officeparser 7.2.1 → 7.2.3

package/dist/parsers/ExcelParser.js

@@ -67,7 +67,7 @@ const parseExcel = async (buffer, config) => {
         !!x.match(customPropsFileRegex) ||
         !!x.match(appPropsFileRegex) ||
         (!!config.extractAttachments && (!!x.match(mediaFileRegex) || !!x.match(drawingRelsRegex))) ||
-        ((!!config.extractAttachments || !config.ignoreComments) && !!x.match(relsRegex)));
+        ((!!config.extractAttachments || !config.ignoreComments) && !!x.match(relsRegex)), config.decompressionLimits);
     const sharedStringsFile = files.find(f => f.path === stringsFilePath);
     // Updated to store structured content (rich text runs) or simple string
     const sharedStrings = [];

package/dist/parsers/OpenOfficeParser.js

@@ -31,6 +31,16 @@ const imageUtils_js_1 = require("../utils/imageUtils.js");
 const ocrUtils_js_1 = require("../utils/ocrUtils.js");
 const xmlUtils_js_1 = require("../utils/xmlUtils.js");
 const zipUtils_js_1 = require("../utils/zipUtils.js");
+/**
+ * Helper to clean and extract attachment name from xlink:href or paths.
+ * Handles trailing slashes, leading "./", and subdirectories.
+ */
+const cleanAttachmentName = (href) => {
+    if (!href)
+        return '';
+    const cleaned = href.replace(/^\.\//, '').replace(/\/$/, '');
+    return cleaned.split('/').pop() || '';
+};
 /**
  * Parses an OpenOffice document (.odt, .odp, .ods) and extracts content.
  *
@@ -54,7 +64,7 @@ const parseOpenOffice = async (buffer, config) => {
         !!x.match(metaFileRegex) ||
         !!x.match(stylesFileRegex) ||
         !!x.match(mimetypeFileRegex) ||
-        (!!config.extractAttachments && !!x.match(mediaFileRegex)));
+        (!!config.extractAttachments && !!x.match(mediaFileRegex)), config.decompressionLimits);
     // 1. Determine File Type
     const mimetypeFile = files.find(f => f.path === 'mimetype');
     let fileType = 'odt'; // Default
@@ -82,6 +92,7 @@ const parseOpenOffice = async (buffer, config) => {
     let lastListStyle = null;
     let listIdCounter = 0;
     let lastWasList = false;
+    let traverse;
     // Helper to parse styles
     const parseStyles = (xml) => {
         const styles = (0, xmlUtils_js_1.getElementsByTagName)(xml, "style:style");
@@ -170,6 +181,64 @@ const parseOpenOffice = async (buffer, config) => {
      * Returns the paragraph content without creating a content node.
      *
      * @param node - The paragraph element to parse
+     */
+    const parseMathML = (node) => {
+        if (!node)
+            return '';
+        if (node.nodeType === 3) { // Text node
+            return node.textContent || '';
+        }
+        if (node.nodeType !== 1) { // Not an element
+            return '';
+        }
+        const element = node;
+        const tagName = element.tagName.toLowerCase().replace(/^.*:/, ''); // strip namespace prefix
+        switch (tagName) {
+            case 'math':
+            case 'mrow':
+            case 'semantics':
+                return Array.from(element.childNodes).map(parseMathML).join('');
+            case 'mfrac': {
+                const children = Array.from(element.childNodes).filter((n) => n.nodeType === 1);
+                if (children.length >= 2) {
+                    return `(${parseMathML(children[0])})/(${parseMathML(children[1])})`;
+                }
+                return Array.from(element.childNodes).map(parseMathML).join('');
+            }
+            case 'msub': {
+                const children = Array.from(element.childNodes).filter((n) => n.nodeType === 1);
+                if (children.length >= 2) {
+                    return `${parseMathML(children[0])}_${parseMathML(children[1])}`;
+                }
+                return Array.from(element.childNodes).map(parseMathML).join('');
+            }
+            case 'msup': {
+                const children = Array.from(element.childNodes).filter((n) => n.nodeType === 1);
+                if (children.length >= 2) {
+                    return `${parseMathML(children[0])}^${parseMathML(children[1])}`;
+                }
+                return Array.from(element.childNodes).map(parseMathML).join('');
+            }
+            case 'msubsup': {
+                const children = Array.from(element.childNodes).filter((n) => n.nodeType === 1);
+                if (children.length >= 3) {
+                    return `${parseMathML(children[0])}_${parseMathML(children[1])}^${parseMathML(children[2])}`;
+                }
+                return Array.from(element.childNodes).map(parseMathML).join('');
+            }
+            case 'mi':
+            case 'mn':
+            case 'mo':
+            case 'mtext':
+            case 'ms':
+                return element.textContent || '';
+            case 'annotation':
+                return '';
+            default:
+                return Array.from(element.childNodes).map(parseMathML).join('');
+        }
+    };
+    /**
      * Helper to parse inline content (text, spans, links, notes, etc.) recursively.
      *
      * @param node - The element to parse (paragraph, span, or link)
@@ -325,41 +394,114 @@ const parseOpenOffice = async (buffer, config) => {
                     }
                 }
                 else if (tagName === 'draw:frame') {
-                    // Inline image
                     const frame = element;
-                    // Extract alt text
-                    let altText = '';
-                    const svgTitle = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:title");
-                    const svgDesc = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:desc");
-                    if (svgTitle && svgTitle.textContent) {
-                        altText = svgTitle.textContent;
