version bump 0.17.0

- Explicit errors on inconsistent XLS records - DBF cap worksheet to 1<<20 rows
SheetJS · May 13, 2021 · 3542d62 · 3542d62 · Andrey-Corado · Mar 21, 2023
1 parent 6c5db36
commit 3542d62
Show file tree

Hide file tree

Showing 24 changed files with 1,772 additions and 112 deletions.
diff --git a/.npmignore b/.npmignore
@@ -39,6 +39,7 @@ tmp
 .gitattributes
 .fossaignore
 .spelling
+.eslintignore
 .eslintrc
 .jshintrc
 CONTRIBUTING.md

diff --git a/bin/xlsx.njs b/bin/xlsx.njs
@@ -4,6 +4,7 @@
 /* vim: set ts=2 ft=javascript: */
 var n = "xlsx";
 var X = require('../');
+try { X = require('../xlsx.flow'); } catch(e) {}
 require('exit-on-epipe');
 var fs = require('fs'), program = require('commander');
 program

diff --git a/bits/01_version.js b/bits/01_version.js
@@ -1 +1 @@
-XLSX.version = '0.16.9';
+XLSX.version = '0.17.0';
diff --git a/bits/22_xmlutils.js b/bits/22_xmlutils.js
@@ -1,6 +1,6 @@
 var XML_HEADER = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\r\n';
 var attregexg=/([^"\s?>\/]+)\s*=\s*((?:")([^"]*)(?:")|(?:')([^']*)(?:')|([^'">\s]+))/g;
-var tagregex=/<[\/\?]?[a-zA-Z0-9:_-]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s?[\/\?]?>/mg;
+var tagregex=/<[\/\?]?[a-zA-Z0-9:_-]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s*[\/\?]?>/mg;
 
 if(!(XML_HEADER.match(tagregex))) tagregex = /<[^>]*>/g;
 var nsregex=/<\w*:/, nsregex2 = /<(\/?)\w+:/;

diff --git a/bits/28_binstructs.js b/bits/28_binstructs.js
@@ -177,7 +177,10 @@ var write_UncheckedRfX = write_RfX;
 
 /* [MS-XLS] 2.5.342 ; [MS-XLSB] 2.5.171 */
 /* TODO: error checking, NaN and Infinity values are not valid Xnum */
-function parse_Xnum(data/*::, length*/) { return data.read_shift(8, 'f'); }
+function parse_Xnum(data/*::, length*/) {
+	if(data.length - data.l < 8) throw "XLS Xnum Buffer underflow";
+	return data.read_shift(8, 'f');
+}
 function write_Xnum(data, o) { return (o || new_buf(8)).write_shift(8, data, 'f'); }
 
 /* [MS-XLSB] 2.4.324 BrtColor */

diff --git a/bits/39_xlsbiff.js b/bits/39_xlsbiff.js
@@ -697,7 +697,7 @@ function parse_Lbl(blob, length, opts) {
 	var name = parse_XLUnicodeStringNoCch(blob, cch, opts);
 	if(flags & 0x20) name = XLSLblBuiltIn[name.charCodeAt(0)];
 	var npflen = target - blob.l; if(opts && opts.biff == 2) --npflen;
-	var rgce = target == blob.l || cce === 0 ? [] : parse_NameParsedFormula(blob, npflen, opts, cce);
+	var rgce = (target == blob.l || cce === 0 || !(npflen > 0)) ? [] : parse_NameParsedFormula(blob, npflen, opts, cce);
 	return {
 		chKey: chKey,
 		Name: name,

diff --git a/bits/40_harb.js b/bits/40_harb.js
@@ -85,7 +85,7 @@ function dbf_to_aoa(buf, opts)/*:AOA*/ {
 	var /*filedate = new Date(),*/ nrow = 0, fpos = 0;
 	if(ft == 0x02) nrow = d.read_shift(2);
 	/*filedate = new Date(d.read_shift(1) + 1900, d.read_shift(1) - 1, d.read_shift(1));*/d.l += 3;
-	if(ft != 0x02) nrow = d.read_shift(4);
+	if(ft != 0x02) nrow = d.read_shift(4); if(nrow > 1048576) nrow = 1e6;
 	if(ft != 0x02) fpos = d.read_shift(2);
 	var rlen = d.read_shift(2);
 
