upload-safety 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Simon Halimonov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,189 @@
-# Temporary Holding Version
+# upload-safety
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[![npm](https://img.shields.io/npm/v/upload-safety?color=cb3837)](https://www.npmjs.com/package/upload-safety)
+[![CI](https://github.com/simulieren/upload-safety/actions/workflows/ci.yml/badge.svg)](https://github.com/simulieren/upload-safety/actions/workflows/ci.yml)
+[![license](https://img.shields.io/github/license/simulieren/upload-safety)](LICENSE)
+[![node](https://img.shields.io/badge/node-%E2%89%A522-339933)](package.json)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
+[![types](https://img.shields.io/badge/types-TypeScript-3178c6)](src/index.ts)
+
+Server-side upload checks for Node that read the file, not just its name. An upload passes only when its extension, its declared MIME type and its bytes agree, and when it carries nothing that runs on its own: no macros, embedded objects, DDE fields, PDF scripts or CSV formulas. Photos, including iPhone HEIC, lose their GPS position and other metadata on the way through.
+
+For apps that take CVs, invoices, contracts and photos from strangers and hand them to colleagues who open them in Office or Acrobat.
+
+```ts
+const result = checkUpload( { filename, mimeType, bytes }, { maxBytes: 10 * 1024 * 1024 } );
+if ( ! result.ok ) {
+	// result.reason: 'macros', 'encrypted', 'content-mismatch', ...
+}
+```
+
+## What it catches
+
+| Upload | Result |
+| - | - |
+| `cv.pdf` that is a Windows executable | refused, `content-mismatch` |
+| `report.docx` with a VBA project, also renamed or hidden behind a content type | refused, `macros` |
+| `invoice.docx` with an embedded OLE package that runs a file on double click | refused, `macros` |
+| `letter.docx` with a `DDEAUTO` field, also split across runs or spelled with `QUOTE` | refused, `macros` |
+| `template.docx` that loads a remote `.dotm` on opening | refused, `macros` |
+| `form.pdf` with JavaScript, a launch action or an attachment, also in compressed object streams | refused, `macros` |
+| `budget.xls` with a very hidden Excel 4.0 macro sheet | refused, `macros` |
+| `notes.odt` with a Basic macro or an event listener | refused, `macros` |
+| `export.csv` with `=HYPERLINK(...)` or `=cmd\|' /C calc'!A0` in a cell | refused, `macros` |
+| `contract.docx` saved with a password | refused, `encrypted` |
+| `data.xlsx` that is a zip bomb | refused, `content-mismatch` |
+| `holiday.jpg` with GPS coordinates | accepted, EXIF, XMP, IPTC and comments removed, orientation kept |
+| `IMG_0042.heic` from an iPhone | accepted, EXIF and XMP overwritten in place, pixels unchanged |
+| `../../CON.pdf`, a plain PDF | accepted, stored as `_CON.pdf` |
+
+Every check fails closed: a part it cannot read is a refusal, not a pass.
+
+## Why
+
+- **Zero runtime dependencies.** Only `node:zlib` and `node:crypto`. Nothing to audit but this package.
+- **Typed reasons.** Each refusal is one of seven string literals, so a `Record<UploadRejection, string>` of messages is checked by the compiler.
+- **Fast enough to run inline.** Synchronous; 647 real documents up to 20 MB each took at most 65 ms on a laptop.
+- **Tested against crafted files.** 235 tests build malformed ZIPs, compound files and PDFs byte by byte, next to real Office and PDF files.
+
+## Install
+
+```sh
+npm install upload-safety
+```
+
+Node 22 or later, ESM.
+
+## Usage
+
+### Web `Request` (Next.js route handlers, Hono, Remix, Bun)
+
+```ts
+import { checkUpload, type UploadRejection } from 'upload-safety';
+
+export async function POST( request: Request ) {
+	const file = ( await request.formData() ).get( 'file' );
+	if ( ! ( file instanceof File ) ) {
+		return Response.json( { error: 'No file.' }, { status: 400 } );
+	}
+
+	const result = checkUpload(
+		{ filename: file.name, mimeType: file.type, bytes: new Uint8Array( await file.arrayBuffer() ) },
+		{ maxBytes: 10 * 1024 * 1024, allowedExtensions: [ 'pdf', 'docx', 'jpg', 'jpeg', 'png' ] }
+	);
+	if ( ! result.ok ) {
+		return Response.json( { error: MESSAGES[ result.reason ] }, { status: 422 } );
+	}
+
+	// Store result.bytes under result.filename with result.mimeType.
+	return Response.json( { name: result.filename } );
+}
+
+const MESSAGES: Record<UploadRejection, string> = {
+	'empty': 'The file is empty.',
+	'too-large': 'The file is too large.',
+	'type-not-allowed': 'This file type is not allowed.',
+	'mime-mismatch': 'The file type does not match its extension.',
+	'content-mismatch': 'The file content does not match its extension.',
+	'macros': 'Files with macros or other active content are not allowed.',
+	'encrypted': 'Password-protected files cannot be checked.',
+};
+```
+
+### Express with multer
+
+```ts
+import express from 'express';
+import multer from 'multer';
+import { checkUpload } from 'upload-safety';
+
+const MAX_BYTES = 10 * 1024 * 1024;
+// Memory storage hands over the bytes; the limit stops a large body before it is buffered.
+const upload = multer( { storage: multer.memoryStorage(), limits: { fileSize: MAX_BYTES } } );
+const app = express();
+
+app.post( '/upload', upload.single( 'file' ), ( req, res ) => {
+	if ( ! req.file ) {
+		return res.status( 400 ).json( { error: 'No file.' } );
+	}
+	const result = checkUpload(
+		{ filename: req.file.originalname, mimeType: req.file.mimetype, bytes: req.file.buffer },
+		{ maxBytes: MAX_BYTES }
+	);
+	if ( ! result.ok ) {
+		return res.status( 422 ).json( { error: result.reason } );
+	}
+	// Store result.bytes under result.filename with result.mimeType.
