npm - officeparser - Versions diffs - 7.2.2 → 7.3.0 - Mend

officeparser 7.2.2 → 7.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (43) hide show

package/README.md +161 -17
package/dist/OfficeGenerator.js +4 -0
package/dist/OfficeParser.d.ts +2 -0
package/dist/OfficeParser.js +6 -0
package/dist/cli.d.ts +1 -1
package/dist/cli.js +3 -2
package/dist/defaults.js +3 -3
package/dist/generators/BaseGenerator.d.ts +11 -0
package/dist/generators/BaseGenerator.js +29 -0
package/dist/generators/CsvGenerator.d.ts +9 -1
package/dist/generators/CsvGenerator.js +24 -14
package/dist/generators/EpubGenerator.d.ts +18 -0
package/dist/generators/EpubGenerator.js +242 -0
package/dist/generators/HtmlGenerator.d.ts +12 -0
package/dist/generators/HtmlGenerator.js +266 -51
package/dist/generators/MarkdownGenerator.d.ts +16 -0
package/dist/generators/MarkdownGenerator.js +173 -24
package/dist/generators/PdfGenerator.js +32 -0
package/dist/generators/RtfGenerator.js +12 -15
package/dist/generators/TextGenerator.js +11 -0
package/dist/index.d.ts +1 -0
package/dist/index.js +1 -0
package/dist/officeparser.browser.d.ts +144 -7
package/dist/officeparser.browser.iife.js +289 -193
package/dist/officeparser.browser.mjs +289 -193
package/dist/officeparser.browser.slim.d.ts +2129 -0
package/dist/officeparser.browser.slim.iife.js +1278 -0
package/dist/officeparser.browser.slim.mjs +1277 -0
package/dist/parsers/EpubParser.d.ts +8 -0
package/dist/parsers/EpubParser.js +217 -0
package/dist/parsers/HtmlParser.js +284 -20
package/dist/parsers/MarkdownParser.js +424 -33
package/dist/parsers/OpenOfficeParser.js +241 -54
package/dist/parsers/PdfParser.js +4 -1
package/dist/parsers/WordParser.js +2 -2
package/dist/sbom.cdx.json +111 -223
package/dist/types.d.ts +146 -7
package/dist/types.js +2 -0
package/dist/utils/errorUtils.js +3 -2
package/dist/utils/sanitize.d.ts +99 -0
package/dist/utils/sanitize.js +228 -0
package/dist/utils/zipUtils.js +76 -26
package/package.json +19 -10

package/dist/types.d.ts CHANGED Viewed

@@ -39,6 +39,8 @@ export declare enum OfficeErrorType {
     ZIP_ENTRY_INVALID_SIZE = "ZIP_ENTRY_INVALID_SIZE",
     /** ZIP uncompressed size limit exceeded */
     ZIP_SIZE_LIMIT_EXCEEDED = "ZIP_SIZE_LIMIT_EXCEEDED",
+    /** Document element/structure nesting exceeded the safe recursion depth */
+    MAX_NESTING_DEPTH_EXCEEDED = "MAX_NESTING_DEPTH_EXCEEDED",
     /** Embedding call timed out */
     EMBEDDING_TIMEOUT = "EMBEDDING_TIMEOUT"
 }
@@ -317,7 +319,7 @@ export interface OfficeParserConfig {
      * The URL/path to the PDF.js worker script.
      *
      * **Mandatory** when using PDF parsing in browser environments to avoid worker configuration errors.
-     * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@5.6.205/build/pdf.worker.min.mjs`.
+     * If not provided, it defaults to `https://cdn.jsdelivr.net/npm/pdfjs-dist@6.1.200/build/pdf.worker.min.mjs`.
      * You can override this with your own local path or a different CDN link.
      */
     pdfWorkerSrc?: string;
@@ -401,7 +403,7 @@ export interface OfficeIssue {
 /**
  * The result of a document conversion operation.
