datoon 1.7.3__tar.gz → 1.8.0__tar.gz

{datoon-1.7.3 → datoon-1.8.0}/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [1.8.0](https://github.com/andrii-su/datoon/compare/v1.7.4...v1.8.0) (2026-07-07)
+
+
+### Features
+
+* **cli:** add --sheet and --table for excel/numbers input ([#39](https://github.com/andrii-su/datoon/issues/39)) ([4799712](https://github.com/andrii-su/datoon/commit/4799712b003ca4fae25cd555aec83b2b1cece136))
+
+## [1.7.4](https://github.com/andrii-su/datoon/compare/v1.7.3...v1.7.4) (2026-07-07)
+
+
+### Bug Fixes
+
+* **xml:** refuse DTD/DOCTYPE to block entity-expansion DoS ([#38](https://github.com/andrii-su/datoon/issues/38)) ([ef6a35e](https://github.com/andrii-su/datoon/commit/ef6a35e624176aab0a648794715c2d99411421d7))
+
 ## [1.7.3](https://github.com/andrii-su/datoon/compare/v1.7.2...v1.7.3) (2026-07-07)
 
 

{datoon-1.7.3 → datoon-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datoon
-Version: 1.7.3
+Version: 1.8.0
 Summary: Smart structured-data-to-TOON gateway with pragmatic auto-gating for LLM prompts.
 Author-email: Andrii Suruhov <andrii.suruhov@gmail.com>
 License: MIT License

{datoon-1.7.3 → datoon-1.8.0}/src/datoon/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.7.3'
-__version_tuple__ = version_tuple = (1, 7, 3)
+__version__ = version = '1.8.0'
+__version_tuple__ = version_tuple = (1, 8, 0)
 
-__commit_id__ = commit_id = 'gc62af15be'
+__commit_id__ = commit_id = 'gacb329fb8'

{datoon-1.7.3 → datoon-1.8.0}/src/datoon/cli.py

@@ -75,6 +75,18 @@ def build_parser() -> argparse.ArgumentParser:
         default=30,
         help="Seconds to wait for the TOON CLI before aborting (default: 30).",
     )
+    parser.add_argument(
+        "--sheet",
+        type=int,
+        default=0,
+        help="Worksheet index for excel/numbers input (default: 0).",
+    )
+    parser.add_argument(
+        "--table",
+        type=int,
+        default=0,
+        help="Table index within a Numbers sheet (default: 0).",
+    )
     parser.add_argument(
         "--report",
         help="Optional path to write conversion report as JSON.",
@@ -172,7 +184,9 @@ def main(argv: Sequence[str] | None = None) -> int:
                     f"datoon error: --format {fmt} requires a file path, not stdin.\n"
                 )
                 return 1
-            rows = read_tabular(fmt, path=Path(args.input))
+            rows = read_tabular(
+                fmt, path=Path(args.input), sheet=args.sheet, table=args.table
+            )
             json_text = json.dumps(rows, ensure_ascii=False, separators=(",", ":"))
             outcome = convert_json_for_llm(json_text, config)
         else:

{datoon-1.7.3 → datoon-1.8.0}/src/datoon/readers/__init__.py

@@ -37,16 +37,20 @@ def read_tabular(
     *,
     text: str | None = None,
     path: Path | None = None,
+    sheet: int = 0,
+    table: int = 0,
 ) -> list[dict[str, Any]]:
     """Read structured data and return rows as a list of dicts.
 
     Text formats (csv, jsonl, yaml, xml) require ``text``.
     Binary formats (excel, parquet, orc, avro, numbers) require ``path``.
+    ``sheet`` selects the worksheet for excel/numbers; ``table`` selects the
+    table within a Numbers sheet. Both are ignored by columnar formats.
     """
     if fmt in BINARY_FORMATS:
         if path is None:
             raise ValueError(f"Format '{fmt}' requires a file path, not text input.")
-        return _read_binary(fmt, path)
+        return _read_binary(fmt, path, sheet=sheet, table=table)
     if fmt in TEXT_FORMATS:
         if text is None:
             raise ValueError(f"Format '{fmt}' requires text input.")
@@ -74,11 +78,13 @@ def _read_text(fmt: str, text: str) -> list[dict[str, Any]]:
     raise ValueError(f"Unknown text format: {fmt}")
 
 
-def _read_binary(fmt: str, path: Path) -> list[dict[str, Any]]:
+def _read_binary(
+    fmt: str, path: Path, *, sheet: int = 0, table: int = 0
+) -> list[dict[str, Any]]:
     if fmt == "excel":
         from datoon.readers.excel import read_excel
 
-        return read_excel(path)
+        return read_excel(path, sheet=sheet)
     if fmt == "parquet":
         from datoon.readers.columnar import read_parquet
 
@@ -94,5 +100,5 @@ def _read_binary(fmt: str, path: Path) -> list[dict[str, Any]]:
     if fmt == "numbers":
         from datoon.readers.numbers import read_numbers
 
-        return read_numbers(path)
+        return read_numbers(path, sheet=sheet, table=table)
     raise ValueError(f"Unknown binary format: {fmt}")

