From f46dc936a554c9464f9837e4311a95a911aa4447 Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 16:41:01 -0500 Subject: [PATCH] Add craft-opc: the OPC package layer of DOCX, XLSX and PPTX files (#883) One crate for what WordCraft's docx::package, GridCraft's xlsx::package and DeckCraft's pptx::opc each carried: bounded ZIP readers (every part up front, or on demand), part names, relationships, content types and a package writer. The declared entry count is checked from the end records before the zip crate indexes the entries. Limits have no defaults: each format passes its own. --- Cargo.lock | 11 ++ Cargo.toml | 1 + README.md | 3 + crates/opc/Cargo.toml | 27 +++ crates/opc/README.md | 93 ++++++++++ crates/opc/src/guard.rs | 192 ++++++++++++++++++++ crates/opc/src/lib.rs | 128 +++++++++++++ crates/opc/src/name.rs | 146 +++++++++++++++ crates/opc/src/read.rs | 342 +++++++++++++++++++++++++++++++++++ crates/opc/src/rels.rs | 243 +++++++++++++++++++++++++ crates/opc/src/write.rs | 224 +++++++++++++++++++++++ crates/opc/tests/package.rs | 350 ++++++++++++++++++++++++++++++++++++ 12 files changed, 1760 insertions(+) create mode 100644 crates/opc/Cargo.toml create mode 100644 crates/opc/README.md create mode 100644 crates/opc/src/guard.rs create mode 100644 crates/opc/src/lib.rs create mode 100644 crates/opc/src/name.rs create mode 100644 crates/opc/src/read.rs create mode 100644 crates/opc/src/rels.rs create mode 100644 crates/opc/src/write.rs create mode 100644 crates/opc/tests/package.rs diff --git a/Cargo.lock b/Cargo.lock index 11f2b7041..f4596f83b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1106,6 +1106,17 @@ dependencies = [ "proptest", ] +[[package]] +name = "craft-opc" +version = "0.1.0" +dependencies = [ + "craft-xml", + "flate2", + "log", + "thiserror 2.0.21", + "zip", +] + [[package]] name = "craft-pcraft-format" version = "0.1.0" diff --git a/Cargo.toml b/Cargo.toml index 956c970c6..00844bb16 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -52,6 +52,7 @@ craft-mime = { path = "crates/mime" } craft-lottie = { path = "crates/lottie" } craft-menu = { path = "crates/menu" } craft-metafile = { path = "crates/metafile" } +craft-opc = { path = "crates/opc" } craft-pcraft-format = { path = "crates/pcraft-format" } craft-prepress = { path = "crates/prepress" } craft-print = { path = "crates/print" } diff --git a/README.md b/README.md index b3cfd1042..c0d2fc266 100644 --- a/README.md +++ b/README.md @@ -136,6 +136,9 @@ craft- = { git = "https://github.com/storytold/craft-libs", rev = "` with the document as a type parameter, `TileRef`, the entry paths, the manifest decode limits and the migration runner. The document model stays in PhotoCraft. diff --git a/crates/opc/Cargo.toml b/crates/opc/Cargo.toml new file mode 100644 index 000000000..ee1cac1fd --- /dev/null +++ b/crates/opc/Cargo.toml @@ -0,0 +1,27 @@ +[package] +name = "craft-opc" +description = "Open Packaging Conventions (ECMA-376 Part 2): the ZIP container of DOCX, XLSX and PPTX files, with bounded reads, part names, relationships and content types, and a package writer." +version.workspace = true +edition.workspace = true +license.workspace = true +rust-version.workspace = true +repository.workspace = true + +[lints] +workspace = true + +[features] +# `zip64_entry_count_sample`, the regression input for a reader's own entry-count test. +test-support = [] + +[dependencies] +craft-xml = { workspace = true } +log = "0.4" +thiserror = { workspace = true } +# `deflate-flate2` with flate2's miniz_oxide backend (chosen below), as in craft-update: zip's own +# `deflate` feature would switch a whole app's flate2 to zlib-rs. +zip = { version = "9", default-features = false, features = ["deflate-flate2"] } +flate2 = { version = "1", default-features = false, features = ["rust_backend"] } + +[dev-dependencies] +zip = { version = "9", default-features = false, features = ["deflate-flate2"] } diff --git a/crates/opc/README.md b/crates/opc/README.md new file mode 100644 index 000000000..1058a19fb --- /dev/null +++ b/crates/opc/README.md @@ -0,0 +1,93 @@ +# craft-opc + +Open Packaging Conventions (ECMA-376 Part 2): the ZIP container that DOCX, XLSX and PPTX files +share. It replaces the package layer each Craft app carried for its own format (WordCraft's +`docx::package`, GridCraft's `xlsx::package`, DeckCraft's `pptx::opc`). + +What the parts hold stays with each format's crate. Parts are read with `zip` and XML with +`craft-xml`. + +```rust +use craft_opc::{Limits, Package, PackageOut, RelsOut}; + +let mut out = PackageOut::default(); +out.xml_part("xl/workbook.xml", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml", b"".to_vec()); +out.binary("xl/media/image1.png", "image/png", vec![0x89, b'P', b'N', b'G']); +let mut rels = RelsOut::default(); +rels.add("officeDocument", "xl/workbook.xml", false); +out.rels("", &rels); +let bytes = out.finish().unwrap(); + +let limits = Limits::new(10_000, 64 << 20, 256 << 20); +let pkg = Package::open(&bytes, &limits).unwrap(); +let main = pkg.rels("").first("officeDocument").map(|r| r.target.clone()).unwrap(); +assert_eq!(main, "xl/workbook.xml"); +assert_eq!(pkg.content_types().of("xl/media/image1.png"), Some("image/png")); +assert!(pkg.get("XL/Workbook.xml").is_some()); +``` + +## Reading + +Two readers, because the apps read in two ways: + +| | `Package` | `LazyPackage` | +| --- | --- | --- | +| Inflates | every part, in `open` | a part when `read` asks for it | +| Borrows the file's bytes | no | yes | +| A part over a limit | refuses the package, or is left out (`Limits::oversized`) | is that read's error | +| A damaged entry | left out with a logged warning | is that read's error, and ends the budget (`read_optional_limited`: costs only its own allowance) | +| Came from | WordCraft (refuse), DeckCraft (leave out) | GridCraft | + +Both look parts up without regard to case, leading `/` or `\` for `/`. + +### Limits + +`Limits` has no defaults: each format keeps its own numbers. + +| Limit | Checked | Error | +| --- | --- | --- | +| `max_entries` | from the end records, before `zip` indexes the entries (`check_entry_count`), and again on the count `zip` found | `TooManyEntries`, `TooManyEndRecords` | +| `max_part` | on the declared size, then on what is inflated (a read stops one byte past it) | `PartTooLarge` | +| `max_total` | on the bytes kept | `PackageTooLarge` | +| `max_work` | on the bytes inflated, kept or not: an entry inflates in full before its checksum is compared, so entries that fail it would otherwise be free | `PackageTooLarge` | + +`Limits::new` sets `max_work` to `max_total` and refuses oversized parts. At most 16 MiB is +reserved for a part before its bytes arrive, whatever size it declares. + +`check_entry_count` is a bytes-only check of what the end of central directory records declare. +It does not validate the archive; `zip` does. + +### Names and relationships + +- `Package::canonical(name)` is the stored spelling. When entries differ only in case, they are + one part: the spelling a relationship names is kept, else the first in byte order. +- `Rels`: `by_id`, `target`, `first(type)`, `all(type)`. A type is matched by its full URI or + by its last segment, so `first("image")` finds the transitional and the strict spelling + (`type_is`). The first relationship of a repeated id wins. +- `Rel::target` is a part name for an internal target and the URL for an external one; + `target_raw` is what the file wrote. A target is looked up as written, then with `%hh` + escapes decoded; when the package has the part, `target` is its stored spelling. +- `resolve(dir, target)` drops a fragment and cannot climb out of the package. `relative(from, to)` + is its inverse. +- `ContentTypes::of(part)`: Override by part name, then Default by extension. + +A missing or unreadable relationships or content types part reads as empty, with a logged +warning for an unreadable one. + +## Writing + +- `PackageOut`: `xml_part` (with an Override), `binary` (a Default for its extension, or an + Override when the extension already has another type), `raw`, `rels`; `finish` writes + `[Content_Types].xml` first and leaves out a second part under a name already written. +- `RelsOut`: `add` reuses the relationship already made for a type, target and mode; `add_new` + never does. Ids are `rId1`, `rId2`… +- `ZipOut` and `zip_entries` for a writer that builds its own content types. Output is + deterministic: deflate level 6, one fixed timestamp. Names with an already-compressed + extension are stored (`compression_for`). + +## Not here + +- Flat OPC (`pkg:package` XML) and encrypted packages (a compound file holding + `EncryptedPackage`): still with the apps. +- A full ZIP preflight (overlapping entries, lying offsets): `check_entry_count` covers the + entry count only. diff --git a/crates/opc/src/guard.rs b/crates/opc/src/guard.rs new file mode 100644 index 000000000..23e9bb8d6 --- /dev/null +++ b/crates/opc/src/guard.rs @@ -0,0 +1,192 @@ +//! A bytes-only check of a ZIP package's declared entry count before the `zip` crate opens it. +//! +//! `zip::ZipArchive::new` reserves room for, and parses, as many central directory headers as the +//! end record declares before its caller can look at `len()`. A ZIP64 end record can declare +//! millions of entries for a file of a few hundred megabytes (only 46 bytes each have to fit), and +//! each parsed entry costs several times that in memory. Here the end records are found the way +//! `zip` finds them (APPNOTE.TXT §4.3.14 to §4.3.16), and a package declaring more than the +//! reader's limit is refused before `zip` parses anything. Anything else that is wrong is left for +//! `zip` to report. + +use crate::Error; + +const EOCD: &[u8; 4] = b"PK\x05\x06"; +const EOCD64_LOCATOR: &[u8; 4] = b"PK\x06\x07"; +const EOCD64: &[u8; 4] = b"PK\x06\x06"; +const CENTRAL_HEADER: &[u8; 4] = b"PK\x01\x02"; + +/// End records looked at, at most. A package has one; a few more can turn up inside stored data. +const MAX_END_RECORDS: usize = 16; + +/// Refuse `bytes` when the end record `zip` would use declares more than `max_entries` entries. +/// +/// `zip` searches the file backwards for an end of central directory record. A ZIP64 one points +/// through its locator at the ZIP64 end record, which `zip` looks for from the locator's offset +/// on: every such record there is checked, and as `zip` may fall back to an earlier end record +/// when one doesn't parse, the search goes on. A plain one is used when it declares no entries, or +/// a central directory header lies between its directory offset and itself: it is the last one +/// looked at. +pub fn check_entry_count(bytes: &[u8], max_entries: u64) -> Result<(), Error> { + let u16_at = |at: usize| bytes.get(at..at.checked_add(2)?).map(|b| u16::from_le_bytes([b[0], b[1]])); + let u32_at = |at: usize| bytes.get(at..at.checked_add(4)?).map(|b| u32::from_le_bytes([b[0], b[1], b[2], b[3]])); + let u64_at = |at: usize| bytes.get(at..at.checked_add(8)?).and_then(|b| <[u8; 8]>::try_from(b).ok()).map(u64::from_le_bytes); + let refuse = + |n: u64| -> Result<(), Error> { if n > max_entries { Err(Error::TooManyEntries { declared: n, limit: max_entries }) } else { Ok(()) } }; + let mut end = bytes.len(); + let mut seen = 0; + while let Some(at) = bytes.get(..end).and_then(|b| b.windows(4).rposition(|w| w == EOCD)) { + end = at; + seen += 1; + if seen > MAX_END_RECORDS { + return Err(Error::TooManyEndRecords(MAX_END_RECORDS)); + } + // `zip` skips a record whose comment runs past the end of the file. + let Some(comment) = u16_at(at + 20) else { continue }; + if at + 22 + usize::from(comment) > bytes.len() { + continue; + } + let (Some(on_disk), Some(total), Some(cd_offset)) = (u16_at(at + 8), u16_at(at + 10), u32_at(at + 16)) else { continue }; + let zip64 = total == u16::MAX || cd_offset == u32::MAX; + if zip64 + && let Some(locator) = at.checked_sub(20) + && bytes.get(locator..locator + 4) == Some(EOCD64_LOCATOR.as_slice()) + { + let (Some(eocd64), Some(disks)) = (u64_at(locator + 8), u32_at(locator + 16)) else { continue }; + let Some(from) = usize::try_from(eocd64).ok().filter(|&f| f < locator) else { continue }; + if disks > 1 { + continue; + } + let records = bytes.get(from..locator).unwrap_or_default().windows(4).enumerate().filter(|(_, w)| *w == EOCD64); + for (i, _) in records { + let p = from + i; + refuse(u64_at(p + 24).unwrap_or(0).max(u64_at(p + 32).unwrap_or(0)))?; + } + continue; + } + if total == 0 { + return Ok(()); + } + let cd = cd_offset as usize; + if cd < at && bytes.get(cd..at).is_some_and(|b| b.windows(4).any(|w| w == CENTRAL_HEADER)) { + return refuse(u64::from(on_disk.max(total))); + } + } + Ok(()) +} + +/// A package of one empty stored file, `a`, whose central directory lists it `entries` times (at +/// most as many as fit in 64 MiB) under a ZIP64 end record that declares them all: `zip` +/// parses and keeps every one of them before its caller can count them. Regression input for the +/// readers' tests: built only for tests, this crate's and (through the `test-support` feature, +/// which they turn on as a dev-dependency) the readers', never into an app. +#[cfg(any(test, feature = "test-support"))] +pub fn zip64_entry_count_sample(entries: u64) -> Vec { + // Local file header (APPNOTE.TXT §4.3.7): version 10, stored, no data, name "a". + let mut f = b"PK\x03\x04".to_vec(); + f.extend_from_slice(&[10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // version, flags, method, time, date + f.extend_from_slice(&[0; 12]); // crc, sizes + f.extend_from_slice(&[1, 0, 0, 0]); // name and extra lengths + f.push(b'a'); + let cd_at = f.len() as u64; + // Its central header (§4.3.12), 47 bytes. + let mut header = CENTRAL_HEADER.to_vec(); + header.extend_from_slice(&[10, 0, 10, 0, 0, 0, 0, 0, 0, 0, 0x21, 0]); // versions, flags, method, time, date + header.extend_from_slice(&[0; 12]); // crc, sizes + header.extend_from_slice(&[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]); // name, extra, comment, disk, attributes + header.extend_from_slice(&[0; 4]); // local header offset + header.push(b'a'); + let count = entries.min((64 << 20) / header.len() as u64); + for _ in 0..count { + f.extend_from_slice(&header); + } + let cd_len = f.len() as u64 - cd_at; + let eocd64_at = f.len() as u64; + // ZIP64 end of central directory record (§4.3.14), 56 bytes. + f.extend_from_slice(EOCD64); + f.extend_from_slice(&44u64.to_le_bytes()); // size of the rest of the record + f.extend_from_slice(&[45, 0, 45, 0]); // versions + f.extend_from_slice(&[0; 8]); // this disk, disk with the central directory + f.extend_from_slice(&entries.to_le_bytes()); // entries on this disk + f.extend_from_slice(&entries.to_le_bytes()); // entries + f.extend_from_slice(&cd_len.to_le_bytes()); + f.extend_from_slice(&cd_at.to_le_bytes()); + // Its locator (§4.3.15), 20 bytes. + f.extend_from_slice(EOCD64_LOCATOR); + f.extend_from_slice(&0u32.to_le_bytes()); + f.extend_from_slice(&eocd64_at.to_le_bytes()); + f.extend_from_slice(&1u32.to_le_bytes()); + // End of central directory record (§4.3.16), 22 bytes, each count and offset "see ZIP64". + f.extend_from_slice(EOCD); + f.extend_from_slice(&[0; 4]); + f.extend_from_slice(&[0xFF; 12]); + f.extend_from_slice(&[0; 2]); + f +} + +#[cfg(test)] +mod tests { + use super::{CENTRAL_HEADER, EOCD, check_entry_count as check, zip64_entry_count_sample}; + use crate::Error; + + /// A plain package's tail: one central header at 0, then an end record declaring `entries`. + fn plain(entries: u16, comment: &[u8]) -> Vec { + let mut f = CENTRAL_HEADER.to_vec(); + f.resize(46, 0); + f.extend_from_slice(EOCD); + f.extend_from_slice(&[0, 0, 0, 0]); + f.extend_from_slice(&entries.to_le_bytes()); + f.extend_from_slice(&entries.to_le_bytes()); + f.extend_from_slice(&46u32.to_le_bytes()); + f.extend_from_slice(&0u32.to_le_bytes()); + f.extend_from_slice(&(comment.len() as u16).to_le_bytes()); + f.extend_from_slice(comment); + f + } + + #[test] + fn a_zip64_end_record_declaring_too_many_entries_is_refused() { + // `zip` would reserve and parse them all before the reader's cap. + let sample = zip64_entry_count_sample(20_001); + assert_eq!(check(&sample, 20_000), Err(Error::TooManyEntries { declared: 20_001, limit: 20_000 })); + assert!(check(&zip64_entry_count_sample(5), 20_000).is_ok()); + // Junk before the package (a self-extracting stub) doesn't hide it. + let mut prefixed = vec![0x55u8; 4096]; + prefixed.extend_from_slice(&sample); + assert!(check(&prefixed, 20_000).is_err()); + } + + #[test] + fn a_plain_end_record_is_checked_as_zip_reads_it() { + assert!(check(&plain(3, b""), 20_000).is_ok()); + assert_eq!(check(&plain(30_000, b"a comment"), 20_000), Err(Error::TooManyEntries { declared: 30_000, limit: 20_000 })); + // A record whose comment runs past the end is not the one `zip` uses. + let mut cut = plain(30_000, b""); + cut.truncate(cut.len() - 2); + cut.extend_from_slice(&500u16.to_le_bytes()); + assert!(check(&cut, 20_000).is_ok()); + assert!(check(b"not a package", 20_000).is_ok()); + assert!(check(b"", 20_000).is_ok()); + } + + #[test] + fn a_fake_end_record_after_the_real_one_does_not_hide_it() { + // `zip` skips a last record with no central header before it and uses the one before. + let mut f = zip64_entry_count_sample(1_000_000); + f.extend_from_slice(EOCD); + f.extend_from_slice(&[0, 0, 0, 0]); + f.extend_from_slice(&7u16.to_le_bytes()); + f.extend_from_slice(&7u16.to_le_bytes()); + f.extend_from_slice(&0u32.to_le_bytes()); + f.extend_from_slice(&((f.len() - 12) as u32).to_le_bytes()); + f.extend_from_slice(&0u16.to_le_bytes()); + assert!(check(&f, 20_000).is_err()); + } + + #[test] + fn many_end_records_are_refused() { + // Each declares one entry and has no central header before it, so `zip` would try them all. + let record = [0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]; + let f: Vec = (0..20).flat_map(|_| EOCD.iter().copied().chain(record)).collect(); + assert_eq!