pptx-react-viewer 1.1.4 → 1.1.5

package/node_modules/pptx-viewer-core/dist/{signature-inspection-status-BcJSdOvb.d.mts → signature-inspection-status-BCUpfCQh.d.mts}

@@ -136,8 +136,19 @@ interface OfficeSignatureReference {
  * These functions operate on raw XML strings without requiring a DOM parser,
  * making them platform-agnostic (browser + Node).
  */
-/** Escape special characters in an XML attribute value. */
+/**
+ * Escape special characters in an XML attribute value.
+ * Handles `&`, `<`, `>`, `"`, and `'` so the result is safe inside both
+ * double- and single-quoted attributes.
+ */
 declare function escapeXmlAttr(value: string): string;
+/**
+ * Escape special characters in XML text content.
+ * Only `&`, `<`, and `>` need escaping outside of attribute values.
+ */
+declare function escapeXmlText(value: string): string;
+/** Validate that `value` only contains characters from the standard base64 alphabet. */
+declare function isValidBase64(value: string): boolean;
 /**
  * Extract an attribute value from the first matching XML tag via regex.
  * Namespace prefixes on the tag name are supported via the pattern.
@@ -206,4 +217,4 @@ declare function computeDetailStatus(detail: Pick<SignatureDetail, 'signatureVal
  */
 declare function computeVerificationStatus(details: SignatureDetail[]): DigitalSignatureReport['verificationStatus'];
 
-export { normalizePartPath as A, resolveReferenceUriToPart as B, type CertificateRevocationStatus as C, DIGEST_ALGORITHM_TO_HASH as D, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV as E, type LoadedSigningMaterial as L, OPC_RELATIONSHIP_TRANSFORM as O, PPTX_VIEWER_MANIFEST_NS as P, type ReferenceTransformResult as R, SUPPORTED_XML_CANON_TRANSFORMS as S, type TimestampAuthorityStatus as T, XMLDSIG_NS as X, DIGEST_ALGORITHM_TO_WEB_CRYPTO as a, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE as b, DIGITAL_SIGNATURE_REL_TYPE as c, type DigitalSignatureReport as d, type DigitalSignatureVerificationStatus as e, ENTERPRISE_REQUIRE_REVOCATION_ENV as f, ENTERPRISE_REQUIRE_TIMESTAMP_ENV as g, ENTERPRISE_TRUST_ROOTS_FILE_ENV as h, ENTERPRISE_TRUST_ROOTS_PEM_ENV as i, type OfficeSignatureReference as j, type ParsedReferenceTransform as k, type SignOptions as l, type SignResult as m, type SignatureDetail as n, type SignatureDetailStatus as o, type SignatureCertificateInfo as p, type SignatureReferenceCheck as q, type SignatureValidationPolicy as r, XML_TRANSFORM_ENVELOPED_SIGNATURE as s, computeDetailStatus as t, computeDigestBase64 as u, computeVerificationStatus as v, escapeXmlAttr as w, extractAllTagText as x, extractFirstTagText as y, extractTagAttribute as z };
+export { extractTagAttribute as A, isValidBase64 as B, type CertificateRevocationStatus as C, DIGEST_ALGORITHM_TO_HASH as D, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV as E, normalizePartPath as F, resolveReferenceUriToPart as G, type LoadedSigningMaterial as L, OPC_RELATIONSHIP_TRANSFORM as O, PPTX_VIEWER_MANIFEST_NS as P, type ReferenceTransformResult as R, SUPPORTED_XML_CANON_TRANSFORMS as S, type TimestampAuthorityStatus as T, XMLDSIG_NS as X, DIGEST_ALGORITHM_TO_WEB_CRYPTO as a, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE as b, DIGITAL_SIGNATURE_REL_TYPE as c, type DigitalSignatureReport as d, type DigitalSignatureVerificationStatus as e, ENTERPRISE_REQUIRE_REVOCATION_ENV as f, ENTERPRISE_REQUIRE_TIMESTAMP_ENV as g, ENTERPRISE_TRUST_ROOTS_FILE_ENV as h, ENTERPRISE_TRUST_ROOTS_PEM_ENV as i, type OfficeSignatureReference as j, type ParsedReferenceTransform as k, type SignOptions as l, type SignResult as m, type SignatureDetail as n, type SignatureDetailStatus as o, type SignatureCertificateInfo as p, type SignatureReferenceCheck as q, type SignatureValidationPolicy as r, XML_TRANSFORM_ENVELOPED_SIGNATURE as s, computeDetailStatus as t, computeDigestBase64 as u, computeVerificationStatus as v, escapeXmlAttr as w, escapeXmlText as x, extractAllTagText as y, extractFirstTagText as z };

package/node_modules/pptx-viewer-core/dist/{signature-inspection-status-BcJSdOvb.d.ts → signature-inspection-status-BCUpfCQh.d.ts}

