diff --git a/CLAUDE.md b/CLAUDE.md index ec025c29..0bedffe1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -284,7 +284,7 @@ Codeman is a Claude Code session manager with web interface and autonomous Ralph **Attachments** (live external document references; all wiring in `file-routes.ts`): a **registry** maps a stable `attachmentId` to a realpath-resolved, extension-allowlisted absolute path, so browser requests never carry arbitrary absolute paths. ⚠️ The **magic-link scanner** (`codeman://attach?...` in terminal output) is **prompt-injectable**, so its scan path is force-confined to the session workspace; a hostile prompt could otherwise exfiltrate arbitrary host files over SSE. The security gate is an extension **allowlist**, not a blocklist. `document-conversion-limiter.ts` caps converter spawns globally: without it, N large docs detected at once fork N multi-minute processes, which is a resource-exhaustion vector. → [architecture-invariants#attachments](docs/architecture-invariants.md#attachments) -**File-path links (terminal + chat)**: a path an agent prints is clickable on BOTH surfaces and opens the file-preview overlay. ⚠️ ONE pattern (`FILE_PATH_LINK_PATTERN` / `absoluteFilePathPattern()` in constants.js) feeds the xterm link provider AND `_linkifyFilePaths()`, a fresh instance per call (`lastIndex`). The chat linkifier walks TEXT NODES with DOM APIs, never rebuilds sanitized markup as a string. ⚠️ An out-of-workspace path goes through the ATTACHMENT routes (`POST /api/sessions/:id/attachments` with `notify: false`), never by widening `file-content`/`file-raw` or `file-stream-manager`'s `tail -f` allowlist. ⚠️ `TEXT_ATTACHMENT_EXTENSIONS` IS `EDITABLE_EXTENSIONS` (never a second list), and widening READ must never widen RUN: `html`/`htm`/`svg` stay download-only, other text is inert `text/plain`+`nosniff`. Media extensions are single-sourced in `attachment-registry.ts`. ⚠️ **XLSX previews parse in the BROWSER**, never on the server: `spreadsheet-preview.js` fetches the raw route with `?preview=true` (413 above `MAX_XLSX_BROWSER_PREVIEW_BYTES`, 10 MB) and hands the bytes to `spreadsheet-preview-worker.js`, the only place the pinned `exceljs`/`fflate` vendor bundles load (never on page load). `admitXlsx()` caps the ZIP before ExcelJS runs, and ExcelJS parses only a STORE-only archive rebuilt from the entries admission inflated (`buildAdmittedArchive()`), never the fetched bytes; cell text goes through `textContent`, formulas are never evaluated. Bumping either package or editing the worker/core changes `SPREADSHEET_ASSET_VERSION`, which `npm run check:public-assets` pins. xls/ods stay download-only. → [architecture-invariants#file-path-links-terminal--response-viewer](docs/architecture-invariants.md#file-path-links-terminal--response-viewer) +**File-path links (terminal + chat)**: a path an agent prints is clickable on BOTH surfaces and opens the file-preview overlay. ⚠️ ONE pattern (`FILE_PATH_LINK_PATTERN` / `absoluteFilePathPattern()` in constants.js) feeds the xterm link provider AND `_linkifyFilePaths()`, a fresh instance per call (`lastIndex`). The chat linkifier walks TEXT NODES with DOM APIs, never rebuilds sanitized markup as a string. ⚠️ An out-of-workspace path goes through the ATTACHMENT routes (`POST /api/sessions/:id/attachments` with `notify: false`), never by widening `file-content`/`file-raw` or `file-stream-manager`'s `tail -f` allowlist. ⚠️ `TEXT_ATTACHMENT_EXTENSIONS` IS `EDITABLE_EXTENSIONS` (never a second list), and widening READ must never widen RUN: `html`/`htm`/`svg` stay download-only, other text is inert `text/plain`+`nosniff`. Media extensions are single-sourced in `attachment-registry.ts`. ⚠️ **XLSX previews parse in the BROWSER**, never on the server: `spreadsheet-preview.js` fetches the raw route with `?preview=true` (413 above `MAX_XLSX_BROWSER_PREVIEW_BYTES`, 10 MB) and hands the bytes to `spreadsheet-preview-worker.js`, the only place the pinned `exceljs`/`fflate` vendor bundles load (never on page load). `admitXlsx()` caps