ooxml-core 1.13.0 → 1.14.0

package/dist/crypto/decrypt.d.ts

@@ -4,16 +4,28 @@
  *
  * Moved from `src/core/pptx/core/utils/ooxml-crypto-decrypt.ts` (see PROVENANCE.md).
  */
+import type { SpinLimits } from '../digest/password-hash.js';
 import type { EncryptionInfo, StandardEncryptionInfo } from './types.js';
+/** Options of agile password verification and package decryption. */
+export interface DecryptOptions extends SpinLimits {
+    /**
+     * Accept an agile package that has no `<dataIntegrity>` element (default false). The HMAC is
+     * the only protection of the ciphertext against tampering, so a missing element is treated as
+     * a downgrade attack unless the caller opts out (for example for a legacy writer).
+     */
+    allowMissingIntegrity?: boolean;
+}
 /**
  * Verify the password against agile encryption info and return the
  * decryption key if valid.
  *
  * @param info - Parsed agile encryption info.
  * @param password - The password to verify.
+ * @param limits - The spin-count limit (default 1,000,000; the spec ceiling is 10,000,000).
  * @returns The document encryption key, or null if the password is wrong.
+ * @throws Error when the EncryptionInfo parameters are invalid or the spin count is too large.
  */
-export declare function verifyAgilePassword(info: EncryptionInfo, password: string): Promise<Uint8Array | null>;
+export declare function verifyAgilePassword(info: EncryptionInfo, password: string, limits?: SpinLimits): Promise<Uint8Array | null>;
 /**
  * Verify the password against standard encryption info and return the
  * decryption key if valid.
@@ -35,9 +47,11 @@ export declare function verifyStandardPassword(info: StandardEncryptionInfo, pas
  * @param info - Parsed agile encryption info.
  * @param key - The document encryption key.
  * @param encryptedPackage - Raw bytes of the EncryptedPackage stream.
- * @throws DataIntegrityError if the data integrity check fails.
+ * @param options - `allowMissingIntegrity` accepts a package without a dataIntegrity element.
+ * @throws DataIntegrityError if the data integrity check fails, or the element is missing and
+ *   `allowMissingIntegrity` is not set (an attacker could strip it to flip ciphertext bits).
  */
-export declare function verifyAgileDataIntegrity(info: EncryptionInfo, key: Uint8Array, encryptedPackage: Uint8Array): Promise<void>;
+export declare function verifyAgileDataIntegrity(info: EncryptionInfo, key: Uint8Array, encryptedPackage: Uint8Array, options?: Pick<DecryptOptions, 'allowMissingIntegrity'>): Promise<void>;
 /**
  * Decrypt the EncryptedPackage stream using the agile encryption key.
  *

package/dist/crypto/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAMtE;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAgC5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA6B5B;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,UAAU,EACf,gBAAgB,EAAE,UAAU,GAC1B,OAAO,CAAC,IAAI,CAAC,CA0Df;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,WAAW,CAAC,CAqCtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,WAAW,CAAC,CAatB"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../crypto/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAW1D,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGtE,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,UAAU;IACjD;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAMD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACxC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,UAAe,GACrB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAsC5B;AAMD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAuB5B;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,UAAU,EACf,gBAAgB,EAAE,UAAU,EAC5B,OAAO,GAAE,IAAI,CAAC,cAAc,EAAE,uBAAuB,CAAM,GACzD,OAAO,CAAC,IAAI,CAAC,CAkDf;AAeD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACxC,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,cAAc,GAClB,OAAO,CAAC,WAAW,CAAC,CAuCtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC3C,gBAAgB,EAAE,UAAU,EAC5B,GAAG,EAAE,UAAU,GACb,OAAO,CAAC,WAAW,CAAC,CActB"}

package/dist/crypto/encryption-info.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption-info.d.ts","sourceRoot":"","sources":["../../crypto/encryption-info.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,sBAAsB,CAa7F"}
+{"version":3,"file":"encryption-info.d.ts","sourceRoot":"","sources":["../../crypto/encryption-info.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGtE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,QAAS,CAAC;AAEjC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,GAAG,sBAAsB,CAa7F"}

package/dist/crypto/index.cjs

@@ -1,5 +1,7 @@
 'use strict';
 
