSE_DIGEST_LENGTH } from './constants.mjs';
 import { sha512 } from './sha512.mjs';
 import { base64ToString, stringToUtf8Bytes, parseIsoDateToTimestamp } from './encoding.mjs';
 /**
- * The alphabet of the encoded payload - URL-safe base64 without padding. The
- * checksum (lowercase hex) is a subset of it, which is what lets the two be
- * split by a fixed length from the right.
+ * The alphabets of the two parts of the machine-readable block. The second
+ * part has a fixed length, so the two are split from the right.
  *
  * @type {RegExp}
  */ const ENCODED_PAYLOAD = /^[A-Za-z0-9\-_]+$/;
 const CHECKSUM = /^[0-9a-f]+$/;
+/**
+ * The whitespace the reader ignores, in the text and inside the block: TAB,
+ * LF, VT, FF, CR, SPACE, NO-BREAK SPACE,
+ * OGHAM SPACE MARK, the U+2000-U+200A spaces, LINE SEPARATOR, PARAGRAPH
+ * SEPARATOR, NARROW NO-BREAK SPACE, MEDIUM MATHEMATICAL SPACE, IDEOGRAPHIC
+ * SPACE, and the BOM.
+ *
+ * Listed explicitly instead of `\s`, whose set has changed between JavaScript
+ * engines (U+180E) and differs in other languages (U+0085), so it matches the
+ * key generator exactly.
+ *
+ * @type {RegExp}
+ */ const PROSE_WHITESPACE = /[\t\n\v\f\r \u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/g;
+/**
+ * A line break or tab that was saved as text - a backslash followed by "n",
+ * "r", or "t" - also ignored.
+ *
+ * Several places a key is stored keep a line break that way rather than as a
+ * real one: a single-quoted or unquoted `.env` value, Docker's `--env-file`,
+ * and many CI secret fields. The block survives that intact, so without this
+ * a genuine key would fail only because of how it was stored. The generator
+ * strips backslashes from every free-text field, so a key it issues never
+ * carries one of its own.
+ *
+ * @type {RegExp}
+ */ const ESCAPED_WHITESPACE = /\\[nrt]/g;
+/**
+ * Removes every escaped line break or tab (`\n`, `\r`, `\t` saved as text) and
+ * then every whitespace character, in that order.
+ *
+ * The block is one long word, so a mail client or an editor that wraps the key
+ * can break it across lines, and a `.env` file can save that line break as the
+ * text `\n`. The block's alphabet has neither, so removing them cannot change
+ * a genuine block.
+ *
+ * @param {string} text The text to remove the whitespace from.
+ * @returns {string}
+ */ function removeWhitespace(text) {
+    return text.replace(ESCAPED_WHITESPACE, '').replace(PROSE_WHITESPACE, '');
+}
+/**
+ * Brings the human-readable text of a key to the form the key protects.
+ *
+ * Only the whitespace, its escaped forms, and the Unicode composition are
+ * ignored. A mail client that rewraps the text (also between two CJK
+ * characters or inside a word) or collapses a blank line, a `.env` file that
+ * saves a line break as `\n`, or a system that stores "u" + U+0308 instead of
+ * U+00FC leaves the key valid. A changed, added, or removed letter, digit, or
+ * symbol does not.
+ * Exported for the test key builder; the library calls `extractEntitlementKeyData`.
+ *
+ * @param {string} prose The text in front of the machine-readable block.
+ * @returns {string}
+ */ export function canonicalizeProse(prose) {
+    // NFC runs last: a line break between a letter and its combining mark (an
+    // NFD copy rewrapped there) has to be gone before the two can compose.
+    return removeWhitespace(prose).normalize('NFC');
+}
+/**
+ * Computes the checksum that closes the block. It must match the canonical
+ * reader in every key format, so Handsontable 18.1 keeps reading newer keys.
+ * Exported for the test key builder.
+ *
+ * @param {string} encodedPayload The encoded payload.
+ * @returns {string}
+ */ export function computePayloadChecksum(encodedPayload) {
+    return sha512(stringToUtf8Bytes(encodedPayload));
+}
+/**
+ * Computes the value a current key stores for its text. Exported for the test
+ * key builder.
+ *
+ * @param {string} canonicalProse The text, already passed through `canonicalizeProse`.
+ * @returns {string}
+ */ export function computeProseDigest(canonicalProse) {
+    return sha512(stringToUtf8Bytes(canonicalProse)).slice(0, PROSE_DIGEST_LENGTH);