+	res.json( { name: result.filename } );
+} );
+```
+
+### In the browser
+
+`acceptAttribute()` gives the matching value for the file picker. It only filters the dialog; the server check is what counts.
+
+```tsx
+<input type="file" accept={ acceptAttribute( [ 'pdf', 'docx' ] ) } />
+```
+
+## Formats
+
+| Format | Extensions | Checked beyond the magic number |
+| - | - | - |
+| PDF | `pdf` | JavaScript, launch, form submit and import actions, links to other files (`GoToR`, `GoToE`), multimedia, XFA forms and embedded files, also inside compressed object streams; encryption |
+| Office (OOXML) | `docx` `xlsx` `pptx` | Required parts; VBA and ActiveX parts; macro content types and relationships; embedded and linked OLE objects; altChunk imports; subdocuments, frames and remote templates; DDE fields in Word and DDE links in Excel; encryption |
+| Office (legacy) | `doc` `xls` `ppt` | OLE directory; VBA storages; embedded OLE objects; Excel 4.0 macro sheets; DDE and OLE links in Excel; PowerPoint VBA and object records; encryption flags |
+| OpenDocument | `odt` `ods` `odp` | The `mimetype` entry; Basic and script modules; embedded OLE objects; event listeners; links to macros; encrypted manifests |
+| Photos | `jpg` `jpeg` `png` `webp` | Structure; EXIF (GPS included), XMP, IPTC, comments and any other metadata segment or chunk are removed, the orientation is kept |
+| HEIF photos | `heic` `heif` `avif` | Brands; EXIF and XMP items are overwritten in place, since dropping them would shift the offsets the file is built on. The orientation lives in the image properties and stays. Image sequences, such as animated AVIF, are refused |
+| Text | `csv` `txt` | No binary data (UTF-8, UTF-16 with a byte order mark, or a Windows code page); in CSV no cell that starts like a formula (`=`, `+`, `-`, `@`) and calls a function or DDE. Numbers such as `-5` or `+49 (30) 1234` pass |
+
+ZIP and OLE reading is capped against zip bombs and malformed sector chains. Every format is in the default list; pass `allowedExtensions` to accept fewer. A PDF that asks for a password is refused. One that only restricts permissions opens without a password and passes, unless its object streams are encrypted, since then they cannot be checked.
+
+## API
+
+`checkUpload` validates the descriptor, inspects the bytes, strips photo metadata and returns the sanitized file name and the canonical MIME type. The parts are exported on their own too:
+
+| Export | Does |
+| - | - |
+| `checkUpload( { filename, mimeType, bytes }, options )` | Every check below; `{ ok: true, extension, filename, mimeType, bytes }` or `{ ok: false, reason }` |
+| `validateUploadDescriptor( { filename, mimeType, size }, options )` | Size, extension and MIME checks before reading the body |
+| `inspectFileContent( extension, bytes )` | `'valid' \| 'macros' \| 'encrypted' \| 'mismatch'` |
+| `stripPhotoMetadata( extension, bytes )` | Cleaned bytes, the input for non-photos, `null` for a broken photo |
+| `sanitizeFilename( name )` | Drops path parts, unsafe characters and trailing dots, renames Windows device names such as `CON`, caps the length at 200 UTF-8 bytes |
+| `getCanonicalMimeType( extension )` | The MIME type to store |
+| `acceptAttribute( extensions? )` | Value for `<input type="file" accept>` |
+| `isEncryptedPdf( buffer )` | PDF encryption check alone |
+
+`options` takes `maxBytes` and, to narrow the built-in list, `allowedExtensions`. The reason `macros` covers all active content: VBA and Excel 4.0 macros, embedded OLE objects, DDE, event listeners and PDF scripts and attachments.
+
+## Limits
+
+These checks are not an antivirus scan. They refuse active content and anything they cannot read. They do not judge whether the data in an otherwise plain file is malicious, and they do not look inside a document embedded in another one, such as the workbook behind a Word chart. DDE is not looked for in legacy `.doc` files, nor in an `.xlsx` cell formula that names a DDE source without an external link part.
+
+The ZIP limits (`MAX_ZIP_UNCOMPRESSED_BYTES`, `MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES`) are set to 100 MB. If a virus scanner runs after these checks, keep them at or below its own limits: ClamAV, for one, reports content past `MaxScanSize` and `MaxFileSize` as clean.
+
+## Before and after the checks
+
+The library checks the bytes it is handed. The rest of the upload path is up to you:
+
+- **Limit the request body before reading it.** `maxBytes` is checked after the whole file is in memory, so cap the body in your server or proxy first.
+- **Serve stored files as downloads.** Send `Content-Disposition: attachment` and `X-Content-Type-Options: nosniff`, and use the canonical `result.mimeType`, not the one the client declared. Serving uploads from a separate origin keeps a file that slips through away from your cookies.
+- **Limit image dimensions before resizing.** A small JPEG or PNG can declare a huge size. These checks do not decode images, so cap width and height in whatever makes thumbnails (sharp's `limitInputPixels`, ImageMagick's `policy.xml`).
+- **Expect metadata in documents.** Only JPEG and PNG uploads are stripped. Author names in Office and PDF files, and EXIF in images inside documents, are kept.
+- **Run a virus scanner if you need one.** These checks refuse active content; they do not recognise malware in data.
+
+## Development
+
+```sh
+npm install
+npm test
+npm run typecheck
+npm run build   # dist/ with .d.ts
+```
+
+Found a way past a check? Please report it privately, as [SECURITY.md](SECURITY.md) describes.
+
+## License
+
+[MIT](LICENSE)