+var xmldom = require('@xmldom/xmldom');
+
 // ../../node_modules/.bun/@christophervr+ole2@0.13.0/node_modules/@christophervr/ole2/dist/ole2-parser-types.js
 var OLE_MAGIC = new Uint8Array([208, 207, 17, 224, 161, 177, 26, 225]);
 var ENDOFCHAIN = 4294967294;
@@ -555,6 +557,14 @@ async function hmac(algorithm, key, data) {
   return new Uint8Array(result);
 }
 
+// digest/timing-safe.ts
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let difference = 0;
+  for (let i2 = 0; i2 < a.length; i2++) difference |= a[i2] ^ b[i2];
+  return difference === 0;
+}
+
 // crypto/aes-ecb.ts
 var BLOCK = 16;
 var BATCH = 4096;
@@ -2338,6 +2348,14 @@ function digestFunction(name) {
   return canonical && DIGESTS[canonical];
 }
 
+// digest/password-hash.ts
+var MAX_SPIN_COUNT = 1e7;
+var DEFAULT_MAX_SPIN_COUNT = 1e6;
+function isValidSpinCount(spinCount, maxSpinCount = DEFAULT_MAX_SPIN_COUNT) {
+  const limit = Math.min(maxSpinCount, MAX_SPIN_COUNT);
+  return spinCount === void 0 || Number.isInteger(spinCount) && spinCount >= 0 && spinCount <= limit;
+}
+
 // crypto/key-derivation.ts
 var BLOCK_KEYS = {
   verifierHashInput: new Uint8Array([254, 167, 210, 118, 59, 75, 158, 121]),
@@ -2346,9 +2364,9 @@ var BLOCK_KEYS = {
   dataIntegrityHmacKey: new Uint8Array([95, 178, 173, 1, 12, 185, 225, 246]),
   dataIntegrityHmacValue: new Uint8Array([160, 103, 127, 2, 178, 44, 132, 51])
 };
-var MAX_SPIN_COUNT = 1e7;
-async function spinPassword(password, salt, spinCount, hashAlgorithm) {
-  if (!Number.isInteger(spinCount) || spinCount < 0 || spinCount > MAX_SPIN_COUNT) {
+var SPIN_CHUNK = 1e5;
+async function spinPassword(password, salt, spinCount, hashAlgorithm, limits = {}) {
+  if (!isValidSpinCount(spinCount, limits.maxSpinCount)) {
     throw new Error(`Unsupported encryption spin count: ${spinCount}.`);
   }
   const passwordBytes = encodePasswordUtf16LE(password);
@@ -2361,6 +2379,9 @@ async function spinPassword(password, salt, spinCount, hashAlgorithm) {
       view.setUint32(0, i2, true);
       buffer.set(h3, 4);
       h3 = digest(buffer);
+      if (i2 % SPIN_CHUNK === SPIN_CHUNK - 1 && i2 + 1 < spinCount) {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      }
     }
     return h3;
   }
@@ -2379,8 +2400,8 @@ async function extendKey(h2, hashAlgorithm, keyLength) {
   const x3 = concatArrays(await pad2(54), await pad2(92));
   return x3.subarray(0, keyLength);
 }
-function computeAgileKeyBase(password, salt, spinCount, hashAlgorithm) {
-  return spinPassword(password, salt, spinCount, hashAlgorithm);
+function computeAgileKeyBase(password, salt, spinCount, hashAlgorithm, limits = {}) {
+  return spinPassword(password, salt, spinCount, hashAlgorithm, limits);
 }
 async function deriveAgileKeyFromBase(base, hashAlgorithm, blockKey, keyBits, hashSize) {
   const h2 = await hash(hashAlgorithm, concatArrays(base, blockKey));
@@ -2411,10 +2432,82 @@ async function generateIV(hashAlgorithm, salt, blockKey, blockSize) {
   return padded;
 }
 
