python-hwpx 6.0.2__tar.gz → 6.0.3__tar.gz

{python_hwpx-6.0.2/src/python_hwpx.egg-info → python_hwpx-6.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-hwpx
-Version: 6.0.2
+Version: 6.0.3
 Summary: 한글 없이 HWPX 문서를 열고, 편집하고, 생성하고, 검증하는 Python 문서 라이브러리
 Author: python-hwpx Maintainers
 License-Expression: Apache-2.0

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-hwpx"
-version = "6.0.2"
+version = "6.0.3"
 description = "한글 없이 HWPX 문서를 열고, 편집하고, 생성하고, 검증하는 Python 문서 라이브러리"
 readme = { file = "README.md", content-type = "text/markdown" }
 license = "Apache-2.0"

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/body_patch.py

@@ -35,6 +35,7 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 
+from .opc.security import guard_zip_file, read_member
 from .mutation_report import MutationReport, project_byte_splice
 from .patch import (
     _finalize,
@@ -440,10 +441,11 @@ def recolor_runs_by_color(
     import io, zipfile
 
     with zipfile.ZipFile(io.BytesIO(source_bytes)) as z:
+        guard_zip_file(z)
         names = z.namelist()
         header_name = next((n for n in names if n.endswith("header.xml")), None)
-        header_xml = z.read(header_name).decode("utf-8") if header_name else ""
-        sections = {n: z.read(n).decode("utf-8") for n in names if re.search(r"section\d+\.xml$", n)}
+        header_xml = read_member(z, header_name).decode("utf-8") if header_name else ""
+        sections = {n: read_member(z, n).decode("utf-8") for n in names if re.search(r"section\d+\.xml$", n)}
 
     ids = set()
     for cm in re.finditer(r"<(?:[A-Za-z_][\w.-]*:)?charPr\b[^>]*?>", header_xml):
@@ -511,10 +513,11 @@ def strip_runs_by_color(
 
     targets = {h.upper() for h in hex_colors}
     with zipfile.ZipFile(io.BytesIO(source_bytes)) as z:
+        guard_zip_file(z)
         names = z.namelist()
         header_name = next((n for n in names if n.endswith("header.xml")), None)
-        header_xml = z.read(header_name).decode("utf-8") if header_name else ""
-        sections = {n: z.read(n).decode("utf-8") for n in names if re.search(r"section\d+\.xml$", n)}
+        header_xml = read_member(z, header_name).decode("utf-8") if header_name else ""
+        sections = {n: read_member(z, n).decode("utf-8") for n in names if re.search(r"section\d+\.xml$", n)}
 
     # 계열 매칭(잔존 게이트와 정렬): 대상 색의 _color_family에 드는 모든 charPr.
     from .oxml.color import color_family
@@ -589,13 +592,14 @@ def apply_body_ops(
 
     header_part: str | None = None
     with zipfile.ZipFile(io.BytesIO(source_bytes)) as z:
+        guard_zip_file(z)
         sections = {
-            n: z.read(n).decode("utf-8")
+            n: read_member(z, n).decode("utf-8")
             for n in z.namelist()
             if re.search(r"section\d+\.xml$", n)
         }
         header_part = next((n for n in z.namelist() if n.endswith("header.xml")), None)
-        header_xml = z.read(header_part).decode("utf-8") if header_part else ""
+        header_xml = read_member(z, header_part).decode("utf-8") if header_part else ""
 
     ctx: dict[str, Any] = {"header": header_xml, "header_changed": False, "charpr_cache": {}}
     skipped: list[dict[str, Any]] = []