the ZIP before ExcelJS runs, counting what ExcelJS will EXPAND as well as what it reads (a merge costs its area, a `` past 16384 is refused, validations are never parsed), and ExcelJS parses only a STORE-only archive rebuilt from the entries admission inflated (`buildAdmittedArchive()`), never the fetched bytes; cell text goes through `textContent`, formulas are never evaluated. Bumping either package or editing the worker/core changes `SPREADSHEET_ASSET_VERSION`, which `npm run check:public-assets` pins. xls/ods stay download-only. → [architecture-invariants#file-path-links-terminal--response-viewer](docs/architecture-invariants.md#file-path-links-terminal--response-viewer) **Filesystem path picker** (Link Existing "Browse" + the mobile keyboard's `📁 Path` key): lazy one-directory browsing via `GET /api/filesystem/browse`, with `GET /api/filesystem/preview` for the tapped file. Inserts the path **without** Enter, so the prompt is never submitted; the sibling `⌫ All` key clears only the unsent prompt and must never send the agent's `/clear`. ⚠️ This is a **second file-serving surface and inherits neither the attachment confinement nor its ownership scoping** — it allowlists Home, `CASES_DIR`, `/mnt/d` and `CODEMAN_FILE_PICKER_ROOTS`, blocks sensitive trees, and rejects symlink escapes **after** `realpath`. ⚠️ The optional `sessionId` is an ownership boundary that must be `canAccessOwned`-checked by hand (it does not go through `findSessionOrFail`), and in multi-user mode a non-admin gets only their own `userSpacePath` as a root: per-user spaces live INSIDE `homedir()`, so a `Home` root exposes every other user's workspace. Previews go through the same global conversion limiter, and Markdown/TXT/JSON are served as inert `text/plain`. → [architecture-invariants#filesystem-path-picker](docs/architecture-invariants.md#filesystem-path-picker) diff --git a/docs/architecture-invariants.md b/docs/architecture-invariants.md index bad2aa88..de35273d 100644 --- a/docs/architecture-invariants.md +++ b/docs/architecture-invariants.md @@ -358,7 +358,7 @@ A file path an agent prints is a link on both surfaces it can appear on, and cli ⚠️ **The preview overlay must outrank the panel that launched it.** `.file-preview-overlay` sits at `z-index: 5100`, above the response viewer (5000) and its backdrop (4999); at its historical 2000 a path clicked in the chat opened the overlay *behind* the chat, which reads as a dead link. It stays below the toast/picker band (10000+) so a "Saved" toast still lands on top. -**XLSX previews parse in the browser worker, and ExcelJS only ever sees what admission checked.** An `.xlsx` joins the raw routes like any other file (`?preview=true` caps it at 10 MB with a 413); the server never parses it. `spreadsheet-preview.js` hands the bytes to `spreadsheet-preview-worker.js`, the ONLY place the pinned `exceljs`/`fflate` vendor bundles load: fflate and `spreadsheet-xlsx-core.js` at worker start, ExcelJS only after `admitXlsx()` passes, and the page itself never loads either. `admitXlsx()` streams every entry through fflate and enforces the entry count, per-entry and total inflated bytes (64 MB), compression ratio, worksheet, cell, merge and style caps on the actual inflated output, refusing (never truncating) a workbook that trips one. ⚠️ Admission walks LOCAL headers while ExcelJS (JSZip) reads the CENTRAL directory, so overlapping entries (a stored entry hiding a whole `sheet1.xml`, a one-cell decoy later in the stream) once let a file be admitted as 1 cell and parsed as 300k. The worker therefore never hands ExcelJS the fetched bytes: it gets `buildAdmittedArchive()`, a STORE-only `fflate.zipSync(entries, { level: 0 })` of exactly the entries admission inflated, and a name streamed twice is refused. That costs one transient copy of the inflated entries (bounded by the same 64 MB cap) and is pinned by the overlapping-entry fixture in `test/spreadsheet-preview-worker.test.ts`. The worker is a stable URL cache-busted by `SPREADSHEET_ASSET_VERSION` in `spreadsheet-preview.js`, the content hash of the worker, the core and both vendor bundles; `npm run check:public-assets` fails when it drifts, so editing any of those (or bumping either package) means updating the token, or a deploy pairs a new worker with a year-cached old core. +**XLSX previews parse in the browser worker, and ExcelJS only ever sees what admission checked.