(check(&f, 20_000), Err(Error::TooManyEndRecords(16))); + } +} diff --git a/crates/opc/src/lib.rs b/crates/opc/src/lib.rs new file mode 100644 index 000000000..a6b3c11f7 --- /dev/null +++ b/crates/opc/src/lib.rs @@ -0,0 +1,128 @@ +#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)] +//! Open Packaging Conventions (ECMA-376 Part 2): the ZIP container that DOCX, XLSX and PPTX +//! files share. +//! +//! - [`Package`] inflates every part up front, within [`Limits`]. [`LazyPackage`] indexes the +//! archive and inflates a part when it is asked for, against a running total. +//! - [`Rels`] and [`ContentTypes`] read `_rels/*.rels` and `[Content_Types].xml`. +//! - [`resolve`], [`relative`], [`rels_path`] and the other part-name functions. +//! - [`PackageOut`], [`RelsOut`] and [`ZipOut`] write a package. +//! - [`check_entry_count`] refuses an archive that declares too many entries before the `zip` +//! crate indexes them. Both readers call it. +//! +//! The limits have no defaults: each format keeps its own numbers. +//! +//! ``` +//! use craft_opc::{Limits, Package, PackageOut, RelsOut}; +//! +//! let mut out = PackageOut::default(); +//! out.xml_part("word/document.xml", "application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml", b"".to_vec()); +//! let mut rels = RelsOut::default(); +//! rels.add("officeDocument", "word/document.xml", false); +//! out.rels("", &rels); +//! let bytes = out.finish()?; +//! +//! let pkg = Package::open(&bytes, &Limits::new(1000, 1 << 20, 1 << 22))?; +//! let main = pkg.rels("").first("officeDocument").map(|r| r.target.clone()); +//! assert_eq!(main.as_deref(), Some("word/document.xml")); +//! assert!(pkg.content_types().of("word/document.xml").is_some_and(|t| t.ends_with("main+xml"))); +//! # Ok::<(), craft_opc::Error>(()) +//! ``` + +#[cfg(doctest)] +#[doc = include_str!("../README.md")] +struct ReadmeExamples; + +mod guard; +mod name; +mod read; +mod rels; +mod write; + +pub use guard::check_entry_count; +#[cfg(any(test, feature = "test-support"))] +pub use guard::zip64_entry_count_sample; +pub use name::{dir_of, file_of, normalize, percent_decode, relative, rels_path, resolve, split_dir}; +pub use read::{LazyPackage, Package, declared_oversized}; +pub use rels::{ContentTypes, Rel, Rels, type_is}; +pub use write::{Compression, PackageOut, RelOut, RelsOut, ZipOut, compression_for, zip_entries}; + +/// The relationship type namespace of ECMA-376 transitional packages: a type is this and a +/// last segment (`image`, `styles`…). +pub const RT_BASE: &str = "http://schemas.openxmlformats.org/officeDocument/2006/relationships/"; +/// The namespace of a relationships part. +pub const NS_RELATIONSHIPS: &str = "http://schemas.openxmlformats.org/package/2006/relationships"; +/// The namespace of `[Content_Types].xml`. +pub const NS_CONTENT_TYPES: &str = "http://schemas.openxmlformats.org/package/2006/content-types"; +/// The content type of a relationships part. +pub const CT_RELATIONSHIPS: &str = "application/vnd.openxmlformats-package.relationships+xml"; + +/// What a reader refuses to exceed. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub struct Limits { + /// Most ZIP entries. Checked before the `zip` crate indexes them. + pub max_entries: usize, + /// Most bytes one part inflates to. + pub max_part: u64, + /// Most bytes kept from the whole package. + pub max_total: u64, + /// Most bytes inflated for the whole package, counting parts that are then left out (too + /// large, or failing part-way). Never less than useful below `max_total`. + pub max_work: u64, + /// What [`Package::open`] does with a part over a limit. + pub oversized: Oversized, +} + +/// What [`Package::open`] does with a part over a limit. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub enum Oversized { + /// The package is not opened. + Refuse, + /// The part is left out with a logged warning; reading stops when `max_work` is spent. + Skip, +} + +impl Limits { + /// `max_work` is `max_total` (every inflated byte counts, kept or not) and a part over a + /// limit refuses the package. + pub const fn new(max_entries: usize, max_part: u64, max_total: u64) -> Limits { + Limits { max_entries, max_part, max_total, max_work: max_total, oversized: Oversized::Refuse } + } +} + +/// Why a package was not read or written. +#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)] +pub enum Error { + /// The bytes are not a ZIP archive the `zip` crate can read, or an entry is damaged. + #[error("zip: {0}")] + Zip(String), + /// The archive declares more entries than [`Limits::max_entries`]. + #[error("the package declares {declared} entries, more than {limit}")] + TooManyEntries { declared: u64, limit: u64 }, + /// More end of central directory records than a package can have. + #[error("more than {0} end of central directory records")] + TooManyEndRecords(usize), + /// A part declares or inflates to more than `limit` bytes. + #[error("part {part} is larger than {limit} bytes")] + PartTooLarge { part: String, limit: u64 }, + /// The parts together inflate to more than `limit` bytes. + #[error("the package expands to more than {limit} bytes")] + PackageTooLarge { limit: u64 }, + /// An XML part could not be read. + #[error("{part}: {error}")] + Xml { part: String, error: craft_xml::Error }, + /// The archive could not be written. + #[error("could not write the package: {0}")] + Write(String), +} + +impl Error { + /// Was a limit exceeded (as opposed to the archive being damaged)? + pub fn is_limit(&self) -> bool { + match self { + Error::TooManyEntries { .. } | Error::TooManyEndRecords(_) | Error::PartTooLarge { .. } | Error::PackageTooLarge { .. } => true, + Error::Xml { error, .. } => error.is_limit(), + Error::Zip(_) | Error::Write(_) => false, + } + } +} diff --git a/crates/opc/src/name.rs b/crates/opc/src/name.rs new file mode 100644 index 000000000..bf1393ba6 --- /dev/null +++ b/crates/opc/src/name.rs @@ -0,0 +1,146 @@ +//! Part names: `word/document.xml`, without the leading `/`. + +/// The key a part name is looked up by: `\` as `/`, no leading `/`, ASCII lower case (part +/// names are case-insensitive, ECMA-376 Part 2 §6.2.2.3). +pub fn normalize(name: &str) -> String { + name.replace('\\', "/").trim_start_matches('/').to_ascii_lowercase() +} + +/// `xl/worksheets/sheet1.xml` → (`xl/worksheets`, `sheet1.xml`). +pub fn split_dir(part: &str) -> (&str, &str) { + let p = part.trim_start_matches('/'); + match p.rfind('/') { + Some(i) => (p.get(..i).unwrap_or(""), p.get(i + 1..).unwrap_or("")), + None => ("", p), + } +} + +/// The folder of a part: `ppt/slides/slide1.xml` → `ppt/slides`. +pub fn dir_of(part: &str) -> &str { + split_dir(part).0 +} + +/// The last segment of a part name. +pub fn file_of(part: &str) -> &str { + part.rsplit('/').next().unwrap_or(part) +} + +/// The relationships part of `part`: `xl/workbook.xml` → `xl/_rels/workbook.xml.rels`. The +/// package's own relationships are those of `""`: `_rels/.rels`. +pub fn rels_path(part: &str) -> String { + let (dir, file) = split_dir(part); + if dir.is_empty() { format!