ooxml-core 1.12.2 → 1.14.0

package/dist/opc/index.mjs

@@ -71,6 +71,8 @@ var NS = {
   a: "http://schemas.openxmlformats.org/drawingml/2006/main",
   /** DrawingML chart. */
   c: "http://schemas.openxmlformats.org/drawingml/2006/chart",
+  /** Office 2016 extended charts (waterfall, histogram, funnel...; `cx:chartSpace`). */
+  cx: "http://schemas.microsoft.com/office/drawing/2014/chartex",
   /** Office 2010 chart extensions, including built-in modern chart styles. */
   c14: "http://schemas.microsoft.com/office/drawing/2007/8/2/chart",
   /** DrawingML diagram (SmartArt) main. */
@@ -126,10 +128,34 @@ var NS = {
   /** XML itself (`xml:space`). */
   xml: "http://www.w3.org/XML/1998/namespace"
 };
+var DEFAULT_XML_LIMITS = {
+  maxDepth: 512,
+  maxNodes: 5e6
+};
+var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+function checkXmlLimits(xml, label, limits = {}) {
+  const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
+  const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
+  let depth = 0;
+  let nodes = 0;
+  for (const match of xml.matchAll(MARKUP_RE)) {
+    const [, closing, name, selfClosing] = match;
+    if (name === void 0) continue;
+    if (closing) {
+      depth--;
+      continue;
+    }
+    nodes++;
+    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (!selfClosing && ++depth > maxDepth)
+      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth}`);
+  }
+}
 function parseXml(xml, options = {}) {
   const label = options.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
     throw new Error(`${label} XML with DTD or entity declarations is not supported`);
+  checkXmlLimits(xml, label, options.limits);
   let parseError = "";
   let parsed;
   try {
@@ -259,7 +285,9 @@ var XML_DECLARATION = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>';
 var EMPTY_TYPES = `${XML_DECLARATION}<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types"></Types>`;
 var EMPTY_RELS = `${XML_DECLARATION}<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships"></Relationships>`;
 function attr2(tag, name) {
-  return new RegExp(`${name}="([^"]*)"`).exec(tag)?.[1];
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = new RegExp(`(?<=[\\s<])${escaped}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`).exec(tag);
+  return match ? match[1] ?? match[2] : void 0;
 }
 async function ensureContentTypeOverride(zip, partName, contentType) {
   const xml = await zip.file(CONTENT_TYPES_PATH)?.async("string") ?? EMPTY_TYPES;
@@ -403,8 +431,176 @@ function isStorableHyperlinkHref(href) {
 function isOpenableHyperlinkHref(href) {
   return hyperlinkPolicy(href).open;
 }
+var DEFAULT_ZIP_LIMITS = {
+  maxInputBytes: 100 * 1024 * 1024,
+  maxEntries: 1e4,
+  maxEntryBytes: 100 * 1024 * 1024,
+  maxTotalBytes: 100 * 1024 * 1024
+};
+var ZipLimitError = class extends Error {
+  code = "ZIP_BOMB";
+  limit;
+  constructor(message, details) {
+    super(message);
+    this.name = "ZipLimitError";
+    this.limit = details.limit;
+  }
+};
+var mib = (bytes) => Math.round(bytes / 1048576);
+function isSafePartName(name) {
+  if (name.includes("\0") || name.includes("\\")) return false;
+  if (/^[A-Za-z]:/u.test(name)) return false;
+  const body = name.startsWith("/") ? name.slice(1) : name;
+  if (body.startsWith("/")) return false;
+  return !body.split("/").some((segment) => segment === "..");
+}
+function declaredEntrySize(entry) {
+  const data = entry._data;
+  const size = Number(data?.uncompressedSize ?? 0);
+  return Number.isFinite(size) && size > 0 ? size : 0;
+}
+function resolveLimits(limits) {
+  const create = limits.createError;
+  return {
+    maxEntries: limits.maxEntries ?? DEFAULT_ZIP_LIMITS.maxEntries,
+    maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
+    maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
+    label: limits.label ?? "ZIP",
+    fail: (message, limit) => create ? create(message, { limit }) : new ZipLimitError(message, { limit })
+  };
+}
+function inflateEntryGuarded(entry, alreadyRead, limits) {
+  const r = resolveLimits(limits);
+  const declared = declaredEntrySize(entry);
+  return new Promise((resolvePromise, reject2) => {
+    const chunks = [];
+    let size = 0;
+    let done = false;
+    const stream = entry.internalStream("uint8array");
+    const abort = (error) => {
+      if (done) return;
+      done = true;
+      stream.pause();
+      chunks.length = 0;
+      reject2(error);