+                    const drawTextBox = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "draw:text-box");
+                    const drawObject = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "draw:object");
+                    if (drawTextBox) {
+                        const textBoxChildren = [];
+                        traverse(drawTextBox, textBoxChildren, false, sourceXml);
+                        children.push(...textBoxChildren);
+                        const textBoxText = textBoxChildren.map(c => c.text || '').join('\n');
+                        fullText += textBoxText;
                     }
-                    else if (svgDesc && svgDesc.textContent) {
-                        altText = svgDesc.textContent;
-                    }
-                    // Extract image href
-                    let imageHref = '';
-                    const drawImages = (0, xmlUtils_js_1.getElementsByTagName)(frame, "draw:image");
-                    if (drawImages.length > 0) {
-                        imageHref = drawImages[0].getAttribute("xlink:href") || '';
-                        if (imageHref) {
-                            const parts = imageHref.split('/');
-                            imageHref = parts[parts.length - 1];
+                    else if (drawObject) {
+                        const href = drawObject.getAttribute("xlink:href");
+                        let isFormula = false;
+                        let formulaText = '';
+                        let attachmentName = '';
+                        if (href) {
+                            attachmentName = cleanAttachmentName(href);
+                            const objectPath = `${attachmentName}/content.xml`;
+                            const objectFile = files.find(f => f.path === objectPath || f.path.endsWith(objectPath));
+                            if (objectFile) {
+                                const objXml = (0, xmlUtils_js_1.parseXmlString)(objectFile.content.toString());
+                                const mathNode = (0, xmlUtils_js_1.getFirstElementByTagName)(objXml, "math");
+                                if (mathNode) {
+                                    isFormula = true;
+                                    formulaText = parseMathML(mathNode).trim();
+                                }
+                            }
+                        }
+                        if (isFormula) {
+                            fullText += formulaText;
+                            const textNode = {
+                                type: 'text',
+                                text: formulaText,
+                                formatting: parentFormatting,
+                                metadata: linkMetadata ? { ...linkMetadata } : undefined
+                            };
+                            if (config.includeRawContent) {
+                                textNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, sourceXml, config);
+                            }
+                            children.push(textNode);
+                        }
+                        else {
+                            // Standard inline image extraction fallback if object is not a formula
+                            let altText = '';
+                            const svgTitle = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:title");
+                            const svgDesc = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:desc");
+                            if (svgTitle && svgTitle.textContent) {
+                                altText = svgTitle.textContent;
+                            }
+                            else if (svgDesc && svgDesc.textContent) {
+                                altText = svgDesc.textContent;
+                            }
+                            let imageHref = '';
+                            const drawImages = (0, xmlUtils_js_1.getElementsByTagName)(frame, "draw:image");
+                            if (drawImages.length > 0) {
+                                imageHref = drawImages[0].getAttribute("xlink:href") || '';
+                                if (imageHref) {
+                                    imageHref = cleanAttachmentName(imageHref);
+                                }
+                            }
+                            const imageNode = {
+                                type: 'image',
+                                text: '',
+                                children: [],
+                                metadata: {
+                                    attachmentName: imageHref || attachmentName,
+                                    ...(altText ? { altText } : {})
+                                }
+                            };
+                            if (config.includeRawContent) {
+                                imageNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, sourceXml, config);
+                            }
+                            children.push(imageNode);
                         }
                     }
-                    const imageNode = {
-                        type: 'image',
-                        text: '',
-                        children: [],
-                        metadata: {
-                            attachmentName: imageHref,
-                            ...(altText ? { altText } : {})
+                    else {
+                        // Standard inline image extraction fallback
+                        let altText = '';
+                        const svgTitle = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:title");
+                        const svgDesc = (0, xmlUtils_js_1.getFirstElementByTagName)(frame, "svg:desc");
+                        if (svgTitle && svgTitle.textContent) {
