officeparser 7.2.3 → 7.4.0

package/dist/utils/configUtils.js

@@ -8,6 +8,37 @@ exports.isValidContainerWidth = isValidContainerWidth;
 const defaults_js_1 = require("../defaults.js");
 const types_js_1 = require("../types.js");
 const errorUtils_js_1 = require("./errorUtils.js");
+/**
+ * Keys that must never be copied from a caller-supplied config onto one of our objects.
+ *
+ * A config that arrived via `JSON.parse` can carry `__proto__` as a genuine **own enumerable**
+ * property (an object *literal* cannot - there `__proto__` invokes the setter at parse time),
+ * which is exactly the shape of a host application accepting a JSON config blob. Copying that
+ * key reaches `Object.prototype` and corrupts every object in the process.
+ *
+ * `constructor` and `prototype` are included because they are the other two names that reach a
+ * prototype through an ordinary property write.
+ */
+const PROTOTYPE_POLLUTION_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * Returns a copy of `source` with prototype-reaching keys removed.
+ *
+ * Needed before `Object.assign`, which does **not** pollute `Object.prototype` (it writes via
+ * `[[Set]]`, so `__proto__` invokes the inherited setter rather than creating an own property) -
+ * but that setter is not inert: it **replaces the target's prototype**, so the returned config
+ * silently inherits attacker-chosen properties for every field the defaults don't set as an own
+ * property. Narrower than global pollution, still wrong. Do not "simplify" this away on the
+ * grounds that `Object.assign` is safe; it is safe only against the *global* variant.
+ */
+function withoutPrototypeKeys(source) {
+    const safe = {};
+    for (const key of Object.keys(source)) {
+        if (PROTOTYPE_POLLUTION_KEYS.has(key))
+            continue;
+        safe[key] = source[key];
+    }
+    return safe;
+}
 /**
  * Deep clones an object, specifically handling arrays and plain objects.
  */
@@ -61,6 +92,7 @@ function resolveParserConfig(userConfig) {
             userConfig.decompressionLimits = {
                 maxUncompressedBytes: 512 * 1024 * 1024,
                 maxZipEntries: 10000,
+                maxTableCells: 1000000,
             };
         }
         return userConfig;
@@ -71,15 +103,22 @@ function resolveParserConfig(userConfig) {
         return config;
     }
     // 2. Merge user config
-    // We handle ocrConfig and decompressionLimits specially to avoid shallow-overwriting the whole objects
-    const { ocrConfig, decompressionLimits, ...rest } = userConfig;
-    Object.assign(config, rest);
+    // We handle ocrConfig, decompressionLimits, and htmlParserConfig specially to avoid
+    // shallow-overwriting the whole nested objects
+    const { ocrConfig, decompressionLimits, htmlParserConfig, ...rest } = userConfig;
+    Object.assign(config, withoutPrototypeKeys(rest));
     if (decompressionLimits) {
         config.decompressionLimits = {
             ...config.decompressionLimits,
             ...decompressionLimits,
         };
     }
+    if (htmlParserConfig) {
+        config.htmlParserConfig = {
+            ...config.htmlParserConfig,
+            ...htmlParserConfig,
+        };
+    }
     if (ocrConfig) {
         const { timeout, ...ocrRest } = ocrConfig;
         config.ocrConfig = {
@@ -124,12 +163,22 @@ function resolveGeneratorConfig(destination, astConfig, userConfig) {
     if (userConfig) {
         // Extract sub-configs to avoid shallow-overwriting the whole sub-config objects
         const { htmlConfig, mdConfig, pdfConfig, csvConfig, textConfig, chunksConfig, ...commonProps } = userConfig;
-        Object.assign(config, commonProps);
+        Object.assign(config, withoutPrototypeKeys(commonProps));
         // Merge sub-configs individually, ignoring undefined properties to preserve defaults
         const mergeSubConfig = (target, source) => {
             if (!source)
                 return;
             for (const key in source) {
+                // Both guards are load-bearing and neither subsumes the other. The own-property
+                // check (matching deepClone above) stops inherited enumerable properties, which
+                // matters once anything else in the process has already polluted a prototype. It
+                // does NOT stop this attack on its own: `JSON.parse('{"__proto__":{...}}')` yields
+                // `__proto__` as an own enumerable key, so it passes hasOwnProperty and would be
+                // written straight through to Object.prototype by the recursion below.
