ooxml-core 1.19.2 → 1.21.0

package/dist/visio/index.cjs

@@ -80,6 +80,19 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
+var XmlLimitError = class extends Error {
+  code = "xml-limit";
+  /** The limit that was exceeded. */
+  limit;
+  /** Its value: the largest depth or element count allowed. */
+  maximum;
+  constructor(message, limit3, maximum) {
+    super(message);
+    this.name = "XmlLimitError";
+    this.limit = limit3;
+    this.maximum = maximum;
+  }
+};
 var TAG_RE = /<(\/?)([^\s\/><]+)(?:\s+[^\s=\/><]+\s*=\s*(?:"[^"<]*"|'[^'<]*'))*\s*(\/?)>/y;
 var MARKUP_SKIPS = [
   ["<!--", "-->"],
@@ -113,11 +126,22 @@ function checkXmlLimits(xml, label, limits = {}) {
       continue;
     }
     nodes++;
-    if (nodes > maxNodes) throw new Error(`${label} XML exceeds the limit of ${maxNodes} elements`);
+    if (nodes > maxNodes)
+      throw new XmlLimitError(
+        `${label} XML exceeds the limit of ${maxNodes} elements`,
+        "maxNodes",
+        maxNodes
+      );
     if (!selfClosing && ++depth > maxDepth)
-      throw new Error(`${label} XML exceeds the nesting depth limit of ${maxDepth}`);
+      throw new XmlLimitError(
+        `${label} XML exceeds the nesting depth limit of ${maxDepth}`,
+        "maxDepth",
+        maxDepth
+      );
   }
 }
+var CRLF_DECLARATION = /^<\?xml[^>]*\?>\r\n/;
+var crlfDeclarations = /* @__PURE__ */ new WeakSet();
 function parseXml(xml, options2 = {}) {
   const label = options2.label ?? "OOXML";
   if (/<!DOCTYPE|<!ENTITY/i.test(xml))
@@ -139,9 +163,13 @@ function parseXml(xml, options2 = {}) {
   }
   if (parseError || !parsed.documentElement)
     throw new Error(`Invalid ${label} XML: ${parseError || "missing root element"}`);
+  if (CRLF_DECLARATION.test(xml)) crlfDeclarations.add(parsed);
   return parsed;
 }
-var buildXml = (node3) => new xmldom.XMLSerializer().serializeToString(node3);
+var buildXml = (node3) => {
+  const xml = new xmldom.XMLSerializer().serializeToString(node3);
+  return crlfDeclarations.has(node3) ? xml.replace(/^(<\?xml[^>]*\?>)\n/, "$1\r\n") : xml;
+};
 var isElement = (node3) => node3.nodeType === 1;
 var elements = (parent) => Array.from(parent.childNodes).filter(isElement);
 function named(element2, local, ns, lenient = true) {
@@ -240,6 +268,12 @@ function parseLiteFragment(xml, container, namespaces) {
     }
     if (lt < 0) break;
     const next = source.charCodeAt(lt + 1);
+    if (next === 33) {
+      const after = skipCommentOrCdata(source, lt, top);
+      if (after < 0) return void 0;
+      pos = after;
+      continue;
+    }
     if (next === 47) {
       const gt = source.indexOf(">", lt);
       if (gt < 0 || stack.length < 2 || source.slice(lt + 2, gt).trimEnd() !== top.tagName)
@@ -260,6 +294,25 @@ function parseLiteFragment(xml, container, namespaces) {
   }
   return stack.length === 1 ? root2 : void 0;
 }
+var DECLARATIONS = /<!DOCTYPE|<!ENTITY/i;
+function skipCommentOrCdata(source, lt, parent) {
+  if (source.startsWith("<!--", lt)) {
+    const end = source.indexOf("-->", lt + 4);
+    if (end < 0) return -1;
+    const body = source.slice(lt + 4, end);
+    if (body.includes("--") || body.endsWith("-") || DECLARATIONS.test(body)) return -1;
+    return end + 3;
+  }
+  if (source.startsWith("<![CDATA[", lt)) {
+    const end = source.indexOf("]]>", lt + 9);
+    if (end < 0) return -1;
+    const text6 = source.slice(lt + 9, end);
+    if (DECLARATIONS.test(text6)) return -1;
+    parent.childNodes.push(text6);
+    return end + 3;
+  }
+  return -1;
+}
 function startTag(source, from, namespaces) {
   const n = source.length;
   let i = from;
@@ -7665,9 +7718,9 @@ function createWorksheet(name3, sheetId5) {
   };
 }
 
-// xlsx/styles.ts
-function styleKey(style2) {
