ooxml-core 1.12.2 → 1.14.0

package/dist/diagram/index.cjs

@@ -444,7 +444,7 @@ function parseStatement(element, state) {
         rules: element.children.filter((c) => c.name === "rule").map((c) => parseRule(c.attrs))
       };
     case "varLst": {
-      const vars = {};
+      const vars = /* @__PURE__ */ Object.create(null);
       for (const entry of element.children) {
         vars[entry.name] = entry.attrs.val ?? "";
       }
@@ -8351,55 +8351,65 @@ var downArrow = {
     }
   ]
 };
+var wedgePointerGuides = [
+  gd16("dxPos", "*/ w adj1 100000"),
+  gd16("dyPos", "*/ h adj2 100000"),
+  gd16("xPos", "+- hc dxPos 0"),
+  gd16("yPos", "+- vc dyPos 0"),
+  gd16("dx", "+- xPos 0 hc"),
+  gd16("dy", "+- yPos 0 vc"),
+  gd16("dq", "*/ dxPos h w"),
+  gd16("ady", "abs dy"),
+  gd16("adq", "abs dq"),
+  gd16("dz", "+- ady 0 adq"),
+  gd16("xg1", "?: dxPos 7 2"),
+  gd16("xg2", "?: dxPos 10 5"),
+  gd16("x1", "*/ w xg1 12"),
+  gd16("x2", "*/ w xg2 12"),
+  gd16("yg1", "?: dyPos 7 2"),
+  gd16("yg2", "?: dyPos 10 5"),
+  gd16("y1", "*/ h yg1 12"),
+  gd16("y2", "*/ h yg2 12"),
+  gd16("t1", "?: dxPos l xPos"),
+  gd16("xl", "?: dz l t1"),
+  gd16("t2", "?: dyPos x1 xPos"),
+  gd16("xt", "?: dz t2 x1"),
+  gd16("t3", "?: dxPos xPos r"),
+  gd16("xr", "?: dz r t3"),
+  gd16("t4", "?: dyPos xPos x1"),
+  gd16("xb", "?: dz t4 x1"),
+  gd16("t5", "?: dxPos y1 yPos"),
+  gd16("yl", "?: dz y1 t5"),
+  gd16("t6", "?: dyPos t yPos"),
+  gd16("yt", "?: dz t6 t"),
+  gd16("t7", "?: dxPos yPos y1"),
+  gd16("yr", "?: dz y1 t7"),
+  gd16("t8", "?: dyPos yPos b"),
+  gd16("yb", "?: dz t8 b")
+];
 var wedgeRectCallout = {
   name: "wedgeRectCallout",
   avLst: { adj1: -20833, adj2: 62500 },
-  gdLst: [
-    gd16("dxPos", "*/ w adj1 100000"),
-    gd16("dyPos", "*/ h adj2 100000"),
-    gd16("xPos", "+- hc dxPos 0"),
-    gd16("yPos", "+- vc dyPos 0"),
-    gd16("dx", "+- xPos 0 hc"),
-    gd16("dy", "+- yPos 0 vc"),
-    gd16("dq", "*/ dxPos h w"),
-    gd16("ady", "abs dy"),
-    gd16("adq", "abs dq"),
-    gd16("xg1", "?: dxPos 7 2"),
-    gd16("xg2", "?: dxPos 10 5"),
-    gd16("x1", "*/ w xg1 12"),
-    gd16("x2", "*/ w xg2 12"),
-    gd16("yg1", "?: dyPos 7 2"),
-    gd16("yg2", "?: dyPos 10 5"),
-    gd16("y1", "*/ h yg1 12"),
-    gd16("y2", "*/ h yg2 12"),
-    gd16("t1", "?: dxPos l xPos"),
-    gd16("xl", "?: ady adq t1 l"),
-    gd16("t2", "?: dyPos yPos t"),
-    gd16("yt", "?: ady adq t t2"),
-    gd16("t3", "?: dxPos xPos r"),
-    gd16("xr", "?: ady adq t3 r"),
-    gd16("t4", "?: dyPos b yPos"),
-    gd16("yb", "?: ady adq b t4")
-  ],
+  gdLst: wedgePointerGuides,
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
         { kind: "moveTo", x: "l", y: "t" },
         { kind: "lnTo", x: "x1", y: "t" },
-        { kind: "lnTo", x: "xl", y: "yt" },
+        { kind: "lnTo", x: "xt", y: "yt" },
         { kind: "lnTo", x: "x2", y: "t" },
         { kind: "lnTo", x: "r", y: "t" },
         { kind: "lnTo", x: "r", y: "y1" },
-        { kind: "lnTo", x: "xr", y: "yt" },
+        { kind: "lnTo", x: "xr", y: "yr" },
         { kind: "lnTo", x: "r", y: "y2" },