package/dist/check-upload.d.ts

@@ -0,0 +1,23 @@
+import { type AllowedExtension, type DescriptorRejection, type UploadOptions } from './upload-allowlist.js';
+export type UploadRejection = DescriptorRejection | 'macros' | 'encrypted' | 'content-mismatch';
+export interface UploadInput {
+    filename: string;
+    /** The MIME type the client declared; empty when it sent none. */
+    mimeType: string;
+    bytes: Uint8Array;
+}
+export type UploadCheck = {
+    ok: true;
+    extension: AllowedExtension;
+    filename: string;
+    /** The canonical MIME type for the extension, not the declared one. */
+    mimeType: string;
+    /** The bytes to store; photos come without their metadata. */
+    bytes: Uint8Array;
+} | {
+    ok: false;
+    reason: UploadRejection;
+};
+/** Runs every check on an upload and returns what is safe to store. */
+export declare function checkUpload({ filename, mimeType, bytes }: UploadInput, options: UploadOptions): UploadCheck;
+//# sourceMappingURL=check-upload.d.ts.map

package/dist/check-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-upload.d.ts","sourceRoot":"","sources":["../src/check-upload.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,QAAQ,GAAG,WAAW,GAAG,kBAAkB,CAAC;AAEhG,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GACpB;IACD,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,gBAAgB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,UAAU,CAAC;CAClB,GACC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC;AAE1C,uEAAuE;AACvE,wBAAgB,WAAW,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,GAAI,WAAW,CAiB7G"}

package/dist/check-upload.js

@@ -0,0 +1,22 @@
+import { stripPhotoMetadata } from './photo-metadata.js';
+import { getCanonicalMimeType, inspectFileContent, validateUploadDescriptor, } from './upload-allowlist.js';
+/** Runs every check on an upload and returns what is safe to store. */
+export function checkUpload({ filename, mimeType, bytes }, options) {
+    const descriptor = validateUploadDescriptor({ filename, mimeType, size: bytes.byteLength }, options);
+    if (!descriptor.ok) {
+        return descriptor;
+    }
+    const { extension, sanitizedFilename } = descriptor;
+    const verdict = inspectFileContent(extension, bytes);
+    if (verdict === 'macros' || verdict === 'encrypted') {
+        return { ok: false, reason: verdict };
+    }
+    const stored = verdict === 'valid' ? stripPhotoMetadata(extension, bytes) : null;
+    if (!stored) {
+        return { ok: false, reason: 'content-mismatch' };
+    }
+    return {
+        ok: true, extension, filename: sanitizedFilename, mimeType: getCanonicalMimeType(extension), bytes: stored,
+    };
+}
+//# sourceMappingURL=check-upload.js.map

package/dist/check-upload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-upload.js","sourceRoot":"","sources":["../src/check-upload.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,GAIxB,MAAM,uBAAuB,CAAC;AAuB/B,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAe,EAAE,OAAsB;IAC9F,MAAM,UAAU,GAAG,wBAAwB,CAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,OAAO,CAAE,CAAC;IACvG,IAAK,CAAE,UAAU,CAAC,EAAE,EAAG,CAAC;QACvB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,UAAU,CAAC;IACpD,MAAM,OAAO,GAAG,kBAAkB,CAAE,SAAS,EAAE,KAAK,CAAE,CAAC;IACvD,IAAK,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,WAAW,EAAG,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAE,SAAS,EAAE,KAAK,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,IAAK,CAAE,MAAM,EAAG,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,OAAO;QACN,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,CAAE,SAAS,CAAE,EAAE,KAAK,EAAE,MAAM;KAC5G,CAAC;AACH,CAAC"}

package/dist/excel-macro-sheets.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Finds Excel 4.0 macro sheets and VBA modules in the globals of a BIFF5/BIFF8
+ * Workbook stream, which list every sheet in a BoundSheet8 record [MS-XLS 2.4.28],
+ * DDE and OLE links, which a SupBook record introduces [MS-XLS 2.4.271], and
+ * encryption, which a FILEPASS record announces [MS-XLS 2.4.117].
+ */
+/**
+ * Whether the globals list a macro sheet or a DDE or OLE link, or encrypt the rest. The walk ends
+ * at their EOF, at FILEPASS or at a record that overruns the stream, which Excel could not read either.
+ */
+export declare function inspectExcelGlobals(workbook: Buffer): 'macros' | 'encrypted' | 'valid';
+//# sourceMappingURL=excel-macro-sheets.d.ts.map