+    };
+    stream.on("data", (chunk) => {
+      if (done) return;
+      size += chunk.byteLength;
+      if (size > declared || size > r.maxEntryBytes)
+        return abort(
+          r.fail(`${r.label} part ${entry.name} inflates past its declared size`, r.maxEntryBytes)
+        );
+      if (alreadyRead + size > r.maxTotalBytes)
+        return abort(
+          r.fail(
+            `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+            r.maxTotalBytes
+          )
+        );
+      chunks.push(chunk);
+    });
+    stream.on("error", (error) => abort(error));
+    stream.on("end", () => {
+      if (done) return;
+      done = true;
+      if (chunks.length === 1 && chunks[0]) return resolvePromise(chunks[0]);
+      const out = new Uint8Array(size);
+      let offset = 0;
+      for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      resolvePromise(out);
+    });
+    stream.resume();
+  });
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768)
+    binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(binary);
+}
+function guardZip(zip, limits = {}) {
+  const r = resolveLimits(limits);
+  const entries = Object.values(zip.files);
+  if (entries.length > r.maxEntries)
+    throw r.fail(
+      `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
+      r.maxEntries
+    );
+  let declared = 0;
+  for (const entry of entries) {
+    const original = entry.unsafeOriginalName;
+    if (!isSafePartName(entry.name) || original !== void 0 && !isSafePartName(original))
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+    if (entry.dir) continue;
+    const size = declaredEntrySize(entry);
+    if (size > r.maxEntryBytes)
+      throw r.fail(
+        `${r.label} part ${entry.name} exceeds the uncompressed part size limit`,
+        r.maxEntryBytes
+      );
+    declared += size;
+  }
+  if (declared > r.maxTotalBytes)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
+      r.maxTotalBytes
+    );
+  const produced = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const entry of entries) {
+    if (entry.dir) continue;
+    const inflateOriginal = entry.async.bind(entry);
+    entry.async = async (type, onUpdate) => {
+      const previous = produced.get(entry.name) ?? 0;
+      const bytes = await inflateEntryGuarded(entry, total - previous, limits);
+      if (bytes.byteLength > previous) {
+        total += bytes.byteLength - previous;
+        produced.set(entry.name, bytes.byteLength);
+      }
+      switch (type) {
+        case "uint8array":
+          return bytes;
+        case "string":
+        case "text":
+          return new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
+        case "arraybuffer":
+          return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+        case "base64":
+          return toBase64(bytes);
+        default:
+          return inflateOriginal(type, onUpdate);
+      }
+    };
+  }
+  return zip;
+}
+async function openZip(input, limits = {}) {
+  const r = resolveLimits(limits);
+  const maxInput = limits.maxInputBytes ?? DEFAULT_ZIP_LIMITS.maxInputBytes;
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  if (bytes.byteLength > maxInput)
+    throw r.fail(
+      `${r.label} package exceeds the ${mib(maxInput)} MiB compressed input limit`,
+      maxInput
+    );
+  return guardZip(await JSZip.loadAsync(bytes), limits);
+}
+
+// opc/embedded-packages.ts
+var EMBEDDED_ZIP_LIMITS = {
+  label: "Embedded",
+  maxEntries: 2e4,
+  maxInputBytes: 200 * 1024 * 1024,
+  maxEntryBytes: 200 * 1024 * 1024,
+  maxTotalBytes: 500 * 1024 * 1024
+};
+var NESTED_ZIP_LIMITS = { label: "Embedded" };
 async function listEmbeddedPackages(bytes) {
-  const zip = await JSZip.loadAsync(bytes);
+  const zip = await openZip(bytes, EMBEDDED_ZIP_LIMITS);
   const result = [];
   for (const file of Object.values(zip.files)) {
     if (file.dir || !/^(word|ppt|xl|visio)\/embeddings\/[^/]+$/u.test(file.name)) continue;
@@ -422,9 +618,9 @@ async function listEmbeddedPackages(bytes) {
 async function replaceEmbeddedPackage(parent, path, child) {
   if (!/^(word|ppt|xl|visio)\/embeddings\/[^/]+\.(docx|xlsx|pptx|vsdx)$/u.test(path))
     throw new Error("Only native Office package embeddings can be saved back");
-  const zip = await JSZip.loadAsync(parent);
+  const zip = await openZip(parent, EMBEDDED_ZIP_LIMITS);
   if (!zip.file(path)) throw new Error("The embedded document no longer exists");