+                            altText = svgTitle.textContent;
                         }
-                    };
-                    if (config.includeRawContent) {
-                        imageNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, sourceXml, config);
+                        else if (svgDesc && svgDesc.textContent) {
+                            altText = svgDesc.textContent;
+                        }
+                        let imageHref = '';
+                        const drawImages = (0, xmlUtils_js_1.getElementsByTagName)(frame, "draw:image");
+                        if (drawImages.length > 0) {
+                            imageHref = drawImages[0].getAttribute("xlink:href") || '';
+                            if (imageHref) {
+                                imageHref = cleanAttachmentName(imageHref);
+                            }
+                        }
+                        const imageNode = {
+                            type: 'image',
+                            text: '',
+                            children: [],
+                            metadata: {
+                                attachmentName: imageHref,
+                                ...(altText ? { altText } : {})
+                            }
+                        };
+                        if (config.includeRawContent) {
+                            imageNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, sourceXml, config);
+                        }
+                        children.push(imageNode);
                     }
-                    children.push(imageNode);
                 }
             }
         }
@@ -713,7 +855,7 @@ const parseOpenOffice = async (buffer, config) => {
          * @param sourceXml - The source XML string for raw content extraction
          * @param asSheet - If true, treats tables as sheets (for ODS)
          */
-        function traverse(node, targetArray, forceHeading = false, sourceXml, asSheet = false) {
+        traverse = (node, targetArray, forceHeading = false, sourceXml = '', asSheet = false) => {
             if (node.tagName === "text:p") {
                 const pContent = parseParagraphContent(node, paragraphStyleMap, styleMap, config, sourceXml);
                 const type = (forceHeading || (node.getAttribute("text:style-name") || '').toLowerCase().includes('title')) ? 'heading' : 'paragraph';
@@ -1011,8 +1153,7 @@ const parseOpenOffice = async (buffer, config) => {
                     // Extract image href to link to attachment
                     let imageHref = image.getAttribute("xlink:href") || '';
                     if (imageHref) {
-                        const parts = imageHref.split('/');
-                        imageHref = parts[parts.length - 1];
+                        imageHref = cleanAttachmentName(imageHref);
                     }
                     const metadata = {
                         attachmentName: imageHref,
@@ -1034,25 +1175,47 @@ const parseOpenOffice = async (buffer, config) => {
                     targetArray.push(imageNode);
                 }
                 else if (object) {
-                    // Handle embedded objects like charts
+                    // Handle embedded objects like charts or math formulas
                     const href = object.getAttribute("xlink:href");
                     if (href) {
-                        const attachmentName = href.split('/')[0];
+                        const attachmentName = cleanAttachmentName(href);
                         const objectPath = `${attachmentName}/content.xml`;
                         const objectFile = files.find(f => f.path === objectPath || f.path.endsWith(objectPath));
                         if (objectFile) {
-                            const chartData = (0, chartUtils_js_1.extractChartData)(objectFile.content);
-                            const chartNode = {
-                                type: 'chart',
-                                text: chartData.rawTexts.join(" "),
-                                metadata: {
-                                    attachmentName: attachmentName,
-                                    chartData
+                            const objXml = (0, xmlUtils_js_1.parseXmlString)(objectFile.content.toString());
+                            const mathNode = (0, xmlUtils_js_1.getFirstElementByTagName)(objXml, "math");
+                            if (mathNode) {
+                                // Math formula object at block level
+                                const formulaText = parseMathML(mathNode).trim();
+                                const formulaNode = {
+                                    type: 'paragraph',
+                                    text: formulaText,
+                                    children: [
+                                        {
+                                            type: 'text',
+                                            text: formulaText
+                                        }
+                                    ]
+                                };
+                                if (config.includeRawContent) {
+                                    formulaNode.rawContent = (0, xmlUtils_js_1.getRawContent)(node, sourceXml, config);
                                 }
-                            };
-                            if (config.includeRawContent)
-                                chartNode.rawContent = (0, xmlUtils_js_1.getRawContent)(node, sourceXml, config);
-                            targetArray.push(chartNode);
+                                targetArray.push(formulaNode);
+                            }
+                            else {