@@ -136,8 +136,19 @@ interface OfficeSignatureReference {
  * These functions operate on raw XML strings without requiring a DOM parser,
  * making them platform-agnostic (browser + Node).
  */
-/** Escape special characters in an XML attribute value. */
+/**
+ * Escape special characters in an XML attribute value.
+ * Handles `&`, `<`, `>`, `"`, and `'` so the result is safe inside both
+ * double- and single-quoted attributes.
+ */
 declare function escapeXmlAttr(value: string): string;
+/**
+ * Escape special characters in XML text content.
+ * Only `&`, `<`, and `>` need escaping outside of attribute values.
+ */
+declare function escapeXmlText(value: string): string;
+/** Validate that `value` only contains characters from the standard base64 alphabet. */
+declare function isValidBase64(value: string): boolean;
 /**
  * Extract an attribute value from the first matching XML tag via regex.
  * Namespace prefixes on the tag name are supported via the pattern.
@@ -206,4 +217,4 @@ declare function computeDetailStatus(detail: Pick<SignatureDetail, 'signatureVal
  */
 declare function computeVerificationStatus(details: SignatureDetail[]): DigitalSignatureReport['verificationStatus'];
 
-export { normalizePartPath as A, resolveReferenceUriToPart as B, type CertificateRevocationStatus as C, DIGEST_ALGORITHM_TO_HASH as D, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV as E, type LoadedSigningMaterial as L, OPC_RELATIONSHIP_TRANSFORM as O, PPTX_VIEWER_MANIFEST_NS as P, type ReferenceTransformResult as R, SUPPORTED_XML_CANON_TRANSFORMS as S, type TimestampAuthorityStatus as T, XMLDSIG_NS as X, DIGEST_ALGORITHM_TO_WEB_CRYPTO as a, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE as b, DIGITAL_SIGNATURE_REL_TYPE as c, type DigitalSignatureReport as d, type DigitalSignatureVerificationStatus as e, ENTERPRISE_REQUIRE_REVOCATION_ENV as f, ENTERPRISE_REQUIRE_TIMESTAMP_ENV as g, ENTERPRISE_TRUST_ROOTS_FILE_ENV as h, ENTERPRISE_TRUST_ROOTS_PEM_ENV as i, type OfficeSignatureReference as j, type ParsedReferenceTransform as k, type SignOptions as l, type SignResult as m, type SignatureDetail as n, type SignatureDetailStatus as o, type SignatureCertificateInfo as p, type SignatureReferenceCheck as q, type SignatureValidationPolicy as r, XML_TRANSFORM_ENVELOPED_SIGNATURE as s, computeDetailStatus as t, computeDigestBase64 as u, computeVerificationStatus as v, escapeXmlAttr as w, extractAllTagText as x, extractFirstTagText as y, extractTagAttribute as z };
+export { extractTagAttribute as A, isValidBase64 as B, type CertificateRevocationStatus as C, DIGEST_ALGORITHM_TO_HASH as D, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV as E, normalizePartPath as F, resolveReferenceUriToPart as G, type LoadedSigningMaterial as L, OPC_RELATIONSHIP_TRANSFORM as O, PPTX_VIEWER_MANIFEST_NS as P, type ReferenceTransformResult as R, SUPPORTED_XML_CANON_TRANSFORMS as S, type TimestampAuthorityStatus as T, XMLDSIG_NS as X, DIGEST_ALGORITHM_TO_WEB_CRYPTO as a, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE as b, DIGITAL_SIGNATURE_REL_TYPE as c, type DigitalSignatureReport as d, type DigitalSignatureVerificationStatus as e, ENTERPRISE_REQUIRE_REVOCATION_ENV as f, ENTERPRISE_REQUIRE_TIMESTAMP_ENV as g, ENTERPRISE_TRUST_ROOTS_FILE_ENV as h, ENTERPRISE_TRUST_ROOTS_PEM_ENV as i, type OfficeSignatureReference as j, type ParsedReferenceTransform as k, type SignOptions as l, type SignResult as m, type SignatureDetail as n, type SignatureDetailStatus as o, type SignatureCertificateInfo as p, type SignatureReferenceCheck as q, type SignatureValidationPolicy as r, XML_TRANSFORM_ENVELOPED_SIGNATURE as s, computeDetailStatus as t, computeDigestBase64 as u, computeVerificationStatus as v, escapeXmlAttr as w, escapeXmlText as x, extractAllTagText as y, extractFirstTagText as z };