  */
-type ConversionValue<D extends UniversalGeneratorFormat> = D extends 'pdf' ? Uint8Array | string : D extends 'chunks' ? OfficeChunk[] : D extends 'csv' ? string | Uint8Array : string;
+type ConversionValue<D extends UniversalGeneratorFormat> = D extends 'pdf' ? Uint8Array | string : D extends 'chunks' ? OfficeChunk[] : D extends 'csv' ? string | Uint8Array : D extends 'epub' ? Uint8Array : string;
 export interface ConversionResult<D extends UniversalGeneratorFormat> {
     /** The actual generated content (HTML, Markdown, Text, OfficeChunk[], etc.). */
     value: ConversionValue<D>;
@@ -411,7 +413,7 @@ export interface ConversionResult<D extends UniversalGeneratorFormat> {
 /**
  * Universal formats supported by all source types for generation.
  */
-export type UniversalGeneratorFormat = 'text' | 'md' | 'html' | 'pdf' | 'csv' | 'rtf' | 'chunks';
+export type UniversalGeneratorFormat = 'text' | 'md' | 'html' | 'pdf' | 'csv' | 'rtf' | 'chunks' | 'epub';
 /**
  * Allowed destination formats for a given source type.
  * Currently, all generators are universal across all source formats.
@@ -628,15 +630,64 @@ export interface HtmlInjectionConfig {
     /** Raw HTML injected immediately before the closing </body> tag */
     bodyEnd?: string;
 }
+/**
+ * Granular control over which parts of the full HTML "document envelope" are emitted.
+ * Shorthand: `standalone: true` == every part on (a complete document); `standalone: false` ==
+ * every part off (a bare content fragment). When an object is passed, any field you omit
+ * defaults to its "on" (standalone) value.
+ */
+export interface StandaloneConfig {
+    /**
+     * Wrap the output in `<!DOCTYPE html><html><head>…</head><body>…</body></html>`.
+     * When false, only the inner content fragment is emitted. Defaults to true.
+     */
+    document?: boolean;
+    /**
+     * Emit `<title>` and `<meta>` tags (author, description, dates, custom properties) in the head.
+     * Only meaningful when `document` is true. Defaults to true.
+     */
+    metaTags?: boolean;
+    /**
+     * How the library's built-in CSS is delivered:
+     * - `'full'` — the complete premium stylesheet using global selectors (`body`, `h1`, `table`, …).
+     *   This is what `standalone: true` has always emitted.
+     * - `'scoped'` — the same styling, scoped under the fragment's container via CSS `@scope` so it
+     *   cannot leak into a host page's own styles. Requires a modern browser engine (Chrome 118+,
+     *   Safari 17.4+, Firefox 128+).
+     * - `'none'` — no stylesheet is emitted; the host page (or EPUB reader, or rich-text editor)
+     *   supplies its own styling.
+     * The boolean shorthand for `standalone` maps `true` → `'full'`, `false` → `'none'`.
+     * Defaults to `'full'`.
+     */
+    styles?: 'full' | 'scoped' | 'none';
+    /**
+     * Emit injected `<script>` tags: the Chart.js loader (when `includeCharts` is true and charts
+     * are present) and the spreadsheet interactivity script. Defaults to true.
+     */
+    scripts?: boolean;
+    /**
+     * Apply `injections.headStart` / `injections.headEnd`. Only meaningful when `document` is true
+     * (there is no `<head>` to inject into otherwise). Defaults to true.
+     */
+    headInjections?: boolean;
+    /**
+     * Apply `injections.bodyStart` / `injections.bodyEnd`. Applies even when generating a bare
+     * fragment (`document: false`), since these wrap body *content*, not the document shell.
+     * Defaults to true.
+     */
+    bodyInjections?: boolean;
+}
 /**
  * Configuration options for HTML generation.
  */
 export interface HtmlGeneratorConfig {
     /**
      * Whether to wrap the output in a full HTML document structure (e.g., <html>, <head>, etc.).
+     * Pass an object instead of a boolean for granular control over individual parts of the
+     * envelope (document shell, meta tags, styles, scripts, injections) - see `StandaloneConfig`.
      * Defaults to true.
      */
-    standalone?: boolean;
+    standalone?: boolean | StandaloneConfig;
     /**
      * URL for the Chart.js library to use when 'includeCharts' is true.
      * Defaults to 'https://cdn.jsdelivr.net/npm/chart.js'.
@@ -1057,11 +1108,11 @@ export interface OfficeChunk {
 /**
  * Supported file types for parsing.