+                if (!Object.prototype.hasOwnProperty.call(source, key))
+                    continue;
+                if (PROTOTYPE_POLLUTION_KEYS.has(key))
+                    continue;
                 if (source[key] !== undefined) {
                     // Deep merge plain objects (like injections or margin)
                     if (typeof source[key] === 'object' &&

package/dist/utils/errorUtils.js

@@ -16,8 +16,8 @@ const ERRORHEADER = "[OfficeParser]: ";
  * Some entries are functions that take parameters to build dynamic messages.
  */
 const ERROR_MESSAGES = {
-    [types_js_1.OfficeErrorType.EXTENSION_UNSUPPORTED]: (ext) => `Sorry, OfficeParser currently supports docx, pptx, xlsx, odt, odp, ods, pdf, rtf, md, html, csv files only. Create a ticket in Issues on github to add support for ${ext} files. Stay tuned for further updates.`,
-    [types_js_1.OfficeErrorType.FORMAT_UNSUPPORTED]: (format) => `Sorry, OfficeGenerator does not support generating '${format}' files. Supported formats: json, text, md, html, csv, rtf, pdf, chunks.`,
+    [types_js_1.OfficeErrorType.EXTENSION_UNSUPPORTED]: (ext) => `Sorry, OfficeParser currently supports docx, pptx, xlsx, odt, odp, ods, pdf, rtf, md, html, csv, epub files only. Create a ticket in Issues on github to add support for ${ext} files. Stay tuned for further updates.`,
+    [types_js_1.OfficeErrorType.FORMAT_UNSUPPORTED]: (format) => `Sorry, OfficeGenerator does not support generating '${format}' files. Supported formats: json, text, md, html, csv, rtf, pdf, chunks, epub.`,
     [types_js_1.OfficeErrorType.FILE_CORRUPTED]: (filepath) => `Your file ${filepath} seems to be corrupted. If you are sure it is fine, please create a ticket in Issues on github with the file to reproduce error.`,
     [types_js_1.OfficeErrorType.FILE_DOES_NOT_EXIST]: (filepath) => `File ${filepath} could not be found! Check if the file exists or verify if the relative path to the file is correct from your terminal's location.`,
     [types_js_1.OfficeErrorType.LOCATION_NOT_FOUND]: (location) => `Entered location ${location} is not reachable! Please make sure that the entered directory location exists. Check relative paths and reenter.`,
@@ -34,6 +34,7 @@ const ERROR_MESSAGES = {
     [types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED]: (limit) => `ZIP entry count exceeds limit (${limit})`,
     [types_js_1.OfficeErrorType.ZIP_ENTRY_INVALID_SIZE]: `ZIP entry missing a valid declared size`,
     [types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED]: (limit) => `ZIP uncompressed size limit exceeded (${limit} bytes)`,
+    [types_js_1.OfficeErrorType.MAX_NESTING_DEPTH_EXCEEDED]: `Document nesting depth exceeded the safe limit (possible denial-of-service input)`,
     [types_js_1.OfficeErrorType.EMBEDDING_TIMEOUT]: (timeout) => `Embedding call timed out after ${timeout}ms`
 };
 /**
@@ -56,7 +57,10 @@ const WARNING_MESSAGES = {
     [types_js_1.OfficeWarningType.FILE_TYPE_DETECTION_FAILED]: `Auto-detection of file type failed. This can happen on older Node.js versions with modern file-type versions. Please provide the 'fileType' hint in the configuration if parsing fails.`,
     [types_js_1.OfficeWarningType.EMPTY_CHUNK_GENERATED]: (strategy) => `No chunks generated for document. Check if the document content is compatible with the '${strategy}' strategy.`,
     [types_js_1.OfficeWarningType.WHITESPACE_NODE_SKIPPED]: (nodeType) => `Skipped whitespace-only node of type: ${nodeType}`,
-    [types_js_1.OfficeWarningType.INVALID_CONTAINER_WIDTH]: (val) => `Invalid HTML containerWidth: ${JSON.stringify(val)}. Falling back to "auto". Width must be a positive number, a valid CSS length string (e.g., "900px", "100%", "50vw"), or "auto".`