package/node_modules/pptx-viewer-core/dist/signature-node/index.d.mts

@@ -1,5 +1,5 @@
-import { p as SignatureCertificateInfo, L as LoadedSigningMaterial, C as CertificateRevocationStatus, T as TimestampAuthorityStatus, r as SignatureValidationPolicy, k as ParsedReferenceTransform, R as ReferenceTransformResult, q as SignatureReferenceCheck, l as SignOptions, m as SignResult, d as DigitalSignatureReport } from '../signature-inspection-status-BcJSdOvb.mjs';
-export { D as DIGEST_ALGORITHM_TO_HASH, a as DIGEST_ALGORITHM_TO_WEB_CRYPTO, b as DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, c as DIGITAL_SIGNATURE_REL_TYPE, e as DigitalSignatureVerificationStatus, E as ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, f as ENTERPRISE_REQUIRE_REVOCATION_ENV, g as ENTERPRISE_REQUIRE_TIMESTAMP_ENV, h as ENTERPRISE_TRUST_ROOTS_FILE_ENV, i as ENTERPRISE_TRUST_ROOTS_PEM_ENV, O as OPC_RELATIONSHIP_TRANSFORM, j as OfficeSignatureReference, P as PPTX_VIEWER_MANIFEST_NS, S as SUPPORTED_XML_CANON_TRANSFORMS, n as SignatureDetail, o as SignatureDetailStatus, X as XMLDSIG_NS, s as XML_TRANSFORM_ENVELOPED_SIGNATURE, t as computeDetailStatus, u as computeDigestBase64WebCrypto, v as computeVerificationStatus, w as escapeXmlAttr, x as extractAllTagText, y as extractFirstTagText, z as extractTagAttribute, A as normalizePartPath, B as resolveReferenceUriToPart } from '../signature-inspection-status-BcJSdOvb.mjs';
+import { p as SignatureCertificateInfo, L as LoadedSigningMaterial, C as CertificateRevocationStatus, T as TimestampAuthorityStatus, r as SignatureValidationPolicy, k as ParsedReferenceTransform, R as ReferenceTransformResult, q as SignatureReferenceCheck, l as SignOptions, m as SignResult, d as DigitalSignatureReport } from '../signature-inspection-status-BCUpfCQh.mjs';
+export { D as DIGEST_ALGORITHM_TO_HASH, a as DIGEST_ALGORITHM_TO_WEB_CRYPTO, b as DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, c as DIGITAL_SIGNATURE_REL_TYPE, e as DigitalSignatureVerificationStatus, E as ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, f as ENTERPRISE_REQUIRE_REVOCATION_ENV, g as ENTERPRISE_REQUIRE_TIMESTAMP_ENV, h as ENTERPRISE_TRUST_ROOTS_FILE_ENV, i as ENTERPRISE_TRUST_ROOTS_PEM_ENV, O as OPC_RELATIONSHIP_TRANSFORM, j as OfficeSignatureReference, P as PPTX_VIEWER_MANIFEST_NS, S as SUPPORTED_XML_CANON_TRANSFORMS, n as SignatureDetail, o as SignatureDetailStatus, X as XMLDSIG_NS, s as XML_TRANSFORM_ENVELOPED_SIGNATURE, t as computeDetailStatus, u as computeDigestBase64WebCrypto, v as computeVerificationStatus, w as escapeXmlAttr, x as escapeXmlText, y as extractAllTagText, z as extractFirstTagText, A as extractTagAttribute, B as isValidBase64, F as normalizePartPath, G as resolveReferenceUriToPart } from '../signature-inspection-status-BCUpfCQh.mjs';
 import JSZip from 'jszip';
 
