web-doc 0.6.2 → 0.8.0

package/dist/edit/ooxml/zip.js

@@ -0,0 +1,280 @@
+import { ViewerError } from "../../errors.js";
+export const METHOD_STORED = 0;
+export const METHOD_DEFLATED = 8;
+const SIGNATURE_LOCAL = 0x04034b50;
+const SIGNATURE_CENTRAL = 0x02014b50;
+const SIGNATURE_EOCD = 0x06054b50;
+const SIGNATURE_DESCRIPTOR = 0x08074b50;
+const SIGNATURE_ZIP64_LOCATOR = 0x07064b50;
+const EOCD_LENGTH = 22;
+const MAX_COMMENT = 0xffff;
+const FLAG_ENCRYPTED = 0x0001;
+const FLAG_DESCRIPTOR = 0x0008;
+const FLAG_STRONG_ENCRYPTION = 0x0040;
+const ZIP64_MARKER = 0xffffffff;
+/** Parses the end-of-central-directory record and the central directory. */
+export function parseZip(bytes, limits) {
+    if (bytes.byteLength > limits.maxInputBytes)
+        throw limit("Input exceeds maxInputBytes", bytes.byteLength, limits.maxInputBytes);
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const eocdOffset = findEndOfCentralDirectory(bytes, view);
+    if (eocdOffset === undefined)
+        throw invalid("No end-of-central-directory record");
+    if (eocdOffset >= 20 &&
+        view.getUint32(eocdOffset - 20, true) === SIGNATURE_ZIP64_LOCATOR)
+        throw unsupported("ZIP64 archives are not supported");
+    const thisDisk = view.getUint16(eocdOffset + 4, true);
+    const directoryDisk = view.getUint16(eocdOffset + 6, true);
+    const countOnDisk = view.getUint16(eocdOffset + 8, true);
+    const count = view.getUint16(eocdOffset + 10, true);
+    const centralDirectoryLength = view.getUint32(eocdOffset + 12, true);
+    const centralDirectoryOffset = view.getUint32(eocdOffset + 16, true);
+    const commentLength = view.getUint16(eocdOffset + 20, true);
+    if (thisDisk !== 0 || directoryDisk !== 0 || countOnDisk !== count)
+        throw unsupported("Multi-disk archives are not supported");
+    if (count === 0xffff ||
+        centralDirectoryLength === ZIP64_MARKER ||
+        centralDirectoryOffset === ZIP64_MARKER)
+        throw unsupported("ZIP64 archives are not supported");
+    if (centralDirectoryOffset + centralDirectoryLength > eocdOffset)
+        throw invalid("The central directory runs past its end record");
+    const comment = bytes.subarray(eocdOffset + EOCD_LENGTH, eocdOffset + EOCD_LENGTH + commentLength);
+    const entries = [];
+    let offset = centralDirectoryOffset;
+    let expanded = 0;
+    for (let index = 0; index < count; index += 1) {
+        if (offset + 46 > eocdOffset ||
+            view.getUint32(offset, true) !== SIGNATURE_CENTRAL)
+            throw invalid(`Central-directory entry ${index} is missing or malformed`);
+        const versionMadeBy = view.getUint16(offset + 4, true);
+        const versionNeeded = view.getUint16(offset + 6, true);
+        const flags = view.getUint16(offset + 8, true);
+        const method = view.getUint16(offset + 10, true);
+        const modTime = view.getUint16(offset + 12, true);
+        const modDate = view.getUint16(offset + 14, true);
+        const crc32 = view.getUint32(offset + 16, true);
+        const compressedSize = view.getUint32(offset + 20, true);
+        const uncompressedSize = view.getUint32(offset + 24, true);
+        const nameLength = view.getUint16(offset + 28, true);
+        const extraLength = view.getUint16(offset + 30, true);
+        const commentLength = view.getUint16(offset + 32, true);
+        const diskNumber = view.getUint16(offset + 34, true);
+        const internalAttributes = view.getUint16(offset + 36, true);
