officeparser 7.2.1 → 7.2.3

package/README.md

@@ -751,6 +751,7 @@ Pass as the second argument to `parseOffice(file, config)`.
 | `ignoreInternalLinks` | `boolean` | `false` | Strip bookmarks and internal cross-references from AST |
 | `fileType` | `SupportedFileType \| null` | `null` | **Required for text-based binary data** (`'md'`, `'html'`, `'csv'`) as these lack magic bytes. |
 | `csvDelimiter` | `string` | `','` | Input delimiter when parsing CSV files |
+| `decompressionLimits` | `DecompressionLimits` | `{ maxUncompressedBytes: 512MB, maxZipEntries: 10000 }` | **New**: Limits applied during ZIP extraction to protect against excessive memory and resource usage |
 | `pdfWorkerSrc` | `string` | CDN (jsDelivr) | Path/URL to `pdf.worker.min.mjs` (required in browser) |
 | `onWarning` | `(issue: OfficeIssue) => void` | — | Callback for non-fatal parsing issues |
 | `abortSignal` | `AbortSignal \| null` | `null` | Optional signal to cancel parsing (rejects with AbortError) |
@@ -1006,12 +1007,17 @@ await officeParser.terminateOcr(); // immediate exit
 
 ## Browser Usage
 
-Two bundles are available in the `dist/` directory:
+Four bundles are available in the `dist/` directory:
 
-| Bundle | Usage |
-|--------|-------|
-| `officeparser.browser.mjs` | ESM, use with `import` statements or modern bundlers (Vite, Webpack, Next.js) |
-| `officeparser.browser.iife.js` | IIFE, use with a `<script>` tag; exposes the global `officeParser` object |
+| Bundle | Type | Description |
+|--------|------|-------------|
+| `officeparser.browser.mjs` | ESM | Standard ESM bundle for modern bundlers (Vite, Webpack, Next.js). |
+| `officeparser.browser.iife.js` | IIFE | Standard UMD bundle for direct `<script>` inclusion (exposes global `officeParser`). |
+| `officeparser.browser.slim.mjs` | ESM | Slim ESM bundle with Tesseract.js (OCR) stubbed out and remote CDN URLs removed. |
+| `officeparser.browser.slim.iife.js` | IIFE | Slim UMD bundle with Tesseract.js (OCR) stubbed out and remote CDN URLs removed. |
+
+### Manifest V3 & Extension Compliance (Slim Bundles)
+For strict browser environments like **Chrome/Edge Manifest V3 extensions**, remotely hosted code is forbidden. Use the **slim** bundles (`officeparser.browser.slim.mjs` or `officeparser.browser.slim.iife.js`) as they do not include default remote CDN urls or the Tesseract OCR engine.
 
 ### ESM (Vite / Webpack / Next.js)
 
@@ -1054,12 +1060,12 @@ const ast = await officeParser.parseOffice(pdfArrayBuffer);
 