@@ -822,7 +822,6 @@ var PRN = (function() {
 			}
 			// If line ends in \r OR \n
 			else if(str.charCodeAt(5) == 13 || str.charCodeAt(5) == 10 ) {
-				//
 				sep = str.charAt(4); str = str.slice(6);
 			}
 		}

diff --git a/bits/67_wsxml.js b/bits/67_wsxml.js
@@ -238,6 +238,8 @@ function parse_ws_xml_sheetviews(data, wb/*:WBWBProps*/) {
 		// $FlowIgnore
 		if(!wb.Views[i]) wb.Views[i] = {};
 		// $FlowIgnore
+		if(+tag.zoomScale) wb.Views[i].zoom = +tag.zoomScale;
+		// $FlowIgnore
 		if(parsexmlbool(tag.rightToLeft)) wb.Views[i].RTL = true;
 	});
 }

diff --git a/bits/76_xls.js b/bits/76_xls.js
@@ -38,10 +38,12 @@ function slurp(R, blob, length/*:number*/, opts)/*:any*/ {
 	var l = length;
 	var bufs = [];
 	var d = blob.slice(blob.l,blob.l+l);
-	if(opts && opts.enc && opts.enc.insitu) switch(R.n) {
-	case 'BOF': case 'FilePass': case 'FileLock': case 'InterfaceHdr': case 'RRDInfo': case 'RRDHead': case 'UsrExcl': break;
+	if(opts && opts.enc && opts.enc.insitu && d.length > 0) switch(R.n) {
+	case 'BOF': case 'FilePass': case 'FileLock': case 'InterfaceHdr': case 'RRDInfo': case 'RRDHead': case 'UsrExcl': case 'EOF':
+		break;
+	case 'BoundSheet8':
+		break;
 	default:
-		if(d.length === 0) break;
 		opts.enc.insitu(d);
 	}
 	bufs.push(d);
@@ -52,15 +54,19 @@ function slurp(R, blob, length/*:number*/, opts)/*:any*/ {
 		l = __readUInt16LE(blob,blob.l+2);
 		start = blob.l + 4;
 		if(next.n == 'ContinueFrt') start += 4;
-		else if(next.n.slice(0,11) == 'ContinueFrt') start += 12;
-		bufs.push(blob.slice(start,blob.l+4+l));
+		else if(next.n.slice(0,11) == 'ContinueFrt') {
+			start += 12;
+		}
+		d = blob.slice(start,blob.l+4+l);
+		bufs.push(d);
 		blob.l += 4+l;
 		next = (XLSRecordEnum[__readUInt16LE(blob, blob.l)]);
 	}
 	var b = (bconcat(bufs)/*:any*/);
 	prep_blob(b, 0);
 	var ll = 0; b.lens = [];
 	for(var j = 0; j < bufs.length; ++j) { b.lens.push(ll); ll += bufs[j].length; }
+	if(b.length < length) throw "XLS Record " + (R && R.n || "??") + " Truncated: " + b.length + " < " + length;
 	return R.f(b, b.length, opts);
 }
 

diff --git a/dist/xlsx.core.min.js b/dist/xlsx.core.min.js
diff --git a/dist/xlsx.core.min.map b/dist/xlsx.core.min.map
diff --git a/dist/xlsx.extendscript.js b/dist/xlsx.extendscript.js
diff --git a/dist/xlsx.full.min.js b/dist/xlsx.full.min.js
diff --git a/dist/xlsx.full.min.map b/dist/xlsx.full.min.map
diff --git a/dist/xlsx.js b/dist/xlsx.js
diff --git a/dist/xlsx.min.js b/dist/xlsx.min.js
diff --git a/dist/xlsx.min.map b/dist/xlsx.min.map
diff --git a/dist/xlsx.mini.min.js b/dist/xlsx.mini.min.js
diff --git a/dist/xlsx.mini.min.map b/dist/xlsx.mini.min.map
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "xlsx",
-	"version": "0.16.9",
+	"version": "0.17.0",
 	"author": "sheetjs",
 	"description": "SheetJS Spreadsheet data parser and writer",
 	"keywords": [