         { kind: "lnTo", x: "r", y: "b" },
         { kind: "lnTo", x: "x2", y: "b" },
-        { kind: "lnTo", x: "xl", y: "yb" },
+        { kind: "lnTo", x: "xb", y: "yb" },
         { kind: "lnTo", x: "x1", y: "b" },
         { kind: "lnTo", x: "l", y: "b" },
         { kind: "lnTo", x: "l", y: "y2" },
-        { kind: "lnTo", x: "xr", y: "yb" },
+        { kind: "lnTo", x: "xl", y: "yl" },
         { kind: "lnTo", x: "l", y: "y1" },
         { kind: "close" }
       ]
@@ -8410,31 +8420,38 @@ var wedgeRoundRectCallout = {
   name: "wedgeRoundRectCallout",
   avLst: { adj1: -20833, adj2: 62500, adj3: 16667 },
   gdLst: [
-    gd16("dxPos", "*/ w adj1 100000"),
-    gd16("dyPos", "*/ h adj2 100000"),
-    gd16("xPos", "+- hc dxPos 0"),
-    gd16("yPos", "+- vc dyPos 0"),
+    ...wedgePointerGuides,
     gd16("a3", "pin 0 adj3 50000"),
     gd16("rad", "*/ ss a3 100000"),
-    gd16("x1", "+- l rad 0"),
-    gd16("x2", "+- r 0 rad"),
-    gd16("y1", "+- t rad 0"),
-    gd16("y2", "+- b 0 rad")
+    gd16("xc1", "+- l rad 0"),
+    gd16("xc2", "+- r 0 rad"),
+    gd16("yc1", "+- t rad 0"),
+    gd16("yc2", "+- b 0 rad")
   ],
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
-        { kind: "moveTo", x: "l", y: "y1" },
+        { kind: "moveTo", x: "l", y: "yc1" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd2", swAng: "cd4" },
+        { kind: "lnTo", x: "x1", y: "t" },
+        { kind: "lnTo", x: "xt", y: "yt" },
         { kind: "lnTo", x: "x2", y: "t" },
+        { kind: "lnTo", x: "xc2", y: "t" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "3cd4", swAng: "cd4" },
+        { kind: "lnTo", x: "r", y: "y1" },
+        { kind: "lnTo", x: "xr", y: "yr" },
         { kind: "lnTo", x: "r", y: "y2" },
+        { kind: "lnTo", x: "r", y: "yc2" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "0", swAng: "cd4" },
-        { kind: "lnTo", x: "xPos", y: "b" },
-        { kind: "lnTo", x: "xPos", y: "yPos" },
+        { kind: "lnTo", x: "x2", y: "b" },
+        { kind: "lnTo", x: "xb", y: "yb" },
         { kind: "lnTo", x: "x1", y: "b" },
+        { kind: "lnTo", x: "xc1", y: "b" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd4", swAng: "cd4" },
+        { kind: "lnTo", x: "l", y: "y2" },
+        { kind: "lnTo", x: "xl", y: "yl" },
+        { kind: "lnTo", x: "l", y: "y1" },
         { kind: "close" }
       ]
     }
@@ -8449,7 +8466,7 @@ var wedgeEllipseCallout = {
     gd16("xPos", "+- hc dxPos 0"),
     gd16("yPos", "+- vc dyPos 0"),
     gd16("sdx", "*/ dxPos hd2 wd2"),
-    gd16("sdy", "val dyPos"),
+    gd16("sdy", "*/ dyPos wd2 hd2"),
     gd16("pang", "at2 sdx sdy"),
     gd16("stAng", "+- pang 660000 0"),
     gd16("enAng", "+- pang 0 660000"),
@@ -8461,17 +8478,15 @@ var wedgeEllipseCallout = {
     gd16("dy2", "sin hd2 enAng"),
     gd16("x2", "+- hc dx2 0"),
     gd16("y2", "+- vc dy2 0"),
-    gd16("stAng1", "at2 dx1 dy1"),
-    gd16("enAngFinal", "at2 dx2 dy2"),
-    gd16("swAng1", "+- enAngFinal 0 stAng1"),
-    gd16("swAng", "?: swAng1 swAng1 +- swAng1 21600000 0")
+    // The arc runs the long way round, from the first pointer edge to the second.