+                                const chartData = (0, chartUtils_js_1.extractChartData)(objectFile.content);
+                                const chartNode = {
+                                    type: 'chart',
+                                    text: chartData.rawTexts.join(" "),
+                                    metadata: {
+                                        attachmentName: attachmentName,
+                                        chartData
+                                    }
+                                };
+                                if (config.includeRawContent)
+                                    chartNode.rawContent = (0, xmlUtils_js_1.getRawContent)(node, sourceXml, config);
+                                targetArray.push(chartNode);
+                            }
                         }
                         else {
                             const chartNode = {
@@ -1077,8 +1240,7 @@ const parseOpenOffice = async (buffer, config) => {
                     }
                 }
             }
-        }
-        ;
+        };
         // ODS: Spreadsheet
         if (fileType === 'ods') {
             const spreadsheet = (0, xmlUtils_js_1.getFirstElementByTagName)(body, "office:spreadsheet");
@@ -1156,28 +1318,50 @@ const parseOpenOffice = async (buffer, config) => {
                                 if (drawImages.length > 0) {
                                     const rawHref = drawImages[0].getAttribute("xlink:href");
                                     if (rawHref) {
-                                        const parts = rawHref.split('/');
-                                        imageHref = parts[parts.length - 1];
+                                        imageHref = cleanAttachmentName(rawHref);
                                     }
                                 }
-                                // Extract chart object href
+                                // Extract chart or math object href
                                 let chartHref = '';
+                                let isFormula = false;
+                                let formulaText = '';
                                 const drawObjects = (0, xmlUtils_js_1.getElementsByTagName)(frame, "draw:object");
                                 if (drawObjects.length > 0) {
                                     const href = drawObjects[0].getAttribute("xlink:href");
                                     if (href) {
-                                        // Object href is usually "./Object 1"
-                                        chartHref = href.split('/')[0];
+                                        chartHref = cleanAttachmentName(href);
+                                        const objectPath = `${chartHref}/content.xml`;
+                                        const objectFile = files.find(f => f.path === objectPath || f.path.endsWith(objectPath));
+                                        if (objectFile) {
+                                            const objXml = (0, xmlUtils_js_1.parseXmlString)(objectFile.content.toString());
+                                            const mathNode = (0, xmlUtils_js_1.getFirstElementByTagName)(objXml, "math");
+                                            if (mathNode) {
+                                                isFormula = true;
+                                                formulaText = parseMathML(mathNode).trim();
+                                            }
+                                        }
                                     }
                                 }
-                                if (drawImages.length > 0) {
+                                if (isFormula) {
+                                    cellText += formulaText;
+                                    const textNode = {
+                                        type: 'text',
+                                        text: formulaText,
+                                        formatting: {}
+                                    };
+                                    if (config.includeRawContent) {
+                                        textNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, xmlString, config);
+                                    }
+                                    children.push(textNode);
+                                }
+                                else if (drawImages.length > 0) {
                                     // logic for image node
                                     const imageNode = {
                                         type: 'image',
                                         text: '', // Will be populated by assignAttachmentData
                                         children: [],
                                         metadata: {
-                                            attachmentName: imageHref, // Might be empty, will resolve in assignAttachmentData
+                                            attachmentName: imageHref || chartHref, // Might be empty, will resolve in assignAttachmentData
                                             ...(altText ? { altText } : {})
                                         }
                                     };
@@ -1195,6 +1379,9 @@ const parseOpenOffice = async (buffer, config) => {
                                             attachmentName: chartHref
                                         }
                                     };
+                                    if (config.includeRawContent) {
+                                        chartNode.rawContent = (0, xmlUtils_js_1.getRawContent)(frame, xmlString, config);
+                                    }
                                     children.push(chartNode);
                                 }
                             }