 /**

package/node_modules/pptx-viewer-core/dist/signature-node/index.d.ts

@@ -1,5 +1,5 @@
-import { p as SignatureCertificateInfo, L as LoadedSigningMaterial, C as CertificateRevocationStatus, T as TimestampAuthorityStatus, r as SignatureValidationPolicy, k as ParsedReferenceTransform, R as ReferenceTransformResult, q as SignatureReferenceCheck, l as SignOptions, m as SignResult, d as DigitalSignatureReport } from '../signature-inspection-status-BcJSdOvb.js';
-export { D as DIGEST_ALGORITHM_TO_HASH, a as DIGEST_ALGORITHM_TO_WEB_CRYPTO, b as DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, c as DIGITAL_SIGNATURE_REL_TYPE, e as DigitalSignatureVerificationStatus, E as ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, f as ENTERPRISE_REQUIRE_REVOCATION_ENV, g as ENTERPRISE_REQUIRE_TIMESTAMP_ENV, h as ENTERPRISE_TRUST_ROOTS_FILE_ENV, i as ENTERPRISE_TRUST_ROOTS_PEM_ENV, O as OPC_RELATIONSHIP_TRANSFORM, j as OfficeSignatureReference, P as PPTX_VIEWER_MANIFEST_NS, S as SUPPORTED_XML_CANON_TRANSFORMS, n as SignatureDetail, o as SignatureDetailStatus, X as XMLDSIG_NS, s as XML_TRANSFORM_ENVELOPED_SIGNATURE, t as computeDetailStatus, u as computeDigestBase64WebCrypto, v as computeVerificationStatus, w as escapeXmlAttr, x as extractAllTagText, y as extractFirstTagText, z as extractTagAttribute, A as normalizePartPath, B as resolveReferenceUriToPart } from '../signature-inspection-status-BcJSdOvb.js';
+import { p as SignatureCertificateInfo, L as LoadedSigningMaterial, C as CertificateRevocationStatus, T as TimestampAuthorityStatus, r as SignatureValidationPolicy, k as ParsedReferenceTransform, R as ReferenceTransformResult, q as SignatureReferenceCheck, l as SignOptions, m as SignResult, d as DigitalSignatureReport } from '../signature-inspection-status-BCUpfCQh.js';
+export { D as DIGEST_ALGORITHM_TO_HASH, a as DIGEST_ALGORITHM_TO_WEB_CRYPTO, b as DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, c as DIGITAL_SIGNATURE_REL_TYPE, e as DigitalSignatureVerificationStatus, E as ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, f as ENTERPRISE_REQUIRE_REVOCATION_ENV, g as ENTERPRISE_REQUIRE_TIMESTAMP_ENV, h as ENTERPRISE_TRUST_ROOTS_FILE_ENV, i as ENTERPRISE_TRUST_ROOTS_PEM_ENV, O as OPC_RELATIONSHIP_TRANSFORM, j as OfficeSignatureReference, P as PPTX_VIEWER_MANIFEST_NS, S as SUPPORTED_XML_CANON_TRANSFORMS, n as SignatureDetail, o as SignatureDetailStatus, X as XMLDSIG_NS, s as XML_TRANSFORM_ENVELOPED_SIGNATURE, t as computeDetailStatus, u as computeDigestBase64WebCrypto, v as computeVerificationStatus, w as escapeXmlAttr, x as escapeXmlText, y as extractAllTagText, z as extractFirstTagText, A as extractTagAttribute, B as isValidBase64, F as normalizePartPath, G as resolveReferenceUriToPart } from '../signature-inspection-status-BCUpfCQh.js';
 import JSZip from 'jszip';
 
