officeparser 7.2.3 → 7.4.0

package/dist/generators/PdfGenerator.js

@@ -85,6 +85,35 @@ class PdfGenerator extends BaseGenerator_js_1.BaseGenerator {
             // a system-installed Chrome, both of which are too intrusive for a library.
             browser = await puppeteer.launch(launchOptions);
             const page = await browser.newPage();
+            // Harden against SSRF: the HTML being rendered is derived from an untrusted
+            // document, and `networkidle0` would otherwise fetch every URL it references
+            // (external images, stylesheets, etc.) from this host — reaching internal
+            // services or a cloud metadata endpoint (169.254.169.254). Intercept requests
+            // and allow only inline data/blob URIs and the configured chart CDN; abort every
+            // other remote fetch.
+            const allowedHosts = new Set();
+            try {
+                const chartSrc = this.config.htmlConfig?.chartJsSrc;
+                if (chartSrc)
+                    allowedHosts.add(new URL(chartSrc).host);
+            }
+            catch { /* no or invalid chart CDN configured */ }
+            let blockedRemoteResource = false;
+            await page.setRequestInterception(true);
+            page.on('request', (req) => {
+                const url = req.url();
+                if (url.startsWith('data:') || url.startsWith('blob:') || url.startsWith('about:')) {
+                    return req.continue().catch(() => { });
+                }
+                try {
+                    if (allowedHosts.has(new URL(url).host)) {
+                        return req.continue().catch(() => { });
+                    }
+                }
+                catch { /* unparseable URL — fall through and block */ }
+                blockedRemoteResource = true;
+                return req.abort().catch(() => { });
+            });
             const pdfConfig = this.config.pdfConfig;
             const timeout = pdfConfig.timeout;
             if (timeout !== undefined && timeout > 0) {
@@ -107,6 +136,9 @@ class PdfGenerator extends BaseGenerator_js_1.BaseGenerator {
             });
             await browser.close();
             browser = null;
+            if (blockedRemoteResource) {
+                this.warn(types_js_1.OfficeWarningType.BROWSER_GENERATION_LIMITATION, 'One or more remote resources referenced by the document were blocked during PDF rendering to prevent server-side request forgery (SSRF). Only inline images and the configured chart CDN are loaded.');
+            }
             return {
                 value: new Uint8Array(pdfBuffer),
                 messages: this.messages