-  return JSON.stringify(sortKeys(style2));
+// xlsx/stable-key.ts
+function stableKey(value3) {
+  return JSON.stringify(sortKeys(value3));
 }
 function sortKeys(value3) {
   if (Array.isArray(value3)) return value3.map(sortKeys);
@@ -7681,6 +7734,11 @@ function sortKeys(value3) {
   }
   return value3;
 }
+
+// xlsx/styles.ts
+function styleKey(style2) {
+  return stableKey(style2);
+}
 function styleAt(workbook, styleId) {
   const style2 = workbook.styles[styleId ?? 0] ?? workbook.styles[0];
   if (!style2) throw new Error("Workbook has no default cell style");
@@ -10287,10 +10345,13 @@ var DEFAULT_ZIP_LIMITS = {
 var ZipLimitError = class extends Error {
   code = "ZIP_BOMB";
   limit;
+  /** The check that failed (absent when the error was built without one). */
+  kind;
   constructor(message, details) {
     super(message);
     this.name = "ZipLimitError";
     this.limit = details.limit;
+    this.kind = details.kind;
   }
 };
 var mib = (bytes) => Math.round(bytes / 1048576);
@@ -10313,7 +10374,7 @@ function resolveLimits(limits) {
     maxEntryBytes: limits.maxEntryBytes ?? DEFAULT_ZIP_LIMITS.maxEntryBytes,
     maxTotalBytes: limits.maxTotalBytes ?? DEFAULT_ZIP_LIMITS.maxTotalBytes,
     label: limits.label ?? "ZIP",
-    fail: (message, limit3) => create2 ? create2(message, { limit: limit3 }) : new ZipLimitError(message, { limit: limit3 })
+    fail: (message, limit3, kind) => create2 ? create2(message, { limit: limit3, kind }) : new ZipLimitError(message, { limit: limit3, kind })
   };
 }
 function inflateEntryGuarded(entry3, alreadyRead, limits) {
@@ -10336,13 +10397,18 @@ function inflateEntryGuarded(entry3, alreadyRead, limits) {
       size3 += chunk.byteLength;
       if (size3 > declared || size3 > r.maxEntryBytes)
         return abort(
-          r.fail(`${r.label} part ${entry3.name} inflates past its declared size`, r.maxEntryBytes)
+          r.fail(
+            `${r.label} part ${entry3.name} inflates past its declared size`,
+            r.maxEntryBytes,
+            size3 > declared ? "declaredSize" : "maxEntryBytes"
+          )
         );
       if (alreadyRead + size3 > r.maxTotalBytes)
         return abort(
           r.fail(
             `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-            r.maxTotalBytes
+            r.maxTotalBytes,
+            "maxTotalBytes"
           )
         );
       chunks.push(chunk);
@@ -10375,26 +10441,29 @@ function guardZip(zip, limits = {}) {
   if (entries.length > r.maxEntries)
     throw r.fail(
       `${r.label} package exceeds the ${r.maxEntries.toLocaleString("en-US")} part limit`,
-      r.maxEntries
+      r.maxEntries,
+      "maxEntries"
     );
   let declared = 0;
   for (const entry3 of entries) {
     const original = entry3.unsafeOriginalName;
     if (!isSafePartName(entry3.name) || original !== void 0 && !isSafePartName(original))
-      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries);
+      throw r.fail(`${r.label} package has an unsafe part name`, r.maxEntries, "partName");
     if (entry3.dir) continue;
     const size3 = declaredEntrySize(entry3);
     if (size3 > r.maxEntryBytes)
       throw r.fail(
         `${r.label} part ${entry3.name} exceeds the uncompressed part size limit`,
-        r.maxEntryBytes
+        r.maxEntryBytes,
+        "maxEntryBytes"
       );
     declared += size3;
   }
   if (declared > r.maxTotalBytes)
     throw r.fail(
       `${r.label} package exceeds the ${mib(r.maxTotalBytes)} MiB uncompressed content limit`,
-      r.maxTotalBytes
+      r.maxTotalBytes,
+      "maxTotalBytes"
     );
   const produced = /* @__PURE__ */ new Map();
   let total = 0;
@@ -12263,10 +12332,69 @@ function mergeComments(legacy, threaded) {
