officeparser 7.2.3 → 7.4.0

package/dist/utils/zipUtils.js

@@ -66,38 +66,88 @@ const extractFiles = (zipInput, filterFn, limits) => {
         ? limits.maxZipEntries
         : 10000;
     return new Promise((resolve, reject) => {
+        // Decompress as a stream and cap on the ACTUAL inflated byte count rather than
+        // the size declared in the ZIP header. The declared size is attacker-controlled,
+        // so a "zip bomb" can understate it and still inflate to gigabytes; counting real
+        // output bytes and aborting once the limit is crossed is the only reliable guard.
+        const results = [];
         let totalEntryCount = 0;
-        let entryCount = 0;
-        let declaredTotal = 0;
-        (0, fflate_1.unzip)(new Uint8Array(zipInput.buffer, zipInput.byteOffset, zipInput.byteLength), {
-            filter: (file) => {
-                totalEntryCount++;
-                if (totalEntryCount > maxZipEntries) {
-                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED, undefined, maxZipEntries));
-                    return false;
+        let actualTotalBytes = 0;
+        let pendingFiles = 0;
+        let pushComplete = false;
+        let settled = false;
+        const fail = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(err);
+        };
+        const maybeResolve = () => {
+            if (!settled && pushComplete && pendingFiles === 0) {
+                settled = true;
+                resolve(results);
+            }
+        };
+        const unzipper = new fflate_1.Unzip((file) => {
+            if (settled)
+                return;
+            totalEntryCount++;
+            if (totalEntryCount > maxZipEntries) {
+                fail((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_ENTRY_COUNT_LIMIT_EXCEEDED, undefined, maxZipEntries));
+                return;
+            }
+            if (!filterFn(file.name))
+                return;
+            const name = file.name;
+            const chunks = [];
+            pendingFiles++;
+            file.ondata = (err, chunk, final) => {
+                if (settled)
+                    return;
+                if (err) {
+                    fail(err);
+                    return;
                 }
-                if (!filterFn(file.name))
-                    return false;
-                if (typeof file.originalSize !== 'number' || !Number.isFinite(file.originalSize) || file.originalSize < 0) {
-                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_ENTRY_INVALID_SIZE));
-                    return false;
+                if (chunk && chunk.length) {
+                    actualTotalBytes += chunk.length;
+                    if (actualTotalBytes > maxUncompressedBytes) {
+                        fail((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED, undefined, maxUncompressedBytes));
+                        return;
+                    }
+                    chunks.push(Buffer.from(chunk));
                 }
-                entryCount++;
-                declaredTotal += file.originalSize;
-                if (declaredTotal > maxUncompressedBytes) {
-                    reject((0, errorUtils_js_1.getOfficeError)(types_js_1.OfficeErrorType.ZIP_SIZE_LIMIT_EXCEEDED, undefined, maxUncompressedBytes));
-                    return false;
+                if (final) {
+                    results.push({ path: name, content: Buffer.concat(chunks) });
+                    pendingFiles--;
+                    maybeResolve();
                 }
-                return true;
+            };
+            try {
+                file.start();
+            }
+            catch (e) {
+                fail(e);
             }
-        }, (err, decompressed) => {
-            if (err)
-                return reject(err);
-            resolve(Object.entries(decompressed).map(([path, data]) => ({
-                path,
-                content: Buffer.from(data)
-            })));
         });
+        unzipper.register(fflate_1.UnzipInflate);
+        const src = new Uint8Array(zipInput.buffer, zipInput.byteOffset, zipInput.byteLength);
+        // Feed the compressed input in bounded chunks so the actual-size check can abort a
+        // bomb early; the worst-case overshoot is one chunk's worth of inflation.