+    gd16("swAng", "+- 21600000 0 1320000")
   ],
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
         { kind: "moveTo", x: "x1", y: "y1" },
-        { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng1", swAng: "swAng" },
+        { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng", swAng: "swAng" },
         { kind: "lnTo", x: "xPos", y: "yPos" },
         { kind: "close" }
       ]
@@ -11974,6 +11989,7 @@ function evaluateCondition(condition, point, lookup) {
 
 // diagram/engine/pres-tree.ts
 var MAX_DEPTH = 96;
+var MAX_NODES = 1e5;
 function lookupVariable(node, name, options) {
   if (name === "dir" && options.direction) {
     return options.direction;
@@ -12011,6 +12027,9 @@ function walk(statements, point, node, state) {
         }
         state.depth++;
         for (const next of iteratePoints(point, forEach.iterator)) {
+          if (state.counter >= MAX_NODES) {
+            break;
+          }
           walk(forEach.body, next, node, state);
         }
         state.depth--;
@@ -12053,10 +12072,17 @@ function walk(statements, point, node, state) {
   }
 }
 function recordedVars(point, name) {
-  return point.source?.presLayoutVarsByName?.[name] ?? {};
+  const byName = point.source?.presLayoutVarsByName;
+  if (!byName || !Object.prototype.hasOwnProperty.call(byName, name)) {
+    return {};
+  }
+  return byName[name] ?? {};
+}
+function variableMap(...sources) {
+  return Object.assign(/* @__PURE__ */ Object.create(null), ...sources);
 }
 function buildNode(def, point, parent, state) {
-  if (state.depth > MAX_DEPTH) {
+  if (state.depth > MAX_DEPTH || state.counter >= MAX_NODES) {
     return void 0;
   }
   const node = {
@@ -12070,7 +12096,7 @@ function buildNode(def, point, parent, state) {
     presOfAnchored: false,
     constraints: [],
     rules: [],
-    vars: { ...recordedVars(point, def.name) },
+    vars: variableMap(recordedVars(point, def.name)),
     children: [],
     parent,
     order: state.counter++
@@ -22509,10 +22535,34 @@ var NS = {
   dsp: "http://schemas.microsoft.com/office/drawing/2008/diagram",
   /** Relationships (`r:id`, `r:embed`). */
   r: "http://schemas.openxmlformats.org/officeDocument/2006/relationships"};
+var DEFAULT_XML_LIMITS = {
+  maxDepth: 512,
+  maxNodes: 5e6
+};
+var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+function checkXmlLimits(xml, label, limits = {}) {
+  const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
+  const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
+  let depth = 0;
+  let nodes = 0;
+  for (const match of xml.matchAll(MARKUP_RE)) {
+    const [, closing, name, selfClosing] = match;
+    if (name === void 0) continue;
+    if (closing) {
+      depth--;
+      continue;
+    }
+    nodes++;
+    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (!selfClosing && ++depth > maxDepth2)
+      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth2}`);
+  }
+}
 function parseXml(xml, options = {}) {
   const label = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
     throw new Error(`${label} XML with DTD or entity declarations is not supported`);