package/dist/excel-macro-sheets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"excel-macro-sheets.d.ts","sourceRoot":"","sources":["../src/excel-macro-sheets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkBH;;;GAGG;AACH,wBAAgB,mBAAmB,CAAE,QAAQ,EAAE,MAAM,GAAI,QAAQ,GAAG,WAAW,GAAG,OAAO,CAwBxF"}

package/dist/excel-macro-sheets.js

@@ -0,0 +1,51 @@
+/**
+ * Finds Excel 4.0 macro sheets and VBA modules in the globals of a BIFF5/BIFF8
+ * Workbook stream, which list every sheet in a BoundSheet8 record [MS-XLS 2.4.28],
+ * DDE and OLE links, which a SupBook record introduces [MS-XLS 2.4.271], and
+ * encryption, which a FILEPASS record announces [MS-XLS 2.4.117].
+ */
+const RECORD_HEADER_SIZE = 4;
+const BOUND_SHEET = 0x0085;
+const END_OF_FILE = 0x000a;
+// Everything after FILEPASS is encrypted, the sheet type included.
+const FILE_PASS = 0x002f;
+/** BoundSheet8 `dt` after lbPlyPos (4 bytes) and hsState (1 byte): 1 macro sheet, 6 VBA module. */
+const SHEET_TYPE_OFFSET = 5;
+const MACRO_SHEET_TYPES = [1, 6];
+// A SupBook names the source of external references. One of a DDE link (a formula such as
+// `=cmd|'/c calc'!A1`) or an OLE link lists no sheets, unlike an external workbook, and carries no
+// marker of the workbook itself or of add-in functions in place of the length of its path.
+const SUP_BOOK = 0x01ae;
+const SUP_BOOK_SIZE = 4;
+const SELF_REFERENCE = 0x0401;
+const ADD_IN_REFERENCE = 0x3a01;
+/**
+ * Whether the globals list a macro sheet or a DDE or OLE link, or encrypt the rest. The walk ends
+ * at their EOF, at FILEPASS or at a record that overruns the stream, which Excel could not read either.
+ */
+export function inspectExcelGlobals(workbook) {
+    let offset = 0;
+    while (offset + RECORD_HEADER_SIZE <= workbook.length) {
+        const type = workbook.readUInt16LE(offset);
+        const size = workbook.readUInt16LE(offset + 2);
+        const body = offset + RECORD_HEADER_SIZE;
+        if (type === FILE_PASS) {
+            return 'encrypted';
+        }
+        if (type === END_OF_FILE) {
+            return 'valid';
+        }
+        if (type === BOUND_SHEET && size > SHEET_TYPE_OFFSET && body + SHEET_TYPE_OFFSET < workbook.length &&
+            MACRO_SHEET_TYPES.includes(workbook[body + SHEET_TYPE_OFFSET])) {
+            return 'macros';
+        }
+        if (type === SUP_BOOK && size >= SUP_BOOK_SIZE && body + SUP_BOOK_SIZE <= workbook.length &&
+            workbook.readUInt16LE(body) === 0 &&
+            ![SELF_REFERENCE, ADD_IN_REFERENCE].includes(workbook.readUInt16LE(body + 2))) {
+            return 'macros';
+        }
+        offset = body + size;
+    }
+    return 'valid';
+}
+//# sourceMappingURL=excel-macro-sheets.js.map

package/dist/excel-macro-sheets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"excel-macro-sheets.js","sourceRoot":"","sources":["../src/excel-macro-sheets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,mEAAmE;AACnE,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,mGAAmG;AACnG,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,iBAAiB,GAAG,CAAE,CAAC,EAAE,CAAC,CAAE,CAAC;AACnC,0FAA0F;AAC1F,mGAAmG;AACnG,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC;AACxB,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAE,QAAgB;IACpD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAQ,MAAM,GAAG,kBAAkB,IAAI,QAAQ,CAAC,MAAM,EAAG,CAAC;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAE,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAE,MAAM,GAAG,CAAC,CAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,GAAG,kBAAkB,CAAC;QACzC,IAAK,IAAI,KAAK,SAAS,EAAG,CAAC;YAC1B,OAAO,WAAW,CAAC;QACpB,CAAC;QACD,IAAK,IAAI,KAAK,WAAW,EAAG,CAAC;YAC5B,OAAO,OAAO,CAAC;QAChB,CAAC;QACD,IAAK,IAAI,KAAK,WAAW,IAAI,IAAI,GAAG,iBAAiB,IAAI,IAAI,GAAG,iBAAiB,GAAG,QAAQ,CAAC,MAAM;YAClG,iBAAiB,CAAC,QAAQ,CAAE,QAAQ,CAAE,IAAI,GAAG,iBAAiB,CAAE,CAAE,EAAG,CAAC;YACtE,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,IAAK,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,aAAa,IAAI,IAAI,GAAG,aAAa,IAAI,QAAQ,CAAC,MAAM;YACzF,QAAQ,CAAC,YAAY,CAAE,IAAI,CAAE,KAAK,CAAC;YACnC,CAAE,CAAE,cAAc,EAAE,gBAAgB,CAAE,CAAC,QAAQ,CAAE,QAAQ,CAAC,YAAY,CAAE,IAAI,GAAG,CAAC,CAAE,CAAE,EAAG,CAAC;YACxF,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC"}