package/dist/generators/RtfGenerator.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RtfGenerator = void 0;
+const sanitize_js_1 = require("../utils/sanitize.js");
 const BaseGenerator_js_1 = require("./BaseGenerator.js");
+const errorUtils_js_1 = require("../utils/errorUtils.js");
 /**
  * Generates high-fidelity RTF (Rich Text Format) from an AST.
  */
@@ -17,14 +19,23 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
         const bodyContent = await this.renderBody(this.ast);
         let output = '{\\rtf1\\ansi\\uc1\\deff0\n';
         // 1. Info Group (Metadata)
-        if (this.config.renderMetadata && this.ast.metadata) {
+        const meta = this.effectiveMetadata;
+        if (this.config.renderMetadata && meta) {
+            // RTF's \info group is a fixed set of control words with no slot for caller-defined keys.
+            this.warnUnrepresentableCustomMetadata('RTF');
             output += '{\\info';
-            if (this.ast.metadata.title)
-                output += `{\\title ${this.escapeRtf(this.ast.metadata.title)}}`;
-            if (this.ast.metadata.author)
-                output += `{\\author ${this.escapeRtf(this.ast.metadata.author)}}`;
-            if (this.ast.metadata.description)
-                output += `{\\comm ${this.escapeRtf(this.ast.metadata.description)}}`;
+            if (meta.title)
+                output += `{\\title ${this.escapeRtf(meta.title)}}`;
+            if (meta.author)
+                output += `{\\author ${this.escapeRtf(meta.author)}}`;
+            if (meta.description)
+                output += `{\\comm ${this.escapeRtf(meta.description)}}`;
+            // \subject and \keywords are standard \info destinations, so unlike a caller's
+            // arbitrary custom keys these DO have a home in RTF.
+            if (meta.subject)
+                output += `{\\subject ${this.escapeRtf(meta.subject)}}`;
+            if (meta.keywords)
+                output += `{\\keywords ${this.escapeRtf(meta.keywords)}}`;
             output += '}\n';
         }
         // 2. Font Table
@@ -50,6 +61,10 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
         };
     }
     async processNodeRecursive(node, processor) {
+        // Mirrors the check in BaseGenerator.processNodeRecursive. This override replaces that
+        // method entirely, so without repeating the check here the signal would be silently
+        // inert for this generator - which is exactly how it was missed.
+        (0, errorUtils_js_1.checkAbortSignal)(this.config.abortSignal);
         const wasInTable = this.inTable;
         if (node.type === 'table')
             this.inTable = true;
@@ -134,7 +149,16 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
                     if (meta?.link) {
                         const isInternal = meta.linkType !== 'external';
                         if (!this.config.ignoreInternalLinks || !isInternal) {
-                            return `{\\field{\\*\\fldinst{HYPERLINK "${meta.link}"}}{\\fldrslt ${text}}}`;
+                            // Scheme-checked, not merely escaped. escapeRtf neutralizes the field
+                            // metacharacters but says nothing about where the link points, so RTF
+                            // was the one generator that would emit `javascript:` or a `file://`
+                            // /UNC target that HTML and Markdown both reject. On rejection, fall
+                            // through to the bare link text - the same degradation as HTML's
+                            // href="" and Markdown's [text]().
+                            const safeLink = (0, sanitize_js_1.sanitizeRtfUrl)(meta.link);
+                            if (safeLink) {
+                                return `{\\field{\\*\\fldinst{HYPERLINK "${safeLink}"}}{\\fldrslt ${text}}}`;
+                            }
                         }
                     }
                     return text;
@@ -214,6 +238,20 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
                 case 'break': {
                     return node.metadata?.breakType === 'page' ? '\\page\n' : '\\line\n';
                 }
+                case 'embed': {
+                    // RTF has no embed concept - degrade to the URL as plain text rather than
+                    // silently dropping the node (it has no children to fall back to).
+                    const meta = node.metadata;
+                    if (!meta?.url)
+                        return '';
+                    // Rendered as visible text rather than a field, but still a URL a reader may
+                    // copy, so it gets the same scheme policy.
+                    const safeUrl = (0, sanitize_js_1.sanitizeRtfUrl)(meta.url);
+                    if (!safeUrl)
+                        return '';
+                    const pPr = this.inTable ? '\\pard\\intbl' : '\\pard';
+                    return `${pPr}\\sa120 ${safeUrl}\\par\n`;
+                }
                 default:
                     return childrenOutput;
             }
@@ -251,20 +289,7 @@ class RtfGenerator extends BaseGenerator_js_1.BaseGenerator {
         return luminance > 0.8;
     }
     escapeRtf(text) {
-        return text
-            .replace(/\\/g, '\\\\')
-            .replace(/{/g, '\\{')
-            .replace(/}/g, '\\}')
-            .replace(/[^\x00-\x7F]/g, (match) => {
-            let code = match.charCodeAt(0);
-            if (code < 256) {
-                return `\\'${code.toString(16).padStart(2, '0')}`;
-            }
-            if (code > 32767) {
-                code -= 65536;
-            }
-            return `{\\uc0\\u${code}}`;
-        });
+        return (0, sanitize_js_1.escapeRtf)(text);
     }
 }
 exports.RtfGenerator = RtfGenerator;