+  checkXmlLimits(xml, label, options.limits);
   let parseError = "";
   let parsed;
   try {

package/dist/diagram/index.mjs

@@ -442,7 +442,7 @@ function parseStatement(element, state) {
         rules: element.children.filter((c) => c.name === "rule").map((c) => parseRule(c.attrs))
       };
     case "varLst": {
-      const vars = {};
+      const vars = /* @__PURE__ */ Object.create(null);
       for (const entry of element.children) {
         vars[entry.name] = entry.attrs.val ?? "";
       }
@@ -8349,55 +8349,65 @@ var downArrow = {
     }
   ]
 };
+var wedgePointerGuides = [
+  gd16("dxPos", "*/ w adj1 100000"),
+  gd16("dyPos", "*/ h adj2 100000"),
+  gd16("xPos", "+- hc dxPos 0"),
+  gd16("yPos", "+- vc dyPos 0"),
+  gd16("dx", "+- xPos 0 hc"),
+  gd16("dy", "+- yPos 0 vc"),
+  gd16("dq", "*/ dxPos h w"),
+  gd16("ady", "abs dy"),
+  gd16("adq", "abs dq"),
+  gd16("dz", "+- ady 0 adq"),
+  gd16("xg1", "?: dxPos 7 2"),
+  gd16("xg2", "?: dxPos 10 5"),
+  gd16("x1", "*/ w xg1 12"),
+  gd16("x2", "*/ w xg2 12"),
+  gd16("yg1", "?: dyPos 7 2"),
+  gd16("yg2", "?: dyPos 10 5"),
+  gd16("y1", "*/ h yg1 12"),
+  gd16("y2", "*/ h yg2 12"),
+  gd16("t1", "?: dxPos l xPos"),
+  gd16("xl", "?: dz l t1"),
+  gd16("t2", "?: dyPos x1 xPos"),
+  gd16("xt", "?: dz t2 x1"),
+  gd16("t3", "?: dxPos xPos r"),
+  gd16("xr", "?: dz r t3"),
+  gd16("t4", "?: dyPos xPos x1"),
+  gd16("xb", "?: dz t4 x1"),
+  gd16("t5", "?: dxPos y1 yPos"),
+  gd16("yl", "?: dz y1 t5"),
+  gd16("t6", "?: dyPos t yPos"),
+  gd16("yt", "?: dz t6 t"),
+  gd16("t7", "?: dxPos yPos y1"),
+  gd16("yr", "?: dz y1 t7"),
+  gd16("t8", "?: dyPos yPos b"),
+  gd16("yb", "?: dz t8 b")
+];
 var wedgeRectCallout = {
   name: "wedgeRectCallout",
   avLst: { adj1: -20833, adj2: 62500 },
-  gdLst: [
-    gd16("dxPos", "*/ w adj1 100000"),
-    gd16("dyPos", "*/ h adj2 100000"),
-    gd16("xPos", "+- hc dxPos 0"),
-    gd16("yPos", "+- vc dyPos 0"),
-    gd16("dx", "+- xPos 0 hc"),
-    gd16("dy", "+- yPos 0 vc"),
-    gd16("dq", "*/ dxPos h w"),
-    gd16("ady", "abs dy"),
-    gd16("adq", "abs dq"),
-    gd16("xg1", "?: dxPos 7 2"),
-    gd16("xg2", "?: dxPos 10 5"),
-    gd16("x1", "*/ w xg1 12"),
-    gd16("x2", "*/ w xg2 12"),
-    gd16("yg1", "?: dyPos 7 2"),
-    gd16("yg2", "?: dyPos 10 5"),
-    gd16("y1", "*/ h yg1 12"),
-    gd16("y2", "*/ h yg2 12"),
-    gd16("t1", "?: dxPos l xPos"),
-    gd16("xl", "?: ady adq t1 l"),
-    gd16("t2", "?: dyPos yPos t"),
-    gd16("yt", "?: ady adq t t2"),
-    gd16("t3", "?: dxPos xPos r"),
-    gd16("xr", "?: ady adq t3 r"),
-    gd16("t4", "?: dyPos b yPos"),
-    gd16("yb", "?: ady adq b t4")
-  ],
+  gdLst: wedgePointerGuides,
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
         { kind: "moveTo", x: "l", y: "t" },
         { kind: "lnTo", x: "x1", y: "t" },
-        { kind: "lnTo", x: "xl", y: "yt" },
+        { kind: "lnTo", x: "xt", y: "yt" },
         { kind: "lnTo", x: "x2", y: "t" },
         { kind: "lnTo", x: "r", y: "t" },
         { kind: "lnTo", x: "r", y: "y1" },
-        { kind: "lnTo", x: "xr", y: "yt" },
+        { kind: "lnTo", x: "xr", y: "yr" },
         { kind: "lnTo", x: "r", y: "y2" },
