stegdoc 5.6.0 → 6.0.0

package/src/lib/log-generator.js

@@ -657,9 +657,12 @@ function decodeLogLines(allRows) {
   const headerStr = headerPayload.toString('utf8');
 
   // Parse header: "STGD05|<metaLen>|<encLen>|{metadataJson}{encryptionMeta}"
-  const markerIdx = headerStr.indexOf('STGD05|');
+  const markerIdx = headerStr.search(/STGD0[56]\|/);
   if (markerIdx === -1) {
-    throw new Error('Invalid v5 format: magic marker not found. This may not be a stegdoc v5 file.');
+    throw new Error('Invalid log-embed format: magic marker not found. This may not be a stegdoc file.');
+  }
+  if (headerStr.startsWith('STGD06|', markerIdx)) {
+    throw new Error('This file uses the v6 format, which the JavaScript decoder cannot read. The native engine is required.');
   }
 
   const afterMarker = headerStr.slice(markerIdx + 7);

package/src/lib/native.js

@@ -0,0 +1,68 @@
+'use strict';
+
+const path = require('path');
+
+const { hostTarget, packageName } = require('./bindings');
+
+const NATIVE_DIR = path.join(__dirname, '..', '..', 'native');
+
+let binding;
+let resolved = false;
+
+/**
+ * Load the native format engine, or return null when it is not available.
+ *
+ * Resolution order:
+ *   1. `STEGDOC_NATIVE_PATH`, an explicit `.node` file.
+ *   2. The platform package (`@stegdoc/binding-<suffix>`) from the published
+ *      install's optionalDependencies.
+ *   3. `native/stegdoc.node`, the local `pnpm build:native` output.
+ *
+ * The binding is required for log-embed (v5/v6) decode and is the preferred
+ * encoder. The CommonJS implementation remains only for the legacy v3/v4
+ * formats, which the native engine does not cover. Set
+ * `STEGDOC_DISABLE_NATIVE=1` to force the JS paths.
+ *
+ * @returns {object|null} The binding, or null when unavailable.
+ */
+function loadNative() {
+  if (resolved) return binding;
+  resolved = true;
+
+  if (process.env.STEGDOC_DISABLE_NATIVE === '1') {
+    binding = null;
+    return binding;
+  }
+
+  const explicit = process.env.STEGDOC_NATIVE_PATH;
+  if (explicit) {
+    binding = require(explicit);
+    return binding;
+  }
+
+  const target = hostTarget();
+  if (target) {
+    try {
+      binding = require(packageName(target));
+      return binding;
+    } catch {
+      // Not installed; fall through to the development build.
+    }
+  }
+
+  try {
+    binding = require(path.join(NATIVE_DIR, 'stegdoc.node'));
+  } catch {
+    binding = null;
+  }
+  return binding;
+}
+
+/**
+ * @returns {boolean} Whether the native engine is loaded.
+ */
+function nativeAvailable() {
+  return loadNative() !== null;
+}
+
+module.exports = { loadNative, nativeAvailable };

package/src/lib/streams.js

@@ -1,65 +1,6 @@
 const { Transform, Writable } = require('stream');
 const crypto = require('crypto');
 