+}
 /**
  * Reports own-property presence without trusting a payload's inherited or
  * overridden `hasOwnProperty`.
@@ -45,6 +121,39 @@ const CHECKSUM = /^[0-9a-f]+$/;
  */ function isStringArray(value) {
     return Array.isArray(value) && value.every((item)=>typeof item === 'string');
 }
+/**
+ * Freezes the value and everything nested in it. The read result is shared
+ * between callers (see the memo below), so a caller that sorted or pushed into
+ * it would silently rewrite what the next caller reads.
+ *
+ * It walks with an explicit stack, not by recursion. An unknown extra field is
+ * kept as it is, and a key can nest one thousands of levels deep - recursion
+ * would then overflow the call stack and throw out of the reader, where a key
+ * is only ever allowed to read as data or as `null`.
+ *
+ * @param {*} value The value to freeze.
+ * @returns {*}
+ */ function deepFreeze(value) {
+    const pending = [
+        value
+    ];
+    while(pending.length > 0){
+        const current = pending.pop();
+        if (isFreezable(current)) {
+            Object.freeze(current);
+            Object.keys(current).forEach((key)=>pending.push(current[key]));
+        }
+    }
+    return value;
+}
+/**
+ * Narrows an unknown value to an object (or array) that is not frozen yet.
+ *
+ * @param {*} value The value to check.
+ * @returns {boolean}
+ */ function isFreezable(value) {
+    return value !== null && typeof value === 'object' && !Object.isFrozen(value);
+}
 /**
  * Adds an own, ordinary property.
  *
@@ -97,7 +206,7 @@ const CHECKSUM = /^[0-9a-f]+$/;
     if (presentDateFields.length !== 1) {
         return null;
     }
-    if (parseIsoDateToTimestamp(`${entry[presentDateFields[0]]}`) === null) {
+    if (parseIsoDateToTimestamp(entry[presentDateFields[0]]) === null) {
         return null;
     }
     if (!isNonNegativeInteger(entry.notice) || !isNonNegativeInteger(entry.grace)) {
@@ -122,6 +231,41 @@ const CHECKSUM = /^[0-9a-f]+$/;
     defineOwn(normalized, presentDateFields[0], entry[presentDateFields[0]]);
     return normalized;
 }
+/**
+ * Reads the format version of a payload. Returns `null` for a value no
+ * generator writes. A version newer than this reader knows is accepted, so a
+ * build already in the field keeps reading newer keys.
+ *
+ * @param {object} payload The decoded payload.
+ * @returns {number|null}
+ */ function readFormatVersion(payload) {
+    // Own properties only, so a value another script put on `Object.prototype`
+    // cannot change how a key is read.
+    if (!hasOwn(payload, 'v')) {
+        return 1;
+    }
+    if (!isNonNegativeInteger(payload.v) || payload.v < 2) {
+        return null;
+    }
+    return payload.v;
+}
+/**
+ * Checks that the text of a current key is intact and that nothing but
+ * whitespace follows its block. A key always states its terms, so the bare
+ * block is rejected. A key in the earlier format is read the way Handsontable
+ * 18.1 reads it.
+ *
+ * @param {object} payload The decoded payload.
+ * @param {string} prose The text in front of the block.
+ * @param {string} textAfterBlock The text after the block.
+ * @returns {boolean}
+ */ function coversItsText(payload, prose, textAfterBlock) {
+    if (canonicalizeProse(textAfterBlock) !== '') {
+        return false;
+    }
+    const canonicalProse = canonicalizeProse(prose);
+    return canonicalProse !== '' && hasOwn(payload, 'prose') && typeof payload.prose === 'string' && computeProseDigest(canonicalProse) === payload.prose;
+}
 /**
  * Reads and verifies one key. Split out from the memoized public entry point so
  * the memo can wrap every exit path uniformly.
@@ -139,7 +283,7 @@ const CHECKSUM = /^[0-9a-f]+$/;
     if (blockEnd === -1) {
         return null;
     }
-    const content = licenseKey.slice(blockStart + 1, blockEnd);
+    const content = removeWhitespace(licenseKey.slice(blockStart + 1, blockEnd));
     if (content.length <= CHECKSUM_LENGTH) {
         return null;
     }
@@ -148,7 +292,7 @@ const CHECKSUM = /^[0-9a-f]+$/;
     if (!ENCODED_PAYLOAD.test(encodedPayload) || !CHECKSUM.test(checksum)) {
         return null;