         { kind: "lnTo", x: "r", y: "b" },
         { kind: "lnTo", x: "x2", y: "b" },
-        { kind: "lnTo", x: "xl", y: "yb" },
+        { kind: "lnTo", x: "xb", y: "yb" },
         { kind: "lnTo", x: "x1", y: "b" },
         { kind: "lnTo", x: "l", y: "b" },
         { kind: "lnTo", x: "l", y: "y2" },
-        { kind: "lnTo", x: "xr", y: "yb" },
+        { kind: "lnTo", x: "xl", y: "yl" },
         { kind: "lnTo", x: "l", y: "y1" },
         { kind: "close" }
       ]
@@ -8408,31 +8418,38 @@ var wedgeRoundRectCallout = {
   name: "wedgeRoundRectCallout",
   avLst: { adj1: -20833, adj2: 62500, adj3: 16667 },
   gdLst: [
-    gd16("dxPos", "*/ w adj1 100000"),
-    gd16("dyPos", "*/ h adj2 100000"),
-    gd16("xPos", "+- hc dxPos 0"),
-    gd16("yPos", "+- vc dyPos 0"),
+    ...wedgePointerGuides,
     gd16("a3", "pin 0 adj3 50000"),
     gd16("rad", "*/ ss a3 100000"),
-    gd16("x1", "+- l rad 0"),
-    gd16("x2", "+- r 0 rad"),
-    gd16("y1", "+- t rad 0"),
-    gd16("y2", "+- b 0 rad")
+    gd16("xc1", "+- l rad 0"),
+    gd16("xc2", "+- r 0 rad"),
+    gd16("yc1", "+- t rad 0"),
+    gd16("yc2", "+- b 0 rad")
   ],
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
-        { kind: "moveTo", x: "l", y: "y1" },
+        { kind: "moveTo", x: "l", y: "yc1" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd2", swAng: "cd4" },
+        { kind: "lnTo", x: "x1", y: "t" },
+        { kind: "lnTo", x: "xt", y: "yt" },
         { kind: "lnTo", x: "x2", y: "t" },
+        { kind: "lnTo", x: "xc2", y: "t" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "3cd4", swAng: "cd4" },
+        { kind: "lnTo", x: "r", y: "y1" },
+        { kind: "lnTo", x: "xr", y: "yr" },
         { kind: "lnTo", x: "r", y: "y2" },
+        { kind: "lnTo", x: "r", y: "yc2" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "0", swAng: "cd4" },
-        { kind: "lnTo", x: "xPos", y: "b" },
-        { kind: "lnTo", x: "xPos", y: "yPos" },
+        { kind: "lnTo", x: "x2", y: "b" },
+        { kind: "lnTo", x: "xb", y: "yb" },
         { kind: "lnTo", x: "x1", y: "b" },
+        { kind: "lnTo", x: "xc1", y: "b" },
         { kind: "arcTo", wR: "rad", hR: "rad", stAng: "cd4", swAng: "cd4" },
+        { kind: "lnTo", x: "l", y: "y2" },
+        { kind: "lnTo", x: "xl", y: "yl" },
+        { kind: "lnTo", x: "l", y: "y1" },
         { kind: "close" }
       ]
     }
@@ -8447,7 +8464,7 @@ var wedgeEllipseCallout = {
     gd16("xPos", "+- hc dxPos 0"),
     gd16("yPos", "+- vc dyPos 0"),
     gd16("sdx", "*/ dxPos hd2 wd2"),
-    gd16("sdy", "val dyPos"),
+    gd16("sdy", "*/ dyPos wd2 hd2"),
     gd16("pang", "at2 sdx sdy"),
     gd16("stAng", "+- pang 660000 0"),
     gd16("enAng", "+- pang 0 660000"),
@@ -8459,17 +8476,15 @@ var wedgeEllipseCallout = {
     gd16("dy2", "sin hd2 enAng"),
     gd16("x2", "+- hc dx2 0"),
     gd16("y2", "+- vc dy2 0"),
-    gd16("stAng1", "at2 dx1 dy1"),
-    gd16("enAngFinal", "at2 dx2 dy2"),
-    gd16("swAng1", "+- enAngFinal 0 stAng1"),
-    gd16("swAng", "?: swAng1 swAng1 +- swAng1 21600000 0")
+    // The arc runs the long way round, from the first pointer edge to the second.