+    [types_js_1.OfficeWarningType.TABLE_CELL_LIMIT_EXCEEDED]: (limit) => `Table cell limit (${limit}) reached while expanding repeated ODF cells/rows; the remaining cells were not materialized. A few hundred bytes of XML can request an unbounded number of cells via table:number-columns-repeated / table:number-rows-repeated, so this is capped. Raise decompressionLimits.maxTableCells if your documents legitimately exceed it.`,
+    [types_js_1.OfficeWarningType.INVALID_CONTAINER_WIDTH]: (val) => `Invalid HTML containerWidth: ${JSON.stringify(val)}. Falling back to "auto". Width must be a positive number, a valid CSS length string (e.g., "900px", "100%", "50vw"), or "auto".`,
+    [types_js_1.OfficeWarningType.METADATA_NOT_REPRESENTABLE]: (info) => `Custom metadata ${info.keys.map(k => `'${k}'`).join(', ')} could not be written to ${info.format} output: the format has a fixed metadata vocabulary with no place for caller-defined keys. The named metadata fields (title, author, etc.) were still applied.`,
+    [types_js_1.OfficeWarningType.INVALID_STYLE_MAP_TAG]: (tag) => `styleMap output.tag ${JSON.stringify(tag)} is not an allowed element name and was ignored; the node's default tag was used instead. A tag name is written into both the opening and closing tag, so only a known-safe set of block, heading and inline elements is accepted.`
 };
 /**
  * Creates a formatted warning message for a specific warning type.

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Shared output-sanitization helpers.
+ *
+ * Every string in the parsed AST originates from an untrusted document, so any
+ * value interpolated into generated output (HTML, XHTML, CSS, URLs, inline
+ * scripts, CSV, RTF, Markdown) must be escaped for its destination context.
+ * These are the single source of truth — each generator delegates to them so
+ * escaping stays consistent and a gap fixed here is fixed everywhere.
+ */
+/**
+ * Whether a string is a plain HTML attribute *name*, safe to interpolate before `="..."`.
+ *
+ * Escaping the value is not enough on its own: a key containing a quote or `=` closes the
+ * attribute and opens another, so `x" onmouseover="alert(1)" z` yields a real event handler no
+ * matter how carefully the value is escaped. This is the shape an attribute-injection payload
+ * takes, and rejecting it outright is simpler and safer than trying to escape a name.
+ *
+ * The predicate is shared rather than restated because it is now applied at four independent
+ * points (the parser's attribute collection, the generator's attribute bag, and two
+ * styleMap-driven paths). Each of those still keeps its own skip-list inline: the lists are the
+ * same policy expressed for different layers, and collapsing them would erase the defence in
+ * depth the surrounding comments describe.
+ */
+export declare function isSafeHtmlAttributeName(name: string): boolean;
+/**
+ * Whether a `styleMap` `output.tag` may be emitted as an element name.
+ *
+ * Callers must fall back to their default tag when this returns false, never emit the value.
+ */
+export declare function isSafeStyleMapTag(tag: unknown): tag is string;
+/**
+ * Escapes text for an HTML text node or a double-quoted attribute value.
+ * Includes the single quote so the result is also safe inside single-quoted
+ * attributes.
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * Escapes text for an XML text node or attribute (XHTML/OPF/NCX). Same as
+ * escapeHtml but emits the XML-canonical `'` for the single quote.
+ */
+export declare function escapeXml(text: string): string;
+/**
+ * Sanitizes a single CSS value (e.g. a color/size/font/alignment pulled from a
+ * document) for placement inside a `style="prop: VALUE"` attribute.
+ *
+ * - Drops the whole value if it contains a resource-fetching or executing
+ *   construct (`url()`, `expression()`, `@import`, `image-set()`, `javascript:`)
+ *   or angle brackets that could break out of the attribute/tag.