     (a2, b) => a2.address.row - b.address.row || a2.address.col - b.address.col
   );
 }
-var MAX_INPUT_BYTES = 50 * 1024 * 1024;
-var MAX_PARTS = 1e4;
-var MAX_UNCOMPRESSED_BYTES = 300 * 1024 * 1024;
-var MAX_PART_BYTES = 200 * 1024 * 1024;
+
+// xlsx/read/limits.ts
+var DEFAULT_XLSX_LOAD_LIMITS = {
+  maxInputBytes: 50 * 1024 * 1024,
+  maxParts: 1e4,
+  maxPartBytes: 200 * 1024 * 1024,
+  maxTotalBytes: 300 * 1024 * 1024,
+  maxXmlElements: 5e6
+};
+var WorkbookTooLargeError = class extends Error {
+  code = "workbook-too-large";
+  /** The limit that was exceeded, as named in {@link XlsxLoadLimits}. */
+  limit;
+  /** The value of that limit when the load failed. */
+  maximum;
+  constructor(message, limit3, maximum, options2) {
+    super(message, options2);
+    this.name = "WorkbookTooLargeError";
+    this.limit = limit3;
+    this.maximum = maximum;
+  }
+};
+function resolveLoadLimits(limits = {}) {
+  const resolved = { ...DEFAULT_XLSX_LOAD_LIMITS };
+  for (const name3 of Object.keys(resolved)) {
+    const value3 = limits[name3];
+    if (value3 === void 0) continue;
+    if (!Number.isFinite(value3) || value3 <= 0)
+      throw new RangeError(`limits.${name3} must be a positive finite number`);
+    resolved[name3] = value3;
+  }
+  return resolved;
+}
+var ZIP_LIMIT_NAMES = {
+  maxInputBytes: "maxInputBytes",
+  maxEntries: "maxParts",
+  maxEntryBytes: "maxPartBytes",
+  maxTotalBytes: "maxTotalBytes"
+};
+function zipLimitsFor(limits) {
+  return {
+    maxInputBytes: limits.maxInputBytes,
+    maxEntries: limits.maxParts,
+    maxEntryBytes: limits.maxPartBytes,
+    maxTotalBytes: limits.maxTotalBytes,
+    label: "XLSX",
+    createError: (message, { limit: limit3, kind }) => {
+      const name3 = ZIP_LIMIT_NAMES[kind];
+      return name3 ? new WorkbookTooLargeError(message, name3, limit3) : new ZipLimitError(message, { limit: limit3, kind });
+    }
+  };
+}
+function parseDataXml(xml, label, maxXmlElements = DEFAULT_XLSX_LOAD_LIMITS.maxXmlElements) {
+  try {
+    return parseXml(xml, { label, limits: { maxNodes: maxXmlElements } });
+  } catch (error) {
+    if (error instanceof XmlLimitError && error.limit === "maxNodes")
+      throw new WorkbookTooLargeError(error.message, "maxXmlElements", error.maximum, {
+        cause: error
+      });
+    throw error;
+  }
+}
 var CONTENT_TYPES = {
   workbook: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml",
   workbookMacro: "application/vnd.ms-excel.sheet.macroEnabled.main+xml",
@@ -12337,16 +12465,15 @@ var SourceIndex = class {
 };
 var mib2 = (bytes) => Math.round(bytes / 1048576);
 async function readZipParts(input, limits = {}) {
-  const maxInput = limits.maxInputBytes ?? MAX_INPUT_BYTES;
-  const zipLimits = {
-    maxEntries: limits.maxParts ?? MAX_PARTS,
-    maxEntryBytes: limits.maxPartBytes ?? MAX_PART_BYTES,
-    maxTotalBytes: limits.maxTotalBytes ?? MAX_UNCOMPRESSED_BYTES,
-    label: "XLSX"
-  };
+  const resolved = resolveLoadLimits(limits);
+  const maxInput = resolved.maxInputBytes;
   const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
   if (bytes.byteLength > maxInput)
-    throw new Error(`XLSX package exceeds the ${mib2(maxInput)} MiB compressed input limit`);
+    throw new WorkbookTooLargeError(
+      `XLSX package exceeds the ${mib2(maxInput)} MiB compressed input limit`,
+      "maxInputBytes",
+      maxInput
+    );
   let loaded;
   try {
     loaded = await JSZip__default.default.loadAsync(bytes);
@@ -12356,7 +12483,7 @@ async function readZipParts(input, limits = {}) {
       { cause: error }
     );
   }
-  const zip = guardZip(loaded, zipLimits);
+  const zip = guardZip(loaded, zipLimitsFor(resolved));
   const parts = /* @__PURE__ */ new Map();
   for (const entry3 of Object.values(zip.files)) {