     }
-    if (sha512(stringToUtf8Bytes(encodedPayload)) !== checksum) {
+    if (computePayloadChecksum(encodedPayload) !== checksum) {
         return null;
     }
     const payloadJson = base64ToString(encodedPayload);
@@ -164,6 +308,13 @@ const CHECKSUM = /^[0-9a-f]+$/;
     if (!isPlainObject(payload) || !isPlainObject(payload.products)) {
         return null;
     }
+    const version = readFormatVersion(payload);
+    if (version === null) {
+        return null;
+    }
+    if (version >= 2 && !coversItsText(payload, licenseKey.slice(0, blockStart), licenseKey.slice(blockEnd + 1))) {
+        return null;
+    }
     const products = {};
     const entries = payload.products;
     let malformed = false;
@@ -178,40 +329,54 @@ const CHECKSUM = /^[0-9a-f]+$/;
     if (malformed) {
         return null;
     }
-    return {
+    return deepFreeze({
+        version,
         products
-    };
+    });
 }
 // The license key is read twice per grid init - the bottom bar
 // (`initLicenseNotification`) and the branding UI (`initLicenseBranding`) each resolve the license
-// state - and reading runs the full SHA-512 + base64 + JSON parse. A one-entry memo on the key makes
-// the second read free. The returned data is treated as read-only by every caller, so sharing one
+// state - and reading runs the full verification and decoding. A one-entry memo on the key makes
+// the second read free. The returned data is frozen, as in the canonical reader, so sharing one
 // object is safe.
 let memoizedKey = null;
 let memoizedData = null;
 /**
  * Extracts the machine-readable data from an entitlement license key.
  *
- * The checksum is verified first, so the returned data is guaranteed to belong
- * to an intact block. A malformed or tampered key reads as `null` - reporting
- * an invalid key is the caller's job, not this function's.
+ * The key is verified first, so the returned data is guaranteed to belong to
+ * an intact key. A malformed or tampered key reads as `null` - reporting an
+ * invalid key is the caller's job, not this function's.
+ *
+ * A current key protects its text as well: edited or removed text (the bare
+ * `[...]` block), or anything but whitespace after the block, reads as `null`.
+ * A key in the earlier format reads the way Handsontable 18.1 reads it. The
+ * verification rules are those of the canonical reader in the private
+ * `license-key` repository.
  *
- * Only the bracketed block matters. The prose in front of it is neither parsed
- * nor covered by the checksum, so the caller may pass the whole key or just the
- * `[...]` block, and rewrapped or re-pasted prose still validates. The block
- * itself has to be intact: its alphabet has no whitespace, so a newline inside
- * it makes the key unreadable, exactly as it does for the key generator.
+ * The caller passes the whole key. The text is never parsed, and its
+ * whitespace and Unicode composition are ignored, so rewrapped or re-pasted
+ * text still validates. Whitespace inside the block is ignored too, so a
+ * block wrapped by a mail client still validates.
  *
  * Unknown products, capability tokens and flags are all tolerated, so nothing
  * about reading a key depends on the commercial vocabulary.
  *
+ * The result is frozen. Copy an array before sorting or changing it.
+ *
  * @param {string} licenseKey The license key to extract the data from.
  * @returns {EntitlementKeyData|null}
  */ export function extractEntitlementKeyData(licenseKey) {
-    const key = `${licenseKey}`;
-    if (key !== memoizedKey) {
-        memoizedKey = key;
-        memoizedData = readEntitlementKeyData(key);
+    if (typeof licenseKey !== 'string') {
+        return null;
+    }
+    if (licenseKey !== memoizedKey) {
+        // Read first, remember second. Were the key remembered before the read,
+        // a read that throws would leave the new key paired with the previous
+        // key's data, and the next read of the new key would return it.
+        const data = readEntitlementKeyData(licenseKey);
+        memoizedKey = licenseKey;
+        memoizedData = data;
     }
     return memoizedData;
 }