("_rels/{file}.rels") } else { format!("{dir}/_rels/{file}.rels") } +} + +/// `%hh` escapes decoded; a `%` not followed by two hex digits stays. +pub fn percent_decode(s: &str) -> String { + let b = s.as_bytes(); + let mut out = Vec::with_capacity(b.len()); + let mut i = 0; + while let Some(&c) = b.get(i) { + if c == b'%' + && let Some(h) = b + .get(i + 1..i + 3) + .filter(|h| h.iter().all(u8::is_ascii_hexdigit)) + .and_then(|h| std::str::from_utf8(h).ok()) + .and_then(|h| u8::from_str_radix(h, 16).ok()) + { + out.push(h); + i += 3; + continue; + } + out.push(c); + i += 1; + } + String::from_utf8_lossy(&out).into_owned() +} + +/// Resolves a relationship target against the source part's folder into a part name. A +/// fragment is dropped, `\` reads as `/`, and `..` cannot climb out of the package. `%hh` +/// escapes are kept as written: [`Rels`](crate::Rels) decodes them when no part has the +/// escaped name. +pub fn resolve(dir: &str, target: &str) -> String { + let target = target.split('#').next().unwrap_or("").replace('\\', "/"); + let mut segs: Vec<&str> = if target.starts_with('/') { Vec::new() } else { dir.split('/').filter(|s| !s.is_empty()).collect() }; + for seg in target.split('/') { + match seg { + "" | "." => {} + ".." => { + segs.pop(); + } + s => segs.push(s), + } + } + segs.join("/") +} + +/// The relative reference from part `from` to part `to`, as a relationship target: +/// `word/document.xml` → `word/charts/chart1.xml` is `charts/chart1.xml`. +pub fn relative(from: &str, to: &str) -> String { + let from_dir: Vec<&str> = dir_of(from).split('/').filter(|s| !s.is_empty()).collect(); + let to: Vec<&str> = to.split('/').filter(|s| !s.is_empty()).collect(); + let to_dir = to.get(..to.len().saturating_sub(1)).unwrap_or(&[]); + let common = from_dir.iter().zip(to_dir).take_while(|(a, b)| a == b).count(); + let mut out: Vec<&str> = vec![".."; from_dir.len().saturating_sub(common)]; + out.extend(to.get(common..).unwrap_or(&[])); + let s = out.join("/"); + // A relative reference whose first segment has a colon would read as a URI scheme. + if s.split('/').next().is_some_and(|seg| seg.contains(':')) { format!("./{s}") } else { s } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn resolves_targets() { + assert_eq!(resolve("word", "media/image1.png"), "word/media/image1.png"); + assert_eq!(resolve("word", "../customXml/item1.xml"), "customXml/item1.xml"); + assert_eq!(resolve("word", "/word/styles.xml"), "word/styles.xml"); + assert_eq!(resolve("", "word/document.xml"), "word/document.xml"); + assert_eq!(resolve("word", "../../../x"), "x"); + assert_eq!(resolve("xl/worksheets", "../drawings/d1.xml"), "xl/drawings/d1.xml"); + assert_eq!(resolve("ppt/slides", "../media/a.png#frag"), "ppt/media/a.png"); + assert_eq!(resolve("ppt/slides", "..\\media\\image1.png"), "ppt/media/image1.png"); + assert_eq!(resolve("ppt/slides", "\\ppt\\media\\a.png"), "ppt/media/a.png"); + // An escaped `#` is part of the name, not a fragment. + assert_eq!(percent_decode(&resolve("ppt/slides", "../media/a%23b.png")), "ppt/media/a#b.png"); + } + + #[test] + fn percent_decoding_requires_two_hex_digits() { + assert_eq!(percent_decode("a%+5b.png"), "a%+5b.png"); + assert_eq!(percent_decode("a%20b.png"), "a b.png"); + assert_eq!(percent_decode("100%"), "100%"); + assert_eq!(percent_decode("%e2%82%ac"), "€"); + } + + #[test] + fn splits_and_names_relationship_parts() { + assert_eq!(split_dir("xl/workbook.xml"), ("xl", "workbook.xml")); + assert_eq!(split_dir("x.xml"), ("", "x.xml")); + assert_eq!(split_dir("/word/document.xml"), ("word", "document.xml")); + assert_eq!(rels_path("ppt/presentation.xml"), "ppt/_rels/presentation.xml.rels"); + assert_eq!(rels_path("[Content_Types].xml"), "_rels/[Content_Types].xml.rels"); + assert_eq!(rels_path(""), "_rels/.rels"); + assert_eq!(normalize("\\PPT\\Slides/Slide1.xml"), "ppt/slides/slide1.xml"); + } + + #[test] + fn relative_targets_resolve_back() { + for (from, to, want) in [ + ("word/document.xml", "word/charts/chart1.xml", "charts/chart1.xml"), + ("word/charts/chart1.xml", "word/embeddings/book.xlsx", "../embeddings/book.xlsx"), + ("word/charts/chart1.xml", "word/charts/colors1.xml", "colors1.xml"), + ("word/document.xml", "customXml/item1.xml", "../customXml/item1.xml"), + ("word/document.xml", "word/a:b.bin", "./a:b.bin"), + ("ppt/slides/slide1.xml", "ppt/media/image1.png", "../media/image1.png"), + ("ppt/presentation.xml", "ppt/slides/slide1.xml", "slides/slide1.xml"), + ("", "word/document.xml", "word/document.xml"), + ] { + let r = relative(from, to); + assert_eq!(r, want); + assert_eq!(resolve(dir_of(from), &r), to); + } + } +} diff --git a/crates/opc/src/read.rs b/crates/opc/src/read.rs new file mode 100644 index 000000000..0bb93f2e3 --- /dev/null +++ b/crates/opc/src/read.rs @@ -0,0 +1,342 @@ +//! Reading a package: every part up front ([`Package`]) or on demand ([`LazyPackage`]). + +use std::collections::hash_map::Entry; +use std::collections::{BTreeMap, HashMap, HashSet}; +use std::io::{Cursor, Read}; +use std::sync::Arc; + +use craft_xml::{El, Options}; + +use crate::guard::check_entry_count; +use crate::name::{normalize, rels_path}; +use crate::rels::{ContentTypes, Rels, targets_of}; +use crate::{Error, Limits, Oversized}; + +/// Most bytes reserved for a part before any of it has been read, whatever size it declares. +const MAX_PREALLOC: u64 = 16 * 1024 * 1024; + +type Zip<'a> = zip::ZipArchive>; + +fn open_zip<'a>(bytes: &'a [u8], limits: &Limits) -> Result, Error> { + // Before `zip` parses every entry the end record declares. + check_entry_count(bytes, limits.max_entries as u64)?; + let zip = zip::ZipArchive::new(Cursor::new(bytes)).map_err(|e| Error::Zip(e.to_string()))?; + if zip.len() > limits.max_entries { + return Err(Error::TooManyEntries { declared: zip.len() as u64, limit: limits.max_entries as u64 }); + } + Ok(zip) +} + +/// A part name as stored: `\` as `/` (code that splits paths on `/` must not meet a `\`), no +/// leading `/`. +fn stored_name(name: &str) -> String { + name.replace('\\', "/").trim_start_matches('/').to_string() +} + +/// The inflated parts of a package, within [`Limits`]. Shared, so a part the caller keeps as it +/// is (a picture, an embedded object) is handed over rather than copied. +#[derive(Clone, Debug, Default)] +pub struct Package { + files: BTreeMap>>, + /// Lowercased part name → its stored spelling: part names are case-insensitive (ECMA-376 + /// Part 2 §6.2.2.3), so every spelling is one part. + lower: HashMap, +} + +impl Package { + /// Inflates every part. + /// + /// An entry the archive cannot produce (a failed checksum, an unknown method) is left out + /// with a logged warning, and what it inflated is charged to [`Limits::max_work`]: an entry + /// inflates in full before its checksum is compared, so failed entries would otherwise + /// inflate without limit. A part over a limit refuses the package or is left out + /// ([`Limits::oversized`]). + pub fn open(bytes: &[u8], limits: &Limits) -> Result { + let mut zip = open_zip(bytes, limits)?; + let skip = limits.oversized == Oversized::Skip; + let mut files = BTreeMap::new(); + let (mut total, mut work) = (0u64, 0u64); + for i in 0..zip.len() { + if skip && work >= limits.max_work { + log::warn!("opc: decompression budget spent; skipping the remaining {} entries", zip.len().saturating_sub(i)); + break; + } + let mut f = match zip.by_index(i) { + Ok(f) => f, + Err(e) => { + log::warn!("opc: skipping unreadable zip entry {i}: {e}"); + continue; + } + }; + if f.is_dir() { + continue; + } + let name = match f.name() { + Ok(name) => stored_name(&name), + Err(e) => { + log::warn!("opc: skipping zip entry {i} with an unreadable name: {e}"); + continue; + } + }; + if f.size() > limits.max_part { + if skip { + log::warn!("opc: skipping oversized part {name} ({} bytes)", f.size()); + continue; + } + return Err(Error::PartTooLarge { part: name, limit: limits.max_part }); + } + let left = limits.max_total.saturating_sub(total).min(limits.max_work.saturating_sub(work)); + let room = limits.max_part.min(left); + let mut buf = Vec::with_capacity(f.size().min(MAX_PREALLOC) as usize); + let read = (&mut f).take(room.saturating_add(1)).read_to_end(&mut buf); + // Charged whether or not the part is kept. + work = work.saturating_add(buf.len() as u64); + if buf.len() as u64 > room { + if skip { + log::warn!("opc: part {name} exceeds size limits; skipped"); + continue; + } + return Err(if left < limits.max_part { + Error::PackageTooLarge { limit: limits.max_total.min(limits.max_work) } + } else { + Error::PartTooLarge { part: name, limit: limits.max_part } + }); + } + if let Err(e) = read { + log::warn!("opc: zip entry {name} unreadable: {e}"); + continue; + } + total = total.saturating_add(buf.len() as u64); + files.insert(name, Arc::new(buf)); + } + Ok(Package::new(files)) + } + + /// A package from parts already in memory (a Flat OPC file, a converted document), by part + /// name. + pub fn from_parts(files: BTreeMap>) -> Package { + Package::new(files.into_iter().map(|(name, bytes)| (stored_name(&name), Arc::new(bytes))).collect()) + } + + fn new(mut files: BTreeMap>>) -> Package { + let mut lower: HashMap = HashMap::new(); + let mut collides = false; + for name in files.keys() { + match lower.entry(name.to_ascii_lowercase()) { + Entry::Occupied(_) => collides = true, + Entry::Vacant(v) => { + v.insert(name.clone()); + } + } + } + if !collides { + return Package { files, lower }; + } + // Entries whose names differ only in case are one part, so every spelling of the name + // reaches the same stored entry. The spelling kept is the one a relationship names, so + // the part the document points at is the one read; the first in byte order only when no + // relationship names any of them. + let mut named = HashSet::new(); + for (name, bytes) in &files { + targets_of(name, bytes, |t| { + named.insert(t); + }); + } + for name in files.keys().rev().filter(|n| named.contains(n.as_str())) { + lower.insert(name.to_ascii_lowercase(), name.clone()); + } + let before = files.len(); + files.retain(|name, _| lower.get(&name.to_ascii_lowercase()) == Some(name)); + let dropped = before.saturating_sub(files.len()); + log::warn!("opc: {dropped} zip entries are other spellings of parts already read; they are left out"); + Package { files, lower } + } + + /// The bytes of all its parts. + pub fn size(&self) -> u64 { + self.files.values().map(|f| f.len() as u64).sum() + } + + /// Every part name as stored, in byte order. + pub fn names(&self) -> impl Iterator { + self.files.keys().map(String::as_str) + } + + /// The stored spelling of part `name` (leading `/` ignored; case-insensitive). + pub fn canonical(&self, name: &str) -> Option<&str> { + self.lower.get(&normalize(name)).map(String::as_str) + } + + /// Part bytes by name (leading `/` ignored; case-insensitive). + pub fn get(&self, name: &str) -> Option<&[u8]> { + self.get_shared(name).map(|v| v.as_slice()) + } + + /// [`Package::get`], as the shared bytes themselves: a part the caller keeps whole then + /// costs no copy. + pub fn get_shared(&self, name: &str) -> Option<&Arc>> { + self.canonical(name).and_then(|n| self.files.get(n)) + } + + /// Part `name` as XML, read with `options` (which carry the caller's limits and its choice + /// of names and strictness). `Ok(None)` when there is no such part. + pub fn xml(&self, name: &str, options: &Options) -> Result, Error> { + match self.get(name) { + Some(b) => options.parse(b).map(Some).map_err(|error| Error::Xml { part: name.to_string(), error }), + None => Ok(None), + } + } + + /// The relationships of `part` (from `dir/_rels/name.rels`); those of the package itself + /// for `""`. Internal targets name the part as stored, so a part reached under several + /// spellings is one part. A missing or unreadable relationships part gives none. + pub fn rels(&self, part: &str) -> Rels { + match self.get(&rels_path(part)) { + Some(bytes) => Rels::parse_in(bytes, part, |n| self.canonical(n).map(str::to_string)), + None => Rels::default(), + } + } + + /// `[Content_Types].xml`. + pub fn content_types(&self) -> ContentTypes { + self.get("[Content_Types].xml").map(ContentTypes::parse).unwrap_or_default() + } +} + +/// A package whose parts are inflated when they are asked for, against a running total: for a +/// reader that needs a few parts of a large file, or one part at a time. +pub struct LazyPackage<'a> { + zip: Zip<'a>, + /// Normalized part name → zip index (the first entry of a name). + names: HashMap, + total: u64, + limits: Limits, +} + +impl<'a> LazyPackage<'a> { + /// Indexes the archive. Nothing is inflated; [`Limits::max_work`] and + /// [`Limits::oversized`] are not used. + pub fn open(bytes: &'a [u8], limits: &Limits) -> Result, Error> { + let zip = open_zip(bytes, limits)?; + let mut names = HashMap::new(); + for i in 0..zip.len() { + if let Some(Ok(n)) = zip.name_for_index(i) { + names.entry(normalize(&n)).or_insert(i); + } + } + Ok(LazyPackage { zip, names, total: 0, limits: *limits }) + } + + /// Every part's normalized name ([`normalize`]), sorted. + pub fn names(&self) -> Vec<&str> { + let mut v: Vec<&str> = self.names.keys().map(String::as_str).collect(); + v.sort_unstable(); + v + } + + pub fn has(&self, part: &str) -> bool { + self.names.contains_key(&normalize(part)) + } + + /// Bytes charged to [`Limits::max_total`] so far. It is the whole of it once a read has + /// failed: see [`LazyPackage::read_limited`]. + pub fn spent(&self) -> u64 { + self.total + } + + /// A part's bytes, up to [`Limits::max_part`]; `Ok(None)` when it doesn't exist. + pub fn read(&mut self, part: &str) -> Result>, Error> { + self.read_limited(part, self.limits.max_part) + } + + /// A part the reader can do without (the caller warns and goes on when it fails). A read + /// that fails part-way is charged this part's whole allowance (`maximum`, and the byte that + /// detects an overrun) instead of ending the package's: the decompression work stays + /// bounded, and the parts read after it still open. + pub fn read_optional_limited(&mut self, part: &str, maximum: u64) -> Result>, Error> { + let before = self.total; + let read = self.read_limited(part, maximum); + if let Err(Error::Zip(_)) = &read { + self.total = before.saturating_add(maximum.min(self.limits.max_part).saturating_add(1)).min(self.limits.max_total); + } + read + } + + /// A part's bytes, up to `maximum` (and [`Limits::max_part`]): for a small metadata part + /// that must not expand to the general limit. + /// + /// A read that fails or overruns spends the whole of [`Limits::max_total`]: it has already + /// cost decompression work the total never saw, and a loop over many broken parts must not + /// pay it again and again. Every later read is then a cheap error. + pub fn read_limited(&mut self, part: &str, maximum: u64) -> Result>, Error> { + let maximum = maximum.min(self.limits.max_part); + let Some(&idx) = self.names.get(&normalize(part)) else { + return Ok(None); + }; + let mut f = self.zip.by_index(idx).map_err(|e| Error::Zip(format!("{part}: {e}")))?; + if f.size() > maximum { + return Err(Error::PartTooLarge { part: part.to_string(), limit: maximum }); + } + let remaining = self.limits.max_total.saturating_sub(self.total); + let limit = maximum.min(remaining); + let mut out = Vec::with_capacity(f.size().min(MAX_PREALLOC) as usize); + let read = (&mut f).take(limit.saturating_add(1)).read_to_end(&mut out); + if out.len() as u64 > limit { + self.total = self.limits.max_total; + return Err(if remaining < maximum { + Error::PackageTooLarge { limit: self.limits.max_total } + } else { + Error::PartTooLarge { part: part.to_string(), limit: maximum } + }); + } + if let Err(e) = read { + self.total = self.limits.max_total; + return Err(Error::Zip(format!("{part}: {e}"))); + } + self.total = self.total.saturating_add(out.len() as u64); + Ok(Some(out)) + } + + /// Part `name` as XML, read with `options`. `Ok(None)` when there is no such part. + pub fn read_xml(&mut self, part: &str, options: &Options) -> Result, Error> { + match self.read(part)? { + Some(b) => options.parse(&b).map(Some).map_err(|error| Error::Xml { part: part.to_string(), error }), + None => Ok(None), + } + } + + /// The relationships of `part`. A missing or unparseable relationships part gives none; one + /// that cannot be inflated is the error. + pub fn rels(&mut self, part: &str) -> Result { + let Some(bytes) = self.read(&rels_path(part))? else { return Ok(Rels::default()) }; + Ok(Rels::parse_in(&bytes, part, |n| self.has(n).then(|| n.to_string()))) + } +} + +/// The first part whose declared size is over [`Limits::max_part`], with that size: for telling +/// the user which part made a package too large. +pub fn declared_oversized(bytes: &[u8], limits: &Limits) -> Option<(String, u64)> { + let mut zip = open_zip(bytes, limits).ok()?; + (0..zip.len()).find_map(|i| { + let f = zip.by_index_raw(i).ok()?; + (f.size() > limits.max_part).then(|| (f.name().map(|n| n.into_owned()).unwrap_or_default(), f.size())) + }) +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::zip64_entry_count_sample; + + #[test] + fn a_package_declaring_too_many_entries_is_refused_before_zip_reads_them() { + let limits = Limits::new(20_000, 1 << 20, 1 << 20); + let bomb = zip64_entry_count_sample(20_001); + let refused = Some(Error::TooManyEntries { declared: 20_001, limit: 20_000 }); + assert_eq!(Package::open(&bomb, &limits).err(), refused); + assert_eq!(LazyPackage::open(&bomb, &limits).err(), refused); + assert!(declared_oversized(&bomb, &limits).is_none()); + // Within the limit, the same archive is the `zip` crate's to judge. + assert!(!matches!