 /**

package/node_modules/pptx-viewer-core/dist/signature-node/index.js

@@ -56,7 +56,13 @@ var DIGEST_ALGORITHM_TO_WEB_CRYPTO = {
 
 // src/core/utils/signature-xml-utils.ts
 function escapeXmlAttr(value) {
-  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function escapeXmlText(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function isValidBase64(value) {
+  return typeof value === "string" && value.length > 0 && /^[A-Za-z0-9+/=\s]+$/.test(value);
 }
 function extractTagAttribute(xml, tagName, attributeName) {
   const pattern = new RegExp(
@@ -1081,7 +1087,7 @@ async function buildOfficeReferenceList(zip) {
 }
 function buildOfficeSignatureXml(references, privateKeyPem, certificatePem) {
   const signedInfoReferencesXml = references.map(
-    (reference) => `<Reference URI="${escapeXmlAttr(reference.uri)}"><DigestMethod Algorithm="${escapeXmlAttr(reference.digestMethod)}"/><DigestValue>${escapeXmlAttr(reference.digestValue)}</DigestValue></Reference>`
+    (reference) => `<Reference URI="${escapeXmlAttr(reference.uri)}"><DigestMethod Algorithm="${escapeXmlAttr(reference.digestMethod)}"/><DigestValue>${escapeXmlText(reference.digestValue)}</DigestValue></Reference>`
   ).join("");
   const signedInfoXml = `<SignedInfo xmlns="${XMLDSIG_NS}"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>${signedInfoReferencesXml}</SignedInfo>`;
   const canonicalSignedInfo = canonicalizeSignedInfoXml(signedInfoXml);
@@ -1090,8 +1096,14 @@ function buildOfficeSignatureXml(references, privateKeyPem, certificatePem) {
   signer.end();
   const signatureValueBase64 = signer.sign(privateKeyPem).toString("base64");
   const certificateBase64 = pemCertificateToBase64(certificatePem);
+  if (!isValidBase64(signatureValueBase64)) {
+    throw new Error("Generated SignatureValue is not valid base64");
+  }
+  if (!isValidBase64(certificateBase64)) {
+    throw new Error("X.509 certificate is not valid base64");
+  }
   const signingTime = (/* @__PURE__ */ new Date()).toISOString();
-  return `<Signature xmlns="${XMLDSIG_NS}">${signedInfoXml}<SignatureValue>${signatureValueBase64}</SignatureValue><KeyInfo><X509Data><X509Certificate>${certificateBase64}</X509Certificate></X509Data></KeyInfo><Object><SignatureProperties><SignatureProperty><SigningTime>${escapeXmlAttr(signingTime)}</SigningTime></SignatureProperty></SignatureProperties></Object></Signature>`;
+  return `<Signature xmlns="${XMLDSIG_NS}">${signedInfoXml}<SignatureValue>${escapeXmlText(signatureValueBase64)}</SignatureValue><KeyInfo><X509Data><X509Certificate>${escapeXmlText(certificateBase64)}</X509Certificate></X509Data></KeyInfo><Object><SignatureProperties><SignatureProperty><SigningTime>${escapeXmlText(signingTime)}</SigningTime></SignatureProperty></SignatureProperties></Object></Signature>`;
 }
 async function signPptxWithCertificate(data, certificateBuffer, options) {
   try {
@@ -1169,6 +1181,7 @@ exports.computeDigestBase64 = computeDigestBase642;
 exports.computeDigestBase64WebCrypto = computeDigestBase64;
 exports.computeVerificationStatus = computeVerificationStatus;
 exports.escapeXmlAttr = escapeXmlAttr;
+exports.escapeXmlText = escapeXmlText;
 exports.evaluateCertificateRevocation = evaluateCertificateRevocation;
 exports.evaluateTimestampAuthority = evaluateTimestampAuthority;
 exports.extractAllTagText = extractAllTagText;
@@ -1181,6 +1194,7 @@ exports.getFirstDescendantElementByLocalName = getFirstDescendantElementByLocalN
 exports.getNodeLocalName = getNodeLocalName;
 exports.getSignatureValidationPolicy = getSignatureValidationPolicy;
 exports.inspectPptxDigitalSignatures = inspectPptxDigitalSignatures;
+exports.isValidBase64 = isValidBase64;
 exports.loadEnterpriseTrustRoots = loadEnterpriseTrustRoots;
 exports.loadSigningMaterialFromBuffer = loadSigningMaterialFromBuffer;
 exports.normalizePartPath = normalizePartPath;