package/dist/parsers/PowerPointParser.js

@@ -63,7 +63,7 @@ const parsePowerPoint = async (buffer, config) => {
         !!x.match(slideRelsRegex) ||
         (!config.ignoreComments && (!!x.match(commentsFileRegex) || !!x.match(commentAuthorsRegex))) ||
         (!config.ignoreSlideMasters && !!x.match(slideMastersRegex)) ||
-        (!!config.extractAttachments && (!!x.match(mediaFileRegex) || !!x.match(chartFileRegex))));
+        (!!config.extractAttachments && (!!x.match(mediaFileRegex) || !!x.match(chartFileRegex))), config.decompressionLimits);
     // Extract metadata
     const corePropsFile = files.find(f => f.path.match(corePropsFileRegex));
     const metadata = corePropsFile ? (0, xmlUtils_js_1.parseOfficeMetadata)(corePropsFile.content.toString()) : {};

package/dist/parsers/WordParser.js

@@ -243,7 +243,7 @@ const parseWord = async (buffer, config) => {
         !!x.match(appPropsFileRegex) ||
         !!x.match(relsFileRegex) ||
         !!x.match(stylesFileRegex) ||
-        (!!config.extractAttachments && !!x.match(mediaFileRegex)));
+        (!!config.extractAttachments && !!x.match(mediaFileRegex)), config.decompressionLimits);
     // Extract metadata
     const corePropsFile = files.find(f => f.path.match(corePropsFileRegex));
     const metadata = corePropsFile ? (0, xmlUtils_js_1.parseOfficeMetadata)(corePropsFile.content.toString()) : {};
@@ -473,7 +473,7 @@ const parseWord = async (buffer, config) => {
         const comments = [];
         // Traverse children of paragraph (runs, hyperlinks, etc.)
         const processChildNode = (node) => {
-            if ((0, xmlUtils_js_1.isElement)(node) && node.nodeName === 'w:r') {
+            if ((0, xmlUtils_js_1.isElement)(node) && (node.nodeName === 'w:r' || node.nodeName === 'm:r')) {
                 const runNode = node;
                 const rPr = (0, xmlUtils_js_1.getFirstElementByTagName)(runNode, "w:rPr");
                 // Formatting
@@ -512,7 +512,7 @@ const parseWord = async (buffer, config) => {
                         continue;
                     // also handle unprefixed version (mirroring the behaviour of getElementsByTagName)
                     // Text content
-                    if (child.tagName === "w:t" || child.tagName === "t") {
+                    if (child.tagName === "w:t" || child.tagName === "t" || child.tagName === "m:t") {
                         const tNode = child;
                         const tContent = tNode.textContent || '';
                         text += tContent;

package/dist/types.d.ts

@@ -32,7 +32,15 @@ export declare enum OfficeErrorType {
     /** Semantic chunking strategy is selected but no embedding function is provided */
     MISSING_EMBEDDING_FUNCTION = "MISSING_EMBEDDING_FUNCTION",
     /** The operation was aborted */
-    OPERATION_ABORTED = "OPERATION_ABORTED"
+    OPERATION_ABORTED = "OPERATION_ABORTED",
+    /** ZIP entry count exceeds limit */
+    ZIP_ENTRY_COUNT_LIMIT_EXCEEDED = "ZIP_ENTRY_COUNT_LIMIT_EXCEEDED",
+    /** ZIP entry missing a valid declared size */
+    ZIP_ENTRY_INVALID_SIZE = "ZIP_ENTRY_INVALID_SIZE",
+    /** ZIP uncompressed size limit exceeded */
+    ZIP_SIZE_LIMIT_EXCEEDED = "ZIP_SIZE_LIMIT_EXCEEDED",
+    /** Embedding call timed out */
+    EMBEDDING_TIMEOUT = "EMBEDDING_TIMEOUT"
 }
 /**
  * Standard warning types for OfficeParser.
@@ -309,7 +317,7 @@ export interface OfficeParserConfig {
      * The URL/path to the PDF.js worker script.
      *
      * **Mandatory** when using PDF parsing in browser environments to avoid worker configuration errors.
-     * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@5.6.205/build/pdf.worker.min.mjs`.
+     * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@6.1.200/build/pdf.worker.min.mjs`.
      * You can override this with your own local path or a different CDN link.
      */
     pdfWorkerSrc?: string;
@@ -347,6 +355,28 @@ export interface OfficeParserConfig {
      * Defaults to ',' but can be overridden (e.g., ';', '\t').
      */
     csvDelimiter?: string;
+    /**
+     * Limits and checks applied during ZIP extraction to protect against excessive
+     * memory and resource usage.
+     */
+    decompressionLimits?: DecompressionLimits;
+}
+/**
+ * Limits applied to ZIP archive decompression.
+ */
+export interface DecompressionLimits {
+    /**
+     * Maximum allowed total uncompressed size (in bytes) of files extracted from a ZIP archive.
+     * Applies to OOXML (DOCX, XLSX, PPTX) and ODF (ODT, ODP, ODS) formats.
+     * Default is 536870912 (512 MB).
+     */
+    maxUncompressedBytes?: number;
+    /**
+     * Maximum allowed number of entries (files and directories) in a ZIP archive.
+     * Applies to OOXML (DOCX, XLSX, PPTX) and ODF (ODT, ODP, ODS) formats.
+     * Default is 10000.
+     */
+    maxZipEntries?: number;
 }
 /**
  * A fully-populated parser configuration containing all options.
@@ -1842,4 +1872,7 @@ export interface OfficeParserAST {
      */
     to<T extends this, D extends SupportedDestination<T['type']>>(this: T, destination: D, config?: GeneratorConfig<D>): Promise<ConversionResult<D>>;
 }
+declare global {
+    const __SLIM__: boolean | undefined;
+}
 export {};