  */
-export type SupportedFileType = 'docx' | 'pptx' | 'xlsx' | 'odt' | 'odp' | 'ods' | 'pdf' | 'rtf' | 'md' | 'html' | 'csv';
+export type SupportedFileType = 'docx' | 'pptx' | 'xlsx' | 'odt' | 'odp' | 'ods' | 'pdf' | 'rtf' | 'md' | 'html' | 'csv' | 'epub';
 /**
  * Types of content nodes in the AST.
  */
-export type OfficeContentNodeType = 'paragraph' | 'heading' | 'table' | 'list' | 'text' | 'image' | 'chart' | 'drawing' | 'slide' | 'note' | 'sheet' | 'row' | 'cell' | 'page' | 'break' | 'code' | 'comment' | 'header' | 'footer' | 'slideMaster';
+export type OfficeContentNodeType = 'paragraph' | 'heading' | 'table' | 'list' | 'text' | 'image' | 'chart' | 'drawing' | 'slide' | 'note' | 'sheet' | 'row' | 'cell' | 'page' | 'break' | 'code' | 'comment' | 'header' | 'footer' | 'slideMaster' | 'embed' | 'admonition' | 'definitionList' | 'definitionTerm' | 'definitionDescription';
 /**
  * Supported MIME types for attachments.
  */
@@ -1255,6 +1306,10 @@ export interface ListMetadata {
     style?: string;
     /** Unique anchor IDs for internal linking. */
     anchorIds?: string[];
+    /** True when this list item is a GFM task-list item (checkbox), regardless of checked state. */
+    isTask?: boolean;
+    /** Checked state for a task-list item. Only meaningful when isTask is true. */
+    checked?: boolean;
 }
 /**
  * Metadata for a table cell (primarily used in Excel/spreadsheet parsing).
@@ -1294,6 +1349,11 @@ export interface CellMetadata {
 export interface TableMetadata {
     /** Unique anchor IDs for internal linking. */
     anchorIds?: string[];
+    /**
+     * Layout alignment of the table on the page (e.g. inscript-editor's `CustomTable`).
+     * @example 'center'
+     */
+    align?: 'left' | 'center' | 'right';
 }
 /**
  * Metadata for a chart node in the document.
@@ -1334,6 +1394,42 @@ export interface ImageMetadata {
     url?: string;
     /** Unique anchor IDs for internal linking. */
     anchorIds?: string[];
+    /**
+     * Display width of the image (e.g. inscript-editor's `CustomImage`), as a CSS length or percentage.
+     * @example "50%"
+     */
+    width?: string;
+    /**
+     * Layout alignment of the image (e.g. inscript-editor's `CustomImage`).
+     * @example 'center'
+     */
+    align?: 'left' | 'center' | 'right';
+}
+/**
+ * Metadata for an embedded external media node (e.g. a YouTube video).
+ * Markdown has no native syntax for this - see `MarkdownGenerator`'s `embed` case.
+ */
+export interface EmbedMetadata {
+    /** The kind of embed. Only 'youtube' is supported today; the shape is generic for future providers. */
+    embedType: 'youtube';
+    /** The provider-specific video ID (e.g. the 11-character YouTube video ID). */
+    videoId: string;
+    /** The original/canonical URL of the embedded media, if known. */
+    url?: string;
+    /** Display width, as a CSS length or percentage. */
+    width?: string;
+    /** Layout alignment of the embed. */
+    align?: 'left' | 'center' | 'right';
+}
+/**
+ * Metadata for an admonition/alert node (e.g. GitHub's `> [!NOTE]` or GLFM's `:::note`).
+ * `MarkdownParser` accepts both syntaxes; `MarkdownGenerator` only ever writes the
+ * blockquote form. Children are block content (paragraphs) wrapped by the admonition.
+ */
+export interface AdmonitionMetadata {
+    admonitionType: 'note' | 'tip' | 'important' | 'warning' | 'caution';
+    /** Optional custom title; falls back to the type label. */
+    title?: string;
 }
 /**
  * Metadata for PDF page nodes.
@@ -1364,6 +1460,25 @@ export interface TextMetadata {
      * - 'external': Link to an external URL
      */
     linkType?: 'internal' | 'external';
+    /**
+     * When set, this text is an abbreviation and this is its full-form expansion,
+     * rendered as `<abbr title="...">`. Populated from Markdown Extra's
+     * `*[HTML]: Hypertext Markup Language` syntax or an HTML `<abbr>` tag.