** An `.xlsx` joins the raw routes like any other file (`?preview=true` caps it at 10 MB with a 413); the server never parses it. `spreadsheet-preview.js` hands the bytes to `spreadsheet-preview-worker.js`, the ONLY place the pinned `exceljs`/`fflate` vendor bundles load: fflate and `spreadsheet-xlsx-core.js` at worker start, ExcelJS only after `admitXlsx()` passes, and the page itself never loads either. `admitXlsx()` streams every entry through fflate and enforces the entry count, per-entry and total inflated bytes (64 MB), compression ratio, worksheet, cell, merge and style caps on the actual inflated output, refusing (never truncating) a workbook that trips one. ⚠️ Admission walks LOCAL headers while ExcelJS (JSZip) reads the CENTRAL directory, so overlapping entries (a stored entry hiding a whole `sheet1.xml`, a one-cell decoy later in the stream) once let a file be admitted as 1 cell and parsed as 300k. The worker therefore never hands ExcelJS the fetched bytes: it gets `buildAdmittedArchive()`, a STORE-only `fflate.zipSync(entries, { level: 0 })` of exactly the entries admission inflated, and a name streamed twice is refused. That costs one transient copy of the inflated entries (bounded by the same 64 MB cap) and is pinned by the overlapping-entry fixture in `test/spreadsheet-preview-worker.test.ts`. ⚠️ Admission also has to bound what ExcelJS EXPANDS, not just what it reads: ExcelJS 4.4.0 builds one object per covered cell of a ``, per address of a `` and per index up to ``, so a 6.5 KB file admitted as one cell once cost a gigabyte. The counter therefore charges each merge its full AREA against the cell caps (an unparseable `ref` is refused), refuses a `` whose `min`/`max` is past 16384, and the worker loads with `ignoreNodes: ['dataValidations']` (the preview never shows validations). The counter reads tags whole across inflate-chunk edges (it scans only up to the last complete tag and carries the rest), and a central-directory `compressedSize` that runs past the file is refused, since the ratio cap divides by it. Fixtures for each are in `test/spreadsheet-preview-worker.test.ts` and `test/spreadsheet-xlsx-core.test.ts`. The worker is a stable URL cache-busted by `SPREADSHEET_ASSET_VERSION` in `spreadsheet-preview.js`, the content hash of the worker, the core and both vendor bundles; `npm run check:public-assets` fails when it drifts, so editing any of those (or bumping either package) means updating the token, or a deploy pairs a new worker with a year-cached old core. ### Filesystem path picker diff --git a/src/web/public/spreadsheet-preview-worker.js b/src/web/public/spreadsheet-preview-worker.js index 4b784d8c..51978a52 100644 --- a/src/web/public/spreadsheet-preview-worker.js +++ b/src/web/public/spreadsheet-preview-worker.js @@ -125,7 +125,10 @@ async function loadWorkbook(bytes) { const admitted = core.buildAdmittedArchive(admission, self.fflate); if (!self.ExcelJS) importScripts(`vendor/exceljs.min.js${spreadsheetAssetQuery}`); const nextWorkbook = new self.ExcelJS.Workbook(); - await nextWorkbook.xlsx.load(admitted); + // ExcelJS expands every address of a `` into its own + // object (a whole-column dropdown is a million), and the preview never shows + // validations, so they are not parsed at all. + await nextWorkbook.xlsx.load(admitted, { ignoreNodes: ['dataValidations'] }); const nextSheets = new Map(); const nextRows = new Map(); normalizedStyles = []; diff --git a/src/web/public/spreadsheet-preview.js b/src/web/public/spreadsheet-preview.js index 75162d4d..1f40b864 100644 --- a/src/web/public/spreadsheet-preview.js +++ b/src/web/public/spreadsheet-preview.js @@ -20,7 +20,7 @@ (function initSpreadsheetPreview(global) { 'use strict'; - const SPREADSHEET_ASSET_VERSION = '91b615278d5b'; + const SPREADSHEET_ASSET_VERSION = '078d54b1055a'; const MAX_PREVIEW_BYTES = 10 * 1024 * 1024; const DEFAULT_TIMEOUT_MS = 20000; const MAX_SCROLL_PX = 8000000; @@ -82,14 +82,37 @@ return metadata?.sheets.find((sheet) => String(sheet.id) === String(activeSheetId)); } + // Prefix sums per override list, built once per sheet's axis: renderTile + // asks for several offsets per cell, so a linear walk over every override + // (one per row on a sheet with explicit heights) made each tile O(n) per cell. + const axisDeltas = new WeakMap(); + + function overrideDeltas(overrides, defaultSize) { + let entry = axisDeltas.get(overrides); + if (!entry || entry.defaultSize !== defaultSize) { + const deltas = []; + let delta = 0; + for (const [, size] of overrides) { + delta += size - defaultSize; + deltas.push(delta); + } + entry = { defaultSize, deltas }; + axisDeltas.set(overrides, entry); + } + return entry.deltas; + } + function axisOffset(count, defaultSize, overrides, index) { const bounded = Math.max(1, Math.min(count + 1, index)); - let value = (bounded - 1) * defaultSize; - for (const [overrideIndex, size] of overrides || []) { - if (overrideIndex >= bounded) break; - value += size - defaultSize; + const list = overrides || []; + let low = 0; + let high = list.length; + while (low < high) { + const mid = (low + high) >> 1; + if (list[mid][0] < bounded) low = mid + 1; + else high = mid; } - return value; + return (bounded - 1) * defaultSize + (low ? overrideDeltas(list, defaultSize)[low - 1] : 0); } function axisIndex(count, defaultSize, overrides, offset) { diff --git a/src/web/public/spreadsheet-xlsx-core.js b/src/web/public/spreadsheet-xlsx-core.js index ffeaea8e..474922a0 100644 --- a/src/web/public/spreadsheet-xlsx-core.js +++ b/src/web/public/spreadsheet-xlsx-core.js @@ -98,6 +98,11 @@ const localExtraLength = u16(bytes, localHeaderOffset + 28); const localNameEnd = localHeaderOffset + 30 + localNameLength; if (localNameEnd + localExtraLength > directoryOffset) fail('malformed', 'Malformed XLSX local entry bounds'); + // The compression-ratio cap divides by this declared size, so it must + // describe bytes that actually exist before the central directory. + if (localNameEnd + localExtraLength + compressedSize > directoryOffset) { + fail('malformed', 'XLSX entry declares more compressed bytes than the file holds'); + } const localName = new TextDecoder().decode(bytes.subarray(localHeaderOffset + 30, localNameEnd)); if (localName !== name) fail('malformed', 'XLSX local and central directory names do not match'); entries.push({ name, compressedSize, declaredSize, localHeaderOffset }); @@ -115,6 +120,36 @@ return null; } + // Longest single XML tag the streaming counter will carry across chunks. Real + // worksheet tags are a few hundred bytes; this only stops a pathological tag + // from turning the carried tail into quadratic re-scanning. + const MAX_CARRIED_TAG = 256 * 1024; + + function attribute(tag, name) { + const match = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`).exec(tag); + return match ? (match[1] ?? match[2]) : null; + } + + // ExcelJS expands a merge into one cell object per covered cell at load time, + // so a merge costs its AREA, not one tag. + function mergeArea(tag) { + const range = parseRange(attribute(tag, 'ref')); + if (!range) fail('malformed', 'Worksheet has a merged range that does not parse'); + return (Math.abs(range.r2 - range.r1) + 1) * (Math.abs(range.c2 - range.c1) + 1); + } + + // ExcelJS builds one column object for every index up to ``, unclamped. + function checkColumnSpan(tag) { + for (const name of ['min', 'max']) { + const value = attribute(tag, name); + if (value === null) continue; + const index = Number(value); + if (!Number.isInteger(index) || index < 1 || index > MAX_COL) { + fail('malformed', `Worksheet column ${name} is outside 1-${MAX_COL}`); + } + } + } + function