+    gd16("swAng", "+- 21600000 0 1320000")
   ],
   rect: FULL_RECT11,
   pathLst: [
     {
       commands: [
         { kind: "moveTo", x: "x1", y: "y1" },
-        { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng1", swAng: "swAng" },
+        { kind: "arcTo", wR: "wd2", hR: "hd2", stAng: "stAng", swAng: "swAng" },
         { kind: "lnTo", x: "xPos", y: "yPos" },
         { kind: "close" }
       ]
@@ -11972,6 +11987,7 @@ function evaluateCondition(condition, point, lookup) {
 
 // diagram/engine/pres-tree.ts
 var MAX_DEPTH = 96;
+var MAX_NODES = 1e5;
 function lookupVariable(node, name, options) {
   if (name === "dir" && options.direction) {
     return options.direction;
@@ -12009,6 +12025,9 @@ function walk(statements, point, node, state) {
         }
         state.depth++;
         for (const next of iteratePoints(point, forEach.iterator)) {
+          if (state.counter >= MAX_NODES) {
+            break;
+          }
           walk(forEach.body, next, node, state);
         }
         state.depth--;
@@ -12051,10 +12070,17 @@ function walk(statements, point, node, state) {
   }
 }
 function recordedVars(point, name) {
-  return point.source?.presLayoutVarsByName?.[name] ?? {};
+  const byName = point.source?.presLayoutVarsByName;
+  if (!byName || !Object.prototype.hasOwnProperty.call(byName, name)) {
+    return {};
+  }
+  return byName[name] ?? {};
+}
+function variableMap(...sources) {
+  return Object.assign(/* @__PURE__ */ Object.create(null), ...sources);
 }
 function buildNode(def, point, parent, state) {
-  if (state.depth > MAX_DEPTH) {
+  if (state.depth > MAX_DEPTH || state.counter >= MAX_NODES) {
     return void 0;
   }
   const node = {
@@ -12068,7 +12094,7 @@ function buildNode(def, point, parent, state) {
     presOfAnchored: false,
     constraints: [],
     rules: [],
-    vars: { ...recordedVars(point, def.name) },
+    vars: variableMap(recordedVars(point, def.name)),
     children: [],
     parent,
     order: state.counter++
@@ -22507,10 +22533,34 @@ var NS = {
   dsp: "http://schemas.microsoft.com/office/drawing/2008/diagram",
   /** Relationships (`r:id`, `r:embed`). */
   r: "http://schemas.openxmlformats.org/officeDocument/2006/relationships"};
+var DEFAULT_XML_LIMITS = {
+  maxDepth: 512,
+  maxNodes: 5e6
+};
+var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+function checkXmlLimits(xml, label, limits = {}) {
+  const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
+  const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
+  let depth = 0;
+  let nodes = 0;
+  for (const match of xml.matchAll(MARKUP_RE)) {
+    const [, closing, name, selfClosing] = match;
+    if (name === void 0) continue;
+    if (closing) {
+      depth--;
+      continue;
+    }
+    nodes++;
+    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (!selfClosing && ++depth > maxDepth2)
+      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth2}`);
+  }
+}
 function parseXml(xml, options = {}) {
   const label = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
     throw new Error(`${label} XML with DTD or entity declarations is not supported`);
+  checkXmlLimits(xml, label, options.limits);
   let parseError = "";
   let parsed;
   try {

package/dist/digest/index.cjs

@@ -1761,9 +1761,21 @@ function digestSync(name, data) {
   return digestFunction(name)?.(data);
 }
 
+// digest/timing-safe.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let difference = 0;
+  for (let i2 = 0; i2 < a.length; i2++) difference |= a[i2] ^ b[i2];
+  return difference === 0;
+}
+
 // digest/password-hash.ts
 var MAX_SPIN_COUNT = 1e7;
-var validSpinCount = (spinCount) => spinCount === void 0 || Number.isInteger(spinCount) && spinCount >= 0 && spinCount <= MAX_SPIN_COUNT;
+var DEFAULT_MAX_SPIN_COUNT = 1e6;