+ * - Strips characters that break out of `prop: value` (`;`, quotes), out of a
+ *   `<style>` rule (`{}`), CSS escapes (`\`), and control characters.
+ *
+ * `rgb()/hsl()` and hex/named colors, lengths, and (unquoted) font names all
+ * survive; the trade-off is that legitimately quoted font names lose their
+ * quotes, which browsers tolerate.
+ */
+export declare function sanitizeCssValue(value: string): string;
+/**
+ * Escapes a document-supplied URL for use in an href/src attribute. Beyond the
+ * usual attribute escaping, this rejects script-executing schemes (javascript:,
+ * vbscript:, data:, etc.) so a hyperlink extracted from an untrusted document
+ * can't run code when clicked — only http(s)/mailto/tel and relative/fragment
+ * URLs are passed through.
+ */
+export declare function sanitizeUrl(url: string): string;
+/**
+ * Like sanitizeUrl but for an <img>/<source> src: additionally permits
+ * `data:image/*` URIs (embedded document images) while still rejecting
+ * script-executing schemes and non-image data URIs (e.g. data:text/html).
+ */
+export declare function sanitizeImageUrl(url: string): string;
+/**
+ * Serializes data for embedding inside an inline <script> block. JSON.stringify
+ * alone doesn't escape "<", so a value containing "</script>" (e.g. a chart
+ * label from attacker-controlled document XML) would close the script early and
+ * inject markup. Also escapes the U+2028/U+2029 line separators, which are
+ * invalid in JS string literals.
+ */
+export declare function serializeForInlineScript(data: unknown): string;
+/**
+ * Formats a value for a CSV field: guards against spreadsheet formula/DDE
+ * injection (CWE-1236) and applies RFC 4180 quoting.
+ *
+ * A cell beginning with `= + - @` (or a tab/CR that some apps treat as a
+ * formula start) is prefixed with a single quote so Excel/Sheets render it as
+ * literal text rather than executing it. Genuine numbers (including negatives)
+ * are exempt so numeric columns are preserved.
+ */
+export declare function csvSafeCell(value: string, delimiter: string): string;
+/**
+ * Validates and escapes a document-supplied URL for an RTF `HYPERLINK` field argument.
+ *
+ * Mirrors `sanitizeUrl`'s contract (validate the scheme, then encode for the destination, else
+ * return `''`) but cannot reuse it: `sanitizeUrl` returns `escapeHtml(...)`, which would emit
+ * `&amp;` into an RTF field. The scheme allowlist is deliberately identical to `sanitizeUrl`'s
+ * and `sanitizeMarkdownUrl`'s, so all three text generators agree on what a hyperlink may point at.
+ *
+ * **Additionally rejects UNC paths (`\\host\share`), which the HTML allowlist does not.** In a
+ * browser `\\evil.com\share` is an inert relative path; in Word it is a live UNC reference that
+ * triggers an SMB fetch and an NTLM handshake on click, which is a credential-leak vector rather
+ * than a rendering quirk. That asymmetry is why this is a separate function and not a flag on
+ * `sanitizeUrl` - the HTML helper must NOT gain this behaviour, since there the path is harmless
+ * and rejecting it would break legitimate relative links.
+ *
+ * Returns `''` for a rejected URL; callers emit the link text without the field wrapper, matching
+ * how HTML degrades to `href=""` and Markdown to `[text]()`.
+ */
+export declare function sanitizeRtfUrl(url: string): string;
+/**
+ * Escapes text for RTF: neutralizes the control/group metacharacters `\ { }`
+ * (which would otherwise inject RTF control words or groups), encodes the double
+ * quote (so a hyperlink field argument can't be terminated early), and hex/unicode
+ * encodes non-ASCII characters.
+ */
+export declare function escapeRtf(text: string): string;
+/**
+ * Escapes document text for a Markdown text position. Markdown passes raw HTML
+ * through to the renderer, so a `<` that begins an HTML tag or comment must be
+ * neutralized to prevent `<script>`/`<img onerror>` injection when the Markdown
+ * is later rendered to HTML.