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/ingest/hwpx_converter.py

@@ -10,6 +10,12 @@ from zipfile import BadZipFile, ZipFile
 from hwpx.document import HwpxDocument
 
 from .base import DocumentIngestResult, DocumentSourceInfo
+from ..opc.security import (
+    MAX_ZIP_MIMETYPE_BYTES as _MAX_MIMETYPE_BYTES,
+    HwpxSecurityError,
+    guard_zip_file,
+    read_member,
+)
 
 
 class HwpxMarkdownConverter:
@@ -70,16 +76,21 @@ def _looks_like_hwpx_package(file_stream: BinaryIO) -> bool:
     cur_pos = file_stream.tell()
     try:
         with ZipFile(file_stream) as archive:
+            guard_zip_file(archive)
             names = set(archive.namelist())
             if "mimetype" in names:
                 try:
-                    mimetype = archive.read("mimetype").decode("utf-8", "replace").strip()
+                    mimetype = (
+                        read_member(archive, "mimetype", limit=_MAX_MIMETYPE_BYTES)
+                        .decode("utf-8", "replace")
+                        .strip()
+                    )
                     if "hwp" in mimetype.lower() or "hwpx" in mimetype.lower():
                         return True
                 except Exception:
                     pass
             return any(name.startswith("Contents/section") and name.endswith(".xml") for name in names)
-    except (BadZipFile, OSError):
+    except (BadZipFile, OSError, HwpxSecurityError):
         return False
     finally:
         file_stream.seek(cur_pos)

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/layout/lint.py

@@ -35,6 +35,7 @@ from hwpx.tools.package_validator import (
 )
 
 from .report import LayoutFinding, LayoutLintReport
+from ..opc.security import guard_zip_file, read_member
 
 if TYPE_CHECKING:
     from hwpx.quality.ledger import DirtyLayoutLedger
@@ -173,11 +174,12 @@ def _section_roots(data: bytes) -> list[tuple[str, ET.Element]]:
     roots: list[tuple[str, ET.Element]] = []
     try:
         with zipfile.ZipFile(io.BytesIO(data)) as archive:
+            guard_zip_file(archive)
             for info in archive.infolist():
                 if info.is_dir() or not is_section_part_name(info.filename):
                     continue
                 try:
-                    roots.append((info.filename, ET.fromstring(archive.read(info.filename))))
+                    roots.append((info.filename, ET.fromstring(read_member(archive, info))))
                 except ET.ParseError:
                     # Malformed XML is the pipeline's well-formedness floor, not ours.
                     continue

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/mutation_report.py

@@ -19,6 +19,7 @@ import zipfile
 from pathlib import Path
 from dataclasses import dataclass, field
 from io import BytesIO
+from .opc.security import guard_zip_file, read_member
 from typing import Any, Literal, Mapping, Sequence
 from zipfile import ZipInfo
 
@@ -58,8 +59,9 @@ def read_archive_members(data: bytes) -> dict[str, bytes]:
     """Return the uncompressed content of every non-directory member of *data*."""
 
     with zipfile.ZipFile(BytesIO(data)) as archive:
+        guard_zip_file(archive)
         return {
-            info.filename: archive.read(info.filename)
+            info.filename: read_member(archive, info)
             for info in archive.infolist()
             if not info.is_dir()
         }

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/opc/package.py

@@ -24,7 +24,7 @@ from .relationships import (
     parse_container_rootfiles,
     parse_manifest_relationships,
 )
-from .security import guard_zip_file
+from .security import guard_zip_file, read_zip_members
 from .xml_utils import (
     extract_xml_declaration,
     iter_declared_namespaces,
@@ -419,7 +419,7 @@ class HwpxPackage:
             with ZipFile(stream, "r") as zf:
                 guard_zip_file(zf)
                 infos = [info for info in zf.infolist() if not info.is_dir()]
-                files = {info.filename: zf.read(info.filename) for info in infos}
+                files = read_zip_members(zf)
                 zip_infos = {info.filename: info for info in infos}
                 zip_order = [info.filename for info in infos]
         except BadZipFile as exc:

python_hwpx-6.0.3/src/hwpx/opc/security.py

@@ -0,0 +1,240 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Input hardening helpers for HWPX OPC/XML readers."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import PurePosixPath, PureWindowsPath
+from typing import Iterable
+from xml.etree import ElementTree as ET
+from zipfile import ZIP_DEFLATED as _ZIP_DEFLATED
+from zipfile import ZIP_STORED as _ZIP_STORED
+from zipfile import ZipFile, ZipInfo
+
+MAX_XML_BYTES = 64 * 1024 * 1024
+MAX_XML_DEPTH = 256
+MAX_ZIP_ENTRIES = 4096
+MAX_ZIP_MEMBER_BYTES = 128 * 1024 * 1024
+MAX_ZIP_TOTAL_UNCOMPRESSED_BYTES = 512 * 1024 * 1024
+MAX_ZIP_COMPRESSION_RATIO = 1000.0
+MAX_ZIP_READ_CHUNK = 64 * 1024
+# `mimetype` is a short fixed string in every real package; reading it during
+# format sniffing must not be able to cost the full per-member allowance.
+MAX_ZIP_MIMETYPE_BYTES = 4 * 1024
+# Container/manifest/preview parts are small by construction; reading them
+# during discovery should not cost the generic per-member allowance either.
+MAX_ZIP_SMALL_PART_BYTES = 4 * 1024 * 1024
+
+# The only methods HWPX uses, and the only ones CPython decompresses under a
+# bound: ``ZipExtFile._read1`` passes ``max_length`` to zlib for ZIP_DEFLATED but
+# calls ``decompress(data)`` with no limit for every other method, so a bzip2 or
+# lzma member inflates in full before the declared size truncates the result.
+# Chunked reading cannot bound those, so they are refused outright.
+_ALLOWED_METHODS = (_ZIP_STORED, _ZIP_DEFLATED)
+
+
+class HwpxSecurityError(ValueError):
+    """Raised when an HWPX input exceeds safe parsing limits."""
+
+
+@dataclass(frozen=True)
+class ZipGuardLimits:
+    max_entries: int = MAX_ZIP_ENTRIES
+    max_member_bytes: int = MAX_ZIP_MEMBER_BYTES
+    max_total_uncompressed_bytes: int = MAX_ZIP_TOTAL_UNCOMPRESSED_BYTES
+    max_compression_ratio: float = MAX_ZIP_COMPRESSION_RATIO
+
+
+def _iter_file_infos(zf: ZipFile) -> list[ZipInfo]:
+    return [info for info in zf.infolist() if not info.is_dir()]
+
+
+def _guard_zip_name(name: str) -> None:
+    normalized = name.replace("\\", "/")
+    if PurePosixPath(normalized).is_absolute() or ".." in PurePosixPath(normalized).parts:
+        raise HwpxSecurityError(f"unsafe ZIP member path: {name!r}")
+    # ``PurePosixPath`` reads ``C:/x`` as a relative path, but joining it onto an
+    # output directory on Windows discards that directory entirely.
+    windows = PureWindowsPath(normalized)
+    if windows.drive or windows.is_absolute():
+        raise HwpxSecurityError(f"unsafe ZIP member path: {name!r}")
+
+
+def guard_zip_file(
+    zf: ZipFile,
+    *,
+    limits: ZipGuardLimits | None = None,
+) -> None:
+    """Validate ZIP metadata before reading member payloads."""
+
+    active_limits = limits or ZipGuardLimits()
+    infos = _iter_file_infos(zf)
+    if len(infos) > active_limits.max_entries:
+        raise HwpxSecurityError(
+            "ZIP archive has too many entries: "
+            f"{len(infos)} > {active_limits.max_entries}"
+        )
+
+    # ``is_dir()`` only tests for a trailing slash in the name, so a member can
+    # opt out of the size accounting below just by calling itself a directory
+    # while still holding a payload that ``ZipFile.open()`` will read. Check the
+    # name of every entry, and require the ones excluded here to be empty.
+    for info in zf.infolist():
+        _guard_zip_name(info.filename)
+        if info.is_dir() and (info.file_size or info.compress_size):
+            raise HwpxSecurityError(
+                "ZIP directory entry carries data: "
+                f"{info.filename}={info.file_size}/{info.compress_size}"
+            )
+
+    total = 0
+    for info in infos:
+        if info.file_size > active_limits.max_member_bytes:
+            raise HwpxSecurityError(
+                "ZIP member exceeds uncompressed size limit: "
+                f"{info.filename}={info.file_size} > {active_limits.max_member_bytes}"
+            )
+        total += info.file_size
+        if total > active_limits.max_total_uncompressed_bytes:
+            raise HwpxSecurityError(
+                "ZIP archive exceeds total uncompressed size limit: "
+                f"{total} > {active_limits.max_total_uncompressed_bytes}"
+            )
+        if info.compress_type not in _ALLOWED_METHODS:
+            raise HwpxSecurityError(
+                "ZIP member uses an unsupported compression method: "
+                f"{info.filename}={info.compress_type}"
+            )
+        # Must run before the ``file_size <= 0`` skip below: a member declaring 0
+        # would otherwise bypass every remaining check.