-  const nested = await JSZip.loadAsync(child);
+  const nested = await openZip(child, NESTED_ZIP_LIMITS);
   if (!nested.file("[Content_Types].xml"))
     throw new Error("The replacement is not an Office package");
   zip.file(path, child);
@@ -1142,8 +1338,11 @@ async function verifySignatureDigests(signature, getPartContent) {
   if (typeof globalThis.crypto?.subtle === "undefined") {
     return "unverified";
   }
+  let checked = 0;
+  let skipped = false;
   for (const ref of signature.references) {
     if (!ref.digestValue || !ref.uri) {
+      skipped = true;
       continue;
     }
     const algo = ref.digestMethod?.toLowerCase() || "";
@@ -1155,23 +1354,24 @@ async function verifySignatureDigests(signature, getPartContent) {
     } else if (algo.includes("sha1") || algo.includes("sha-1")) {
       hashAlgo = "SHA-1";
     } else {
+      skipped = true;
       continue;
     }
     const content2 = await getPartContent(ref.uri);
     if (!content2) {
-      continue;
+      return "invalid";
     }
     try {
       const digest = await crypto.subtle.digest(hashAlgo, content2);
-      const digestBase64 = arrayBufferToBase64(digest);
-      if (digestBase64 !== ref.digestValue) {
+      if (arrayBufferToBase64(digest) !== ref.digestValue) {
         return "invalid";
       }
+      checked++;
     } catch {
       return "unverified";
     }
   }
-  return signature.certificate ? "valid" : "unknownCA";
+  return checked > 0 && !skipped ? "digestsMatch" : "unverified";
 }
 function arrayBufferToBase64(buffer) {
   const bytes = new Uint8Array(buffer);
@@ -1232,27 +1432,55 @@ function extractTagAttribute(xml, tagName, attributeName) {
   const match = xml.match(pattern);
   return match?.groups?.["attributeValue"]?.trim();
 }
+var isNameChar = (c) => c !== void 0 && /[\w.-]/.test(c);
+var isWordChar = (c) => c !== void 0 && /\w/.test(c);
+function matchName(xml, lowerXml, from, lname) {
+  let pos = from;
+  if (!lowerXml.startsWith(lname, pos)) {
+    let end = pos;
+    while (isNameChar(xml[end])) end++;
+    if (end === pos || xml[end] !== ":") return -1;
+    pos = end + 1;
+    if (!lowerXml.startsWith(lname, pos)) return -1;
+  }
+  return pos + lname.length;
+}
+function findTagText(xml, lowerXml, lname, from) {
+  let lt = xml.indexOf("<", from);
+  while (lt !== -1) {
+    const afterName = matchName(xml, lowerXml, lt + 1, lname);
+    if (afterName !== -1 && !isWordChar(xml[afterName])) {
+      const gt = xml.indexOf(">", afterName);
+      if (gt === -1) return null;
+      let close = xml.indexOf("</", gt + 1);
+      while (close !== -1) {
+        const closeEnd = matchName(xml, lowerXml, close + 2, lname);
+        if (closeEnd !== -1 && xml[closeEnd] === ">") {
+          return { text: xml.slice(gt + 1, close), end: closeEnd + 1 };
+        }
+        close = xml.indexOf("</", close + 2);
+      }
+      return null;
+    }
+    lt = xml.indexOf("<", lt + 1);
+  }
+  return null;
+}
 function extractFirstTagText(xml, localName) {
-  const pattern = new RegExp(
-    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
-    "i"
-  );
-  const match = xml.match(pattern);
-  return match?.[2]?.replace(/\s+/g, "").trim() || void 0;
+  const found = findTagText(xml, xml.toLowerCase(), localName.toLowerCase(), 0);
+  return found?.text.replace(/\s+/g, "").trim() || void 0;
 }
 function extractAllTagText(xml, localName) {
   const result = [];
-  const regex = new RegExp(
-    `<([\\w.-]+:)?${localName}\\b[^>]*>([\\s\\S]*?)<\\/([\\w.-]+:)?${localName}>`,
-    "gi"
-  );
-  let match = regex.exec(xml);
-  while (match) {
-    const value = match[2]?.replace(/\s+/g, "").trim();
+  const lowerXml = xml.toLowerCase();
+  const lname = localName.toLowerCase();
+  let found = findTagText(xml, lowerXml, lname, 0);
+  while (found) {
+    const value = found.text.replace(/\s+/g, "").trim();
     if (value) {
       result.push(value);
     }
-    match = regex.exec(xml);
+    found = findTagText(xml, lowerXml, lname, found.end);
   }
   return result;
 }
@@ -1347,4 +1575,4 @@ function computeVerificationStatus(details) {
   return hasInvalidSignature ? "signature-invalid" : hasRevoked ? "certificate-revoked" : hasTimestampInvalid ? "timestamp-invalid" : hasTimestampUntrusted ? "timestamp-untrusted" : hasMissing ? "reference-missing" : hasMismatch ? "digest-mismatch" : allVerified ? "verified-trusted" : hasUntrusted ? "verified-untrusted" : "present-not-verified";
 }
 