+ *
+ * Deliberately narrow — only a `<` immediately followed by a letter, `/`, `!` or
+ * `?` (i.e. one that actually opens a tag/comment/PI, matching how browsers
+ * detect tags) is encoded. A bare `<` (e.g. `a < b`), `>`, `&`, `[]` and other
+ * Markdown metacharacters are left untouched: they can't start a tag, and
+ * MarkdownParser round-trips this output without decoding entities, so encoding
+ * them would corrupt re-parsed content. URL schemes are handled by
+ * sanitizeMarkdownUrl.
+ */
+export declare function markdownEscapeText(text: string): string;
+/**
+ * Sanitizes a document-supplied URL for a Markdown `[text](url)` / `![alt](url)`
+ * target. Rejects script-executing schemes (returning '' → a dead link) and
+ * percent-encodes the characters that would break out of the `(...)` or inject
+ * markup. `&` is preserved so query strings survive; set `allowDataImage` for
+ * image targets so embedded `data:image/*` URIs are permitted.
+ */
+export declare function sanitizeMarkdownUrl(url: string, opts?: {
+    allowDataImage?: boolean;
+}): string;

package/dist/utils/sanitize.js

@@ -0,0 +1,318 @@
+"use strict";
+/**
+ * Shared output-sanitization helpers.
+ *
+ * Every string in the parsed AST originates from an untrusted document, so any
+ * value interpolated into generated output (HTML, XHTML, CSS, URLs, inline
+ * scripts, CSV, RTF, Markdown) must be escaped for its destination context.
+ * These are the single source of truth — each generator delegates to them so
+ * escaping stays consistent and a gap fixed here is fixed everywhere.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeHtmlAttributeName = isSafeHtmlAttributeName;
+exports.isSafeStyleMapTag = isSafeStyleMapTag;
+exports.escapeHtml = escapeHtml;
+exports.escapeXml = escapeXml;
+exports.sanitizeCssValue = sanitizeCssValue;
+exports.sanitizeUrl = sanitizeUrl;
+exports.sanitizeImageUrl = sanitizeImageUrl;
+exports.serializeForInlineScript = serializeForInlineScript;
+exports.csvSafeCell = csvSafeCell;
+exports.sanitizeRtfUrl = sanitizeRtfUrl;
+exports.escapeRtf = escapeRtf;
+exports.markdownEscapeText = markdownEscapeText;
+exports.sanitizeMarkdownUrl = sanitizeMarkdownUrl;
+/**
+ * Whether a string is a plain HTML attribute *name*, safe to interpolate before `="..."`.
+ *
+ * Escaping the value is not enough on its own: a key containing a quote or `=` closes the
+ * attribute and opens another, so `x" onmouseover="alert(1)" z` yields a real event handler no
+ * matter how carefully the value is escaped. This is the shape an attribute-injection payload
+ * takes, and rejecting it outright is simpler and safer than trying to escape a name.
+ *
+ * The predicate is shared rather than restated because it is now applied at four independent
+ * points (the parser's attribute collection, the generator's attribute bag, and two
+ * styleMap-driven paths). Each of those still keeps its own skip-list inline: the lists are the
+ * same policy expressed for different layers, and collapsing them would erase the defence in
+ * depth the surrounding comments describe.
+ */
+function isSafeHtmlAttributeName(name) {
+    return typeof name === 'string' && /^[a-zA-Z][a-zA-Z0-9-]*$/.test(name);
+}
+/**
+ * Element names a `styleMap` may map a node onto.
+ *
+ * An allowlist rather than a pattern: a tag name is interpolated into both `<TAG …>` and
+ * `</TAG>`, so it is not enough for it to *look* like a name - `script`, `style`, `iframe` and
+ * friends are perfectly well-formed names that would introduce an active context the rest of the
+ * generator's escaping assumes does not exist. This is the semantic set a style mapping is for:
+ * block containers, headings, and the inline emphasis elements.
+ */
+const SAFE_STYLE_MAP_TAGS = new Set([
+    'p', 'div', 'span', 'section', 'article', 'aside', 'header', 'footer', 'main', 'figure', 'figcaption',
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'blockquote', 'pre', 'code', 'q', 'cite', 'address',
+    'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+    'b', 'strong', 'i', 'em', 'u', 'ins', 'del', 's', 'strike', 'mark', 'small', 'sub', 'sup', 'kbd', 'samp', 'var', 'abbr',
+]);
+/**
+ * Whether a `styleMap` `output.tag` may be emitted as an element name.