-/**
- * Transform stream that converts binary input to base64 text output.
- * Buffers incomplete 3-byte groups across chunk boundaries.
- */
-class Base64EncodeTransform extends Transform {
-  constructor() {
-    super();
-    this._remainder = Buffer.alloc(0);
-  }
-
-  _transform(chunk, encoding, callback) {
-    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, encoding);
-    const combined = this._remainder.length > 0 ? Buffer.concat([this._remainder, buf]) : buf;
-    const usable = combined.length - (combined.length % 3);
-    if (usable > 0) {
-      this.push(combined.slice(0, usable).toString('base64'));
-    }
-    this._remainder = usable < combined.length ? combined.slice(usable) : Buffer.alloc(0);
-    callback();
-  }
-
-  _flush(callback) {
-    if (this._remainder.length > 0) {
-      this.push(this._remainder.toString('base64'));
-      this._remainder = Buffer.alloc(0);
-    }
-    callback();
-  }
-}
-
-/**
- * Transform stream that converts base64 text input to binary output.
- * Buffers incomplete 4-char groups across chunk boundaries.
- */
-class Base64DecodeTransform extends Transform {
-  constructor() {
-    super();
-    this._remainder = '';
-  }
-
-  _transform(chunk, encoding, callback) {
-    const str = this._remainder + (Buffer.isBuffer(chunk) ? chunk.toString() : chunk);
-    const usable = str.length - (str.length % 4);
-    if (usable > 0) {
-      this.push(Buffer.from(str.slice(0, usable), 'base64'));
-    }
-    this._remainder = usable < str.length ? str.slice(usable) : '';
-    callback();
-  }
-
-  _flush(callback) {
-    if (this._remainder.length > 0) {
-      this.push(Buffer.from(this._remainder, 'base64'));
-      this._remainder = '';
-    }
-    callback();
-  }
-}
-
 /**
  * Transform stream that passes data through unchanged while computing SHA-256 hash.
  * Access the hex hash via .digest after the stream has ended.
@@ -90,51 +31,6 @@ class HashPassthrough extends Transform {
   }
 }
 
-/**
- * Writable stream that collects string output up to maxBytes.
- * Calls an async onChunkReady callback when a chunk is full, applying
- * backpressure to pause upstream until the callback resolves.
- */
-class ChunkCollector extends Writable {
-  constructor(maxBytes, onChunkReady) {
-    super({ decodeStrings: false });
-    this._maxBytes = maxBytes;
-    this._buffer = '';
-    this._chunkIndex = 0;
-    this._onChunkReady = onChunkReady;
-  }
-
-  async _write(chunk, encoding, callback) {
-    try {
-      this._buffer += typeof chunk === 'string' ? chunk : chunk.toString();
-      while (this._buffer.length >= this._maxBytes) {
-        const piece = this._buffer.slice(0, this._maxBytes);
-        this._buffer = this._buffer.slice(this._maxBytes);
-        await this._onChunkReady(piece, this._chunkIndex++);
-      }
-      callback();
-    } catch (err) {
-      callback(err);
-    }
-  }
-
-  async _final(callback) {
-    try {
-      if (this._buffer.length > 0) {
-        await this._onChunkReady(this._buffer, this._chunkIndex++);
-        this._buffer = '';
-      }
-      callback();
-    } catch (err) {
-      callback(err);
-    }
-  }
-
-  get totalChunks() {
-    return this._chunkIndex;
-  }
-}
-
 /**
  * Writable stream that collects binary Buffer output up to maxBytes.
  * Calls an async onChunkReady callback with a Buffer when full.
@@ -221,10 +117,7 @@ class ProgressTransform extends Transform {
 }
 
 module.exports = {
-  Base64EncodeTransform,
-  Base64DecodeTransform,
   HashPassthrough,
-  ChunkCollector,
   BinaryChunkCollector,
   ProgressTransform,
 };

package/src/lib/utils.js

@@ -213,6 +213,25 @@ function detectFormat(filename) {
   return null;
 }
 
+/**
+ * Reduce a metadata-supplied name to a bare, safe filename.
+ *
+ * `originalFilename` is unauthenticated, so it is never joined onto a directory
+ * unchecked (FORMAT.md 11.1). Any directory component is discarded and the
+ * remainder must not be empty, `.`, `..`, or contain NUL.
+ *
+ * @param {string} name - Metadata-supplied filename
+ * @returns {string} A bare filename safe to join onto a directory
+ * @throws {Error} If the name has no usable filename component
+ */
+function safeFilename(name) {
+  const last = String(name == null ? '' : name).split(/[/\\]/).pop();
+  if (!last || last === '.' || last === '..' || last.includes('\0')) {
+    throw new Error(`Unsafe output filename in metadata: ${JSON.stringify(name)}`);
+  }
+  return last;
+}
+
 module.exports = {
   generateHash,
   generateContentHash,
@@ -221,6 +240,7 @@ module.exports = {
   generateFilename,
   parseFilename,
   detectFormat,
+  safeFilename,
   // Legacy aliases for backward compatibility
   generateDocxFilename,
   parseDocxFilename,