     if (entry3.dir) continue;
@@ -12563,9 +12690,9 @@ function parseRichString(element2, palette) {
   const text6 = parsed.map((run) => run.text).join("");
   return { text: text6, runs: parsed };
 }
-function parseSharedStrings(xml, palette) {
+function parseSharedStrings(xml, palette, maxXmlElements) {
   if (!xml) return [];
-  const root2 = parseXml(xml, { label: "XLSX shared strings" }).documentElement;
+  const root2 = parseDataXml(xml, "XLSX shared strings", maxXmlElements).documentElement;
   return xChildren(root2, "si").map((si) => parseRichString(si, palette));
 }
 
@@ -17156,21 +17283,50 @@ function rootNamespaces(xml) {
   for (const match of (root2[2] ?? "").matchAll(DECLARATION2)) out[match[1] ?? ""] = match[3] ?? "";
   return out;
 }
+var SPECIAL = /<[!?]/g;
+var SECTIONS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
+function blankComments(xml) {
+  if (!xml.includes("<!--") && !xml.includes("<![CDATA[")) return xml;
+  const pieces = [];
+  let copied = 0;
+  SPECIAL.lastIndex = 0;
+  for (let match = SPECIAL.exec(xml); match; match = SPECIAL.exec(xml)) {
+    const at2 = match.index;
+    const section3 = SECTIONS.find(([open2]) => xml.startsWith(open2, at2));
+    if (!section3) return void 0;
+    const [open, close4] = section3;
+    const end = xml.indexOf(close4, at2 + open.length);
+    if (end < 0) return void 0;
+    const after = end + close4.length;
+    if (open !== "<?") {
+      pieces.push(xml.slice(copied, at2), " ".repeat(after - at2));
+      copied = after;
+    }
+    SPECIAL.lastIndex = after;
+  }
+  pieces.push(xml.slice(copied));
+  return pieces.join("");
+}
 function splitSheetData(xml) {
-  if (xml.includes("<!--") || xml.includes("<![CDATA[")) return void 0;
-  const namespaces = rootNamespaces(xml);
-  const open = OPEN.exec(xml);
+  const plain4 = blankComments(xml);
+  if (plain4 === void 0) return void 0;
+  const namespaces = rootNamespaces(plain4);
+  const open = OPEN.exec(plain4);
   if (!namespaces || !open) return void 0;
   const prefix2 = (open[1] ?? "").slice(0, -1);
   const ns = namespaces[prefix2];
   if (prefix2 && ns === void 0) return void 0;
   const tagName2 = `${open[1] ?? ""}sheetData`;
-  const openEnd = xml.indexOf(">", open.index);
+  const openEnd = plain4.indexOf(">", open.index);
   if (openEnd < 0) return void 0;
-  const attributes = xml.slice(open.index + tagName2.length + 1, openEnd);
+  const attributes = plain4.slice(open.index + tagName2.length + 1, openEnd);
   if (attributes.trimEnd().endsWith("/") || attributes.includes("xmlns")) return void 0;
-  const close4 = xml.indexOf(`</${tagName2}`, openEnd);
-  if (close4 < 0 || OPEN.test(xml.slice(openEnd))) return void 0;
+  const close4 = plain4.indexOf(`</${tagName2}`, openEnd);
+  if (close4 < 0 || OPEN.test(plain4.slice(openEnd))) return void 0;
   const container = new LiteElement(tagName2, "sheetData", ns || null);
   const data = parseLiteFragment(xml.slice(openEnd + 1, close4), container, namespaces);
   if (!data) return void 0;
@@ -17370,7 +17526,11 @@ function parseWorksheet(ctx, partName, name3, sheetId5) {
     return sheet;
   }
   const split = splitSheetData(xml);
-  const root2 = parseXml(split?.xml ?? xml, { label: "XLSX worksheet" }).documentElement;
+  const root2 = parseDataXml(
+    split?.xml ?? xml,
+    "XLSX worksheet",
+    ctx.maxXmlElements
+  ).documentElement;
   const byName = /* @__PURE__ */ new Map();
   const cfBlocks = [];
   for (const node3 of elements(root2)) {
@@ -17444,8 +17604,9 @@ function liftPrintAreas(workbook) {
     return false;
   });
 }
-async function loadXlsx(input) {
-  const parts = await readZipParts(input);
+async function loadXlsx(input, options2 = {}) {