+// crypto/validate.ts
+var AGILE_DIGEST_LENGTH = {
+  "SHA-1": 20,
+  "SHA-256": 32,
+  "SHA-384": 48,
+  "SHA-512": 64
+};
+function agileDigestLength(hashAlgorithm) {
+  const name = normalizeDigestAlgorithmName(hashAlgorithm);
+  return name === void 0 ? void 0 : AGILE_DIGEST_LENGTH[name];
+}
+var KEY_BITS = /* @__PURE__ */ new Set([128, 192, 256]);
+function assertBlock(block, what) {
+  if (block.cipherAlgorithm !== "AES") {
+    throw new Error(`Unsupported ${what} cipherAlgorithm: ${block.cipherAlgorithm}.`);
+  }
+  if (block.cipherChaining !== "ChainingModeCBC") {
+    throw new Error(`Unsupported ${what} cipherChaining: ${block.cipherChaining}.`);
+  }
+  const digestLength = agileDigestLength(block.hashAlgorithm);
+  if (digestLength === void 0) {
+    throw new Error(`Unsupported ${what} hashAlgorithm: ${block.hashAlgorithm}.`);
+  }
+  if (block.hashSize !== digestLength) {
+    throw new Error(
+      `Invalid ${what} hashSize ${block.hashSize}: ${block.hashAlgorithm} produces ${digestLength} bytes.`
+    );
+  }
+  if (!KEY_BITS.has(block.keyBits)) throw new Error(`Invalid ${what} keyBits: ${block.keyBits}.`);
+  if (block.blockSize !== 16) throw new Error(`Invalid ${what} blockSize: ${block.blockSize}.`);
+  if (!Number.isInteger(block.saltSize) || block.saltSize <= 0 || block.saltSize > 64) {
+    throw new Error(`Invalid ${what} saltSize: ${block.saltSize}.`);
+  }
+  if (block.saltValue.length !== block.saltSize) {
+    throw new Error(`The ${what} saltValue does not match its saltSize.`);
+  }
+}
+function assertValidAgileEncryptionInfo(info) {
+  assertBlock(info.keyData, "keyData");
+  const pke = info.passwordKeyEncryptor;
+  assertBlock(pke, "password key encryptor");
+  if (!Number.isInteger(pke.spinCount) || pke.spinCount < 0) {
+    throw new Error(`Invalid spinCount: ${pke.spinCount}.`);
+  }
+  if (pke.saltSize > pke.hashSize) {
+    throw new Error(`Invalid password key encryptor saltSize: ${pke.saltSize}.`);
+  }
+}
+function assertValidStandardEncryptionInfo(info) {
+  if (!KEY_BITS.has(info.header.keySize)) {
+    throw new Error(`Invalid Standard encryption keySize: ${info.header.keySize}.`);
+  }
+  if (info.verifier.salt.length !== 16 || info.verifier.saltSize !== 16) {
+    throw new Error(`Invalid Standard encryption saltSize: ${info.verifier.saltSize}.`);
+  }
+  if (info.verifier.verifierHashSize !== 20) {
+    throw new Error(
+      `Invalid Standard encryption verifierHashSize: ${info.verifier.verifierHashSize}.`
+    );
+  }
+  if (info.verifier.encryptedVerifier.length !== 16 || info.verifier.encryptedVerifierHash.length < 20) {
+    throw new Error("The Standard encryption verifier is truncated.");
+  }
+}
+
 // crypto/decrypt.ts
-async function verifyAgilePassword(info, password) {
+async function verifyAgilePassword(info, password, limits = {}) {
+  assertValidAgileEncryptionInfo(info);
   const pke = info.passwordKeyEncryptor;
-  const base = await computeAgileKeyBase(password, pke.saltValue, pke.spinCount, pke.hashAlgorithm);
+  const base = await computeAgileKeyBase(
+    password,
+    pke.saltValue,
+    pke.spinCount,
+    pke.hashAlgorithm,
+    limits
+  );
   const blockKey = (block) => deriveAgileKeyFromBase(base, pke.hashAlgorithm, block, pke.keyBits, pke.hashSize);