package/node_modules/pptx-viewer-core/dist/signature-node/index.mjs

@@ -43,7 +43,13 @@ var DIGEST_ALGORITHM_TO_WEB_CRYPTO = {
 
 // src/core/utils/signature-xml-utils.ts
 function escapeXmlAttr(value) {
-  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function escapeXmlText(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function isValidBase64(value) {
+  return typeof value === "string" && value.length > 0 && /^[A-Za-z0-9+/=\s]+$/.test(value);
 }
 function extractTagAttribute(xml, tagName, attributeName) {
   const pattern = new RegExp(
@@ -1068,7 +1074,7 @@ async function buildOfficeReferenceList(zip) {
 }
 function buildOfficeSignatureXml(references, privateKeyPem, certificatePem) {
   const signedInfoReferencesXml = references.map(
-    (reference) => `<Reference URI="${escapeXmlAttr(reference.uri)}"><DigestMethod Algorithm="${escapeXmlAttr(reference.digestMethod)}"/><DigestValue>${escapeXmlAttr(reference.digestValue)}</DigestValue></Reference>`
+    (reference) => `<Reference URI="${escapeXmlAttr(reference.uri)}"><DigestMethod Algorithm="${escapeXmlAttr(reference.digestMethod)}"/><DigestValue>${escapeXmlText(reference.digestValue)}</DigestValue></Reference>`
   ).join("");
   const signedInfoXml = `<SignedInfo xmlns="${XMLDSIG_NS}"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>${signedInfoReferencesXml}</SignedInfo>`;
   const canonicalSignedInfo = canonicalizeSignedInfoXml(signedInfoXml);
@@ -1077,8 +1083,14 @@ function buildOfficeSignatureXml(references, privateKeyPem, certificatePem) {
   signer.end();
   const signatureValueBase64 = signer.sign(privateKeyPem).toString("base64");
   const certificateBase64 = pemCertificateToBase64(certificatePem);
+  if (!isValidBase64(signatureValueBase64)) {
+    throw new Error("Generated SignatureValue is not valid base64");
+  }
+  if (!isValidBase64(certificateBase64)) {
+    throw new Error("X.509 certificate is not valid base64");
+  }
   const signingTime = (/* @__PURE__ */ new Date()).toISOString();
-  return `<Signature xmlns="${XMLDSIG_NS}">${signedInfoXml}<SignatureValue>${signatureValueBase64}</SignatureValue><KeyInfo><X509Data><X509Certificate>${certificateBase64}</X509Certificate></X509Data></KeyInfo><Object><SignatureProperties><SignatureProperty><SigningTime>${escapeXmlAttr(signingTime)}</SigningTime></SignatureProperty></SignatureProperties></Object></Signature>`;
+  return `<Signature xmlns="${XMLDSIG_NS}">${signedInfoXml}<SignatureValue>${escapeXmlText(signatureValueBase64)}</SignatureValue><KeyInfo><X509Data><X509Certificate>${escapeXmlText(certificateBase64)}</X509Certificate></X509Data></KeyInfo><Object><SignatureProperties><SignatureProperty><SigningTime>${escapeXmlText(signingTime)}</SigningTime></SignatureProperty></SignatureProperties></Object></Signature>`;
 }
 async function signPptxWithCertificate(data, certificateBuffer, options) {
   try {
@@ -1128,4 +1140,4 @@ async function signPptxWithCertificate(data, certificateBuffer, options) {
   }
 }
 