package/dist/heif-metadata.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Removes EXIF and XMP from a HEIF still image (HEIC, AVIF) without moving a byte. The item
+ * locations are byte offsets that dropping data would shift, so the items are overwritten in
+ * place instead: EXIF with an empty TIFF block, XMP with spaces. The orientation lives in the
+ * `irot` and `imir` properties, which stay. Image sequences (`moov`) are refused.
+ */
+/**
+ * The HEIF image with its EXIF and XMP items overwritten, or null when its boxes do not read,
+ * an item's data cannot be located, or it is an image sequence.
+ */
+export declare function stripHeif(content: Buffer): Buffer | null;
+/** The major and compatible brands of a file's leading `ftyp` box, empty when there is none. */
+export declare function readFtypBrands(content: Buffer): string[];
+//# sourceMappingURL=heif-metadata.d.ts.map

package/dist/heif-metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heif-metadata.d.ts","sourceRoot":"","sources":["../src/heif-metadata.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2KH;;;GAGG;AACH,wBAAgB,SAAS,CAAE,OAAO,EAAE,MAAM,GAAI,MAAM,GAAG,IAAI,CAqC1D;AAED,gGAAgG;AAChG,wBAAgB,cAAc,CAAE,OAAO,EAAE,MAAM,GAAI,MAAM,EAAE,CAW1D"}