+        const externalAttributes = view.getUint32(offset + 38, true);
+        const localHeaderOffset = view.getUint32(offset + 42, true);
+        const centralLength = 46 + nameLength + extraLength + commentLength;
+        if (offset + centralLength > eocdOffset)
+            throw invalid(`Central-directory entry ${index} runs past the directory`);
+        if (compressedSize === ZIP64_MARKER ||
+            uncompressedSize === ZIP64_MARKER ||
+            localHeaderOffset === ZIP64_MARKER)
+            throw unsupported("ZIP64 entries are not supported");
+        if (diskNumber !== 0)
+            throw unsupported("Multi-disk archives are not supported");
+        if (flags & (FLAG_ENCRYPTED | FLAG_STRONG_ENCRYPTION))
+            throw unsupported("Encrypted archives are not supported");
+        if (method !== METHOD_STORED && method !== METHOD_DEFLATED)
+            throw unsupported(`Compression method ${method} is not supported`);
+        if (uncompressedSize > limits.maxZipEntryBytes)
+            throw limit("ZIP entry exceeds maxZipEntryBytes", uncompressedSize, limits.maxZipEntryBytes);
+        expanded += uncompressedSize;
+        if (expanded > limits.maxExpandedOfficeBytes)
+            throw limit("Office package exceeds maxExpandedOfficeBytes", expanded, limits.maxExpandedOfficeBytes);
+        if (localHeaderOffset + 30 > centralDirectoryOffset)
+            throw invalid(`Entry ${index} points outside the archive`);
+        const nameBytes = bytes.subarray(offset + 46, offset + 46 + nameLength);
+        entries.push({
+            name: new TextDecoder("utf-8", { fatal: false }).decode(nameBytes),
+            nameBytes,
+            method,
+            flags,
+            crc32,
+            compressedSize,
+            uncompressedSize,
+            localHeaderOffset,
+            centralOffset: offset,
+            centralLength,
+            extra: bytes.subarray(offset + 46 + nameLength, offset + 46 + nameLength + extraLength),
+            comment: bytes.subarray(offset + 46 + nameLength + extraLength, offset + centralLength),
+            modTime,
+            modDate,
+            versionMadeBy,
+            versionNeeded,
+            internalAttributes,
+            externalAttributes,
+        });
+        offset += centralLength;
+    }
+    if (offset !== centralDirectoryOffset + centralDirectoryLength)
+        throw invalid("The central directory's length does not match its entries");
+    return {
+        bytes,
+        entries,
+        centralDirectoryOffset,
+        centralDirectoryLength,
+        eocdOffset,
+        comment,
+    };
+}
+/**
+ * Locates an entry's local record and checks it against the central record:
+ * same name, same method, and the same sizes and CRC unless the entry
+ * carries them in a data descriptor instead.
+ */
+export function localRecordOf(archive, entry) {
+    const { bytes } = archive;
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    const headerOffset = entry.localHeaderOffset;
+    if (headerOffset + 30 > bytes.byteLength ||
+        view.getUint32(headerOffset, true) !== SIGNATURE_LOCAL)
+        throw invalid(`Entry ${entry.name} has no local header`);
+    const flags = view.getUint16(headerOffset + 6, true);
+    const method = view.getUint16(headerOffset + 8, true);
+    const crc32 = view.getUint32(headerOffset + 14, true);
+    const compressedSize = view.getUint32(headerOffset + 18, true);