+  const limits = resolveLoadLimits(options2.limits);
+  const parts = await readZipParts(input, limits);
   const source = new SourceIndex(parts);
   const workbookPart = source.workbookPart();
   if (!workbookPart) throw new Error("XLSX package has no workbook part (xl/workbook.xml)");
@@ -17466,7 +17627,8 @@ async function loadXlsx(input) {
     source,
     sharedStrings: parseSharedStrings(
       stringsPart ? source.text(stringsPart) : void 0,
-      styles.palette
+      styles.palette,
+      limits.maxXmlElements
     ),
     xfMap: styles.xfMap,
     date1904: book.date1904,
@@ -17474,7 +17636,8 @@ async function loadXlsx(input) {
     dxfs: styles.dxfs,
     persons: parsePersons(personsPart ? source.text(personsPart) : void 0),
     dynamicCells: parseDynamicArrayMetadata(metadataPart ? source.text(metadataPart) : void 0),
-    warn
+    warn,
+    maxXmlElements: limits.maxXmlElements
   };
   const rels = source.rels(workbookPart);
   const sheets = book.sheets.map((entry3) => {
@@ -17957,14 +18120,24 @@ function formatAxisValue(value3, percent = false) {
   return `${v < 0 ? "-" : ""}${grouped}${frac ? `.${frac}` : ""}`;
 }
 
+// chart/extent.ts
+function extentOf(values) {
+  let min = Infinity;
+  let max = -Infinity;
+  for (const value3 of values) {
+    min = Math.min(min, value3);
+    max = Math.max(max, value3);
+  }
+  return { min, max };
+}
+
 // chart/axis-range.ts
 function computeLogValueRange(series, logBase) {
   const allValues = series.flatMap((item) => item.values).filter((value3) => value3 !== null && Number.isFinite(value3) && value3 > 0);
   if (allValues.length === 0) {
     return { min: 1, max: logBase, span: 1, logScale: true, logBase };
   }
-  const dataMin = Math.min(...allValues);
-  const dataMax = Math.max(...allValues);
+  const { min: dataMin, max: dataMax } = extentOf(allValues);
   const logMin = Math.floor(Math.log(dataMin) / Math.log(logBase));
   const logMax = Math.ceil(Math.log(dataMax) / Math.log(logBase));
   const min = logBase ** logMin;
@@ -18692,8 +18865,7 @@ function computeHistogramBins(values, options2, format5 = String) {
     });
   }
   if (regular.length > 0) {
-    const min = Math.min(...regular.map((item) => item.value));
-    const max = Math.max(...regular.map((item) => item.value));
+    const { min, max } = extentOf(regular.map((item) => item.value));
     const requestedSize = options2.binSize && options2.binSize > 0 ? options2.binSize : void 0;
     const requestedCount = options2.binCount && options2.binCount > 0 ? options2.binCount : void 0;
     const start = requestedSize ? Math.floor(min / requestedSize) * requestedSize : min;
@@ -18821,8 +18993,9 @@ function waterfallView(chart, model2, ctx) {
     colors: { increase: role(0), decrease: role(1), total: role(2) }
   };
   const ends = steps.flatMap((step2) => [step2.startValue, step2.endValue]);
+  const range2 = extentOf(ends);
   model2.valueAxis = {
-    ...ends.length ? niceScale(Math.min(...ends), Math.max(...ends)) : niceScale(0, 1),
+    ...ends.length ? niceScale(range2.min, range2.max) : niceScale(0, 1),
     percent: false
   };
   const labels = model2.categories;
@@ -18938,7 +19111,8 @@ function chartSummaryView(chart, theme2, options2 = {}) {
       s.xValues = s.values.map((_, k) => numeric5 ? toNumber(cats[k] ?? null) : k + 1);
     });
     const xs = series.flatMap((s) => s.xValues ?? []).filter((x) => x !== null);
-    model2.xAxis = xs.length ? niceScale(Math.min(...xs), Math.max(...xs)) : niceScale(0, 1);
+    const range2 = extentOf(xs);
+    model2.xAxis = xs.length ? niceScale(range2.min, range2.max) : niceScale(0, 1);
   }
   if (type === "stock") model2.stock = stockView(chart.stock, ctx);
   if (type === "bubble") bubbleView(chart, model2, ctx.evaluateRef);