+     */
+    abbreviationTitle?: string;
+    /**
+     * When set, this text is a Pandoc/MultiMarkdown-style citation reference
+     * (`[@citekey]`), and this is the bare citekey (e.g. "smith2024"). Bibliography
+     * resolution (author/year display, .bib management) is left to the consuming app.
+     */
+    citationKey?: string;
+    /**
+     * True when this is an Obsidian-style wikilink (`[[page]]` / `[[page|alias]]`).
+     * `link` holds the bare page name and `linkType` is always 'internal'; the
+     * per-workspace enable/disable toggle lives in markdownwriter, not here -
+     * officeParser always parses/generates the syntax.
+     */
+    wikilink?: boolean;
 }
 /**
  * Metadata for note nodes (footnotes/endnotes).
@@ -1417,6 +1532,12 @@ export interface CodeMetadata {
     language?: string;
     /** Unique anchor IDs for internal linking. */
     anchorIds?: string[];
+    /**
+     * When set, this node is a LaTeX math expression rather than a code block. `node.text`
+     * holds the bare LaTeX (delimiters excluded); 'inline' round-trips as `$...$`,
+     * 'block' as `$$...$$`. Matches inscript-editor's math node (Roadmap Step 11.5).
+     */
+    math?: 'inline' | 'block';
 }
 /**
  * Metadata for a comment/annotation.
@@ -1436,7 +1557,7 @@ export interface HeaderFooterMetadata {
 /**
  * Union type for content metadata.
  */
-export type ContentMetadata = SlideMetadata | SheetMetadata | HeadingMetadata | ListMetadata | CellMetadata | ImageMetadata | ChartMetadata | PageMetadata | ParagraphMetadata | TextMetadata | NoteMetadata | BreakMetadata | CodeMetadata | CommentMetadata | HeaderFooterMetadata | TableMetadata | undefined;
+export type ContentMetadata = SlideMetadata | SheetMetadata | HeadingMetadata | ListMetadata | CellMetadata | ImageMetadata | ChartMetadata | PageMetadata | ParagraphMetadata | TextMetadata | NoteMetadata | BreakMetadata | CodeMetadata | CommentMetadata | HeaderFooterMetadata | TableMetadata | EmbedMetadata | AdmonitionMetadata | undefined;
 /**
  * Represents a node in the document content tree.
  * This is the core building block of the parsed document structure.
@@ -1598,6 +1719,21 @@ export type OfficeContentNode = BaseContentNode & ({
 } | {
     type: 'slideMaster';
     metadata?: SlideMetadata;
+} | {
+    type: 'embed';
+    metadata?: EmbedMetadata;
+} | {
+    type: 'admonition';
+    metadata?: AdmonitionMetadata;
+} | {
+    type: 'definitionList';
+    metadata?: undefined;
+} | {
+    type: 'definitionTerm';
+    metadata?: undefined;
+} | {
+    type: 'definitionDescription';
+    metadata?: undefined;
 });
 /**
  * Structured information extracted from a chart.
@@ -1872,4 +2008,7 @@ export interface OfficeParserAST {
      */
     to<T extends this, D extends SupportedDestination<T['type']>>(this: T, destination: D, config?: GeneratorConfig<D>): Promise<ConversionResult<D>>;
 }
+declare global {
+    const __SLIM__: boolean | undefined;
+}
 export {};

package/dist/types.js CHANGED Viewed

@@ -43,6 +43,8 @@ var OfficeErrorType;
     OfficeErrorType["ZIP_ENTRY_INVALID_SIZE"] = "ZIP_ENTRY_INVALID_SIZE";
     /** ZIP uncompressed size limit exceeded */
     OfficeErrorType["ZIP_SIZE_LIMIT_EXCEEDED"] = "ZIP_SIZE_LIMIT_EXCEEDED";
+    /** Document element/structure nesting exceeded the safe recursion depth */
+    OfficeErrorType["MAX_NESTING_DEPTH_EXCEEDED"] = "MAX_NESTING_DEPTH_EXCEEDED";
     /** Embedding call timed out */
     OfficeErrorType["EMBEDDING_TIMEOUT"] = "EMBEDDING_TIMEOUT";
 })(OfficeErrorType || (exports.OfficeErrorType = OfficeErrorType = {}));

package/dist/utils/errorUtils.js CHANGED Viewed

@@ -16,8 +16,8 @@ const ERRORHEADER = "[OfficeParser]: ";
  * Some entries are functions that take parameters to build dynamic messages.