+ *
+ * Callers must fall back to their default tag when this returns false, never emit the value.
+ */
+function isSafeStyleMapTag(tag) {
+    return typeof tag === 'string' && SAFE_STYLE_MAP_TAGS.has(tag.toLowerCase());
+}
+/**
+ * Escapes text for an HTML text node or a double-quoted attribute value.
+ * Includes the single quote so the result is also safe inside single-quoted
+ * attributes.
+ */
+function escapeHtml(text) {
+    if (typeof text !== 'string')
+        return text;
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Escapes text for an XML text node or attribute (XHTML/OPF/NCX). Same as
+ * escapeHtml but emits the XML-canonical `&apos;` for the single quote.
+ */
+function escapeXml(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;');
+}
+/**
+ * Sanitizes a single CSS value (e.g. a color/size/font/alignment pulled from a
+ * document) for placement inside a `style="prop: VALUE"` attribute.
+ *
+ * - Drops the whole value if it contains a resource-fetching or executing
+ *   construct (`url()`, `expression()`, `@import`, `image-set()`, `javascript:`)
+ *   or angle brackets that could break out of the attribute/tag.
+ * - Strips characters that break out of `prop: value` (`;`, quotes), out of a
+ *   `<style>` rule (`{}`), CSS escapes (`\`), and control characters.
+ *
+ * `rgb()/hsl()` and hex/named colors, lengths, and (unquoted) font names all
+ * survive; the trade-off is that legitimately quoted font names lose their
+ * quotes, which browsers tolerate.
+ */
+function sanitizeCssValue(value) {
+    if (typeof value !== 'string')
+        return '';
+    // Strip every form of intra-token noise FIRST, then test for dangerous constructs.
+    // Order matters: a payload like "u\nrl(", "url/*x*/(" or "u\rl(" would survive the test if
+    // tested before removal, then reassemble into "url(" once the noise is stripped.
+    //
+    // The backslash strip belongs here, not after the test. CSS treats `\` as an escape a
+    // browser resolves away, so `u\rl(http://evil)` IS `url(http://evil)` to a renderer -
+    // stripping it downstream of the test meant the sanitizer handed back a live `url()` it
+    // had just declared safe. Every construct in the denylist is reachable this way
+    // (`expr\ession(`, `image\-set(`), so the fix is the ordering, not another pattern.
+    const cleaned = value
+        .replace(/[\x00-\x1F\x7F]/g, '') // control chars (incl. newlines/tabs)
+        .replace(/\/\*[\s\S]*?\*\//g, '') // CSS comments used to obfuscate
+        .replace(/\\/g, ''); // CSS escapes; see above
+    if (/(?:url|expression|image-set|element|-moz-binding)\s*\(|@import|javascript:|[<>]/i.test(cleaned)) {
+        return '';
+    }
+    // Backslash is already gone above; the rest still have work to do here.
+    return cleaned.replace(/[;{}"'`]/g, '').trim();
+}
+/**
+ * Escapes a document-supplied URL for use in an href/src attribute. Beyond the
+ * usual attribute escaping, this rejects script-executing schemes (javascript:,
+ * vbscript:, data:, etc.) so a hyperlink extracted from an untrusted document
+ * can't run code when clicked — only http(s)/mailto/tel and relative/fragment
+ * URLs are passed through.
+ */
+function sanitizeUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    // Browsers ignore control characters when parsing a URL scheme, so strip them
+    // first to catch obfuscated payloads like "java\tscript:alert(1)".
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch && !/^(https?|mailto|tel)$/i.test(schemeMatch[1])) {
+        return '';
+    }
+    // Emit the same normalized string that was validated.
+    return escapeHtml(stripped);
+}
+/**
+ * Like sanitizeUrl but for an <img>/<source> src: additionally permits
+ * `data:image/*` URIs (embedded document images) while still rejecting
+ * script-executing schemes and non-image data URIs (e.g. data:text/html).