package/dist/generators/TextGenerator.js

@@ -2,6 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TextGenerator = void 0;
 const BaseGenerator_js_1 = require("./BaseGenerator.js");
+const escapeRegExpChars = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/**
+ * Separator between table/sheet cells on the paths that don't render an aligned grid (a `table`
+ * with `preserveLayout` off, and `sheet`/`row`/`cell`, which never go through `renderTable`).
+ * A tab is the conventional plain-text column delimiter and, unlike a space, survives a value that
+ * already contains spaces.
+ */
+const CELL_SEPARATOR = '\t';
 /**
  * Generates plain text from an AST.
  */
@@ -16,13 +24,26 @@ class TextGenerator extends BaseGenerator_js_1.BaseGenerator {
         let output = '';
         const newline = this.config.textConfig.newlineDelimiter;
         // Add Metadata Header
-        if (this.config.renderMetadata && this.ast.metadata) {
-            if (this.ast.metadata.title)
-                output += `Title: ${this.ast.metadata.title}${newline}`;
-            if (this.ast.metadata.author)
-                output += `Author: ${this.ast.metadata.author}${newline}`;
-            if (this.ast.metadata.created)
-                output += `Created: ${new Date(this.ast.metadata.created).toLocaleString()}${newline}`;
+        const meta = this.effectiveMetadata;
+        if (this.config.renderMetadata && meta) {
+            // The header is a structured `Key: value` block terminated by a rule, and consumers
+            // parse it as such. A value containing a line break would forge extra fields - a title
+            // of "Real\nAuthor: Attacker" renders an Author line the document never had - so line
+            // breaks are folded to spaces, matching how CsvGenerator guards its `#` comment block.
+            // Plain text has no code-execution context, but fabricated structure is still a lie
+            // about the document, and every AST string is treated as attacker-controlled.
+            const oneLine = (value) => String(value ?? '').replace(/[\r\n]+/g, ' ');
+            if (meta.title)
+                output += `Title: ${oneLine(meta.title)}${newline}`;
+            if (meta.author)
+                output += `Author: ${oneLine(meta.author)}${newline}`;
+            // Guarded like HtmlGenerator's toIsoDate: a malformed date must not render the literal
+            // "Invalid Date" into the header as if it were the document's creation time.
+            if (meta.created) {
+                const created = new Date(meta.created);
+                if (!isNaN(created.getTime()))
+                    output += `Created: ${oneLine(created.toLocaleString())}${newline}`;
+            }
             output += `-------------------${newline}${newline}`;
         }
         const processor = async (node, childrenOutput) => {
@@ -40,6 +61,17 @@ class TextGenerator extends BaseGenerator_js_1.BaseGenerator {
                 const meta = node.metadata;
                 return `[Image: ${meta?.altText || meta?.attachmentName || 'Untitled'}]${newline}`;
             }
+            if (node.type === 'embed') {
+                const meta = node.metadata;
+                return meta?.url ? `[${meta.embedType === 'youtube' ? 'YouTube' : 'Embed'}: ${meta.url}]${newline}` : '';
+            }
+            if (node.type === 'admonition') {
+                const meta = node.metadata;
+                if (childrenOutput.trim() === '')
+                    return '';
+                const label = (meta?.admonitionType || 'note').toUpperCase();
+                return `[${label}] ${childrenOutput.trim()}${newline}`;
+            }
             if (node.type === 'table' && this.config.textConfig.preserveLayout) {
                 return await this.renderTable(node, processor, newline);
             }
@@ -50,26 +82,81 @@ class TextGenerator extends BaseGenerator_js_1.BaseGenerator {
                 const marker = meta?.listType === 'ordered' ? `${(meta.itemIndex ?? 0) + 1}. ` : '- ';
                 return `${indent}${marker}${childrenOutput.trimStart()}` + (childrenOutput.endsWith(newline) ? '' : newline);
             }
-            // Append newline for block-level elements to maintain structure
+            // Cells need an explicit separator between them. Without one they concatenate into a
+            // single run - "ITEM" + "NEEDED" becomes "ITEMNEEDED", which is unreadable and loses the
+            // cell boundary entirely. This was previously masked for spreadsheets only because
+            // XLSX/ODS cell values happen to carry a trailing non-breaking space in the source data,
+            // so they *appeared* separated; formats whose cell text has no trailing whitespace (MD,
+            // HTML) collided outright. Relying on the data to supply a delimiter isn't a separator.
+            //
+            // Applies to the paths that don't go through renderTable: a `table` when preserveLayout
+            // is off, and `sheet`/`row`/`cell` always, since a sheet is not a `table` node.
+            if (node.type === 'cell') {