+        if info.compress_size > info.file_size + info.file_size // 1000 + 64:
+            raise HwpxSecurityError(
+                "ZIP member declares less data than it stores: "
+                f"{info.filename}={info.file_size} < {info.compress_size}"
+            )
+        if info.file_size <= 0:
+            continue
+        if info.compress_size <= 0:
+            raise HwpxSecurityError(f"ZIP member has invalid compressed size: {info.filename}")
+        ratio = info.file_size / info.compress_size
+        if ratio > active_limits.max_compression_ratio:
+            raise HwpxSecurityError(
+                "ZIP member compression ratio exceeds limit: "
+                f"{info.filename}={ratio:.1f} > {active_limits.max_compression_ratio:.1f}"
+            )
+
+
+def read_member(
+    zf: ZipFile,
+    member: str | ZipInfo,
+    *,
+    limit: int = MAX_ZIP_MEMBER_BYTES,
+) -> bytes:
+    """Read one ZIP member without trusting the size it declares.
+
+    ``ZipFile.read()`` calls ``ZipExtFile.read()`` with no argument, which hands
+    zlib a 2 GiB ``max_length`` and inflates the whole stream before truncating
+    the result to the declared size. Reading in fixed chunks and counting what
+    actually arrives keeps the allocation bounded no matter what the central
+    directory claims.
+    """
+
+    name = member.filename if isinstance(member, ZipInfo) else member
+    chunks: list[bytes] = []
+    total = 0
+    with zf.open(member) as handle:
+        while True:
+            block = handle.read(MAX_ZIP_READ_CHUNK)
+            if not block:
+                break
+            total += len(block)
+            if total > limit:
+                raise HwpxSecurityError(
+                    "ZIP member exceeds uncompressed size limit: "
+                    f"{name} > {limit}"
+                )
+            chunks.append(block)
+    return b"".join(chunks)
+
+
+def read_zip_members(
+    zf: ZipFile,
+    *,
+    limits: ZipGuardLimits | None = None,
+    names: Iterable[str] | None = None,
+) -> dict[str, bytes]:
+    """Read members with per-member and cumulative bounds on what is produced.
+
+    ``names`` restricts the read to those members; the cumulative budget still
+    applies across everything read.
+    """
+
+    active_limits = limits or ZipGuardLimits()
+    wanted = None if names is None else set(names)
+    payloads: dict[str, bytes] = {}
+    total = 0
+    for info in _iter_file_infos(zf):
+        if wanted is not None and info.filename not in wanted:
+            continue
+        data = read_member(zf, info, limit=active_limits.max_member_bytes)
+        total += len(data)
+        if total > active_limits.max_total_uncompressed_bytes:
+            raise HwpxSecurityError(
+                "ZIP archive exceeds total uncompressed size limit: "
+                f"{total} > {active_limits.max_total_uncompressed_bytes}"
+            )
+        payloads[info.filename] = data
+    return payloads
+
+
+def guard_xml_bytes(
+    payload: bytes,
+    *,
+    part_name: str = "XML payload",
+    max_xml_bytes: int = MAX_XML_BYTES,
+) -> None:
+    """Reject XML payloads that should never be parsed from an HWPX package."""
+
+    if len(payload) > max_xml_bytes:
+        raise HwpxSecurityError(
+            f"{part_name} exceeds XML size limit: {len(payload)} > {max_xml_bytes}"
+        )
+    lowered = payload[:4096].lower()
+    if b"<!doctype" in lowered or b"<!entity" in lowered:
+        raise HwpxSecurityError(f"{part_name} contains a disallowed DTD/entity declaration")
+
+
+def guard_xml_depth(
+    root: object,
+    *,
+    part_name: str = "XML payload",
+    max_depth: int = MAX_XML_DEPTH,
+) -> None:
+    """Reject extremely deep XML trees after parsing."""
+
+    stack: list[tuple[object, int]] = [(root, 1)]
+    while stack:
+        element, depth = stack.pop()
+        if depth > max_depth:
+            raise HwpxSecurityError(
+                f"{part_name} exceeds XML depth limit: {depth} > {max_depth}"
+            )
+        children: Iterable[object] = list(element)  # type: ignore[arg-type]
+        for child in children:
+            stack.append((child, depth + 1))
+
+
+def parse_xml_stdlib(
+    payload: bytes,
+    *,
+    part_name: str = "XML payload",
+) -> ET.Element:
+    """Parse XML with stdlib ElementTree after applying HWPX safety guards."""
+
+    guard_xml_bytes(payload, part_name=part_name)
+    try:
+        root = ET.fromstring(payload)
+    except ET.ParseError as exc:
+        raise ValueError(f"malformed XML: {exc}") from exc
+    guard_xml_depth(root, part_name=part_name)
+    return root