+        const PUSH_CHUNK = 1 << 16; // 64 KiB
+        try {
+            let offset = 0;
+            while (offset < src.length && !settled) {
+                const end = Math.min(offset + PUSH_CHUNK, src.length);
+                unzipper.push(src.subarray(offset, end), end >= src.length);
+                offset = end;
+            }
+        }
+        catch (e) {
+            fail(e);
+            return;
+        }
+        pushComplete = true;
+        maybeResolve();
     });
 };
 exports.extractFiles = extractFiles;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "officeparser",
-  "version": "7.2.3",
-  "description": "A robust, strictly-typed Node.js and Browser library for parsing office files (.docx, .pptx, .xlsx, .odt, .odp, .ods, .pdf, .rtf, .csv, .md, .html) and generating high-fidelity outputs in Markdown, HTML, CSV, RTF, and RAG-focused chunks.",
+  "version": "7.4.0",
+  "description": "A robust, strictly-typed Node.js and Browser library for parsing office files (.docx, .pptx, .xlsx, .odt, .odp, .ods, .pdf, .rtf, .csv, .md, .html, .epub) and generating high-fidelity outputs in Markdown, HTML, CSV, RTF, PDF, EPUB, and RAG-focused chunks.",
   "funding": "https://github.com/sponsors/harshankur",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -34,9 +34,11 @@
     "build:browser:types": "dts-bundle-generator --no-check -o dist/officeparser.browser.d.ts src/index.ts && cp dist/officeparser.browser.d.ts dist/officeparser.browser.slim.d.ts",
     "build:browser": "node build_browser.js && npm run sync:docs",
     "sync:versions": "node scripts/sync-pdfjs-versions.js",
-    "sync:docs": "mkdir -p docs/dist && cp dist/officeparser.browser.iife.js docs/dist/ && cp dist/officeparser.browser.mjs docs/dist/ && cp dist/officeparser.browser.slim.iife.js docs/dist/ && cp dist/officeparser.browser.slim.mjs docs/dist/ && mkdir -p docs/test/files && cp test/files/* docs/test/files/",
+    "sync:docs": "mkdir -p docs/dist && cp dist/officeparser.browser.iife.js docs/dist/ && cp dist/officeparser.browser.mjs docs/dist/ && cp dist/officeparser.browser.slim.iife.js docs/dist/ && cp dist/officeparser.browser.slim.mjs docs/dist/ && mkdir -p docs/test/files && cp -r test/files/* docs/test/files/",
     "lint": "eslint src",
-    "test": "npm run lint && npm run test:clean && npm run build && npm run test:license && npm run test:artifacts && npm run test:parser && npm run test:generator && npm run test:cli",
+    "test": "npm run lint && npm run test:clean && npm run build && npm run test:license && npm run test:artifacts && npm run test:parser && npm run test:exhaustive && npm run test:generator && npm run test:security && npm run test:cli",
+    "test:exhaustive": "npx tsx test/testExhaustive.ts",
+    "test:security": "npx tsx test/security/testSanitization.ts",
     "test:baseline": "npm run test:parser:baseline && npm run test:generator:baseline",
     "test:parser": "npx tsx test/parser/testOfficeParser.ts",
     "test:parser:baseline": "npx tsx test/parser/testOfficeParser.ts baseline",
@@ -100,7 +102,9 @@
     "rag",
     "chunking",
     "markdown",
-    "html"
+    "html",
+    "epub",
+    "ebook"
   ],
   "author": "Harsh Ankur",
   "license": "MIT",
@@ -121,19 +125,19 @@
     }
   },
   "devDependencies": {
-    "@types/node": "^25.5.0",
-    "@typescript-eslint/eslint-plugin": "^8.59.3",
-    "@typescript-eslint/parser": "^8.59.3",
+    "@types/node": "^26.1.1",
+    "@typescript-eslint/eslint-plugin": "^8.64.0",
+    "@typescript-eslint/parser": "^8.64.0",
     "buffer": "^6.0.3",
     "dts-bundle-generator": "^9.5.1",
     "esbuild": "^0.28.1",
     "esbuild-plugins-node-modules-polyfill": "^1.8.2",
-    "eslint": "^10.3.0",
+    "eslint": "^10.7.0",
     "husky": "^9.1.7",
     "postject": "^1.0.0-alpha.6",
     "process": "^0.11.10",
-    "puppeteer": "^22.15.0",
-    "tsx": "^4.21.0",
-    "typescript": "^6.0.2"
+    "puppeteer": "^24.43.1",
+    "tsx": "^4.23.1",
+    "typescript": "^6.0.3"
   }
 }