package/dist/types.js

@@ -37,6 +37,14 @@ var OfficeErrorType;
     OfficeErrorType["MISSING_EMBEDDING_FUNCTION"] = "MISSING_EMBEDDING_FUNCTION";
     /** The operation was aborted */
     OfficeErrorType["OPERATION_ABORTED"] = "OPERATION_ABORTED";
+    /** ZIP entry count exceeds limit */
+    OfficeErrorType["ZIP_ENTRY_COUNT_LIMIT_EXCEEDED"] = "ZIP_ENTRY_COUNT_LIMIT_EXCEEDED";
+    /** ZIP entry missing a valid declared size */
+    OfficeErrorType["ZIP_ENTRY_INVALID_SIZE"] = "ZIP_ENTRY_INVALID_SIZE";
+    /** ZIP uncompressed size limit exceeded */
+    OfficeErrorType["ZIP_SIZE_LIMIT_EXCEEDED"] = "ZIP_SIZE_LIMIT_EXCEEDED";
+    /** Embedding call timed out */
+    OfficeErrorType["EMBEDDING_TIMEOUT"] = "EMBEDDING_TIMEOUT";
 })(OfficeErrorType || (exports.OfficeErrorType = OfficeErrorType = {}));
 /**
  * Standard warning types for OfficeParser.

package/dist/utils/configUtils.js

@@ -57,6 +57,12 @@ function isFullParserConfig(config) {
  */
 function resolveParserConfig(userConfig) {
     if (isFullParserConfig(userConfig)) {
+        if (!userConfig.decompressionLimits) {
+            userConfig.decompressionLimits = {
+                maxUncompressedBytes: 512 * 1024 * 1024,
+                maxZipEntries: 10000,
+            };
+        }
         return userConfig;
     }
     // 1. Start with full defaults (deep cloned)
@@ -65,9 +71,15 @@ function resolveParserConfig(userConfig) {
         return config;
     }
     // 2. Merge user config
-    // We handle ocrConfig specially to avoid shallow-overwriting the whole object
-    const { ocrConfig, ...rest } = userConfig;
+    // We handle ocrConfig and decompressionLimits specially to avoid shallow-overwriting the whole objects
+    const { ocrConfig, decompressionLimits, ...rest } = userConfig;
     Object.assign(config, rest);
+    if (decompressionLimits) {
+        config.decompressionLimits = {
+            ...config.decompressionLimits,
+            ...decompressionLimits,
+        };
+    }
     if (ocrConfig) {
         const { timeout, ...ocrRest } = ocrConfig;
         config.ocrConfig = {