+ */
+function sanitizeImageUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        if (scheme === 'data') {
+            if (!/^data:image\//i.test(stripped))
+                return '';
+        }
+        else if (scheme !== 'http' && scheme !== 'https') {
+            return '';
+        }
+    }
+    return escapeHtml(stripped);
+}
+/**
+ * Serializes data for embedding inside an inline <script> block. JSON.stringify
+ * alone doesn't escape "<", so a value containing "</script>" (e.g. a chart
+ * label from attacker-controlled document XML) would close the script early and
+ * inject markup. Also escapes the U+2028/U+2029 line separators, which are
+ * invalid in JS string literals.
+ */
+function serializeForInlineScript(data) {
+    // U+2028/U+2029 (line/paragraph separators) are valid in JSON but break
+    // JS string literals; reference them by code point to keep the source ASCII.
+    const lineSep = String.fromCharCode(0x2028);
+    const paraSep = String.fromCharCode(0x2029);
+    return JSON.stringify(data)
+        .replace(/</g, '\\u003C')
+        .replace(/>/g, '\\u003E')
+        .split(lineSep).join('\\u2028')
+        .split(paraSep).join('\\u2029');
+}
+/**
+ * Formats a value for a CSV field: guards against spreadsheet formula/DDE
+ * injection (CWE-1236) and applies RFC 4180 quoting.
+ *
+ * A cell beginning with `= + - @` (or a tab/CR that some apps treat as a
+ * formula start) is prefixed with a single quote so Excel/Sheets render it as
+ * literal text rather than executing it. Genuine numbers (including negatives)
+ * are exempt so numeric columns are preserved.
+ */
+function csvSafeCell(value, delimiter) {
+    let v = typeof value === 'string' ? value : String(value ?? '');
+    // A plain signed number (e.g. "-8", "+7", "-5.3") can't be a formula, so exempt it —
+    // otherwise numeric columns get quoted as text. Anything else starting with a formula
+    // trigger (including "+1+1", "-1+cmd", "=", "@") is prefixed with a quote.
+    const isNumber = /^[+-]?(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?$/.test(v.trim());
+    // Test the trimmed value: the numeric exemption above already trims, so testing the raw
+    // string here meant a leading space slipped a trigger past the guard (" =1+1" was emitted
+    // unprefixed). Most spreadsheet apps treat a leading-space cell as text and would not
+    // evaluate it, so this is defence in depth rather than a demonstrated bypass - but the
+    // asymmetry between the two tests was an accident, not a decision.
+    if (!isNumber && /^[=+\-@\t\r]/.test(v.trim())) {
+        v = `'${v}`;
+    }
+    if (v.includes(delimiter) || v.includes('"') || v.includes('\n') || v.includes('\r')) {
+        return `"${v.replace(/"/g, '""')}"`;
+    }
+    return v;
+}
+/**
+ * Validates and escapes a document-supplied URL for an RTF `HYPERLINK` field argument.
+ *
+ * Mirrors `sanitizeUrl`'s contract (validate the scheme, then encode for the destination, else
+ * return `''`) but cannot reuse it: `sanitizeUrl` returns `escapeHtml(...)`, which would emit
+ * `&amp;` into an RTF field. The scheme allowlist is deliberately identical to `sanitizeUrl`'s
+ * and `sanitizeMarkdownUrl`'s, so all three text generators agree on what a hyperlink may point at.
+ *
+ * **Additionally rejects UNC paths (`\\host\share`), which the HTML allowlist does not.** In a
+ * browser `\\evil.com\share` is an inert relative path; in Word it is a live UNC reference that
+ * triggers an SMB fetch and an NTLM handshake on click, which is a credential-leak vector rather
+ * than a rendering quirk. That asymmetry is why this is a separate function and not a flag on
+ * `sanitizeUrl` - the HTML helper must NOT gain this behaviour, since there the path is harmless
+ * and rejecting it would break legitimate relative links.
+ *
+ * Returns `''` for a rejected URL; callers emit the link text without the field wrapper, matching
+ * how HTML degrades to `href=""` and Markdown to `[text]()`.