-export { DIGEST_ALGORITHM_TO_HASH, DIGEST_ALGORITHM_TO_WEB_CRYPTO, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, DIGITAL_SIGNATURE_REL_TYPE, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, ENTERPRISE_REQUIRE_REVOCATION_ENV, ENTERPRISE_REQUIRE_TIMESTAMP_ENV, ENTERPRISE_TRUST_ROOTS_FILE_ENV, ENTERPRISE_TRUST_ROOTS_PEM_ENV, OPC_RELATIONSHIP_TRANSFORM, PPTX_VIEWER_MANIFEST_NS, SUPPORTED_XML_CANON_TRANSFORMS, XMLDSIG_NS, XML_TRANSFORM_ENVELOPED_SIGNATURE, applyReferenceTransforms, buildOcspRequestDer, buildReferenceChecksFromPptxViewerManifest, buildReferenceChecksFromSignatureXml, canonicalizeNode, canonicalizeSignedInfoXml, certFingerprintSha256, certPemFromBase64, certificateInfoFromBase64, computeDetailStatus, computeDigestBase642 as computeDigestBase64, computeDigestBase64 as computeDigestBase64WebCrypto, computeVerificationStatus, escapeXmlAttr, evaluateCertificateRevocation, evaluateTimestampAuthority, extractAllTagText, extractFirstTagText, extractOcspUrls, extractPemCertificatesFromText, extractReferenceTransforms, extractTagAttribute, getFirstDescendantElementByLocalName, getNodeLocalName, getSignatureValidationPolicy, inspectPptxDigitalSignatures, loadEnterpriseTrustRoots, loadSigningMaterialFromBuffer, normalizePartPath, parseOcspResponseStatus, pemCertificateToBase64, resolveReferenceUriToPart, signPptxWithCertificate, validateCertificateChain, verifySignatureValue };
+export { DIGEST_ALGORITHM_TO_HASH, DIGEST_ALGORITHM_TO_WEB_CRYPTO, DIGITAL_SIGNATURE_ORIGIN_REL_TYPE, DIGITAL_SIGNATURE_REL_TYPE, ENTERPRISE_FAIL_ON_REVOCATION_UNKNOWN_ENV, ENTERPRISE_REQUIRE_REVOCATION_ENV, ENTERPRISE_REQUIRE_TIMESTAMP_ENV, ENTERPRISE_TRUST_ROOTS_FILE_ENV, ENTERPRISE_TRUST_ROOTS_PEM_ENV, OPC_RELATIONSHIP_TRANSFORM, PPTX_VIEWER_MANIFEST_NS, SUPPORTED_XML_CANON_TRANSFORMS, XMLDSIG_NS, XML_TRANSFORM_ENVELOPED_SIGNATURE, applyReferenceTransforms, buildOcspRequestDer, buildReferenceChecksFromPptxViewerManifest, buildReferenceChecksFromSignatureXml, canonicalizeNode, canonicalizeSignedInfoXml, certFingerprintSha256, certPemFromBase64, certificateInfoFromBase64, computeDetailStatus, computeDigestBase642 as computeDigestBase64, computeDigestBase64 as computeDigestBase64WebCrypto, computeVerificationStatus, escapeXmlAttr, escapeXmlText, evaluateCertificateRevocation, evaluateTimestampAuthority, extractAllTagText, extractFirstTagText, extractOcspUrls, extractPemCertificatesFromText, extractReferenceTransforms, extractTagAttribute, getFirstDescendantElementByLocalName, getNodeLocalName, getSignatureValidationPolicy, inspectPptxDigitalSignatures, isValidBase64, loadEnterpriseTrustRoots, loadSigningMaterialFromBuffer, normalizePartPath, parseOcspResponseStatus, pemCertificateToBase64, resolveReferenceUriToPart, signPptxWithCertificate, validateCertificateChain, verifySignatureValue };

package/node_modules/pptx-viewer-core/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pptx-viewer-core",
-	"version": "1.1.4",
+	"version": "1.1.5",
 	"description": "Core PPTX engine — parse, edit, serialize, and convert PowerPoint files.",
 	"keywords": [
 		"converter",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pptx-react-viewer",
-	"version": "1.1.4",
+	"version": "1.1.5",
 	"description": "React-based PowerPoint viewer, editor, and canvas export — depends on pptx-viewer-core",
 	"keywords": [
 		"editor",
@@ -57,14 +57,16 @@
 	},
 	"dependencies": {
 		"clsx": "^2.1.1",
-		"emf-converter": "^1.1.4",
+		"dompurify": "^3.4.2",
+		"emf-converter": "^1.1.5",
 		"html2canvas-pro": "^2.0.2",
-		"mtx-decompressor": "^1.1.4",
-		"pptx-viewer-core": "^1.1.4",
+		"mtx-decompressor": "^1.1.5",
+		"pptx-viewer-core": "^1.1.5",
 		"tailwind-merge": "^3.5.0"
 	},
 	"devDependencies": {
 		"@tailwindcss/cli": "^4.2.4",
+		"@types/dompurify": "^3.2.0",
 		"@types/react": "^19.2.14",
 		"@types/react-dom": "^19.2.3",
 		"tailwindcss": "^4.2.4",