   const verifierHashInput = await aesCbcDecryptRaw(
     await blockKey(BLOCK_KEYS.verifierHashInput),
@@ -2427,10 +2520,8 @@ async function verifyAgilePassword(info, password) {
     pke.encryptedVerifierHashValue
   );
   const computedHash = await hash(pke.hashAlgorithm, verifierHashInput.subarray(0, pke.saltSize));
-  if (computedHash.length < pke.hashSize || verifierHashValue.length < pke.hashSize) return null;
-  let difference = 0;
-  for (let i2 = 0; i2 < pke.hashSize; i2++) difference |= verifierHashValue[i2] ^ computedHash[i2];
-  if (difference !== 0) return null;
+  if (computedHash.length !== pke.hashSize || verifierHashValue.length < pke.hashSize) return null;
+  if (!timingSafeEqual(verifierHashValue.subarray(0, pke.hashSize), computedHash)) return null;
   const decryptedKey = await aesCbcDecryptRaw(
     await blockKey(BLOCK_KEYS.encryptedKeyValue),
     pke.saltValue,
@@ -2439,6 +2530,7 @@ async function verifyAgilePassword(info, password) {
   return decryptedKey.subarray(0, info.keyData.keyBits / 8);
 }
 async function verifyStandardPassword(info, password) {
+  assertValidStandardEncryptionInfo(info);
   const key = await deriveStandardKey(
     password,
     info.verifier.salt,
@@ -2448,20 +2540,16 @@ async function verifyStandardPassword(info, password) {
   const decryptedVerifier = await aesEcbDecrypt(key, info.verifier.encryptedVerifier);
   const decryptedHash = await aesEcbDecrypt(key, info.verifier.encryptedVerifierHash);
   const computedHash = await hash("SHA-1", decryptedVerifier);
-  const hashSize = info.verifier.verifierHashSize;
-  let match = true;
-  for (let i2 = 0; i2 < Math.min(hashSize, 20); i2++) {
-    if (computedHash[i2] !== decryptedHash[i2]) {
-      match = false;
-      break;
-    }
-  }
+  const match = timingSafeEqual(decryptedHash.subarray(0, 20), computedHash);
   return match ? key : null;
 }
-async function verifyAgileDataIntegrity(info, key, encryptedPackage) {
+async function verifyAgileDataIntegrity(info, key, encryptedPackage, options = {}) {
   const keyData = info.keyData;
   if (!info.dataIntegrity) {
-    return;
+    if (options.allowMissingIntegrity) return;
+    throw new DataIntegrityError(
+      "The encrypted package has no data integrity record, so it cannot be checked for tampering."
+    );
   }
   const hmacKeyIV = await generateIV(
     keyData.hashAlgorithm,
@@ -2488,28 +2576,26 @@ async function verifyAgileDataIntegrity(info, key, encryptedPackage) {
   );
   const expectedHmac = decryptedHmacValue.subarray(0, keyData.hashSize);
   const computedHmac = await hmac(keyData.hashAlgorithm, hmacKey, encryptedPackage);
-  let match = true;
-  if (computedHmac.length < keyData.hashSize) {
-    match = false;
-  } else {
-    for (let i2 = 0; i2 < keyData.hashSize; i2++) {
-      if (computedHmac[i2] !== expectedHmac[i2]) {
-        match = false;
-        break;
-      }
-    }
-  }
+  const match = timingSafeEqual(computedHmac, expectedHmac);
   if (!match) {
     throw new DataIntegrityError(
       "Data integrity check failed. The encrypted file may be corrupted or tampered with."
     );
   }
 }
+function readOriginalSize(encryptedPackage, wide) {