+    const uncompressedSize = view.getUint32(headerOffset + 22, true);
+    const nameLength = view.getUint16(headerOffset + 26, true);
+    const extraLength = view.getUint16(headerOffset + 28, true);
+    const dataStart = headerOffset + 30 + nameLength + extraLength;
+    const localName = bytes.subarray(headerOffset + 30, headerOffset + 30 + nameLength);
+    if (!sameBytes(localName, entry.nameBytes))
+        throw invalid(`Entry ${entry.name} is named differently in its local header`);
+    if (method !== entry.method)
+        throw invalid(`Entry ${entry.name} has a different method in its local header`);
+    const hasDescriptor = (flags & FLAG_DESCRIPTOR) !== 0;
+    if (!hasDescriptor &&
+        (crc32 !== entry.crc32 ||
+            compressedSize !== entry.compressedSize ||
+            uncompressedSize !== entry.uncompressedSize))
+        throw invalid(`Entry ${entry.name} has different sizes in its local header`);
+    const dataEnd = dataStart + entry.compressedSize;
+    if (dataEnd > archive.centralDirectoryOffset)
+        throw invalid(`Entry ${entry.name} runs into the central directory`);
+    let recordEnd = dataEnd;
+    if (hasDescriptor) {
+        let at = dataEnd;
+        if (at + 4 <= bytes.byteLength &&
+            view.getUint32(at, true) === SIGNATURE_DESCRIPTOR)
+            at += 4;
+        if (at + 12 > bytes.byteLength)
+            throw invalid(`Entry ${entry.name} has a truncated data descriptor`);
+        const descriptorCrc = view.getUint32(at, true);
+        const descriptorCompressed = view.getUint32(at + 4, true);
+        const descriptorUncompressed = view.getUint32(at + 8, true);
+        if (descriptorCrc !== entry.crc32 ||
+            descriptorCompressed !== entry.compressedSize ||
+            descriptorUncompressed !== entry.uncompressedSize)
+            throw invalid(`Entry ${entry.name} has a data descriptor that disagrees with the directory`);
+        recordEnd = at + 12;
+    }
+    return { headerOffset, dataStart, dataEnd, recordEnd };
+}
+/** The entry's bytes, inflated when needed, metered and CRC-checked. */
+export async function inflateEntry(archive, entry, limits, signal) {
+    const local = localRecordOf(archive, entry);
+    const data = archive.bytes.subarray(local.dataStart, local.dataEnd);
+    let output;
+    if (entry.method === METHOD_STORED) {
+        if (data.byteLength !== entry.uncompressedSize)
+            throw invalid(`Entry ${entry.name} is stored with a different size than declared`);
+        output = data.slice();
+    }
+    else {
+        output = await inflateRaw(data, entry, limits, signal);
+    }
+    if (crc32(output) !== entry.crc32)
+        throw invalid(`Entry ${entry.name} does not match its CRC-32`);
+    return output;
+}
+async function inflateRaw(data, entry, limits, signal) {
+    if (typeof DecompressionStream !== "function")
+        throw new ViewerError("edit-unsupported", "This environment has no DecompressionStream for OOXML parts", { details: { reason: "no-decompression-stream" } });
+    const expected = entry.uncompressedSize;
+    const ceiling = Math.min(expected, limits.maxZipEntryBytes);
+    const output = new Uint8Array(expected);
+    let total = 0;
+    const stream = new DecompressionStream("deflate-raw");
+    const writer = stream.writable.getWriter();
+    // A copy: the stream wants an ArrayBuffer-backed view, and the slice
+    // keeps a shared or detached source from leaking into the stream.