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/patch.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from typing import Any, Mapping, Sequence
 from zipfile import ZIP_DEFLATED, ZIP_STORED, ZipFile
 
+from .opc.security import guard_zip_file, read_member, read_zip_members
 from .mutation_report import MutationReport, project_byte_splice, visual_value_from_status
 from .quality import QualityPolicy, SavePipeline
 from .quality.report import VisualCompleteReport
@@ -199,6 +200,10 @@ def paragraph_patch(
     source_bytes = _read_source_bytes(source)
     normalized_patches = tuple(_normalize_patch(item) for item in patches)
     if not normalized_patches:
+        # The early return still hands the source to the save pipeline, so it has
+        # to clear the same limits as the patching path below.
+        with ZipFile(io.BytesIO(source_bytes), "r") as archive:
+            guard_zip_file(archive)
         open_safety, visual_complete = _finalize(source_bytes, output_path, source=source)
         return BytePreservingPatchResult(
             data=source_bytes,
@@ -212,7 +217,8 @@ def paragraph_patch(
         )
 
     with ZipFile(io.BytesIO(source_bytes), "r") as archive:
-        parts = {info.filename: archive.read(info.filename) for info in archive.infolist() if not info.is_dir()}
+        guard_zip_file(archive)
+        parts = read_zip_members(archive)
 
     changed_parts: dict[str, bytes] = {}
     applied: list[PatchApplied] = []
@@ -481,9 +487,12 @@ def _apply_edits(payload: bytes, edits: Sequence[tuple[int, int, bytes]]) -> byt
 def _rewrite_zip_entries(source: bytes, replacements: Mapping[str, bytes]) -> bytes:
     buffer = io.BytesIO()
     with ZipFile(io.BytesIO(source), "r") as src:
+        # Also reached directly by the public rewrite_package_parts(), so the
+        # entry-count, total-size and ratio limits have to be applied here too.
+        guard_zip_file(src)
         with ZipFile(buffer, "w") as dst:
             for info in src.infolist():
-                payload = replacements.get(info.filename, src.read(info.filename))
+                payload = replacements.get(info.filename, read_member(src, info))
                 dst.writestr(info, payload)
     return buffer.getvalue()
 

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/quality/save_pipeline.py

@@ -48,6 +48,7 @@ from .report import (
     VisualCompleteReport,
     VisualCompleteStatus,
 )
+from ..opc.security import guard_zip_file, parse_xml_stdlib, read_member
 
 PublishMode = Literal["on_pass", "always", "never"]
 
@@ -277,12 +278,13 @@ class SavePipeline:
 
         try:
             with zipfile.ZipFile(io.BytesIO(data)) as archive:
+                guard_zip_file(archive)
                 names = [info.filename for info in archive.infolist() if not info.is_dir()]
                 for name in names:
                     base = os.path.basename(name)
                     if name.endswith(_XML_SUFFIXES) or base in _XML_NAMES:
                         try:
-                            ET.fromstring(archive.read(name))
+                            parse_xml_stdlib(read_member(archive, name), part_name=name)
                         except ET.ParseError as exc:
                             errors.append(
                                 QualityError(