 // Or specify your own:
 const ast = await officeParser.parseOffice(pdfArrayBuffer, {
-    pdfWorkerSrc: 'https://cdn.jsdelivr.net/npm/pdfjs-dist@5.6.205/build/pdf.worker.min.mjs'
+    pdfWorkerSrc: 'https://cdn.jsdelivr.net/npm/pdfjs-dist@6.1.200/build/pdf.worker.min.mjs'
 });
 ```
 
 > [!NOTE]
-> The `pdfjs-dist` worker version must match the version bundled with `officeparser` (currently **5.6.205**).
+> The `pdfjs-dist` worker version must match the version bundled with `officeparser` (currently **6.1.200**).
 
 ---
 
@@ -1068,7 +1074,7 @@ const ast = await officeParser.parseOffice(pdfArrayBuffer, {
 | Symptom | Fix |
 |---------|-----|
 | Node.js process stays alive after finishing | Call `await officeParser.terminateOcr()` at end of script when OCR was used |
-| `"Worker not found"` in browser for PDF | Verify `pdfWorkerSrc` points to `pdf.worker.min.mjs` matching version `5.6.205` |
+| `"Worker not found"` in browser for PDF | Verify `pdfWorkerSrc` points to `pdf.worker.min.mjs` matching version `6.1.200` |
 | Low OCR accuracy | Verify `ocrConfig.language` matches the document language; quality depends on image resolution |
 | Out of memory on large Excel files | Call `ast.toText()` early and discard the AST object to allow garbage collection |
 | `md`/`html`/`csv` buffer not detected | Add `fileType: 'md'` (or `'html'`, `'csv'`) to config (these formats have no magic bytes) |

package/dist/defaults.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_GENERATOR_CONFIG = exports.DEFAULT_SEMANTIC_CHUNKING_CONFIG = exports.DEFAULT_DOCUMENT_STRUCTURE_CHUNKING_CONFIG = exports.DEFAULT_FIXED_SIZE_CHUNKING_CONFIG = exports.DEFAULT_OFFICE_PARSER_CONFIG = exports.DEFAULT_ABBREVIATIONS = exports.DEFAULT_SENTENCE_BOUNDARY_REGEX = void 0;
-const PDFJS_VERSION = '5.6.205';
-const DEFAULT_PDF_WORKER_SRC = `https://cdn.jsdelivr.net/npm/pdfjs-dist@${PDFJS_VERSION}/build/pdf.worker.min.mjs`;
+const PDFJS_VERSION = '6.1.200';
+const DEFAULT_PDF_WORKER_SRC = typeof __SLIM__ !== 'undefined' && __SLIM__ ? '' : `https://cdn.jsdelivr.net/npm/pdfjs-dist@${PDFJS_VERSION}/build/pdf.worker.min.mjs`;
 /**
  * The default regex used for identifying sentence boundaries.
  * When this default is used, the generator employs a high-fidelity "robust"
@@ -59,13 +59,17 @@ exports.DEFAULT_OFFICE_PARSER_CONFIG = {
     ignoreInternalLinks: false,
     fileType: null,
     csvDelimiter: ',',
+    decompressionLimits: {
+        maxUncompressedBytes: 512 * 1024 * 1024,
+        maxZipEntries: 10000,
+    },
 };
 /**
  * Default configuration for HTML generation.
  */
 const DEFAULT_HTML_GENERATOR_CONFIG = {
     standalone: true,
-    chartJsSrc: 'https://cdn.jsdelivr.net/npm/chart.js',
+    chartJsSrc: typeof __SLIM__ !== 'undefined' && __SLIM__ ? '' : 'https://cdn.jsdelivr.net/npm/chart.js',
     containerWidth: 'auto',
     customCss: '',
     injections: {

package/dist/generators/ChunkingGenerator.js

@@ -644,7 +644,7 @@ class ChunkingGenerator extends BaseGenerator_js_1.BaseGenerator {
                     let timerId;
                     const timeoutPromise = new Promise((_, reject) => {
                         timerId = setTimeout(() => {
-                            reject(new Error(`Embedding call timed out after ${timeoutMs}ms`));
+                            reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.EMBEDDING_TIMEOUT, this.config, timeoutMs));
                         }, timeoutMs);
                     });
                     return Promise.race([call, timeoutPromise]).finally(() => {

package/dist/generators/HtmlGenerator.js

@@ -469,7 +469,7 @@ class HtmlGenerator extends BaseGenerator_js_1.BaseGenerator {
                         src = `data:${attachment.mimeType || 'image/png'};base64,${attachment.data}`;
                     }
                 }
-                const img = `<img src="${src}" alt="${this.escape(node.text || meta?.altText || '')}"${className}${mappedAttrs}${styleAttr}>`;
+                const img = `<img src="${this.escape(src)}" alt="${this.escape(node.text || meta?.altText || '')}"${className}${mappedAttrs}${styleAttr}>`;
                 const content = this.config.includeFormatting ? `<div class="image-container">${img}<div class="caption">${this.escape(attachmentName || '')}</div></div>` : img;
                 return `${extraAnchors}<div${idAttr}>${content}</div>`;
             }

package/dist/officeparser.browser.d.ts

@@ -34,7 +34,15 @@ export declare enum OfficeErrorType {
 	/** Semantic chunking strategy is selected but no embedding function is provided */
 	MISSING_EMBEDDING_FUNCTION = "MISSING_EMBEDDING_FUNCTION",
 	/** The operation was aborted */
-	OPERATION_ABORTED = "OPERATION_ABORTED"
+	OPERATION_ABORTED = "OPERATION_ABORTED",
+	/** ZIP entry count exceeds limit */
+	ZIP_ENTRY_COUNT_LIMIT_EXCEEDED = "ZIP_ENTRY_COUNT_LIMIT_EXCEEDED",
+	/** ZIP entry missing a valid declared size */
+	ZIP_ENTRY_INVALID_SIZE = "ZIP_ENTRY_INVALID_SIZE",
+	/** ZIP uncompressed size limit exceeded */
+	ZIP_SIZE_LIMIT_EXCEEDED = "ZIP_SIZE_LIMIT_EXCEEDED",
+	/** Embedding call timed out */
+	EMBEDDING_TIMEOUT = "EMBEDDING_TIMEOUT"
 }
 /**
  * Standard warning types for OfficeParser.
@@ -311,7 +319,7 @@ export interface OfficeParserConfig {
 	 * The URL/path to the PDF.js worker script.
 	 *
 	 * **Mandatory** when using PDF parsing in browser environments to avoid worker configuration errors.
-	 * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@5.6.205/build/pdf.worker.min.mjs`.
+	 * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@6.1.200/build/pdf.worker.min.mjs`.
 	 * You can override this with your own local path or a different CDN link.
 	 */
 	pdfWorkerSrc?: string;
@@ -349,6 +357,28 @@ export interface OfficeParserConfig {
 	 * Defaults to ',' but can be overridden (e.g., ';', '\t').
 	 */
 	csvDelimiter?: string;
+	/**
+	 * Limits and checks applied during ZIP extraction to protect against excessive
+	 * memory and resource usage.
+	 */
+	decompressionLimits?: DecompressionLimits;
+}
+/**
+ * Limits applied to ZIP archive decompression.
+ */
+export interface DecompressionLimits {
+	/**
+	 * Maximum allowed total uncompressed size (in bytes) of files extracted from a ZIP archive.
+	 * Applies to OOXML (DOCX, XLSX, PPTX) and ODF (ODT, ODP, ODS) formats.
+	 * Default is 536870912 (512 MB).
+	 */
+	maxUncompressedBytes?: number;
+	/**
+	 * Maximum allowed number of entries (files and directories) in a ZIP archive.
+	 * Applies to OOXML (DOCX, XLSX, PPTX) and ODF (ODT, ODP, ODS) formats.
+	 * Default is 10000.
+	 */
+	maxZipEntries?: number;
 }
 /**
  * Represents a single issue (warning, error, or info) generated during document processing.