  */
 const ERROR_MESSAGES = {
-    [types_js_1.OfficeErrorType.EXTENSION_UNSUPPORTED]: (ext) => `Sorry, OfficeParser currently supports docx, pptx, xlsx, odt, odp, ods, pdf, rtf, md, html, csv files only. Create a ticket in Issues on github to add support for ${ext} files. Stay tuned for further updates.`,
-    [types_js_1.OfficeErrorType.FORMAT_UNSUPPORTED]: (format) => `Sorry, OfficeGenerator does not support generating '${format}' files. Supported formats: json, text, md, html, csv, rtf, pdf, chunks.`,
+    [types_js_1.OfficeErrorType.EXTENSION_UNSUPPORTED]: (ext) => `Sorry, OfficeParser currently supports docx, pptx, xlsx, odt, odp, ods, pdf, rtf, md, html, csv, epub files only. Create a ticket in Issues on github to add support for ${ext} files. Stay tuned for further updates.`,
+    [types_js_1.OfficeErrorType.FORMAT_UNSUPPORTED]: (format) => `Sorry, OfficeGenerator does not support generating '${format}' files. Supported formats: json, text, md, html, csv, rtf, pdf, chunks, epub.`,
     [types_js_1.OfficeErrorType.FILE_CORRUPTED]: (filepath) => `Your file ${filepath} seems to be corrupted. If you are sure it is fine, please create a ticket in Issues on github with the file to reproduce error.`,
     [types_js_1.OfficeErrorType.FILE_DOES_NOT_EXIST]: (filepath) => `File ${filepath} could not be found! Check if the file exists or verify if the relative path to the file is correct from your terminal's location.`,
     [types_js_1.OfficeErrorType.LOCATION_NOT_FOUND]: (location) => `Entered location ${location} is not reachable! Please make sure that the entered directory location exists. Check relative paths and reenter.`,
@@ -34,6 +34,7 @@ const ERROR_MESSAGES = {
     [types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED]: (limit) => `ZIP entry count exceeds limit (${limit})`,
     [types_js_1.OfficeErrorType.ZIP_ENTRY_INVALID_SIZE]: `ZIP entry missing a valid declared size`,
     [types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED]: (limit) => `ZIP uncompressed size limit exceeded (${limit} bytes)`,
+    [types_js_1.OfficeErrorType.MAX_NESTING_DEPTH_EXCEEDED]: `Document nesting depth exceeded the safe limit (possible denial-of-service input)`,
     [types_js_1.OfficeErrorType.EMBEDDING_TIMEOUT]: (timeout) => `Embedding call timed out after ${timeout}ms`
 };
 /**

package/dist/utils/sanitize.d.ts ADDED Viewed

@@ -0,0 +1,99 @@
+/**
+ * Shared output-sanitization helpers.
+ *
+ * Every string in the parsed AST originates from an untrusted document, so any
+ * value interpolated into generated output (HTML, XHTML, CSS, URLs, inline
+ * scripts, CSV, RTF, Markdown) must be escaped for its destination context.
+ * These are the single source of truth — each generator delegates to them so
+ * escaping stays consistent and a gap fixed here is fixed everywhere.
+ */
+/**
+ * Escapes text for an HTML text node or a double-quoted attribute value.
+ * Includes the single quote so the result is also safe inside single-quoted
+ * attributes.
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * Escapes text for an XML text node or attribute (XHTML/OPF/NCX). Same as
+ * escapeHtml but emits the XML-canonical `&apos;` for the single quote.
+ */
+export declare function escapeXml(text: string): string;
+/**
+ * Sanitizes a single CSS value (e.g. a color/size/font/alignment pulled from a
+ * document) for placement inside a `style="prop: VALUE"` attribute.
+ *
+ * - Drops the whole value if it contains a resource-fetching or executing
+ *   construct (`url()`, `expression()`, `@import`, `image-set()`, `javascript:`)
+ *   or angle brackets that could break out of the attribute/tag.
+ * - Strips characters that break out of `prop: value` (`;`, quotes), out of a
+ *   `<style>` rule (`{}`), CSS escapes (`\`), and control characters.