-export { CORE_PROPERTY_FIELDS, CUSTOM_PROPERTIES_FMTID, PROPERTY_CONTENT_TYPES, PROPERTY_PART_NAMES, RELATIONSHIP_TYPES, STRICT_APP_NAMESPACES, allocateCustomPropertyIds, buildContentTypesXml, buildRelationshipsXml, clonePartGraph, contentTypeForPart, customPropertyFromText, ensureContentTypeDefault, ensureContentTypeOverride, ensureRelationship, findOfficeDocumentPart, formatW3cdtf, fromTitleGroups, getRelationshipId, hyperlinkPolicy, isOpenableHyperlinkHref, isSafeHyperlinkHref, isStorableHyperlinkHref, listEmbeddedPackages, nextRelationshipId, parseAppProperties, parseContentTypes, parseCoreProperties, parseCustomProperties, parseCustomPropertyTexts, parseRelationships, relationshipsPartFor, relativePartTarget, replaceEmbeddedPackage, replaceTitleGroup, resolvePartPath, signature_exports as signature, titleGroups, writeAppProperties, writeCoreProperties, writeCustomProperties };
+export { CORE_PROPERTY_FIELDS, CUSTOM_PROPERTIES_FMTID, DEFAULT_ZIP_LIMITS, PROPERTY_CONTENT_TYPES, PROPERTY_PART_NAMES, RELATIONSHIP_TYPES, STRICT_APP_NAMESPACES, ZipLimitError, allocateCustomPropertyIds, buildContentTypesXml, buildRelationshipsXml, clonePartGraph, contentTypeForPart, customPropertyFromText, declaredEntrySize, ensureContentTypeDefault, ensureContentTypeOverride, ensureRelationship, findOfficeDocumentPart, formatW3cdtf, fromTitleGroups, getRelationshipId, guardZip, hyperlinkPolicy, inflateEntryGuarded, isOpenableHyperlinkHref, isSafeHyperlinkHref, isSafePartName, isStorableHyperlinkHref, listEmbeddedPackages, nextRelationshipId, openZip, parseAppProperties, parseContentTypes, parseCoreProperties, parseCustomProperties, parseCustomPropertyTexts, parseRelationships, relationshipsPartFor, relativePartTarget, replaceEmbeddedPackage, replaceTitleGroup, resolvePartPath, signature_exports as signature, titleGroups, writeAppProperties, writeCoreProperties, writeCustomProperties };