+  if (encryptedPackage.length < 8) throw new Error("The EncryptedPackage stream is truncated.");
+  const view = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
+  const high = view.getUint32(4, true);
+  return view.getUint32(0, true) + (wide ? high * 4294967296 : 0);
+}
 async function decryptAgilePackage(encryptedPackage, key, info) {
   const keyData = info.keyData;
-  const sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
-  const originalSize = sizeView.getUint32(0, true) + sizeView.getUint32(4, true) * 4294967296;
+  const originalSize = readOriginalSize(encryptedPackage, true);
   const encryptedData = encryptedPackage.subarray(8);
+  if (originalSize > encryptedData.length) {
+    throw new Error("The declared package size exceeds the encrypted data.");
+  }
   const segmentSize = 4096;
   const result = new Uint8Array(originalSize);
   let resultOffset = 0;
@@ -2533,9 +2619,11 @@ async function decryptAgilePackage(encryptedPackage, key, info) {
   return result.buffer;
 }
 async function decryptStandardPackage(encryptedPackage, key) {
-  const sizeView = new DataView(encryptedPackage.buffer, encryptedPackage.byteOffset, 8);
-  const originalSize = sizeView.getUint32(0, true);
+  const originalSize = readOriginalSize(encryptedPackage, false);
   const encryptedData = encryptedPackage.subarray(8);
+  if (originalSize > encryptedData.length) {
+    throw new Error("The declared package size exceeds the encrypted data.");
+  }
   const decrypted = await aesEcbDecrypt(key, encryptedData);
   return decrypted.slice(0, originalSize).buffer;
 }
@@ -3118,6 +3206,52 @@ async function encryptStandard(packageData, password, options = {}) {
   );
   return container(encryptionInfo, await encryptStandardPackage(packageData, key));
 }
+var DEFAULT_XML_LIMITS = {
+  maxDepth: 512,
+  maxNodes: 5e6
+};
+var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+function checkXmlLimits(xml, label, limits = {}) {
+  const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
+  const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
+  let depth = 0;
+  let nodes = 0;
+  for (const match of xml.matchAll(MARKUP_RE)) {
+    const [, closing, name, selfClosing] = match;
+    if (name === void 0) continue;
+    if (closing) {
+      depth--;
+      continue;
+    }
+    nodes++;
+    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (!selfClosing && ++depth > maxDepth)
+      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth}`);
+  }
+}
+function parseXml(xml, options = {}) {
+  const label = options.label ?? "OOXML";
+  if (/<!DOCTYPE|<!ENTITY/i.test(xml))
+    throw new Error(`${label} XML with DTD or entity declarations is not supported`);
+  checkXmlLimits(xml, label, options.limits);
+  let parseError = "";
+  let parsed;
+  try {
+    parsed = new xmldom.DOMParser({
+      onError: (level, message) => {
+        if (level !== "warning") parseError = message;
+      }
+    }).parseFromString(xml, "application/xml");
+  } catch (error) {
+    throw new Error(
+      `Invalid ${label} XML: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+  if (parseError || !parsed.documentElement)
+    throw new Error(`Invalid ${label} XML: ${parseError || "missing root element"}`);
+  return parsed;
+}
 