+ *
+ * `rgb()/hsl()` and hex/named colors, lengths, and (unquoted) font names all
+ * survive; the trade-off is that legitimately quoted font names lose their
+ * quotes, which browsers tolerate.
+ */
+export declare function sanitizeCssValue(value: string): string;
+/**
+ * Escapes a document-supplied URL for use in an href/src attribute. Beyond the
+ * usual attribute escaping, this rejects script-executing schemes (javascript:,
+ * vbscript:, data:, etc.) so a hyperlink extracted from an untrusted document
+ * can't run code when clicked — only http(s)/mailto/tel and relative/fragment
+ * URLs are passed through.
+ */
+export declare function sanitizeUrl(url: string): string;
+/**
+ * Like sanitizeUrl but for an <img>/<source> src: additionally permits
+ * `data:image/*` URIs (embedded document images) while still rejecting
+ * script-executing schemes and non-image data URIs (e.g. data:text/html).
+ */
+export declare function sanitizeImageUrl(url: string): string;
+/**
+ * Serializes data for embedding inside an inline <script> block. JSON.stringify
+ * alone doesn't escape "<", so a value containing "</script>" (e.g. a chart
+ * label from attacker-controlled document XML) would close the script early and
+ * inject markup. Also escapes the U+2028/U+2029 line separators, which are
+ * invalid in JS string literals.
+ */
+export declare function serializeForInlineScript(data: unknown): string;
+/**
+ * Formats a value for a CSV field: guards against spreadsheet formula/DDE
+ * injection (CWE-1236) and applies RFC 4180 quoting.
+ *
+ * A cell beginning with `= + - @` (or a tab/CR that some apps treat as a
+ * formula start) is prefixed with a single quote so Excel/Sheets render it as
+ * literal text rather than executing it. Genuine numbers (including negatives)
+ * are exempt so numeric columns are preserved.
+ */
+export declare function csvSafeCell(value: string, delimiter: string): string;
+/**
+ * Escapes text for RTF: neutralizes the control/group metacharacters `\ { }`
+ * (which would otherwise inject RTF control words or groups), encodes the double
+ * quote (so a hyperlink field argument can't be terminated early), and hex/unicode
+ * encodes non-ASCII characters.
+ */
+export declare function escapeRtf(text: string): string;
+/**
+ * Escapes document text for a Markdown text position. Markdown passes raw HTML
+ * through to the renderer, so a `<` that begins an HTML tag or comment must be
+ * neutralized to prevent `<script>`/`<img onerror>` injection when the Markdown
+ * is later rendered to HTML.
+ *
+ * Deliberately narrow — only a `<` immediately followed by a letter, `/`, `!` or
+ * `?` (i.e. one that actually opens a tag/comment/PI, matching how browsers
+ * detect tags) is encoded. A bare `<` (e.g. `a < b`), `>`, `&`, `[]` and other
+ * Markdown metacharacters are left untouched: they can't start a tag, and
+ * MarkdownParser round-trips this output without decoding entities, so encoding
+ * them would corrupt re-parsed content. URL schemes are handled by
+ * sanitizeMarkdownUrl.
+ */
+export declare function markdownEscapeText(text: string): string;
+/**
+ * Sanitizes a document-supplied URL for a Markdown `[text](url)` / `![alt](url)`
+ * target. Rejects script-executing schemes (returning '' → a dead link) and
+ * percent-encodes the characters that would break out of the `(...)` or inject
+ * markup. `&` is preserved so query strings survive; set `allowDataImage` for
+ * image targets so embedded `data:image/*` URIs are permitted.
+ */
+export declare function sanitizeMarkdownUrl(url: string, opts?: {
+    allowDataImage?: boolean;
+}): string;

package/dist/utils/sanitize.js ADDED Viewed

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Shared output-sanitization helpers.
+ *
+ * Every string in the parsed AST originates from an untrusted document, so any
+ * value interpolated into generated output (HTML, XHTML, CSS, URLs, inline
+ * scripts, CSV, RTF, Markdown) must be escaped for its destination context.