package/dist/heif-metadata.js

@@ -0,0 +1,216 @@
+/**
+ * Removes EXIF and XMP from a HEIF still image (HEIC, AVIF) without moving a byte. The item
+ * locations are byte offsets that dropping data would shift, so the items are overwritten in
+ * place instead: EXIF with an empty TIFF block, XMP with spaces. The orientation lives in the
+ * `irot` and `imir` properties, which stay. Image sequences (`moov`) are refused.
+ */
+/** Bounds far above real files that keep a crafted one cheap. */
+const MAX_BOXES = 10_000;
+const MAX_ITEMS = 100_000;
+const XMP_CONTENT_TYPE = 'application/rdf+xml';
+/** An EXIF item: the offset of the TIFF header (0), then a big-endian TIFF block with an empty IFD0. */
+const EMPTY_EXIF = Buffer.from('00000000' + '4d4d002a00000008' + '0000' + '00000000', 'hex');
+const SPACE = 0x20;
+/** The boxes in `[start, end)`, or null when one runs past it or there are too many. */
+function readBoxes(bytes, start, end) {
+    const boxes = [];
+    for (let offset = start; offset < end;) {
+        if (offset + 8 > end || boxes.length === MAX_BOXES) {
+            return null;
+        }
+        let size = bytes.readUInt32BE(offset);
+        let header = 8;
+        if (size === 1) {
+            const large = offset + 16 <= end ? bytes.readBigUInt64BE(offset + 8) : undefined;
+            if (large === undefined || large > BigInt(end - offset)) {
+                return null;
+            }
+            size = Number(large);
+            header = 16;
+        }
+        else if (size === 0) {
+            // Runs to the end of the file.
+            size = end - offset;
+        }
+        const type = bytes.toString('latin1', offset + 4, offset + 8);
+        header += type === 'uuid' ? 16 : 0;
+        if (size < header || offset + size > end) {
+            return null;
+        }
+        boxes.push({ type, start: offset + header, end: offset + size });
+        offset += size;
+    }
+    return boxes;
+}
+/** Reads the fields of a box's content in order; any read past its end throws. */
+class FieldReader {
+    position;
+    bytes;
+    end;
+    constructor(bytes, box) {
+        this.bytes = bytes;
+        this.position = box.start;
+        this.end = box.end;
+    }
+    /** An unsigned big-endian integer of 0, 1, 2, 4 or 8 bytes. */
+    uint(size) {
+        if (this.position + size > this.end) {
+            throw new RangeError('Box field past its end');
+        }
+        const value = size === 8 ? Number(this.bytes.readBigUInt64BE(this.position)) : size === 0 ? 0 : this.bytes.readUIntBE(this.position, size);
+        this.position += size;
+        return value;
+    }
+    text(length) {
+        if (this.position + length > this.end) {
+            throw new RangeError('Box field past its end');
+        }
+        this.position += length;
+        return this.bytes.toString('latin1', this.position - length, this.position);
+    }
+    /** A NUL-terminated string, or the rest of the box when the NUL is missing. */
+    string() {
+        const nul = this.bytes.indexOf(0, this.position);
+        const stop = nul < 0 || nul >= this.end ? this.end : nul;
+        const value = this.bytes.toString('utf8', this.position, stop);
+        this.position = Math.min(this.end, stop + 1);
+        return value;
+    }
+}
+/** The IDs of the EXIF and XMP items an `iinf` box lists; throws a RangeError when it does not read. */
+function readMetadataItems(bytes, iinf) {
+    const reader = new FieldReader(bytes, iinf);
+    const version = reader.uint(1);
+    reader.uint(3);
+    reader.uint(version === 0 ? 2 : 4);
+    const exif = new Set();
+    const xmp = new Set();
+    const entries = readBoxes(bytes, reader.position, iinf.end);
+    if (!entries) {
+        throw new RangeError('Item entries do not read');
+    }
+    for (const infe of entries) {
+        if (infe.type !== 'infe') {
+            continue;
+        }
+        const entry = new FieldReader(bytes, infe);
+        const entryVersion = entry.uint(1);
+        entry.uint(3);
+        const id = entry.uint(entryVersion === 3 ? 4 : 2);
+        entry.uint(2);
+        // Versions 0 and 1 describe a MIME item without naming its type.
+        const type = entryVersion >= 2 ? entry.text(4) : 'mime';
+        entry.string();
+        if (type === 'Exif') {
+            exif.add(id);
+        }
+        else if (type === 'mime' && entry.string().toLowerCase() === XMP_CONTENT_TYPE) {
+            xmp.add(id);
+        }
+    }
+    return { exif, xmp };
+}
+/**
+ * Where the data of each item lies, as file offsets read from an `iloc` box, `[ -1, -1 ]` for an
+ * extent that cannot be located; throws a RangeError when the box does not read.
+ */
+function readItemLocations(bytes, iloc, idat) {
+    const reader = new FieldReader(bytes, iloc);
+    const version = reader.uint(1);
+    reader.uint(3);
+    const sizes = reader.uint(2);
+    const offsetSize = sizes >> 12;
+    const lengthSize = (sizes >> 8) & 0xf;
+    const baseOffsetSize = (sizes >> 4) & 0xf;
+    const indexSize = version === 0 ? 0 : sizes & 0xf;
+    const itemCount = reader.uint(version < 2 ? 2 : 4);
+    if (itemCount > MAX_ITEMS) {
+        throw new RangeError('Too many items');
+    }
+    const locations = new Map();
+    for (let item = 0; item < itemCount; item++) {
+        const id = reader.uint(version < 2 ? 2 : 4);
+        const method = version === 0 ? 0 : reader.uint(2) & 0xf;
+        const dataReference = reader.uint(2);
+        const baseOffset = reader.uint(baseOffsetSize);
+        const extentCount = reader.uint(2);
+        const extents = [];
+        for (let extent = 0; extent < extentCount; extent++) {
+            reader.uint(indexSize);
+            const offset = reader.uint(offsetSize);
+            const length = reader.uint(lengthSize);
+            // Method 0 points into the file, 1 into the `idat` box; 2 (other items) and other files are not read.
+            const origin = method === 0 && dataReference === 0 ? 0 : method === 1 ? idat?.start : undefined;
+            const start = origin === undefined ? -1 : origin + baseOffset + offset;
+            const limit = method === 1 ? idat?.end ?? -1 : bytes.length;
+            extents.push(start < 0 || length === 0 || start + length > limit ? [-1, -1] : [start, start + length]);
+        }
+        locations.set(id, [...(locations.get(id) ?? []), ...extents]);
+    }
+    return locations;
+}
+/** Writes `data`, padded with `fill`, over the extents in order. */
+function overwrite(bytes, extents, data, fill) {
+    let written = 0;
+    for (const [start, end] of extents) {
+        bytes.fill(fill, start, end);
+        written += data.copy(bytes, start, Math.min(written, data.length), Math.min(data.length, written + end - start));
+    }
+}
+/**
+ * The HEIF image with its EXIF and XMP items overwritten, or null when its boxes do not read,
+ * an item's data cannot be located, or it is an image sequence.
+ */
+export function stripHeif(content) {
+    const boxes = readBoxes(content, 0, content.length);
+    if (!boxes || boxes[0]?.type !== 'ftyp' || boxes.some((box) => box.type === 'moov')) {
+        return null;
+    }
+    const metas = boxes.filter((box) => box.type === 'meta');
+    // `meta` is a full box: version and flags come before its children.
+    const children = metas.length === 1 ? readBoxes(content, metas[0].start + 4, metas[0].end) : null;
+    const iinf = children?.find((box) => box.type === 'iinf');
+    const iloc = children?.find((box) => box.type === 'iloc');
+    if (!iinf || !iloc) {
+        return null;
+    }
+    const stripped = Buffer.from(content);
+    try {
+        const { exif, xmp } = readMetadataItems(content, iinf);
+        const locations = readItemLocations(content, iloc, children.find((box) => box.type === 'idat'));
+        for (const [ids, data, fill] of [[exif, EMPTY_EXIF, 0], [xmp, Buffer.alloc(0), SPACE]]) {
+            for (const id of ids) {
+                const extents = locations.get(id) ?? [];
+                if (extents.some(([start]) => start < 0)) {
+                    return null;
+                }
+                overwrite(stripped, extents, data, fill);
+            }
+        }
+    }
+    catch (error) {
+        if (error instanceof RangeError) {
+            return null;
+        }
+        throw error;
+    }
+    // Top-level `uuid` boxes hold vendor data, such as XMP in some writers.
+    for (const box of boxes.filter((box) => box.type === 'uuid')) {
+        stripped.fill(0, box.start, box.end);
+    }
+    return stripped;
+}
+/** The major and compatible brands of a file's leading `ftyp` box, empty when there is none. */
+export function readFtypBrands(content) {
+    const size = content.length >= 16 ? content.readUInt32BE(0) : 0;
+    if (size < 16 || size > content.length || content.toString('latin1', 4, 8) !== 'ftyp') {
+        return [];
+    }
+    // The minor version sits between the major brand and the compatible ones.
+    const brands = [content.toString('latin1', 8, 12)];
+    for (let offset = 16; offset + 4 <= size; offset += 4) {
+        brands.push(content.toString('latin1', offset, offset + 4));
+    }
+    return brands;
+}
+//# sourceMappingURL=heif-metadata.js.map