 // crypto/encryption-info.ts
 var RC4_ALG_ID = 26625;
@@ -3180,53 +3314,87 @@ function parseStandardEncryptionInfo(data) {
     }
   };
 }
-function tagAttribute(xml, tag, attr) {
-  const tagMatch = xml.match(new RegExp(`<[^>]*${tag}[^>]*>`, "i"));
-  if (!tagMatch) return "";
-  const attrMatch = tagMatch[0].match(new RegExp(`\\b${attr}="([^"]*)"`, "i"));
-  return attrMatch?.[1] ?? "";
+var PASSWORD_KEY_ENCRYPTOR_URI = "http://schemas.microsoft.com/office/2006/keyEncryptor/password";
+function childrenNamed(parent, localName) {
+  const found = [];
+  for (let node = parent.firstChild; node; node = node.nextSibling) {
+    if (node.nodeType === 1 && node.localName === localName) {
+      found.push(node);
+    }
+  }
+  return found;
 }
-function parseAgileEncryptionInfo(data) {
-  const xml = new TextDecoder("utf-8").decode(data.subarray(8));
-  const keyData = (attr) => tagAttribute(xml, "keyData", attr);
-  const integrity = (attr) => tagAttribute(xml, "dataIntegrity", attr);
-  const pke = (attr) => tagAttribute(xml, "encryptedKey", attr);
-  const int = (value) => parseInt(value, 10);
-  const encryptedHmacKey = integrity("encryptedHmacKey");
+function singleChild(parent, localName, mustExist) {
+  const matches = childrenNamed(parent, localName);
+  if (matches.length > 1) throw new Error(`The EncryptionInfo has several ${localName} elements.`);
+  if (matches.length === 0 && mustExist) {
+    throw new Error(`The EncryptionInfo has no ${localName} element.`);
+  }
+  return matches[0];
+}
+function required(element, attr) {
+  const value = element.getAttribute(attr);
+  if (!value) throw new Error(`The EncryptionInfo ${element.localName} has no ${attr}.`);
+  return value;
+}
+function requiredInt(element, attr) {
+  const value = required(element, attr);
+  if (!/^\d{1,10}$/.test(value)) {
+    throw new Error(`The EncryptionInfo ${element.localName} ${attr} is not a number: ${value}.`);
+  }
+  return Number(value);
+}
+function parseKeyBlock(element) {
   return {
+    saltSize: requiredInt(element, "saltSize"),
+    blockSize: requiredInt(element, "blockSize"),
+    keyBits: requiredInt(element, "keyBits"),
+    hashSize: requiredInt(element, "hashSize"),
+    cipherAlgorithm: required(element, "cipherAlgorithm"),
+    cipherChaining: required(element, "cipherChaining"),
+    hashAlgorithm: required(element, "hashAlgorithm"),
+    saltValue: base64Decode(required(element, "saltValue"))
+  };
+}
+function parseAgileEncryptionInfo(data) {
+  const root = parseXml(new TextDecoder("utf-8").decode(data.subarray(8)), {
+    label: "EncryptionInfo"
+  }).documentElement;
+  if (root.localName !== "encryption") {
+    throw new Error("The EncryptionInfo root element is not <encryption>.");
+  }
+  const keyData = parseKeyBlock(singleChild(root, "keyData", true));
+  const integrity = singleChild(root, "dataIntegrity", false);
+  const encryptors = childrenNamed(singleChild(root, "keyEncryptors", true), "keyEncryptor");
+  const passwordEncryptors = encryptors.filter(
+    (encryptor) => encryptor.getAttribute("uri") === PASSWORD_KEY_ENCRYPTOR_URI
+  );
+  if (passwordEncryptors.length !== 1) {
+    throw new Error(
+      passwordEncryptors.length === 0 ? "The EncryptionInfo has no password key encryptor." : "The EncryptionInfo has several password key encryptors."
+    );
+  }
+  const pke = singleChild(passwordEncryptors[0], "encryptedKey", true);
+  const info = {
     version: { major: 4, minor: 4 },
     isAgile: true,
-    keyData: {
-      saltSize: int(keyData("saltSize")),
-      blockSize: int(keyData("blockSize")),
-      keyBits: int(keyData("keyBits")),
-      hashSize: int(keyData("hashSize")),
-      cipherAlgorithm: keyData("cipherAlgorithm"),
-      cipherChaining: keyData("cipherChaining"),
-      hashAlgorithm: keyData("hashAlgorithm"),
-      saltValue: base64Decode(keyData("saltValue"))
-    },
-    ...encryptedHmacKey ? {
+    keyData,
+    ...integrity ? {
       dataIntegrity: {
-        encryptedHmacKey: base64Decode(encryptedHmacKey),
-        encryptedHmacValue: base64Decode(integrity("encryptedHmacValue"))
+        encryptedHmacKey: base64Decode(required(integrity, "encryptedHmacKey")),
+        encryptedHmacValue: base64Decode(required(integrity, "encryptedHmacValue"))
       }
     } : {},
     passwordKeyEncryptor: {
-      saltSize: int(pke("saltSize")),
-      blockSize: int(pke("blockSize")),
-      keyBits: int(pke("keyBits")),
-      hashSize: int(pke("hashSize")),
-      cipherAlgorithm: pke("cipherAlgorithm"),
-      cipherChaining: pke("cipherChaining"),
-      hashAlgorithm: pke("hashAlgorithm"),
-      saltValue: base64Decode(pke("saltValue")),
-      spinCount: int(pke("spinCount")),
-      encryptedVerifierHashInput: base64Decode(pke("encryptedVerifierHashInput")),
-      encryptedVerifierHashValue: base64Decode(pke("encryptedVerifierHashValue")),
-      encryptedKeyValue: base64Decode(pke("encryptedKeyValue"))
+      ...parseKeyBlock(pke),
+      spinCount: requiredInt(pke, "spinCount"),
+      encryptedVerifierHashInput: base64Decode(required(pke, "encryptedVerifierHashInput")),
+      encryptedVerifierHashValue: base64Decode(required(pke, "encryptedVerifierHashValue")),
+      encryptedKeyValue: base64Decode(required(pke, "encryptedKeyValue"))
     }
   };
+  assertValidAgileEncryptionInfo(info);
+  return info;
 }
 