+function isValidSpinCount(spinCount, maxSpinCount = DEFAULT_MAX_SPIN_COUNT) {
+  const limit = Math.min(maxSpinCount, MAX_SPIN_COUNT);
+  return spinCount === void 0 || Number.isInteger(spinCount) && spinCount >= 0 && spinCount <= limit;
+}
 function spinPasswordHash(password, salt, spinCount, digest) {
   const input = new Uint8Array(salt.length + password.length * 2);
   input.set(salt);
@@ -1782,32 +1794,31 @@ function spinPasswordHash(password, salt, spinCount, digest) {
   }
   return value;
 }
-function hashBytes(password, { algorithmName, saltValue, spinCount }) {
+function hashBytes(password, { algorithmName, saltValue, spinCount }, limits) {
   const digest = digestFunction(algorithmName);
   const salt = decodeBase64(saltValue);
-  if (!digest || !salt || !validSpinCount(spinCount)) return void 0;
+  if (!digest || !salt || !isValidSpinCount(spinCount, limits.maxSpinCount)) return void 0;
   return spinPasswordHash(password, salt, spinCount ?? 0, digest);
 }
-function hashPassword(password, options) {
-  const bytes = hashBytes(password, options);
+function hashPassword(password, options, limits = {}) {
+  const bytes = hashBytes(password, options, limits);
   return bytes && encodeBase64(bytes);
 }
-function verifyPasswordHash(password, hash) {
+function verifyPasswordHash(password, hash, limits = {}) {
   if (!digestFunction(hash.algorithmName)) return void 0;
   const expected = decodeBase64(hash.hashValue);
-  const actual = expected && hashBytes(password, hash);
-  if (!expected || !actual || actual.length !== expected.length) return false;
-  let difference = 0;
-  for (let i2 = 0; i2 < actual.length; i2++) difference |= actual[i2] ^ expected[i2];
-  return difference === 0;
+  const actual = expected && hashBytes(password, hash, limits);
+  return !!expected && !!actual && timingSafeEqual(actual, expected);
 }
 
+exports.DEFAULT_MAX_SPIN_COUNT = DEFAULT_MAX_SPIN_COUNT;
 exports.MAX_SPIN_COUNT = MAX_SPIN_COUNT;
 exports.decodeBase64 = decodeBase64;
 exports.digestFunction = digestFunction;
 exports.digestSync = digestSync;
 exports.encodeBase64 = encodeBase64;
 exports.hashPassword = hashPassword;
+exports.isValidSpinCount = isValidSpinCount;
 exports.md2 = md2;
 exports.md4 = md4;
 exports.md5 = md5;
@@ -1819,5 +1830,6 @@ exports.sha256 = sha256;
 exports.sha384 = sha384;
 exports.sha512 = sha512;
 exports.spinPasswordHash = spinPasswordHash;
+exports.timingSafeEqual = timingSafeEqual;
 exports.verifyPasswordHash = verifyPasswordHash;
 exports.whirlpool = whirlpool;

package/dist/digest/index.d.ts

@@ -4,11 +4,12 @@ export { digestFunction, digestSync, type DigestFunction } from './digest.js';
 export { md2 } from './md2.js';
 export { md4 } from './md4.js';
 export { md5 } from './md5.js';
-export { MAX_SPIN_COUNT, hashPassword, spinPasswordHash, verifyPasswordHash, type PasswordHash, } from './password-hash.js';
+export { DEFAULT_MAX_SPIN_COUNT, MAX_SPIN_COUNT, hashPassword, isValidSpinCount, spinPasswordHash, verifyPasswordHash, type PasswordHash, type SpinLimits, } from './password-hash.js';
 export { ripemd128 } from './ripemd128.js';
 export { ripemd160 } from './ripemd160.js';
 export { sha1 } from './sha1.js';
 export { sha256 } from './sha256.js';
 export { sha384, sha512 } from './sha512.js';
+export { timingSafeEqual } from './timing-safe.js';
 export { whirlpool } from './whirlpool.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/digest/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../digest/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EACN,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../digest/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACN,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AAC5B,OAAO,EACN,sBAAsB,EACtB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}