+    const writing = writer
+        .write(data.slice())
+        .then(() => writer.close())
+        .catch(() => undefined);
+    const reader = stream.readable.getReader();
+    try {
+        for (;;) {
+            if (signal?.aborted)
+                throw new ViewerError("aborted", "Inflation was aborted");
+            let chunk;
+            try {
+                chunk = await reader.read();
+            }
+            catch (error) {
+                throw invalid(`Entry ${entry.name} is not valid deflate data`, error);
+            }
+            if (chunk.done)
+                break;
+            if (total + chunk.value.byteLength > ceiling) {
+                await reader.cancel().catch(() => undefined);
+                throw limit(`Entry ${entry.name} inflates beyond its declared size`, total + chunk.value.byteLength, ceiling);
+            }
+            output.set(chunk.value, total);
+            total += chunk.value.byteLength;
+        }
+    }
+    finally {
+        reader.releaseLock();
+        await writing;
+    }
+    if (total !== expected)
+        throw invalid(`Entry ${entry.name} inflates to ${total} bytes, not the declared ${expected}`);
+    return output;
+}
+const CRC_TABLE = (() => {
+    const table = new Uint32Array(256);
+    for (let n = 0; n < 256; n += 1) {
+        let c = n;
+        for (let k = 0; k < 8; k += 1)
+            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+        table[n] = c >>> 0;
+    }
+    return table;
+})();
+/** CRC-32 as ZIP uses it (IEEE 802.3, reflected). */
+export function crc32(bytes, seed = 0) {
+    let crc = (seed ^ 0xffffffff) >>> 0;
+    for (let index = 0; index < bytes.byteLength; index += 1)
+        crc = CRC_TABLE[(crc ^ bytes[index]) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function findEndOfCentralDirectory(bytes, view) {
+    const floor = Math.max(0, bytes.byteLength - EOCD_LENGTH - MAX_COMMENT);
+    for (let offset = bytes.byteLength - EOCD_LENGTH; offset >= floor; offset -= 1) {
+        if (view.getUint32(offset, true) !== SIGNATURE_EOCD)
+            continue;
+        const commentLength = view.getUint16(offset + 20, true);
+        if (offset + EOCD_LENGTH + commentLength === bytes.byteLength)
+            return offset;
+    }
+    return undefined;
+}
+function sameBytes(a, b) {
+    if (a.byteLength !== b.byteLength)
+        return false;
+    for (let index = 0; index < a.byteLength; index += 1)
+        if (a[index] !== b[index])
+            return false;
+    return true;
+}
+function invalid(message, cause) {
+    return new ViewerError("invalid-file", message, cause === undefined ? {} : { cause });
+}
+function unsupported(message) {
+    return new ViewerError("unsupported-package", message);
+}
+function limit(message, actual, limit) {
+    return new ViewerError("resource-limit", message, {
+        details: { actual, limit },
+    });
+}

package/dist/edit/operations.d.ts

@@ -0,0 +1,19 @@
+import { ViewerError } from "../errors.js";
+import type { BinaryData, OperationIssue, OperationSchemaSet } from "./types.js";
+/**
+ * Checks the batch-level preconditions of `apply()`: an array that is not empty
+ * and not larger than the limit.
+ */
+export declare function assertBatchSize(operations: unknown, limit: number): void;
+/**
+ * Shape and schema checks for every operation of a batch: JSON-only values, a
+ * known `op`, and the operation's JSON Schema. All issues are collected.
+ */
+export declare function checkOperations(operations: readonly unknown[], schemas: OperationSchemaSet): OperationIssue[];
+export declare function invalidOperationError(issues: readonly OperationIssue[]): ViewerError;
+/** Bytes of a `BinaryData` value that already passed schema validation. */
+export declare function decodeBinary(data: BinaryData): Uint8Array;
+/** Deep copy of a validated batch, so later caller mutations cannot reach the history. */
+/** The operation index a `"$<n>"` same-batch target names, if it is one. */
+export declare function parseReference(target: string): number | undefined;
+export declare function freezeOperations<T>(operations: readonly T[]): readonly T[];

package/dist/edit/operations.js

@@ -0,0 +1,137 @@
+import { ViewerError } from "../errors.js";
+import { pointerSegment, validateSchema } from "./schema.js";
+/**
+ * Checks the batch-level preconditions of `apply()`: an array that is not empty
+ * and not larger than the limit.
+ */
+export function assertBatchSize(operations, limit) {
+    if (!Array.isArray(operations) || operations.length === 0)
+        throw invalidOperationError([
+            {
+                operationIndex: -1,
+                path: "",
+                code: "empty-batch",
+                message: "A batch needs at least one operation",
+            },
+        ]);
+    if (operations.length > limit)
+        throw new ViewerError("resource-limit", "The batch exceeds maxEditOperations", { details: { operations: operations.length, limit } });
+}
+/**
+ * Shape and schema checks for every operation of a batch: JSON-only values, a
+ * known `op`, and the operation's JSON Schema. All issues are collected.