 // crypto/index.ts
@@ -3242,7 +3410,7 @@ function streams(bytes) {
   }
   throw new Error("EncryptedPackage stream not found. The file may be corrupted.");
 }
-async function decryptOoxmlPackage(input, password) {
+async function decryptOoxmlPackage(input, password, options = {}) {
   const { info: infoStream, data } = streams(toBytes(input));
   const info = parseEncryptionInfo(infoStream);
   if (isStandard(info)) {
@@ -3250,21 +3418,26 @@ async function decryptOoxmlPackage(input, password) {
     if (!key2) throw new IncorrectPasswordError();
     return new Uint8Array(await decryptStandardPackage(data, key2));
   }
-  const key = await verifyAgilePassword(info, password);
+  const key = await verifyAgilePassword(info, password, options);
   if (!key) throw new IncorrectPasswordError();
-  await verifyAgileDataIntegrity(info, key, data);
+  await verifyAgileDataIntegrity(info, key, data, options);
   return new Uint8Array(await decryptAgilePackage(data, key, info));
 }
+function inspectOoxmlEncryption(input) {
+  const info = parseEncryptionInfo(streams(toBytes(input)).info);
+  if (isStandard(info)) return { scheme: "standard", integrityProtected: false };
+  return { scheme: "agile", integrityProtected: info.dataIntegrity !== void 0 };
+}
 function encryptOoxmlPackage(input, password, options = {}) {
   const bytes = toBytes(input);
   return options.encryptionScheme === "standard" ? encryptStandard(bytes, password, options) : encryptAgile(bytes, password, options);
 }
-async function verifyOoxmlPackagePassword(input, password) {
+async function verifyOoxmlPackagePassword(input, password, options = {}) {
   try {
     const opened = openEncryptedPackage(input);
     if (!opened) return false;
     const info = parseEncryptionInfo(opened.encryptionInfo);
-    const key = isStandard(info) ? await verifyStandardPassword(info, password) : await verifyAgilePassword(info, password);
+    const key = isStandard(info) ? await verifyStandardPassword(info, password) : await verifyAgilePassword(info, password, options);
     return key !== null;
   } catch {
     return false;
@@ -3293,6 +3466,7 @@ exports.encryptAgilePackage = encryptAgilePackage;
 exports.encryptOoxmlPackage = encryptOoxmlPackage;
 exports.encryptStandardPackage = encryptStandardPackage;
 exports.generateIV = generateIV;
+exports.inspectOoxmlEncryption = inspectOoxmlEncryption;
 exports.isCompoundFile = isCompoundFile;
 exports.isEncryptedOoxmlPackage = isEncryptedOoxmlPackage;
 exports.isOoxmlCryptoError = isOoxmlCryptoError;