package/dist/heif-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heif-metadata.js","sourceRoot":"","sources":["../src/heif-metadata.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,iEAAiE;AACjE,MAAM,SAAS,GAAG,MAAM,CAAC;AACzB,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAC/C,wGAAwG;AACxG,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAE,UAAU,GAAG,kBAAkB,GAAG,MAAM,GAAG,UAAU,EAAE,KAAK,CAAE,CAAC;AAC/F,MAAM,KAAK,GAAG,IAAI,CAAC;AAEnB,wFAAwF;AACxF,SAAS,SAAS,CAAE,KAAa,EAAE,KAAa,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAU,EAAE,CAAC;IACxB,KAAM,IAAI,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,GAAG,GAAI,CAAC;QAC1C,IAAK,MAAM,GAAG,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAG,CAAC;YACtD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,GAAG,KAAK,CAAC,YAAY,CAAE,MAAM,CAAE,CAAC;QACxC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAK,IAAI,KAAK,CAAC,EAAG,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAE,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,IAAK,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAE,GAAG,GAAG,MAAM,CAAE,EAAG,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,GAAG,MAAM,CAAE,KAAK,CAAE,CAAC;YACvB,MAAM,GAAG,EAAE,CAAC;QACb,CAAC;aAAM,IAAK,IAAI,KAAK,CAAC,EAAG,CAAC;YACzB,+BAA+B;YAC/B,IAAI,GAAG,GAAG,GAAG,MAAM,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAE,CAAC;QAChE,MAAM,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAK,IAAI,GAAG,MAAM,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG,EAAG,CAAC;YAC5C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,EAAE,CAAE,CAAC;QACnE,MAAM,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,MAAM,WAAW;IAChB,QAAQ,CAAS;IACA,KAAK,CAAS;IACd,GAAG,CAAS;IAE7B,YAAa,KAAa,EAAE,GAAQ;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAE,IAAY;QACjB,IAAK,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAG,CAAC;YACvC,MAAM,IAAI,UAAU,CAAE,wBAAwB,CAAE,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAE,IAAI,CAAC,QAAQ,CAAE,CAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAE,CAAC;QACjJ,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAE,MAAc;QACnB,IAAK,IAAI,CAAC,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAG,CAAC;YACzC,MAAM,IAAI,UAAU,CAAE,wBAAwB,CAAE,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAE,CAAC;IAC/E,CAAC;IAED,+EAA+E;IAC/E,MAAM;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAE,CAAC;QACnD,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAE,CAAC;QACjE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAE,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;CACD;AAED,wGAAwG;AACxG,SAAS,iBAAiB,CAAE,KAAa,EAAE,IAAS;IACnD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAE,KAAK,EAAE,IAAI,CAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;IACjC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;IACjB,MAAM,CAAC,IAAI,CAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,OAAO,GAAG,SAAS,CAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAE,CAAC;IAC9D,IAAK,CAAE,OAAO,EAAG,CAAC;QACjB,MAAM,IAAI,UAAU,CAAE,0BAA0B,CAAE,CAAC;IACpD,CAAC;IACD,KAAM,MAAM,IAAI,IAAI,OAAO,EAAG,CAAC;QAC9B,IAAK,IAAI,CAAC,IAAI,KAAK,MAAM,EAAG,CAAC;YAC5B,SAAS;QACV,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,WAAW,CAAE,KAAK,EAAE,IAAI,CAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;QAChB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;QAChB,iEAAiE;QACjE,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,IAAK,IAAI,KAAK,MAAM,EAAG,CAAC;YACvB,IAAI,CAAC,GAAG,CAAE,EAAE,CAAE,CAAC;QAChB,CAAC;aAAM,IAAK,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,EAAG,CAAC;YACnF,GAAG,CAAC,GAAG,CAAE,EAAE,CAAE,CAAC;QACf,CAAC;IACF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAE,KAAa,EAAE,IAAS,EAAE,IAAqB;IAC1E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAE,KAAK,EAAE,IAAI,CAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;IACjC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;IACjB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,CAAE,KAAK,IAAI,CAAC,CAAE,GAAG,GAAG,CAAC;IACxC,MAAM,cAAc,GAAG,CAAE,KAAK,IAAI,CAAC,CAAE,GAAG,GAAG,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACrD,IAAK,SAAS,GAAG,SAAS,EAAG,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAE,gBAAgB,CAAE,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC/D,KAAM,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,EAAG,CAAC;QAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,GAAG,GAAG,CAAC;QAC1D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAE,cAAc,CAAE,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAE,CAAC,CAAE,CAAC;QACrC,MAAM,OAAO,GAA8B,EAAE,CAAC;QAC9C,KAAM,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,MAAM,EAAE,EAAG,CAAC;YACvD,MAAM,CAAC,IAAI,CAAE,SAAS,CAAE,CAAC;YACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAE,UAAU,CAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAE,UAAU,CAAE,CAAC;YACzC,sGAAsG;YACtG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAChG,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;YACvE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAE,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAAE,CAAE,CAAC;QAC9G,CAAC;QACD,SAAS,CAAC,GAAG,CAAE,EAAE,EAAE,CAAE,GAAG,CAAE,SAAS,CAAC,GAAG,CAAE,EAAE,CAAE,IAAI,EAAE,CAAE,EAAE,GAAG,OAAO,CAAE,CAAE,