package/utils/entitlementLicenseKey/types.d.ts

@@ -29,6 +29,11 @@ export interface ProductEntitlement {
  * known ones.
  */
 export interface EntitlementKeyData {
+    /**
+     * The format version of the key; 1 for the keys issued before versions
+     * existed.
+     */
+    version: number;
     products: {
         [productName: string]: ProductEntitlement;
     };

package/utils/licenseBranding/index.js

@@ -62,9 +62,9 @@ const _lockScreen = require("./lockScreen");
 }
 function initLicenseBranding(hotInstance) {
     // DO NOT add a `typeof process` guard here - see the matching comment in `initLicenseNotification`.
-    // The bundler inlines `"15/09/2026"` to a string literal (the bare read cannot
+    // The bundler inlines `"07/10/2026"` to a string literal (the bare read cannot
     // crash); a guard is left un-inlined and compiles to `false` in browser bundles, blanking the date
     // and silently killing expired-key detection.
-    const releaseDate = "15/09/2026" || '';
+    const releaseDate = "07/10/2026" || '';
     mountBrandingSurface(hotInstance, (0, _mixed._getLicenseState)(hotInstance.getSettings().licenseKey, releaseDate));
 }

package/utils/licenseBranding/index.mjs

@@ -63,9 +63,9 @@ import { mountLicenseLock } from './lockScreen.mjs';
  * @returns {void}
  */ export function initLicenseBranding(hotInstance) {
     // DO NOT add a `typeof process` guard here - see the matching comment in `initLicenseNotification`.
-    // The bundler inlines `"15/09/2026"` to a string literal (the bare read cannot
+    // The bundler inlines `"07/10/2026"` to a string literal (the bare read cannot
     // crash); a guard is left un-inlined and compiles to `false` in browser bundles, blanking the date
     // and silently killing expired-key detection.
-    const releaseDate = "15/09/2026" || '';
+    const releaseDate = "07/10/2026" || '';
     mountBrandingSurface(hotInstance, _getLicenseState(hotInstance.getSettings().licenseKey, releaseDate));
 }

package/utils/licenseNotification.js

@@ -84,12 +84,12 @@ function initLicenseNotification(hotInstance) {
     }
     const licenseKey = hotInstance.getSettings().licenseKey;
     // DO NOT wrap this in a `typeof process` guard (or any `process` existence check). The bundler
-    // replaces the whole `"15/09/2026"` expression with a string literal at build time,
+    // replaces the whole `"07/10/2026"` expression with a string literal at build time,
     // so the bare read never touches a runtime `process` object and cannot crash. A guard is NOT
     // inlined - it survives as `typeof process !== 'undefined' && "..."`, which is `false` in every
     // browser bundle, blanks the release date, and silently kills expired-key detection. That was the
     // 18.0.0 regression this read restores; re-adding the guard reintroduces it.
-    const releaseDate = "15/09/2026" || '';
+    const releaseDate = "07/10/2026" || '';
     const notificationElement = (0, _mixed._injectProductInfo)({
         className: LICENSE_INFO_CLASS,
         key: licenseKey,

package/utils/licenseNotification.mjs

@@ -88,12 +88,12 @@ export const LICENSE_INFO_CLASS = 'hot-display-license-info';
     }
     const licenseKey = hotInstance.getSettings().licenseKey;
     // DO NOT wrap this in a `typeof process` guard (or any `process` existence check). The bundler
-    // replaces the whole `"15/09/2026"` expression with a string literal at build time,
+    // replaces the whole `"07/10/2026"` expression with a string literal at build time,
     // so the bare read never touches a runtime `process` object and cannot crash. A guard is NOT
     // inlined - it survives as `typeof process !== 'undefined' && "..."`, which is `false` in every
     // browser bundle, blanks the release date, and silently kills expired-key detection. That was the
     // 18.0.0 regression this read restores; re-adding the guard reintroduces it.
-    const releaseDate = "15/09/2026" || '';
+    const releaseDate = "07/10/2026" || '';
     const notificationElement = _injectProductInfo({
         className: LICENSE_INFO_CLASS,
         key: licenseKey,