package/dist/opc/package.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../opc/package.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAa/B;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,4FAA4F;AAC5F,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKpF"}
+{"version":3,"file":"package.d.ts","sourceRoot":"","sources":["../../opc/package.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAmB/B;;;GAGG;AACH,wBAAsB,yBAAyB,CAC9C,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACvC,GAAG,EAAE,KAAK,EACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,4FAA4F;AAC5F,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAKpF"}

package/dist/opc/signature/detection.d.ts

@@ -84,14 +84,30 @@ export declare function getSignaturePathsToStrip(zipEntryPaths: string[]): strin
  */
 export declare function parseSignatureXml(signatureXml: Record<string, unknown>, signaturePath: string): ParsedSignature;
 /**
- * Verify a signature's digest references against actual document content.
+ * Outcome of {@link verifySignatureDigests}. Deliberately distinct from
+ * {@link SignatureStatus} so a digest check cannot be mistaken for trust.
  *
- * Uses the Web Crypto API (SubtleCrypto) to compute SHA-256/SHA-1 digests
- * of referenced parts and compare against the signed digest values.
+ * - `digestsMatch`: every reference was checked and its digest matched.
+ * - `invalid`: a digest mismatched, or a referenced part is missing.
+ * - `unverified`: nothing could be (fully) checked: no references, no Web
+ *   Crypto, or a reference was skipped (missing URI or digest value, unknown
+ *   digest algorithm).
+ */
+export type SignatureDigestStatus = 'digestsMatch' | 'invalid' | 'unverified';
+/**
+ * Check a signature's digest references against actual document content.
+ *
+ * This is an integrity check of the referenced parts only. It does NOT verify
+ * `ds:SignatureValue`, the signed-info canonicalization, the certificate chain,
+ * validity dates or revocation, so a `digestsMatch` result says nothing about
+ * who signed the package. Never present it as "signature valid".
+ *
+ * Every reference must be checked: a reference without URI or digest value, or
+ * with an unknown digest algorithm, makes the result `unverified`; a referenced
+ * part that cannot be found makes it `invalid` (the signed content is gone).
  *
- * @param signature - The parsed signature to verify.
+ * @param signature - The parsed signature to check.
  * @param getPartContent - Function that retrieves part content by URI.
- * @returns The updated signature status after digest verification.
  */
-export declare function verifySignatureDigests(signature: ParsedSignature, getPartContent: (uri: string) => Promise<ArrayBuffer | undefined>): Promise<SignatureStatus>;
+export declare function verifySignatureDigests(signature: ParsedSignature, getPartContent: (uri: string) => Promise<ArrayBuffer | undefined>): Promise<SignatureDigestStatus>;
 //# sourceMappingURL=detection.d.ts.map

package/dist/opc/signature/detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detection.d.ts","sourceRoot":"","sources":["../../../opc/signature/detection.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAEH,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,gEAAgE;AAChE,MAAM,WAAW,wBAAwB;IACxC,2CAA2C;IAC3C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3F,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC/B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,8CAA8C;IAC9C,UAAU,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IAClC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAGvD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAUzF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE1E;AA2FD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,aAAa,EAAE,MAAM,GACnB,eAAe,CAsEjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,eAAe,EAC1B,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,GAC/D,OAAO,CAAC,eAAe,CAAC,CA6C1B"}
+{"version":3,"file":"detection.d.ts","sourceRoot":"","sources":["../../../opc/signature/detection.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;GAWG;AAEH,qCAAqC;AACrC,MAAM,WAAW,wBAAwB;IACxC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,gEAAgE;AAChE,MAAM,WAAW,wBAAwB;IACxC,2CAA2C;IAC3C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAE3F,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC/B,4CAA4C;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,mCAAmC;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,8CAA8C;IAC9C,UAAU,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IAClC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,mCAAmC;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAGvD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,wBAAwB,CAUzF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE1E;AA2FD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,aAAa,EAAE,MAAM,GACnB,eAAe,CAsEjB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,SAAS,GAAG,YAAY,CAAC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC3C,SAAS,EAAE,eAAe,EAC1B,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,GAC/D,OAAO,CAAC,qBAAqB,CAAC,CA8ChC"}