+ * These are the single source of truth — each generator delegates to them so
+ * escaping stays consistent and a gap fixed here is fixed everywhere.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapeHtml = escapeHtml;
+exports.escapeXml = escapeXml;
+exports.sanitizeCssValue = sanitizeCssValue;
+exports.sanitizeUrl = sanitizeUrl;
+exports.sanitizeImageUrl = sanitizeImageUrl;
+exports.serializeForInlineScript = serializeForInlineScript;
+exports.csvSafeCell = csvSafeCell;
+exports.escapeRtf = escapeRtf;
+exports.markdownEscapeText = markdownEscapeText;
+exports.sanitizeMarkdownUrl = sanitizeMarkdownUrl;
+/**
+ * Escapes text for an HTML text node or a double-quoted attribute value.
+ * Includes the single quote so the result is also safe inside single-quoted
+ * attributes.
+ */
+function escapeHtml(text) {
+    if (typeof text !== 'string')
+        return text;
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Escapes text for an XML text node or attribute (XHTML/OPF/NCX). Same as
+ * escapeHtml but emits the XML-canonical `&apos;` for the single quote.
+ */
+function escapeXml(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+/**
+ * Sanitizes a single CSS value (e.g. a color/size/font/alignment pulled from a
+ * document) for placement inside a `style="prop: VALUE"` attribute.
+ *
+ * - Drops the whole value if it contains a resource-fetching or executing
+ *   construct (`url()`, `expression()`, `@import`, `image-set()`, `javascript:`)
+ *   or angle brackets that could break out of the attribute/tag.
+ * - Strips characters that break out of `prop: value` (`;`, quotes), out of a
+ *   `<style>` rule (`{}`), CSS escapes (`\`), and control characters.
+ *
+ * `rgb()/hsl()` and hex/named colors, lengths, and (unquoted) font names all
+ * survive; the trade-off is that legitimately quoted font names lose their
+ * quotes, which browsers tolerate.
+ */
+function sanitizeCssValue(value) {
+    if (typeof value !== 'string')
+        return '';
+    // Strip control chars and CSS comments FIRST, then test for dangerous constructs.
+    // Order matters: a payload like "u\nrl(" or "url/*x*/(" would survive the test if
+    // tested before removal, then reassemble into "url(" once the noise is stripped.
+    const cleaned = value
+        .replace(/[\x00-\x1F\x7F]/g, '') // control chars (incl. newlines/tabs)
+        .replace(/\/\*[\s\S]*?\*\//g, ''); // CSS comments used to obfuscate
+    if (/(?:url|expression|image-set|element|-moz-binding)\s*\(|@import|javascript:|[<>]/i.test(cleaned)) {
+        return '';
+    }
+    return cleaned.replace(/[;{}"'`\\]/g, '').trim();
+}
+/**
+ * Escapes a document-supplied URL for use in an href/src attribute. Beyond the
+ * usual attribute escaping, this rejects script-executing schemes (javascript:,
+ * vbscript:, data:, etc.) so a hyperlink extracted from an untrusted document
+ * can't run code when clicked — only http(s)/mailto/tel and relative/fragment
+ * URLs are passed through.
+ */
+function sanitizeUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    // Browsers ignore control characters when parsing a URL scheme, so strip them
+    // first to catch obfuscated payloads like "java\tscript:alert(1)".
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch && !/^(https?|mailto|tel)$/i.test(schemeMatch[1])) {
+        return '';
+    }
+    // Emit the same normalized string that was validated.
+    return escapeHtml(stripped);
+}
+/**
+ * Like sanitizeUrl but for an <img>/<source> src: additionally permits
+ * `data:image/*` URIs (embedded document images) while still rejecting
+ * script-executing schemes and non-image data URIs (e.g. data:text/html).
+ */
+function sanitizeImageUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        if (scheme === 'data') {
+            if (!/^data:image\//i.test(stripped))
+                return '';
+        }
+        else if (scheme !== 'http' && scheme !== 'https') {
+            return '';
+        }
+    }
+    return escapeHtml(stripped);
+}
+/**
+ * Serializes data for embedding inside an inline <script> block. JSON.stringify
+ * alone doesn't escape "<", so a value containing "</script>" (e.g. a chart
+ * label from attacker-controlled document XML) would close the script early and
+ * inject markup. Also escapes the U+2028/U+2029 line separators, which are
+ * invalid in JS string literals.