createXmlCounter(name, counts, limits) { let tail = ''; const decoder = new TextDecoder(); @@ -123,22 +158,34 @@ let inCellXfs = false; const worksheet = /^xl\/worksheets\/[^/]+\.xml$/i.test(name); const styles = name === 'xl/styles.xml'; + const addCells = (cells) => { + sheetCells += cells; + counts.cells += cells; + if (sheetCells > limits.maxCellsPerSheet || counts.cells > limits.maxCells) + fail('cell-limit', 'Workbook exceeds the cells limit'); + }; return { push(chunk, final) { if (!worksheet && !styles) return; const text = tail + decoder.decode(chunk, { stream: !final }); - const safeEnd = final ? text.length : Math.max(0, text.length - 128); + // Scan only up to a tag boundary: a tag cut by a chunk edge is carried + // whole into the next scan, so its attributes are read in one piece. + let safeEnd = text.length; + if (!final) { + const open = text.lastIndexOf('<'); + if (open > text.lastIndexOf('>')) safeEnd = open; + } const scan = text.slice(0, safeEnd); if (worksheet) { - const cells = (scan.match(/)/g) || []).length; - const merges = (scan.match(/)/g) || []).length; - sheetCells += cells; - sheetMerges += merges; - counts.cells += cells; - counts.merges += merges; - if (sheetCells > limits.maxCellsPerSheet || counts.cells > limits.maxCells) - fail('cell-limit', 'Workbook exceeds the cells limit'); - if (sheetMerges > limits.maxMergesPerSheet) fail('merge-limit', 'Worksheet exceeds the merged ranges limit'); + addCells((scan.match(/)/g) || []).length); + for (const [tag] of scan.matchAll(/]*)?>/g)) { + sheetMerges += 1; + counts.merges += 1; + if (sheetMerges > limits.maxMergesPerSheet) + fail('merge-limit', 'Worksheet exceeds the merged ranges limit'); + addCells(mergeArea(tag)); + } + for (const [tag] of scan.matchAll(/]*)?>/g)) checkColumnSpan(tag); } if (styles) { const tokens = scan.match(/)|<\/cellXfs\s*>|)/g) || []; @@ -150,6 +197,7 @@ if (counts.styles > limits.maxStyles) fail('style-limit', 'Workbook exceeds the cell styles limit'); } tail = text.slice(safeEnd); + if (tail.length > MAX_CARRIED_TAG) fail('malformed', 'Workbook XML has an oversized tag'); }, }; } @@ -277,17 +325,34 @@ .filter(([index, size]) => index >= 1 && index <= count && Number.isFinite(size)) .map(([index, size]) => [index, Math.max(0, size)]) .sort((a, b) => a[0] - b[0]); - return { count: Math.max(0, count), defaultSize: Math.max(0, defaultSize), overrides: sorted }; + const base = Math.max(0, defaultSize); + // deltas[i] is the summed size change of overrides[0..i], so an offset is + // one binary search instead of a walk over every override. + const deltas = []; + let delta = 0; + for (const [, size] of sorted) { + delta += size - base; + deltas.push(delta); + } + return { count: Math.max(0, count), defaultSize: base, overrides: sorted, deltas }; + } + + // Number of overrides whose index is below `bounded`. + function overridesBefore(overrides, bounded) { + let low = 0; + let high = overrides.length; + while (low < high) { + const mid = (low + high) >> 1; + if (overrides[mid][0] < bounded) low = mid + 1; + else high = mid; + } + return low; } function axisOffset(axis, index) { const bounded = Math.max(1, Math.min(axis.count + 1, index)); - let offset = (bounded - 1) * axis.defaultSize; - for (const [overrideIndex, size] of axis.overrides) { - if (overrideIndex >= bounded) break; - offset += size - axis.defaultSize; - } - return offset; + const before = overridesBefore(axis.overrides, bounded); + return (bounded - 1) * axis.defaultSize + (before ? axis.deltas[before - 1] : 0); } function axisIndexAt(axis, offset) { @@ -641,6 +706,7 @@ MAX_COL, XlsxPreviewError, inspectZipDirectory, + createXmlCounter, admitXlsx, buildAdmittedArchive, parseCellRef, diff --git a/test/spreadsheet-preview-worker.test.ts b/test/spreadsheet-preview-worker.test.ts index ef4ef817..8986918d 100644 --- a/test/spreadsheet-preview-worker.test.ts +++ b/test/spreadsheet-preview-worker.test.ts @@ -132,6 +132,8 @@ function createHarness() { messages, imports, self, + /** Evaluate an expression against the worker's