package/dist/crypto/index.d.ts

@@ -1,21 +1,36 @@
 export { createOfficeGuid } from './uuid.js';
+import { type DecryptOptions } from './decrypt.js';
 import type { EncryptionOptions } from './types.js';
 export { DataIntegrityError, IncorrectPasswordError, PasswordRequiredError, isOoxmlCryptoError, type OoxmlCryptoErrorCode, } from './errors.js';
 export { EncryptedFileError, detectFileFormat, isCompoundFile, isEncryptedOoxmlPackage, openEncryptedPackage, type EncryptedPackageStreams, type FileFormatDetection, } from './detect.js';
 export type { EncryptionAlgorithm, EncryptionInfo, EncryptionOptions, EncryptionScheme, StandardEncryptionInfo, } from './types.js';
 export { RC4_ALG_ID, parseEncryptionInfo } from './encryption-info.js';
 export { BLOCK_KEYS, computeStandardKeyBase, deriveAgileKey, deriveStandardKey, deriveStandardKeyFromBase, generateIV, } from './key-derivation.js';
-export { decryptAgilePackage, decryptStandardPackage, verifyAgileDataIntegrity, verifyAgilePassword, verifyStandardPassword, } from './decrypt.js';
+export { decryptAgilePackage, decryptStandardPackage, verifyAgileDataIntegrity, verifyAgilePassword, verifyStandardPassword, type DecryptOptions, } from './decrypt.js';
 export { encryptAgilePackage, encryptStandardPackage } from './encrypt.js';
 export { buildAgileEncryptionInfoXml, buildEncryptionInfoStream, buildStandardEncryptionInfoStream, } from './encryption-info-write.js';
 /**
  * Decrypts a password-protected OOXML package (agile or Standard encryption) to the plain zip.
  *
  * @throws IncorrectPasswordError (`code: 'incorrect-password'`) when the password is wrong.
- * @throws DataIntegrityError (`code: 'data-integrity'`) when the agile HMAC does not match.
+ * @throws DataIntegrityError (`code: 'data-integrity'`) when the agile HMAC does not match or
+ *   is absent (pass `allowMissingIntegrity: true` to accept a package without one).
+ *   Standard encryption has no integrity record at all: see {@link inspectOoxmlEncryption}.
  * @throws Error when the bytes are not an encrypted package or the scheme is unsupported.
  */
-export declare function decryptOoxmlPackage(input: Uint8Array | ArrayBuffer, password: string): Promise<Uint8Array>;
+export declare function decryptOoxmlPackage(input: Uint8Array | ArrayBuffer, password: string, options?: DecryptOptions): Promise<Uint8Array>;
+/** What an encrypted package offers, from {@link inspectOoxmlEncryption}. */
+export interface OoxmlEncryptionSummary {
+    scheme: 'agile' | 'standard';
+    /**
+     * Whether the ciphertext is authenticated. False for Standard encryption (no HMAC exists in
+     * the scheme, so a decrypted package may have been modified) and for an agile package whose
+     * `dataIntegrity` was stripped.
+     */
+    integrityProtected: boolean;
+}
+/** The scheme of an encrypted package and whether it is integrity protected; no password needed. */
+export declare function inspectOoxmlEncryption(input: Uint8Array | ArrayBuffer): OoxmlEncryptionSummary;
 /**
  * Encrypts an OOXML package (the zip bytes of a .xlsx, .docx, .pptx, ...) with a password to
  * open. Writes the agile scheme (AES-256, SHA-512, 100,000 spins: what Office 2010+ writes) by
@@ -23,5 +38,5 @@ export declare function decryptOoxmlPackage(input: Uint8Array | ArrayBuffer, pas
  */
 export declare function encryptOoxmlPackage(input: Uint8Array | ArrayBuffer, password: string, options?: EncryptionOptions): Promise<Uint8Array>;
 /** Whether `password` opens the encrypted package, without decrypting it. Never throws. */
-export declare function verifyOoxmlPackagePassword(input: Uint8Array | ArrayBuffer, password: string): Promise<boolean>;
+export declare function verifyOoxmlPackagePassword(input: Uint8Array | ArrayBuffer, password: string, options?: DecryptOptions): Promise<boolean>;
 //# sourceMappingURL=index.d.ts.map

package/dist/crypto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../crypto/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAY1C,OAAO,KAAK,EAAkB,iBAAiB,EAA0B,MAAM,SAAS,CAAC;AAEzF,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,oBAAoB,GACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACxB,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EACN,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,UAAU,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,GACjC,MAAM,yBAAyB,CAAC;AAoBjC;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CAYrB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED,2FAA2F;AAC3F,wBAAsB,0BAA0B,CAC/C,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAYlB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../crypto/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1C,OAAO,EAMN,KAAK,cAAc,EACnB,MAAM,WAAW,CAAC;AAKnB,OAAO,KAAK,EAAkB,iBAAiB,EAA0B,MAAM,SAAS,CAAC;AAEzF,OAAO,EACN,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,oBAAoB,GACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACxB,MAAM,UAAU,CAAC;AAClB,YAAY,EACX,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EACN,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,yBAAyB,EACzB,UAAU,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,cAAc,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EACN,2BAA2B,EAC3B,yBAAyB,EACzB,iCAAiC,GACjC,MAAM,yBAAyB,CAAC;AAoBjC;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACxC,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAYrB;AAED,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,OAAO,GAAG,UAAU,CAAC;IAC7B;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,oGAAoG;AACpG,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,sBAAsB,CAI9F;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED,2FAA2F;AAC3F,wBAAsB,0BAA0B,CAC/C,KAAK,EAAE,UAAU,GAAG,WAAW,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,cAAmB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAYlB"}