package/dist/utils/errorUtils.js

@@ -30,7 +30,11 @@ const ERROR_MESSAGES = {
     [types_js_1.OfficeErrorType.INVALID_SELECTOR]: (selector) => `Invalid selector: ${selector}`,
     [types_js_1.OfficeErrorType.INVALID_OUTPUT_MAPPING]: (output) => `Invalid output mapping: ${output}`,
     [types_js_1.OfficeErrorType.MISSING_EMBEDDING_FUNCTION]: `Semantic chunking requires an "embeddingFunction" to be provided in chunksConfig. This function must accept a string and return a Promise resolving to a number array (vector).`,
-    [types_js_1.OfficeErrorType.OPERATION_ABORTED]: `The operation was aborted.`
+    [types_js_1.OfficeErrorType.OPERATION_ABORTED]: `The operation was aborted.`,
+    [types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED]: (limit) => `ZIP entry count exceeds limit (${limit})`,
+    [types_js_1.OfficeErrorType.ZIP_ENTRY_INVALID_SIZE]: `ZIP entry missing a valid declared size`,
+    [types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED]: (limit) => `ZIP uncompressed size limit exceeded (${limit} bytes)`,
+    [types_js_1.OfficeErrorType.EMBEDDING_TIMEOUT]: (timeout) => `Embedding call timed out after ${timeout}ms`
 };
 /**
  * Lookup table for warning messages.

package/dist/utils/zipUtils.d.ts

@@ -13,6 +13,7 @@
  *
  * @module zipUtils
  */
+import { DecompressionLimits } from '../types.js';
 /**
  * Represents a file extracted from a ZIP archive.
  * Contains the file's path within the archive and its content as a Buffer.
@@ -69,5 +70,5 @@ interface ZipFileContent {
  *
  * @see https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT ZIP file format specification
  */
-export declare const extractFiles: (zipInput: Buffer, filterFn: (fileName: string) => boolean) => Promise<ZipFileContent[]>;
+export declare const extractFiles: (zipInput: Buffer, filterFn: (fileName: string) => boolean, limits: DecompressionLimits) => Promise<ZipFileContent[]>;
 export {};

package/dist/utils/zipUtils.js

@@ -17,6 +17,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.extractFiles = void 0;
 const fflate_1 = require("fflate");
+const types_js_1 = require("../types.js");
+const errorUtils_js_1 = require("./errorUtils.js");
 /**
  * Extracts files from a ZIP archive with optional filtering.
  *
@@ -56,9 +58,39 @@ const fflate_1 = require("fflate");
  *
  * @see https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT ZIP file format specification
  */
-const extractFiles = (zipInput, filterFn) => {
+const extractFiles = (zipInput, filterFn, limits) => {
+    const maxUncompressedBytes = limits?.maxUncompressedBytes !== undefined && Number.isFinite(limits.maxUncompressedBytes) && limits.maxUncompressedBytes >= 0
+        ? limits.maxUncompressedBytes
+        : 512 * 1024 * 1024;
+    const maxZipEntries = limits?.maxZipEntries !== undefined && Number.isFinite(limits.maxZipEntries) && limits.maxZipEntries >= 0
+        ? limits.maxZipEntries
+        : 10000;
     return new Promise((resolve, reject) => {
-        (0, fflate_1.unzip)(new Uint8Array(zipInput.buffer, zipInput.byteOffset, zipInput.byteLength), { filter: (file) => filterFn(file.name) }, (err, decompressed) => {
+        let totalEntryCount = 0;
+        let entryCount = 0;
+        let declaredTotal = 0;
+        (0, fflate_1.unzip)(new Uint8Array(zipInput.buffer, zipInput.byteOffset, zipInput.byteLength), {
+            filter: (file) => {
+                totalEntryCount++;
+                if (totalEntryCount > maxZipEntries) {
+                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED, undefined, maxZipEntries));
+                    return false;
+                }
+                if (!filterFn(file.name))
+                    return false;
+                if (typeof file.originalSize !== 'number' || !Number.isFinite(file.originalSize) || file.originalSize < 0) {
+                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_ENTRY_INVALID_SIZE));
+                    return false;
+                }
+                entryCount++;
+                declaredTotal += file.originalSize;
+                if (declaredTotal > maxUncompressedBytes) {
+                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED, undefined, maxUncompressedBytes));
+                    return false;
+                }
+                return true;
+            }
+        }, (err, decompressed) => {
             if (err)
                 return reject(err);
             resolve(Object.entries(decompressed).map(([path, data]) => ({