+                // Only when the cell doesn't already end in a line break. Cell content varies by
+                // source: DOCX/ODT/RTF wrap it in a paragraph, which emits its own newline and so
+                // already separates cells, while MD/HTML/XLSX hold bare text that would otherwise
+                // collide. Appending unconditionally would push a stray tab onto the formats that
+                // were already correct - measured, not assumed: doing so moved DOCX from 6 to 178
+                // line-edits away from toText().
+                if (childrenOutput === '' || childrenOutput.endsWith(newline))
+                    return childrenOutput;
+                return childrenOutput + CELL_SEPARATOR;
+            }
+            // Append newline for block-level elements to maintain structure.
             const blockTypes = ['paragraph', 'heading', 'row', 'sheet', 'slide', 'note', 'list', 'table', 'code'];
+            if (node.type === 'row') {
+                // Trailing separator on the final cell is an artifact of appending one per cell, not
+                // content, so drop it rather than leaving every row ending in a stray tab.
+                const row = childrenOutput.endsWith(CELL_SEPARATOR)
+                    ? childrenOutput.slice(0, -CELL_SEPARATOR.length)
+                    : childrenOutput;
+                if (row === '')
+                    return '';
+                return row + (row.endsWith(newline) ? '' : newline);
+            }
             if (blockTypes.includes(node.type)) {
-                if (childrenOutput.trim() === '')
+                // Drop a block only when it is genuinely empty, not merely whitespace. A paragraph
+                // containing spaces is content the document actually holds - discarding it silently
+                // deletes an author's blank-but-not-empty line, and disagreed with every parser's
+                // own toTextSync, which filters on `!== ''` rather than on trimmed emptiness.
+                if (childrenOutput === '')
                     return '';
                 return childrenOutput + (childrenOutput.endsWith(newline) ? '' : newline);
             }
+            // Fallback for node types with no explicit handling above. Prefer rendered children,
+            // but fall back to the node's own text when it has none: a `chart` carries its whole
+            // data series in `text` with zero child nodes, and a CSV `comment` likewise, so
+            // returning only `childrenOutput` silently dropped both. Every parser's own toTextSync
+            // reads `node.text`, so this is what the rest of the library already does - and it
+            // covers any future node type of the same shape rather than just the two known today.
+            if (!childrenOutput && node.text) {
+                return node.text + (node.text.endsWith(newline) ? '' : newline);
+            }
             return childrenOutput;
         };
         for (const node of this.ast.content) {
             output += await this.processNodeRecursive(node, processor);
         }
-        if (this.collectedNotes.length > 0) {
+        if (this.collectedNotes.length > 0 && this.config.textConfig.renderNotes) {
             output += `${newline}${newline}--- Notes ---${newline}`;
             for (const note of this.collectedNotes) {
                 output += await this.processNodeRecursive(note, processor);
             }
         }
+        // Every block-level node above unconditionally appends its own trailing `newline` as a
+        // separator from whatever sibling follows - including, unavoidably, the very last one,
+        // which has no sibling to separate from - and renderTable below unconditionally *prepends*
+        // one too, as a separator from whatever precedes it (also unavoidably applied when a table
+        // is the very first/only node). Both are pure generator artifacts, never part of the
+        // document's actual content, so a run of exactly this delimiter at either end is the only
+        // thing safe to strip. Nothing else is: not leading/trailing spaces or tabs (e.g. an
+        // intentionally-indented opening line, or trailing spaces on the last line - both real
+        // content), and not any whitespace that isn't composed of this exact repeated delimiter. A
+        // blanket trim()/trimEnd() would silently destroy all of those.
+        const d = escapeRegExpChars(newline);
+        const leadingOrTrailingArtifact = new RegExp(`^(?:${d})+|(?:${d})+$`, 'g');
         return {
-            value: output.trim(),
+            value: output.replace(leadingOrTrailingArtifact, ''),
             messages: this.messages
         };
     }

package/dist/index.d.ts

@@ -10,6 +10,7 @@
  * - Portable: PDF
  * - Legacy: RTF (Rich Text Format)
  * - Web/Plain: CSV, MD, HTML
+ * - E-book: EPUB
  *
  * **Key Features:**
  * - Unified AST output across all formats

package/dist/index.js

@@ -11,6 +11,7 @@
  * - Portable: PDF
  * - Legacy: RTF (Rich Text Format)
  * - Web/Plain: CSV, MD, HTML
+ * - E-book: EPUB
  *
  * **Key Features:**
  * - Unified AST output across all formats