package/src/lib/xlsx-handler.js

@@ -1,16 +1,11 @@
-const ExcelJS = require('exceljs');
 const fs = require('fs');
 const path = require('path');
 const AdmZip = require('adm-zip');
-const { generateDecoyHeaders, generateDecoyData, calculateDecoyRowCount, rowToArray, resetTimeWindow } = require('./decoy-generator');
 const { generateLogHeaders, encodePayloadToLogLines, decodeLogLines, resetTimeState } = require('./log-generator');
 const { parseXmlFromZip, ensureArray, extractTextContent } = require('./xml-utils');
+const { createXlsxRaw } = require('./xlsx-writer');
 
-// Constants for data storage
-const HIDDEN_SHEET_NAME = 'Data';
-const VISIBLE_SHEET_NAME = 'Server Metrics';
 const V5_SHEET_NAME = 'Access Logs';
-const CELL_CHUNK_SIZE = 32000; // Max characters per cell (~32KB)
 
 // ─── v5 Log-Embed Format ───────────────────────────────────────────────────
 
@@ -29,88 +24,23 @@ const CELL_CHUNK_SIZE = 32000; // Max characters per cell (~32KB)
 async function createXlsxPartV5(options) {
   const { payloadBuffer, encryptionMeta, metadataJson, outputPath } = options;
 
-  // Ensure output directory exists
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  const workbook = new ExcelJS.stream.xlsx.WorkbookWriter({
-    filename: outputPath,
-    useSharedStrings: false,
-  });
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  // === Single Sheet: Access Logs ===
-  const sheet = workbook.addWorksheet(V5_SHEET_NAME, {
-    properties: { tabColor: { argb: '2F5496' } },
-  });
-
-  // Column widths for log data
-  sheet.columns = [
-    { width: 16 },  // Remote Address
-    { width: 28 },  // Timestamp
-    { width: 8 },   // Method
-    { width: 90 },  // Request (contains URL with payload)
-    { width: 7 },   // Status
-    { width: 8 },   // Bytes
-    { width: 65 },  // Referer
-    { width: 85 },  // User-Agent
-    { width: 38 },  // X-Request-ID
-    { width: 34 },  // X-Trace-ID
-  ];
-
-  // Header row with styling
-  const headers = generateLogHeaders();
-  const headerRow = sheet.addRow(headers);
-  for (let col = 1; col <= headers.length; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 10, color: { argb: 'FFFFFF' }, name: 'Consolas' };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2F5496' },
-    };
-  }
-  headerRow.commit();
-
   // Generate all log lines (header + data + filler)
   const { headerRows, dataRows, fillerRows } = encodePayloadToLogLines(
     payloadBuffer, metadataJson, encryptionMeta
   );
 
-  // Write header lines (metadata)
-  for (const row of headerRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  // Write data lines (payload)
-  for (const row of dataRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  // Write filler lines (realistic padding)
-  for (const row of fillerRows) {
-    const r = sheet.addRow(row);
-    r.commit();
-  }
-
-  const totalRows = headerRows.length + dataRows.length + fillerRows.length;
-
-  // Add filters
-  sheet.autoFilter = {
-    from: 'A1',
-    to: `J${totalRows + 1}`,
-  };
-
-  await sheet.commit();
-  await workbook.commit();
+  const headers = generateLogHeaders();
+  const allRows = [...headerRows, ...dataRows, ...fillerRows];
+
+  // Build XLSX from raw XML (no ExcelJS — passes air gap filters)
+  createXlsxRaw({
+    headers,
+    rows: allRows,
+    sheetName: V5_SHEET_NAME,
+    outputPath,
+    colWidths: [16, 28, 8, 90, 7, 8, 65, 85, 38, 34],
+    autoFilter: true,
+  });
 
   return outputPath;
 }
@@ -130,17 +60,17 @@ async function readXlsxV5(xlsxPath) {
   const fileBuffer = fs.readFileSync(xlsxPath);
   const zip = new AdmZip(fileBuffer);
 