own top-level bindings. */ + peek: (expression: string): unknown => vm.runInContext(expression, context), send: async (data: unknown) => { await (self.onmessage as (event: { data: unknown }) => Promise)({ data }); }, @@ -508,3 +510,66 @@ describe('spreadsheet preview worker: ExcelJS sees only what admission checked', else expect(result.type).toBe('error'); }, 60_000); }); + +/** A one-cell ExcelJS workbook whose sheet1.xml gets `xml` spliced in at `where`. */ +async function sheetWithInjectedXml(where: 'before-sheetData' | 'after-sheetData', xml: string): Promise { + const workbook = new ExcelJS.Workbook(); + workbook.addWorksheet('Data').getCell('A1').value = 'one'; + const entries = fflate.unzipSync(new Uint8Array(await workbook.xlsx.writeBuffer())); + const sheet = fflate.strFromU8(entries['xl/worksheets/sheet1.xml']); + const patched = + where === 'before-sheetData' + ? sheet.replace('', `${xml}`) + : sheet.replace('', `${xml}`); + expect(patched).not.toBe(sheet); + entries['xl/worksheets/sheet1.xml'] = fflate.strToU8(patched); + return toArrayBuffer(fflate.zipSync(entries)); +} + +describe('spreadsheet preview worker: admission bounds what ExcelJS expands', () => { + // ExcelJS creates one cell object per covered cell of a merge, so a single + // `` tag over 3M cells took 10 s and a gigabyte of heap. + it('refuses a merge whose area exceeds the cell caps before ExcelJS loads', async () => { + const harness = createHarness(); + await harness.send({ + type: 'load', + bytes: await sheetWithInjectedXml( + 'after-sheetData', + '' + ), + }); + expect(harness.messages.at(-1)).toMatchObject({ type: 'error', code: 'cell-limit' }); + expect(harness.imports.some((url) => url.includes('exceljs'))).toBe(false); + }); + + // `Column.fromModel` builds every column up to `` with no clamp. + it('refuses a range past column 16384 before ExcelJS loads', async () => { + const harness = createHarness(); + await harness.send({ + type: 'load', + bytes: await sheetWithInjectedXml('before-sheetData', ''), + }); + expect(harness.messages.at(-1)).toMatchObject({ type: 'error', code: 'malformed' }); + expect(harness.imports.some((url) => url.includes('exceljs'))).toBe(false); + }); + + // A whole-column dropdown is a few bytes of XML that ExcelJS expands into one + // object per address (5 s here; a whole-sheet range was still running after + // 60 s). The preview never shows validations, so the worker does not parse + // them, and the file still previews. + it('previews a sheet with a whole-column data validation without expanding it', async () => { + const harness = createHarness(); + const metadata = await loadMetadata( + harness, + await sheetWithInjectedXml( + 'after-sheetData', + '' + + '"a,b"' + ) + ); + expect(harness.peek('Object.keys(workbook.worksheets[0].dataValidations.model).length')).toBe(0); + expect(metadata.sheets[0]).toMatchObject({ rows: 1, cols: 1 }); + const tile = await requestTile(harness, metadata.sheets[0].id, { r1: 1, c1: 1, r2: 1, c2: 1 }); + expect(tile.cells).toEqual([expect.objectContaining({ row: 1, col: 1, text: 'one' })]); + }, 30_000); +}); diff --git a/test/spreadsheet-xlsx-core.test.ts b/test/spreadsheet-xlsx-core.test.ts index 61083cd1..ba5bc2a2 100644 --- a/test/spreadsheet-xlsx-core.test.ts +++ b/test/spreadsheet-xlsx-core.test.ts @@ -11,6 +11,11 @@ type Core = { XlsxPreviewError: new (code: string, message: string) => Error & { code: string }; inspectZipDirectory(bytes: Uint8Array, limits?: Record): { entries: Array<{ name: string }> }; admitXlsx(bytes: Uint8Array, zip: typeof fflate, limits?: Record): unknown; + createXmlCounter( + name: string, + counts: { cells: number; merges: number; styles: number }, + limits: Record + ): { push(chunk: Uint8Array, final: boolean): void }; buildAdmittedArchive(admission: unknown, zip: typeof fflate): Uint8Array; parseCellRef(ref: string): { row: number; col: number } | null; deriveExtent(cells: string[], merges: string[]): { rows: number; cols: number }; @@ -107,7 +112,8 @@ describe('spreadsheet XLSX