+ */
+function serializeForInlineScript(data) {
+    // U+2028/U+2029 (line/paragraph separators) are valid in JSON but break
+    // JS string literals; reference them by code point to keep the source ASCII.
+    const lineSep = String.fromCharCode(0x2028);
+    const paraSep = String.fromCharCode(0x2029);
+    return JSON.stringify(data)
+        .replace(/</g, '\\u003C')
+        .replace(/>/g, '\\u003E')
+        .split(lineSep).join('\\u2028')
+        .split(paraSep).join('\\u2029');
+}
+/**
+ * Formats a value for a CSV field: guards against spreadsheet formula/DDE
+ * injection (CWE-1236) and applies RFC 4180 quoting.
+ *
+ * A cell beginning with `= + - @` (or a tab/CR that some apps treat as a
+ * formula start) is prefixed with a single quote so Excel/Sheets render it as
+ * literal text rather than executing it. Genuine numbers (including negatives)
+ * are exempt so numeric columns are preserved.
+ */
+function csvSafeCell(value, delimiter) {
+    let v = typeof value === 'string' ? value : String(value ?? '');
+    // A plain signed number (e.g. "-8", "+7", "-5.3") can't be a formula, so exempt it —
+    // otherwise numeric columns get quoted as text. Anything else starting with a formula
+    // trigger (including "+1+1", "-1+cmd", "=", "@") is prefixed with a quote.
+    const isNumber = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/.test(v.trim());
+    if (!isNumber && /^[=+\-@\t\r]/.test(v)) {
+        v = `'${v}`;
+    }
+    if (v.includes(delimiter) || v.includes('"') || v.includes('\n') || v.includes('\r')) {
+        return `"${v.replace(/"/g, '""')}"`;
+    }
+    return v;
+}
+/**
+ * Escapes text for RTF: neutralizes the control/group metacharacters `\ { }`
+ * (which would otherwise inject RTF control words or groups), encodes the double
+ * quote (so a hyperlink field argument can't be terminated early), and hex/unicode
+ * encodes non-ASCII characters.
+ */
+function escapeRtf(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/\\/g, '\\\\')
+        .replace(/{/g, '\\{')
+        .replace(/}/g, '\\}')
+        .replace(/"/g, "\\'22")
+        .replace(/[^\x00-\x7F]/g, (match) => {
+        let code = match.charCodeAt(0);
+        if (code < 256) {
+            return `\\'${code.toString(16).padStart(2, '0')}`;
+        }
+        if (code > 32767) {
+            code -= 65536;
+        }
+        return `{\\uc0\\u${code}}`;
+    });
+}
+/**
+ * Escapes document text for a Markdown text position. Markdown passes raw HTML
+ * through to the renderer, so a `<` that begins an HTML tag or comment must be
+ * neutralized to prevent `<script>`/`<img onerror>` injection when the Markdown
+ * is later rendered to HTML.
+ *
+ * Deliberately narrow — only a `<` immediately followed by a letter, `/`, `!` or
+ * `?` (i.e. one that actually opens a tag/comment/PI, matching how browsers
+ * detect tags) is encoded. A bare `<` (e.g. `a < b`), `>`, `&`, `[]` and other
+ * Markdown metacharacters are left untouched: they can't start a tag, and
+ * MarkdownParser round-trips this output without decoding entities, so encoding
+ * them would corrupt re-parsed content. URL schemes are handled by
+ * sanitizeMarkdownUrl.
+ */
+function markdownEscapeText(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text.replace(/<(?=[a-zA-Z/!?])/g, '&lt;');
+}
+/**
+ * Sanitizes a document-supplied URL for a Markdown `[text](url)` / `![alt](url)`
+ * target. Rejects script-executing schemes (returning '' → a dead link) and
+ * percent-encodes the characters that would break out of the `(...)` or inject
+ * markup. `&` is preserved so query strings survive; set `allowDataImage` for
+ * image targets so embedded `data:image/*` URIs are permitted.
+ */
+function sanitizeMarkdownUrl(url, opts) {
+    if (typeof url !== 'string')
+        return '';
+    const stripped = url.trim().replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        const ok = /^(?:https?|mailto|tel)$/.test(scheme)
+            || (opts?.allowDataImage === true && /^data:image\//i.test(stripped));
+        if (!ok)
+            return '';
+    }
+    return stripped.replace(/[\s()<>"`\\]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
+}