-  // Parse shared strings (only if present — v5 files created with useSharedStrings:false may not have them)
+  // Parse shared strings — handles both normal and namespace-prefixed XML (ns0:si, ns0:t)
   let sharedStrings = null;
   const ssEntry = zip.getEntry('xl/sharedStrings.xml');
   if (ssEntry) {
     sharedStrings = [];
     const ssXml = ssEntry.getData().toString('utf8');
-    // Fast extract: match each <si><t>...</t></si> or <si><t ...>...</t></si>
-    const siRegex = /<si><t[^>]*>([^<]*)<\/t><\/si>/g;
+    // Match <si><t>...</t></si> or <ns0:si><ns0:t>...</ns0:t></ns0:si> (any nsN prefix)
+    const siRegex = /<(?:\w+:)?si><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?si>/g;
     let match;
     while ((match = siRegex.exec(ssXml)) !== null) {
-      sharedStrings.push(match[1]);
+      sharedStrings.push(decodeXmlEntities(match[1]));
     }
   }
 
@@ -151,10 +81,10 @@ async function readXlsxV5(xlsxPath) {
   }
   const sheetXml = sheetEntry.getData().toString('utf8');
 
-  // Fast row extraction using regex — much faster than full DOM parsing
+  // Fast row extraction using regex — handles both normal and namespace-prefixed XML
   const allRows = [];
-  const rowRegex = /<row [^>]*>(.*?)<\/row>/gs;
-  const cellRegex = /<c r="([A-Z]+)\d+"(?: t="([^"]*)")?[^>]*>(?:<v>([^<]*)<\/v>|<is><t[^>]*>([^<]*)<\/t><\/is>)?<\/c>/g;
+  const rowRegex = /<(?:\w+:)?row [^>]*>(.*?)<\/(?:\w+:)?row>/gs;
+  const cellRegex = /<(?:\w+:)?c r="([A-Z]+)\d+"(?: t="([^"]*)")?[^>]*>(?:<(?:\w+:)?v>([^<]*)<\/(?:\w+:)?v>|<(?:\w+:)?is><(?:\w+:)?t[^>]*>([^<]*)<\/(?:\w+:)?t><\/(?:\w+:)?is>)?<\/(?:\w+:)?c>/g;
 
   let rowMatch;
   while ((rowMatch = rowRegex.exec(sheetXml)) !== null) {
@@ -251,201 +181,7 @@ function detectXlsxVersion(xlsxPath) {
   return 'v5';
 }
 