package/dist/opc/signature/index.d.ts

@@ -1,4 +1,4 @@
-export { SIGNATURE_PART_PREFIX, detectDigitalSignatures, getSignaturePathsToStrip, isSignaturePart, parseSignatureXml, verifySignatureDigests, type ParsedSignature, type SignatureCertificateInfo, type SignatureDetectionResult, type SignatureReference, type SignatureStatus, } from './detection.js';
+export { SIGNATURE_PART_PREFIX, detectDigitalSignatures, getSignaturePathsToStrip, isSignaturePart, parseSignatureXml, verifySignatureDigests, type ParsedSignature, type SignatureCertificateInfo, type SignatureDetectionResult, type SignatureReference, type SignatureDigestStatus, type SignatureStatus, } from './detection.js';
 export { DIGEST_ALGORITHM_TO_HASH, DIGEST_ALGORITHM_TO_WEB_CRYPTO, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, DIGITAL_SIGNATURE_REL_TYPE, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, ENTERPRISE_REQUIRE_REVOCATION_ENV, ENTERPRISE_REQUIRE_TIMESTAMP_ENV, ENTERPRISE_TRUST_ROOTS_FILE_ENV, ENTERPRISE_TRUST_ROOTS_PEM_ENV, OPC_RELATIONSHIP_TRANSFORM, PPTX_VIEWER_MANIFEST_NS, SUPPORTED_XML_CANON_TRANSFORMS, XMLDSIG_NS, XML_TRANSFORM_ENVELOPED_SIGNATURE, } from './constants.js';
 export type { CertificateRevocationStatus, DigitalSignatureReport, DigitalSignatureVerificationStatus, LoadedSigningMaterial, OfficeSignatureReference, ParsedReferenceTransform, ReferenceTransformResult, SignatureCertificateInfo as SignatureNodeCertificateInfo, SignatureDetail, SignatureDetailStatus, SignatureReferenceCheck, SignatureValidationPolicy, SignOptions, SignResult, TimestampAuthorityStatus, } from './types.js';
 export { escapeXmlAttr, escapeXmlText, extractAllTagText, extractFirstTagText, extractTagAttribute, isValidBase64, } from './xml-utils.js';

package/dist/opc/signature/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../opc/signature/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,wBAAwB,EACxB,8BAA8B,EAC9B,iCAAiC,EACjC,0BAA0B,EAC1B,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,UAAU,EACV,iCAAiC,GACjC,MAAM,aAAa,CAAC;AACrB,YAAY,EACX,2BAA2B,EAC3B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,IAAI,4BAA4B,EACxD,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,wBAAwB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../opc/signature/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,wBAAwB,EACxB,8BAA8B,EAC9B,iCAAiC,EACjC,0BAA0B,EAC1B,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,EAChC,+BAA+B,EAC/B,8BAA8B,EAC9B,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,EAC9B,UAAU,EACV,iCAAiC,GACjC,MAAM,aAAa,CAAC;AACrB,YAAY,EACX,2BAA2B,EAC3B,sBAAsB,EACtB,kCAAkC,EAClC,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,IAAI,4BAA4B,EACxD,eAAe,EACf,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,wBAAwB,GACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/opc/signature/xml-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"xml-utils.d.ts","sourceRoot":"","sources":["../../../opc/signature/xml-utils.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAOpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAe1E"}
+{"version":3,"file":"xml-utils.d.ts","sourceRoot":"","sources":["../../../opc/signature/xml-utils.ts"],"names":[],"mappings":"AACA;;;;;GAKG;AAEH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAOpB;AAkDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAa1E"}