+ */
+function sanitizeRtfUrl(url) {
+    if (typeof url !== 'string')
+        return '';
+    const trimmed = url.trim();
+    // Control characters are stripped before scheme matching for the same reason as sanitizeUrl:
+    // they are ignored when the target application parses the scheme.
+    const stripped = trimmed.replace(/[\x00-\x1F\x7F]+/g, '');
+    if (/^[\\/]{2}[^\\/]/.test(stripped))
+        return ''; // UNC (\\host\share, //host\share)
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch && !/^(https?|mailto|tel)$/i.test(schemeMatch[1])) {
+        return '';
+    }
+    return escapeRtf(stripped);
+}
+/**
+ * Escapes text for RTF: neutralizes the control/group metacharacters `\ { }`
+ * (which would otherwise inject RTF control words or groups), encodes the double
+ * quote (so a hyperlink field argument can't be terminated early), and hex/unicode
+ * encodes non-ASCII characters.
+ */
+function escapeRtf(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(/\\/g, '\\\\')
+        .replace(/{/g, '\\{')
+        .replace(/}/g, '\\}')
+        .replace(/"/g, "\\'22")
+        .replace(/[^\x00-\x7F]/g, (match) => {
+        let code = match.charCodeAt(0);
+        if (code < 256) {
+            return `\\'${code.toString(16).padStart(2, '0')}`;
+        }
+        if (code > 32767) {
+            code -= 65536;
+        }
+        return `{\\uc0\\u${code}}`;
+    });
+}
+/**
+ * Escapes document text for a Markdown text position. Markdown passes raw HTML
+ * through to the renderer, so a `<` that begins an HTML tag or comment must be
+ * neutralized to prevent `<script>`/`<img onerror>` injection when the Markdown
+ * is later rendered to HTML.
+ *
+ * Deliberately narrow — only a `<` immediately followed by a letter, `/`, `!` or
+ * `?` (i.e. one that actually opens a tag/comment/PI, matching how browsers
+ * detect tags) is encoded. A bare `<` (e.g. `a < b`), `>`, `&`, `[]` and other
+ * Markdown metacharacters are left untouched: they can't start a tag, and
+ * MarkdownParser round-trips this output without decoding entities, so encoding
+ * them would corrupt re-parsed content. URL schemes are handled by
+ * sanitizeMarkdownUrl.
+ */
+function markdownEscapeText(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text.replace(/<(?=[a-zA-Z/!?])/g, '&lt;');
+}
+/**
+ * Sanitizes a document-supplied URL for a Markdown `[text](url)` / `![alt](url)`
+ * target. Rejects script-executing schemes (returning '' → a dead link) and
+ * percent-encodes the characters that would break out of the `(...)` or inject
+ * markup. `&` is preserved so query strings survive; set `allowDataImage` for
+ * image targets so embedded `data:image/*` URIs are permitted.
+ */
+function sanitizeMarkdownUrl(url, opts) {
+    if (typeof url !== 'string')
+        return '';
+    const stripped = url.trim().replace(/[\x00-\x1F\x7F]+/g, '');
+    const schemeMatch = /^([a-z][a-z0-9+.-]*):/i.exec(stripped);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        const ok = /^(?:https?|mailto|tel)$/.test(scheme)
+            || (opts?.allowDataImage === true && /^data:image\//i.test(stripped));
+        if (!ok)
+            return '';
+    }
+    return stripped.replace(/[\s()<>"`\\]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'));
+}

package/dist/utils/xmlUtils.js

@@ -440,12 +440,12 @@ const decodeXmlEntities = (text) => {
             if (entity[1] === 'x' || entity[1] === 'X') {
                 const hex = entity.slice(2);
                 const code = parseInt(hex, 16);
-                return !isNaN(code) ? String.fromCodePoint(code) : match;
+                return (!isNaN(code) && code >= 0 && code <= 0x10FFFF) ? String.fromCodePoint(code) : match;
             }
             else {
                 const dec = entity.slice(1);
                 const code = parseInt(dec, 10);
-                return !isNaN(code) ? String.fromCodePoint(code) : match;
+                return (!isNaN(code) && code >= 0 && code <= 0x10FFFF) ? String.fromCodePoint(code) : match;
             }
         }
         switch (entity) {