-// ─── v3/v4 Legacy Format ────────────────────────────────────────────────────
-
-/**
- * Create an XLSX file using streaming WorkbookWriter (v4 format).
- * Memory-efficient: rows are freed after commit.
- * @param {object} options
- * @param {string} options.base64Content - Base64 content to store in this part
- * @param {string} options.encryptionMeta - Packed encryption metadata (iv:salt:authTag) or ''
- * @param {string} options.metadataJson - Serialized metadata JSON string
- * @param {string} options.outputPath - Output file path
- * @returns {Promise<string>} Path to created file
- */
-async function createXlsxPartStreaming(options) {
-  const { base64Content, encryptionMeta, metadataJson, outputPath } = options;
-
-  // Ensure output directory exists
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  const workbook = new ExcelJS.stream.xlsx.WorkbookWriter({
-    filename: outputPath,
-    useSharedStrings: false, // Inline strings for easier post-processing
-  });
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  // === Sheet 1: Visible decoy data (server metrics) ===
-  const visibleSheet = workbook.addWorksheet(VISIBLE_SHEET_NAME, {
-    properties: { tabColor: { argb: '4472C4' } },
-  });
-
-  // Set column widths before adding rows
-  visibleSheet.columns = [
-    { width: 20 }, // Timestamp
-    { width: 16 }, // Server ID
-    { width: 12 }, // Status
-    { width: 8 },  // CPU %
-    { width: 10 }, // Memory %
-    { width: 8 },  // Disk %
-    { width: 14 }, // Network (MB/s)
-    { width: 10 }, // Requests
-    { width: 14 }, // Resp Time (ms)
-    { width: 12 }, // Uptime (hrs)
-  ];
-
-  // Add headers
-  const headers = generateDecoyHeaders();
-  const headerRow = visibleSheet.addRow(headers);
-
-  const headerCount = headers.length;
-  for (let col = 1; col <= headerCount; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 11, color: { argb: 'FFFFFF' } };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2E7D32' },
-    };
-  }
-  headerRow.commit();
-
-  // Generate and write decoy data rows, committing each to free memory
-  const payloadSize = base64Content.length;
-  const rowCount = calculateDecoyRowCount(payloadSize);
-  const decoyData = generateDecoyData(rowCount);
-
-  for (const row of decoyData) {
-    const dataRow = visibleSheet.addRow(rowToArray(row));
-    dataRow.commit();
-  }
-
-  // Add filters
-  visibleSheet.autoFilter = {
-    from: 'A1',
-    to: `J${rowCount + 1}`,
-  };
-
-  await visibleSheet.commit();
-
-  // === Sheet 2: Hidden payload (veryHidden) ===
-  const hiddenSheet = workbook.addWorksheet(HIDDEN_SHEET_NAME, {
-    state: 'veryHidden',
-  });
-
-  // Split base64 content into cell-sized chunks
-  const chunks = splitIntoChunks(base64Content, CELL_CHUNK_SIZE);
-
-  // Row 1: metadata
-  const metaRow = hiddenSheet.getRow(1);
-  metaRow.getCell(1).value = encryptionMeta;
-  metaRow.getCell(2).value = metadataJson;
-  metaRow.getCell(3).value = chunks.length.toString();
-  metaRow.commit();
-
-  // Write cell chunks in rows starting from row 2, columns A-Z
-  const totalChunks = chunks.length;
-  const totalRows = Math.ceil(totalChunks / 26);
-
-  for (let rowIdx = 0; rowIdx < totalRows; rowIdx++) {
-    const sheetRow = hiddenSheet.getRow(rowIdx + 2);
-    const startChunk = rowIdx * 26;
-    const endChunk = Math.min(startChunk + 26, totalChunks);
-
-    for (let i = startChunk; i < endChunk; i++) {
-      const col = (i % 26) + 1;
-      sheetRow.getCell(col).value = chunks[i];
-    }
-    sheetRow.commit();
-  }
-
-  await hiddenSheet.commit();
-  await workbook.commit();
-
-  // WorkbookWriter natively supports veryHidden state — no post-processing needed.
-  return outputPath;
-}
-
-/**
- * Create an XLSX file with encrypted base64 content hidden in a veryHidden sheet (legacy v3)
- */
-async function createXlsxWithBase64(options) {
-  const { base64Content, encryptionMeta, metadata, outputPath } = options;
-
-  const workbook = new ExcelJS.Workbook();
-
-  workbook.creator = 'Microsoft Excel';
-  workbook.lastModifiedBy = 'Microsoft Excel';
-  workbook.created = new Date();
-  workbook.modified = new Date();
-
-  const visibleSheet = workbook.addWorksheet(VISIBLE_SHEET_NAME, {
-    properties: { tabColor: { argb: '4472C4' } },
-  });
-
-  const headers = generateDecoyHeaders();
-  const headerRow = visibleSheet.addRow(headers);
-
-  const headerCount = headers.length;
-  for (let col = 1; col <= headerCount; col++) {
-    const cell = headerRow.getCell(col);
-    cell.font = { bold: true, size: 11, color: { argb: 'FFFFFF' } };
-    cell.fill = {
-      type: 'pattern',
-      pattern: 'solid',
-      fgColor: { argb: '2E7D32' },
-    };
-  }
-
-  const payloadSize = base64Content.length;
-  const rowCount = calculateDecoyRowCount(payloadSize);
-
-  const decoyData = generateDecoyData(rowCount);
-  decoyData.forEach((row) => {
-    visibleSheet.addRow(rowToArray(row));
-  });
-
-  visibleSheet.columns = [
-    { width: 20 }, { width: 16 }, { width: 12 }, { width: 8 },
-    { width: 10 }, { width: 8 }, { width: 14 }, { width: 10 },
-    { width: 14 }, { width: 12 },
-  ];
-
-  visibleSheet.autoFilter = { from: 'A1', to: `J${rowCount + 1}` };
-
-  const hiddenSheet = workbook.addWorksheet(HIDDEN_SHEET_NAME, {
-    state: 'veryHidden',
-  });
-
-  hiddenSheet.getCell('A1').value = encryptionMeta;
-  hiddenSheet.getCell('B1').value = metadata;
-
-  const chunks = splitIntoChunks(base64Content, CELL_CHUNK_SIZE);
-  hiddenSheet.getCell('C1').value = chunks.length.toString();
-
-  chunks.forEach((chunk, index) => {
-    const row = Math.floor(index / 26) + 2;
-    const col = (index % 26) + 1;
-    hiddenSheet.getCell(row, col).value = chunk;
-  });
-
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  await workbook.xlsx.writeFile(outputPath);
-  await ensureVeryHidden(outputPath);
-
-  return outputPath;
-}
+// ─── v3/v4 Legacy XLSX Creation (removed — no longer passes air gap filters)
 