{datoon-1.7.3 → datoon-1.8.0}/src/datoon/readers/xml.py

@@ -1,15 +1,30 @@
-"""XML reader using stdlib xml.etree.ElementTree."""
+"""XML reader using stdlib xml.etree.ElementTree.
+
+The stdlib parser rejects external entities but expands internal ones, so a DTD
+can smuggle a billion-laughs DoS. datoon may process untrusted payloads, so DTDs
+are refused outright. ``<!DOCTYPE`` is a fixed XML token (no internal
+whitespace), so a literal scan reliably catches every declaration expat would
+process.
+"""
 
 from __future__ import annotations
 
+import re
 import xml.etree.ElementTree as ET
 from typing import Any
 
 from datoon.readers._coerce import coerce_scalar as _coerce
 
+_DOCTYPE_RE = re.compile(r"<!DOCTYPE", re.IGNORECASE)
+
 
 def read_xml(text: str) -> list[dict[str, Any]]:
     """Parse XML into a list of row dicts from the dominant repeated child element."""
+    if _DOCTYPE_RE.search(text):
+        raise ValueError(
+            "XML with a DOCTYPE/DTD is not allowed (entity-expansion risk)."
+        )
+
     try:
         root = ET.fromstring(text)
     except ET.ParseError as exc:

{datoon-1.7.3 → datoon-1.8.0}/src/datoon.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datoon
-Version: 1.7.3
+Version: 1.8.0
 Summary: Smart structured-data-to-TOON gateway with pragmatic auto-gating for LLM prompts.
 Author-email: Andrii Suruhov <andrii.suruhov@gmail.com>
 License: MIT License

{datoon-1.7.3 → datoon-1.8.0}/src/datoon.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "1.7.3",
+  "tag": "1.8.0",
   "distance": 0,
-  "node": "gc62af15beaa5e92e3597409d1b5cda2a1511cbef",
+  "node": "gacb329fb8ab013fc074f180d839e72bc2381dad3",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-07-07"

{datoon-1.7.3 → datoon-1.8.0}/tests/unit/test_cli.py

@@ -280,3 +280,38 @@ def test_mcp_subcommand_missing_extra_errors(
     rc = main(["mcp"])
     assert rc == 1
     assert "mcp" in capsys.readouterr().err
+
+
+# ---------------------------------------------------------------------------
+# --sheet / --table passthrough for spreadsheet formats
+# ---------------------------------------------------------------------------
+
+
+def test_main_forwards_sheet_and_table_for_binary(
+    monkeypatch: pytest.MonkeyPatch,
+    tmp_path: Path,
+) -> None:
+    captured: dict[str, int] = {}
+
+    def fake_read_tabular(
+        fmt: str,
+        *,
+        text: str | None = None,
+        path: Path | None = None,
+        sheet: int = 0,
+        table: int = 0,
+    ) -> list[dict[str, object]]:
+        captured["sheet"] = sheet
+        captured["table"] = table
+        return [{"id": 1, "v": "a"}]
+
+    monkeypatch.setattr("datoon.cli.read_tabular", fake_read_tabular)
+    monkeypatch.setattr("datoon.converter._run_toon_cli", lambda _, **kw: "x\n")
+    xlsx = tmp_path / "data.xlsx"
+    xlsx.write_bytes(b"")
+
+    rc = main(
+        ["--format", "excel", "--sheet", "2", "--table", "1", "--force", str(xlsx)]
+    )
+    assert rc == 0
+    assert captured == {"sheet": 2, "table": 1}

{datoon-1.7.3 → datoon-1.8.0}/tests/unit/test_readers.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import sys
+from pathlib import Path
 from unittest.mock import MagicMock
 
 import pytest
@@ -250,6 +251,26 @@ def test_read_xml_rejects_non_finite() -> None:
     assert rows[1]["v"] == "nan"
 
 
+def test_read_xml_rejects_dtd_billion_laughs() -> None:
+    # Internal entity expansion (billion laughs) is a DoS vector; DTDs are refused.
+    payload = (
+        '<!DOCTYPE lolz [<!ENTITY lol "lol">'
+        '<!ENTITY lol2 "&lol;&lol;&lol;">]>'
+        "<rows><r>&lol2;</r></rows>"
+    )
+    with pytest.raises(ValueError, match="DOCTYPE"):
+        read_xml(payload)
+
+
+def test_read_xml_rejects_external_entity_dtd() -> None:
+    payload = (
+        '<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>'
+        "<rows><r>&xxe;</r></rows>"
+    )
+    with pytest.raises(ValueError, match="DOCTYPE"):
+        read_xml(payload)
+
+
 def test_read_xml_invalid_raises() -> None:
     with pytest.raises(ValueError, match="Invalid XML"):
         read_xml("<not closed>")
@@ -297,6 +318,35 @@ def test_read_tabular_text_without_text_raises() -> None:
             read_tabular(fmt, path=None)
 
 
+def test_read_tabular_forwards_sheet_to_excel(monkeypatch: pytest.MonkeyPatch) -> None:
+    captured: dict[str, int] = {}
+
+    def fake_read_excel(path: Path, *, sheet: int = 0) -> list[dict[str, int]]:
+        captured["sheet"] = sheet
+        return [{"a": 1}]
+
+    monkeypatch.setattr("datoon.readers.excel.read_excel", fake_read_excel)
+    read_tabular("excel", path=Path("x.xlsx"), sheet=2)
+    assert captured["sheet"] == 2
+
+
+def test_read_tabular_forwards_sheet_and_table_to_numbers(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    captured: dict[str, int] = {}
+
+    def fake_read_numbers(
+        path: Path, *, sheet: int = 0, table: int = 0
+    ) -> list[dict[str, int]]:
+        captured["sheet"] = sheet
+        captured["table"] = table
+        return [{"a": 1}]
+
+    monkeypatch.setattr("datoon.readers.numbers.read_numbers", fake_read_numbers)
+    read_tabular("numbers", path=Path("x.numbers"), sheet=1, table=3)
+    assert captured == {"sheet": 1, "table": 3}
+
+
 # ---------------------------------------------------------------------------
 # Format sets sanity
 # ---------------------------------------------------------------------------