core', () => { counts: { worksheets: number; cells: number; merges: number; styles: number }; features: string[]; }; - expect(result.counts).toEqual({ worksheets: 1, cells: 1, merges: 1, styles: 1 }); + // The 2x2 merge costs its four covered cells on top of the one real cell. + expect(result.counts).toEqual({ worksheets: 1, cells: 5, merges: 1, styles: 1 }); expect(result.features).toEqual(expect.arrayContaining(['charts', 'externalLinks'])); }); @@ -146,6 +152,63 @@ describe('spreadsheet XLSX core', () => { expect(() => core.admitXlsx(zip, duplicate)).toThrowError(/duplicate/i); }); + it('charges a merged range its full area and refuses one that does not parse', () => { + const merged = (ref: string) => + workbookZip( + `` + ); + expect(() => core.admitXlsx(merged('A1:CV30000'), fflate)).toThrowError(/cells limit/i); + // Reversed corners describe the same area. + expect(() => core.admitXlsx(merged('CV30000:A1'), fflate)).toThrowError(/cells limit/i); + expect(() => core.admitXlsx(merged('A1:XFE2'), fflate)).toThrowError(/merged range/i); + expect(() => core.admitXlsx(merged('not-a-range'), fflate)).toThrowError(/merged range/i); + const admitted = core.admitXlsx(merged('A1:J10'), fflate) as { counts: { cells: number } }; + expect(admitted.counts.cells).toBe(101); + }); + + it('refuses a whose min or max is past the last Excel column', () => { + const cols = (attrs: string) => + workbookZip( + `` + ); + expect(() => core.admitXlsx(cols('min="1" max="3000000"'), fflate)).toThrowError(/column max/i); + expect(() => core.admitXlsx(cols('min="16385" max="16385"'), fflate)).toThrowError(/column min/i); + expect(() => core.admitXlsx(cols('min="1" max="1e9"'), fflate)).toThrowError(/column max/i); + expect(() => core.admitXlsx(cols('min="1" max="16384"'), fflate)).not.toThrow(); + }); + + it('reads a merge or col tag whole even when a stream chunk boundary cuts through it', () => { + // Markup on both sides, so a cut can land 128+ bytes past the tag's start. + const pad = ''.repeat(12); + const cases: Array<[string, RegExp]> = [ + [`${pad}${pad}`, /column max/i], + [`${pad}${pad}`, /cells limit/i], + ]; + for (const [xml, pattern] of cases) { + const bytes = fflate.strToU8(xml); + for (let cut = 1; cut < bytes.length; cut += 1) { + const counter = core.createXmlCounter( + 'xl/worksheets/sheet1.xml', + { cells: 0, merges: 0, styles: 0 }, + core.LIMITS + ); + expect(() => { + counter.push(bytes.subarray(0, cut), false); + counter.push(bytes.subarray(cut), true); + }, `cut at ${cut}`).toThrowError(pattern); + } + } + }); + + it('refuses an entry whose declared compressed size runs past the file', () => { + const zip = workbookZip(); + const view = new DataView(zip.buffer, zip.byteOffset, zip.byteLength); + const eocd = zip.length - 22; + const centralStart = view.getUint32(eocd + 16, true); + view.setUint32(centralStart + 20, 0x7fffffff, true); + expect(() => core.inspectZipDirectory(zip)).toThrowError(/compressed bytes/i); + }); + it('derives bounded extents from real cells and merges', () => { expect(core.parseCellRef('XFD1048576')).toEqual({ row: 1_048_576, col: 16_384 }); expect(core.parseCellRef('XFE1')).toBeNull(); @@ -164,6 +227,18 @@ describe('spreadsheet XLSX core', () => { expect(end - start).toBeLessThan(10); }); + it('matches a plain walk over the overrides at every index', () => { + const overrides: Array<[number, number]> = []; + for (let index = 3; index <= 400; index += 7) overrides.push([index, (index * 13) % 50]); + const axis = core.createSparseAxis(500, 20, overrides); + for (let index = 0; index <= 502; index += 1) { + const bounded = Math.max(1, Math.min(501, index)); + let expected = (bounded - 1) * 20; + for (const [at, size] of overrides) if (at < bounded) expected += size - 20; + expect(core.axisOffset(axis, index), `index ${index}`).toBe(expected); + } + }); + it('returns intersecting merges even when their anchor is offscreen', () => { expect(core.intersectingMerges(['A1:D4', 'Z1:Z2'], { r1: 3, c1: 3, r2: 6, c2: 6 })).toEqual(['A1:D4']); });