+ */
+export function checkOperations(operations, schemas) {
+    const issues = [];
+    operations.forEach((operation, operationIndex) => {
+        const shape = jsonIssues(operation, "", operationIndex, new Set());
+        if (shape.length > 0) {
+            issues.push(...shape);
+            return;
+        }
+        if (!isPlainObject(operation) || typeof operation.op !== "string") {
+            issues.push({
+                operationIndex,
+                path: "/op",
+                code: "required",
+                message: "An operation is an object with a string op",
+            });
+            return;
+        }
+        const schema = schemas.operations[operation.op];
+        if (!schema) {
+            issues.push({
+                operationIndex,
+                path: "/op",
+                code: "unknown-operation",
+                message: `Unknown ${schemas.format} operation ${operation.op}`,
+            });
+            return;
+        }
+        issues.push(...validateSchema(operation, schema, operationIndex));
+    });
+    return issues;
+}
+export function invalidOperationError(issues) {
+    const first = issues[0];
+    return new ViewerError("invalid-operation", first
+        ? `Invalid operation ${first.operationIndex} at ${first.path || "/"}: ${first.message}`
+        : "Invalid operation", {
+        details: {
+            issues: Object.freeze(issues.map((issue) => Object.freeze({ ...issue }))),
+        },
+    });
+}
+/** Bytes of a `BinaryData` value that already passed schema validation. */
+export function decodeBinary(data) {
+    if (data instanceof Uint8Array)
+        return data;
+    return Uint8Array.from(atob(data), (character) => character.charCodeAt(0));
+}
+/** Deep copy of a validated batch, so later caller mutations cannot reach the history. */
+/** The operation index a `"$<n>"` same-batch target names, if it is one. */
+export function parseReference(target) {
+    const match = /^\$(\d{1,4})$/.exec(target);
+    return match ? Number(match[1]) : undefined;
+}
+export function freezeOperations(operations) {
+    return Object.freeze(operations.map((operation) => deepCopy(operation)));
+}
+function deepCopy(value) {
+    if (value instanceof Uint8Array)
+        return value.slice();
+    if (Array.isArray(value))
+        return Object.freeze(value.map(deepCopy));
+    if (isPlainObject(value))
+        return Object.freeze(Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .map(([key, child]) => [key, deepCopy(child)])));
+    return value;
+}
+function jsonIssues(value, path, operationIndex, ancestors) {
+    const issue = (message) => [
+        { operationIndex, path, code: "not-json", message },
+    ];
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return [];
+    if (typeof value === "number")
+        return Number.isFinite(value) ? [] : issue("Numbers must be finite");
+    if (value instanceof Uint8Array)
+        return [];
+    if (typeof value !== "object")
+        return issue(`A ${typeof value} is not a JSON value`);
+    if (ancestors.has(value))
+        return issue("Cyclic value");
+    const issues = [];
+    ancestors.add(value);
+    if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+            const childPath = `${path}${pointerSegment(index)}`;
+            if (!(index in value) || value[index] === undefined)
+                issues.push({
+                    operationIndex,
+                    path: childPath,
+                    code: "not-json",
+                    message: "Arrays cannot hold holes or undefined",
+                });
+            else
+                issues.push(...jsonIssues(value[index], childPath, operationIndex, ancestors));
+        }
+    }
+    else if (isPlainObject(value)) {
+        for (const [key, child] of Object.entries(value))
+            if (child !== undefined)
+                issues.push(...jsonIssues(child, `${path}${pointerSegment(key)}`, operationIndex, ancestors));
+    }
+    else {
+        issues.push(...issue("Class instances are not JSON values"));
+    }
+    ancestors.delete(value);
+    return issues;
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/dist/edit/pdf/engine/compact.d.ts

@@ -0,0 +1,6 @@
+import { ViewerError } from "../../../errors.js";
+export declare class PdfCompactionError extends ViewerError {
+    constructor(message: string);
+}
+/** The reachable objects of `bytes` with a fresh cross-reference table. */
+export declare function compactPdf(bytes: Uint8Array): Uint8Array;