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/table_patch.py

@@ -30,6 +30,7 @@ from pathlib import Path
 from typing import Any, Iterable, Mapping, Sequence
 
 from .errors import HwpxError
+from .opc.security import guard_zip_file, read_member, read_zip_members
 from .mutation_report import MutationReport, project_byte_splice
 from .patch import (
     _apply_edits,
@@ -585,8 +586,9 @@ def resolve_cell_target(
     import zipfile
 
     with zipfile.ZipFile(io.BytesIO(source_bytes), "r") as archive:
+        guard_zip_file(archive)
         parts = {
-            info.filename: archive.read(info.filename)
+            info.filename: read_member(archive, info)
             for info in archive.infolist()
             if not info.is_dir()
         }
@@ -661,7 +663,8 @@ def fill_cells(
     import io
     import zipfile
     with zipfile.ZipFile(io.BytesIO(source_bytes), "r") as zf:
-        parts = {i.filename: zf.read(i.filename) for i in zf.infolist() if not i.is_dir()}
+        guard_zip_file(zf)
+        parts = read_zip_members(zf)
 
     # FR-002: resolve table/cell anchors to concrete (table_index,row,col) first.
     resolved_cells, anchor_skips = _resolve_anchor_cells(parts, cells)
@@ -1376,7 +1379,8 @@ def _apply_cell_line_spacing(
     import io
     import zipfile
     with zipfile.ZipFile(io.BytesIO(source_bytes), "r") as zf:
-        parts = {i.filename: zf.read(i.filename) for i in zf.infolist() if not i.is_dir()}
+        guard_zip_file(zf)
+        parts = read_zip_members(zf)
     header_name = _header_part_name(parts)
     header = parts.get(header_name)
     transcript: list[dict[str, Any]] = []
@@ -1482,7 +1486,8 @@ def _sections(data: bytes) -> dict[str, bytes]:
     import io
     import zipfile
     with zipfile.ZipFile(io.BytesIO(data)) as z:
-        return {n: z.read(n) for n in z.namelist() if re.search(r"section\d+\.xml$", n)}
+        guard_zip_file(z)
+        return {n: read_member(z, n) for n in z.namelist() if re.search(r"section\d+\.xml$", n)}
 
 
 def _table_dims(table: str | bytes) -> str:
@@ -1795,11 +1800,12 @@ def strip_trailing_table_captions(
     import zipfile
 
     with zipfile.ZipFile(io.BytesIO(source_bytes), "r") as archive:
+        guard_zip_file(archive)
         section_names = [
             info.filename for info in archive.infolist()
             if not info.is_dir() and re.search(r"section\d+\.xml$", info.filename)
         ]
-        sections = {name: archive.read(name).decode("utf-8") for name in section_names}
+        sections = {name: read_member(archive, name).decode("utf-8") for name in section_names}
 
     applied: list[CellApplied] = []
     changed_parts: dict[str, bytes] = {}

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/tools/archive_cli.py

@@ -17,6 +17,7 @@ from lxml import etree  # type: ignore[reportAttributeAccessIssue]
 from ..opc.relationships import is_header_part_name, is_section_part_name
 from ..oxml.namespaces import HWPML_COMPAT_ROOT_NAMESPACES
 from .package_validator import validate_editor_open_safety, validate_package
+from ..opc.security import HwpxSecurityError, guard_xml_bytes, guard_xml_depth, guard_zip_file, read_member
 
 _XML_SUFFIXES = (".xml", ".hpf")
 _PACK_METADATA_NAME = ".hwpx-pack-metadata.json"
@@ -81,18 +82,43 @@ def _prepare_output_path(output_path: Path, *, overwrite: bool) -> None:
         raise FileExistsError(f"output file already exists: {output_path}")
 