 // ─── Unified Reader ─────────────────────────────────────────────────────────
 
@@ -561,38 +297,6 @@ async function extractFromXml(xlsxPath) {
 
 // ─── Helpers ────────────────────────────────────────────────────────────────
 
-async function ensureVeryHidden(xlsxPath) {
-  const zip = new AdmZip(xlsxPath);
-
-  const workbookEntry = zip.getEntry('xl/workbook.xml');
-  if (workbookEntry) {
-    let workbookXml = workbookEntry.getData().toString('utf8');
-
-    workbookXml = workbookXml.replace(
-      /(<sheet[^>]*name="Data"[^>]*)\s+state="[^"]*"([^>]*\/>)/gi,
-      '$1 state="veryHidden"$2'
-    );
-
-    if (!workbookXml.match(/<sheet[^>]*name="Data"[^>]*state="/i)) {
-      workbookXml = workbookXml.replace(
-        /(<sheet[^>]*name="Data")([^>]*\/>)/gi,
-        '$1 state="veryHidden"$2'
-      );
-    }
-
-    zip.updateFile('xl/workbook.xml', Buffer.from(workbookXml, 'utf8'));
-    zip.writeZip(xlsxPath);
-  }
-}
-
-function splitIntoChunks(str, size) {
-  const chunks = [];
-  for (let i = 0; i < str.length; i += size) {
-    chunks.push(str.slice(i, i + size));
-  }
-  return chunks;
-}
-
 function columnToLetter(col) {
   let letter = '';
   while (col > 0) {
@@ -608,9 +312,6 @@ module.exports = {
   createXlsxPartV5,
   readXlsxV5,
   detectXlsxVersion,
-  // v3/v4 legacy
-  createXlsxPartStreaming,
-  createXlsxWithBase64,
-  // Unified reader
+  // Unified reader (auto-detects v5 vs legacy)
   readXlsxBase64,
 };