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,SAAS,SAAS,CAAE,KAAa,EAAE,OAAkC,EAAE,IAAY,EAAE,IAAY;IAChG,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAM,MAAM,CAAE,KAAK,EAAE,GAAG,CAAE,IAAI,OAAO,EAAG,CAAC;QACxC,KAAK,CAAC,IAAI,CAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAE,CAAC;QAC/B,OAAO,IAAI,IAAI,CAAC,IAAI,CAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAE,EAAE,IAAI,CAAC,GAAG,CAAE,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,KAAK,CAAE,CAAE,CAAC;IACxH,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAE,OAAe;IACzC,MAAM,KAAK,GAAG,SAAS,CAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAE,CAAC;IACtD,IAAK,CAAE,KAAK,IAAI,KAAK,CAAE,CAAC,CAAE,EAAE,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,EAAG,CAAC;QAC9F,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC7D,oEAAoE;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAE,OAAO,EAAE,KAAK,CAAE,CAAC,CAAE,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAE,CAAC,CAAE,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,IAAK,CAAE,IAAI,IAAI,CAAE,IAAI,EAAG,CAAC;QACxB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAE,OAAO,CAAE,CAAC;IACxC,IAAI,CAAC;QACJ,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAE,OAAO,EAAE,IAAI,CAAE,CAAC;QACzD,MAAM,SAAS,GAAG,iBAAiB,CAAE,OAAO,EAAE,IAAI,EAAE,QAAS,CAAC,IAAI,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAE,CAAC;QACvG,KAAM,MAAM,CAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAE,IAAI,CAAE,CAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAE,EAAE,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAE,CAAC,CAAE,EAAE,KAAK,CAAE,CAAW,EAAG,CAAC;YAC7G,KAAM,MAAM,EAAE,IAAI,GAAG,EAAG,CAAC;gBACxB,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAE,EAAE,CAAE,IAAI,EAAE,CAAC;gBAC1C,IAAK,OAAO,CAAC,IAAI,CAAE,CAAE,CAAE,KAAK,CAAE,EAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAE,EAAG,CAAC;oBAClD,OAAO,IAAI,CAAC;gBACb,CAAC;gBACD,SAAS,CAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAE,CAAC;YAC5C,CAAC;QACF,CAAC;IACF,CAAC;IAAC,OAAQ,KAAK,EAAG,CAAC;QAClB,IAAK,KAAK,YAAY,UAAU,EAAG,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,wEAAwE;IACxE,KAAM,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,CAAE,CAAE,GAAG,EAAG,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,EAAG,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAE,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,CAAE,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,cAAc,CAAE,OAAe;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAE,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,IAAK,IAAI,GAAG,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAE,KAAK,MAAM,EAAG,CAAC;QAC3F,OAAO,EAAE,CAAC;IACX,CAAC;IACD,0EAA0E;IAC1E,MAAM,MAAM,GAAG,CAAE,OAAO,CAAC,QAAQ,CAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAE,CAAE,CAAC;IACvD,KAAM,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,IAAI,CAAC,EAAG,CAAC;QACzD,MAAM,CAAC,IAAI,CAAE,OAAO,CAAC,QAAQ,CAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAAE,CAAE,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './check-upload.js';
+export * from './upload-allowlist.js';
+export { stripPhotoMetadata } from './photo-metadata.js';
+export { isEncryptedPdf } from './pdf-encryption.js';
+export { MAX_ZIP_ENTRIES, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES, MAX_ZIP_UNCOMPRESSED_BYTES } from './zip-entries.js';
+export { MAX_OLE_STREAM_BYTES } from './ole-streams.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export * from './check-upload.js';
+export * from './upload-allowlist.js';
+export { stripPhotoMetadata } from './photo-metadata.js';
+export { isEncryptedPdf } from './pdf-encryption.js';
+export { MAX_ZIP_ENTRIES, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES, MAX_ZIP_UNCOMPRESSED_BYTES } from './zip-entries.js';
+export { MAX_OLE_STREAM_BYTES } from './ole-streams.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,gCAAgC,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACjH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/ole-streams.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Reads the directory and streams of an OLE compound file (the container of
+ * legacy .doc/.xls/.ppt files) by following its sector chains.
+ * Returns null for anything malformed, oversized or outside versions 3 and 4.
+ */
+export interface OleDirectory {
+    /** Names of every storage and stream, at any depth. */
+    names: string[];
+    /** A stream right below the root, matched case-insensitively, or null when missing or malformed. */
+    readStream(name: string): Buffer | null;
+}
+/** Upper bounds that keep a crafted file from costing more than a real one. */
+export declare const MAX_OLE_STREAM_BYTES: number;
+export declare function readOleDirectory(content: Buffer): OleDirectory | null;
+//# sourceMappingURL=ole-streams.d.ts.map

package/dist/ole-streams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ole-streams.d.ts","sourceRoot":"","sources":["../src/ole-streams.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,YAAY;IAC5B,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,oGAAoG;IACpG,UAAU,CAAE,IAAI,EAAE,MAAM,GAAI,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAwHrD,wBAAgB,gBAAgB,CAAE,OAAO,EAAE,MAAM,GAAI,YAAY,GAAG,IAAI,CA2FvE"}