 
+_MAX_INDENT_GROWTH = 8
+_MIN_INDENT_BUDGET = 64 * 1024
+
+
 def _format_xml_bytes(payload: bytes) -> bytes:
+    """Re-indent an XML part, falling back to the original bytes.
+
+    Indentation is an amplifier: at the depth libxml2 accepts, every leaf gains
+    two spaces per level, so a 4-byte element can grow past 500 bytes. The
+    payload is guarded first, and a result that grew beyond the per-member
+    allowance is discarded in favour of the input.
+    """
+
+    try:
+        guard_xml_bytes(payload, part_name="XML part")
+    except HwpxSecurityError:
+        return payload
     try:
         element = etree.fromstring(payload)
     except etree.XMLSyntaxError:
         return payload
+    try:
+        guard_xml_depth(element, part_name="XML part")
+    except HwpxSecurityError:
+        return payload
     etree.indent(element, space="  ")
-    return etree.tostring(
+    formatted = etree.tostring(
         element,
         pretty_print=True,
         xml_declaration=True,
         encoding="UTF-8",
     )
+    # Real parts grow at most ~1.7x when indented (measured across the repo's
+    # packages); anything past this is the indentation acting as an amplifier.
+    if len(formatted) > max(_MAX_INDENT_GROWTH * len(payload), _MIN_INDENT_BUDGET):
+        return payload
+    return formatted
 
 
 def _normalize_hwpml_compat_root(rel_path: str, payload: bytes) -> bytes:
@@ -225,9 +251,10 @@ def unpack_hwpx(
     _prepare_output_dir(destination, overwrite=overwrite)
 
     with ZipFile(source_path, "r") as archive:
+        guard_zip_file(archive)
         entries = _iter_file_entries(archive)
         for entry in entries:
-            data = archive.read(entry.path)
+            data = read_member(archive, entry.path)
             if pretty_xml and entry.path.endswith(_XML_SUFFIXES):
                 data = _format_xml_bytes(data)
             target = destination / entry.path

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/tools/exporter.py

@@ -15,7 +15,7 @@ from typing import TYPE_CHECKING
 from xml.etree import ElementTree as ET
 from zipfile import ZipFile
 
-from ..opc.security import guard_zip_file, parse_xml_stdlib
+from ..opc.security import guard_zip_file, parse_xml_stdlib, read_member
 #: A caller-supplied redaction step. Declared here rather than imported from
 #: mail_merge, which imports export_text — the two would form a cycle.
 TextSanitizer = Callable[[str], str]
@@ -41,7 +41,7 @@ def _section_xmls(source: HwpxDocument | bytes) -> list[ET.Element]:
         with ZipFile(io.BytesIO(source)) as zf:
             guard_zip_file(zf)
             names = sorted(n for n in zf.namelist() if _SECTION_RE.match(n))
-            return [parse_xml_stdlib(zf.read(n), part_name=n) for n in names]
+            return [parse_xml_stdlib(read_member(zf, n), part_name=n) for n in names]
     return [sec.element for sec in source._root.sections]
 
 

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/tools/idempotence.py

@@ -28,6 +28,7 @@ import zipfile
 from dataclasses import dataclass
 
 from hwpx.document import HwpxDocument
+from ..opc.security import guard_zip_file, read_member
 
 __all__ = [
     "IdempotenceReport",
@@ -78,11 +79,12 @@ def _part_contents(data: bytes) -> tuple[dict[str, bytes], list[str]]:
     contents: dict[str, bytes] = {}
     duplicates: list[str] = []
     with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        guard_zip_file(archive)
         for info in archive.infolist():
             name = info.filename
             if name in contents:
                 duplicates.append(name)
-            contents[name] = archive.read(info)
+            contents[name] = read_member(archive, info)
     return contents, duplicates
 
 

{python_hwpx-6.0.2 → python_hwpx-6.0.3}/src/hwpx/tools/ir_equality.py

@@ -20,6 +20,7 @@ import re
 import xml.etree.ElementTree as ET
 import zipfile
 from dataclasses import dataclass
+from ..opc.security import guard_zip_file, read_member
 
 __all__ = [
     "IrEqualityReport",
@@ -91,12 +92,13 @@ def project_document(data: bytes) -> list:
     """Project a whole HWPX byte blob: paragraphs across all sections in order."""
     projection: list = []
     with zipfile.ZipFile(io.BytesIO(data)) as archive:
+        guard_zip_file(archive)
         names = sorted(
             (n for n in archive.namelist() if _SECTION_RE.match(n)),
             key=lambda n: int(_SECTION_RE.match(n).group(1)),
         )
         for name in names:
-            projection.extend(project_section_xml(archive.read(name)))
+            projection.extend(project_section_xml(read_member(archive, name)))
     return projection