package/dist/opc/zip-limits.d.ts

@@ -0,0 +1,52 @@
+import JSZip from 'jszip';
+/** Default limits for a nested or unspecified package. */
+export declare const DEFAULT_ZIP_LIMITS: {
+    readonly maxInputBytes: number;
+    readonly maxEntries: 10000;
+    readonly maxEntryBytes: number;
+    readonly maxTotalBytes: number;
+};
+/** Size and hygiene limits applied while opening and reading a zip package. */
+export interface ZipLimits {
+    /** Largest accepted package (compressed bytes). */
+    maxInputBytes?: number;
+    /** Largest number of zip entries. */
+    maxEntries?: number;
+    /** Largest inflated size of one entry. */
+    maxEntryBytes?: number;
+    /** Largest total inflated size of every entry read or declared. */
+    maxTotalBytes?: number;
+    /** Format name used in error messages, such as `DOCX`. */
+    label?: string;
+    /** Builds the error thrown on a violation; defaults to {@link ZipLimitError}. */
+    createError?: (message: string, details: {
+        limit: number;
+    }) => Error;
+}
+/** Thrown when a package breaks a size, entry-count or part-name limit. */
+export declare class ZipLimitError extends Error {
+    readonly code = "ZIP_BOMB";
+    readonly limit: number;
+    constructor(message: string, details: {
+        limit: number;
+    });
+}
+/** True when a zip entry name is a safe, relative part name (no traversal, drive or backslash). */
+export declare function isSafePartName(name: string): boolean;
+/** The declared (header) uncompressed size of an entry; attacker-controlled. */
+export declare function declaredEntrySize(entry: JSZip.JSZipObject): number;
+/**
+ * Inflates one entry chunk by chunk, counting the bytes actually produced. Header sizes are
+ * attacker-controlled, so the read is rejected as soon as the entry inflates past its declared
+ * size or the running total passes the limit, before the rest of the entry is inflated.
+ */
+export declare function inflateEntryGuarded(entry: JSZip.JSZipObject, alreadyRead: number, limits: ZipLimits): Promise<Uint8Array>;
+/**
+ * Validates a loaded zip (entry count, part names, declared sizes) and replaces every entry's
+ * `async` so each read inflates through the streaming guard with per-entry and running-total
+ * caps. Existing `zip.file(name).async(...)` call sites are therefore protected unchanged.
+ */
+export declare function guardZip(zip: JSZip, limits?: ZipLimits): JSZip;
+/** Opens a zip with the input-size cap, then guards it (see {@link guardZip}). */
+export declare function openZip(input: Uint8Array | ArrayBuffer, limits?: ZipLimits): Promise<JSZip>;
+//# sourceMappingURL=zip-limits.d.ts.map

package/dist/opc/zip-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zip-limits.d.ts","sourceRoot":"","sources":["../../opc/zip-limits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB;aAC9B,aAAa;aACb,UAAU,EAAE,KAAM;aAClB,aAAa;aACb,aAAa;CACJ,CAAC;AAEX,+EAA+E;AAC/E,MAAM,WAAW,SAAS;IACzB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,KAAK,CAAC;CACrE;AAED,2EAA2E;AAC3E,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAItD;CACD;AAID,mGAAmG;AACnG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMpD;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,GAAG,MAAM,CAIlE;AA0BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,KAAK,CAAC,WAAW,EACxB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,GACf,OAAO,CAAC,UAAU,CAAC,CA8CrB;AASD;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAE,SAAc,GAAG,KAAK,CA0DlE;AAED,kFAAkF;AAClF,wBAAsB,OAAO,CAC5B,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,MAAM,GAAE,SAAc,GACpB,OAAO,CAAC,KAAK,CAAC,CAUhB"}