(Package::open(&zip64_entry_count_sample(5), &limits), Err(Error::TooManyEntries { .. }))); + } +} diff --git a/crates/opc/src/rels.rs b/crates/opc/src/rels.rs new file mode 100644 index 000000000..6e0b7d457 --- /dev/null +++ b/crates/opc/src/rels.rs @@ -0,0 +1,243 @@ +//! Relationships (`_rels/*.rels`) and content types (`[Content_Types].xml`). + +use std::collections::HashMap; + +use craft_xml::{El, Local, Options}; + +use crate::name::{dir_of, normalize, percent_decode, resolve}; + +/// Is relationship type `t` the type `ty`? `ty` is a full type URI or its last segment +/// (`image`). Only the last segment is compared when the URIs differ, so the transitional, +/// strict and vendor spellings of one type are the same type. +pub fn type_is(t: &str, ty: &str) -> bool { + fn tail(s: &str) -> &str { + s.rsplit('/').next().unwrap_or(s) + } + t == ty || tail(t) == tail(ty) +} + +/// One relationship. +#[derive(Clone, Debug, Default, PartialEq, Eq)] +pub struct Rel { + pub id: String, + /// The full relationship type URI. + pub ty: String, + /// `Target` as the relationships part writes it (a relative reference or a URL). + pub target_raw: String, + /// The part name for an internal target, spelled as the package stores it when the package + /// has the part; the URL for an external one. + pub target: String, + pub external: bool, +} + +impl Rel { + /// The last segment of the type (`slide`, `image`, `styles`…): the same for the + /// transitional and strict namespaces. + pub fn kind(&self) -> &str { + self.ty.rsplit('/').next().unwrap_or(&self.ty) + } +} + +/// The relationships of one part, in document order. +#[derive(Clone, Debug, Default)] +pub struct Rels { + pub list: Vec, + /// Each id's first relationship in `list`, so a lookup doesn't scan every relationship. + ids: HashMap, +} + +impl Rels { + /// The relationships of `part` from the bytes of its relationships part. Internal targets + /// resolve against `part`'s folder, with `%hh` escapes decoded. Unreadable XML gives what + /// was read before the damage, or nothing. + pub fn parse(bytes: &[u8], part: &str) -> Rels { + Rels::parse_in(bytes, part, |_| None) + } + + /// [`Rels::parse`] for a package: `stored` gives the stored spelling of a part name, or + /// `None` when the package has no such part. A target is looked up as written, then with + /// its `%hh` escapes decoded. + pub fn parse_in(bytes: &[u8], part: &str, stored: impl Fn(&str) -> Option) -> Rels { + match Options::local().parse(bytes) { + Ok(root) => Rels::from_el(&root, part, stored), + Err(e) => { + log::warn!("opc: ignoring unreadable relationships of {part}: {e}"); + Rels::default() + } + } + } + + fn from_el(root: &El, part: &str, stored: impl Fn(&str) -> Option) -> Rels { + let dir = dir_of(part); + let mut rels = Rels::default(); + for r in root.children(Local("Relationship")) { + let (Some(id), Some(target)) = (r.attr("Id"), r.attr("Target")) else { continue }; + let external = r.attr("TargetMode").is_some_and(|m| m.eq_ignore_ascii_case("External")); + let resolved = if external { + target.to_string() + } else { + let path = resolve(dir, target); + stored(&path).unwrap_or_else(|| { + let decoded = percent_decode(&path); + stored(&decoded).unwrap_or(decoded) + }) + }; + rels.ids.entry(id.to_string()).or_insert(rels.list.len()); + rels.list.push(Rel { + id: id.to_string(), + ty: r.attr("Type").unwrap_or("").to_string(), + target_raw: target.to_string(), + target: resolved, + external, + }); + } + rels + } + + /// The relationship with this id: the first, when a damaged part repeats one. + pub fn by_id(&self, id: &str) -> Option<&Rel> { + self.ids.get(id).and_then(|&i| self.list.get(i)) + } + /// The target of the relationship with this id. + pub fn target(&self, id: &str) -> Option<&str> { + self.by_id(id).map(|r| r.target.as_str()) + } + /// The first relationship of type `ty` ([`type_is`]: a full URI or a last segment). + pub fn first(&self, ty: &str) -> Option<&Rel> { + self.list.iter().find(|r| type_is(&r.ty, ty)) + } + /// Every relationship of type `ty`. + pub fn all<'a>(&'a self, ty: &'a str) -> impl Iterator + 'a { + self.list.iter().filter(move |r| type_is(&r.ty, ty)) + } +} + +/// Every internal part name the relationships part `name` (with bytes `bytes`) targets, as +/// written and with escapes decoded. +pub(crate) fn targets_of(name: &str, bytes: &[u8], mut each: impl FnMut(String)) { + // `dir/_rels/file.rels` relates `dir/file`, so its targets resolve against `dir`. + let lower = name.to_ascii_lowercase(); + let Some(at) = lower.rfind("_rels/").filter(|_| lower.ends_with(".rels")) else { return }; + let dir = name.get(..at).unwrap_or("").trim_end_matches('/'); + let Ok(root) = Options::local().parse(bytes) else { return }; + for r in root.children(Local("Relationship")) { + let external = r.attr("TargetMode").is_some_and(|m| m.eq_ignore_ascii_case("External")); + if let (Some(target), false) = (r.attr("Target"), external) { + let path = resolve(dir, target); + let decoded = percent_decode(&path); + if decoded != path { + each(decoded); + } + each(path); + } + } +} + +/// `[Content_Types].xml`: Override by part name, then Default by extension (both +/// case-insensitive). The first entry for a name or an extension wins. +#[derive(Clone, Debug, Default)] +pub struct ContentTypes { + overrides: HashMap, + defaults: HashMap, +} + +impl ContentTypes { + /// Unreadable XML gives no content types. + pub fn parse(bytes: &[u8]) -> ContentTypes { + let mut ct = ContentTypes::default(); + let root = match Options::local().parse(bytes) { + Ok(root) => root, + Err(e) => { + log::warn!("opc: ignoring unreadable [Content_Types].xml: {e}"); + return ct; + } + }; + for e in root.elements() { + let Some(t) = e.attr("ContentType") else { continue }; + let (map, key) = match (e.name.as_str(), e.attr("PartName"), e.attr("Extension")) { + ("Override", Some(part), _) => (&mut ct.overrides, normalize(part)), + ("Default", _, Some(ext)) => (&mut ct.defaults, ext.to_ascii_lowercase()), + _ => continue, + }; + map.entry(key).or_insert_with(|| t.to_string()); + } + ct + } + + /// The content type of `part`. + pub fn of(&self, part: &str) -> Option<&str> { + let part = normalize(part); + if let Some(t) = self.overrides.get(&part) { + return Some(t); + } + let ext = part.rsplit_once('.').map(|(_, e)| e)?; + self.defaults.get(ext).map(String::as_str) + } +} + +#[cfg(test)] +mod tests { + use super::*; + use crate::{NS_RELATIONSHIPS, RT_BASE}; + + #[test] + fn types_compare_by_last_segment() { + let strict = "http://purl.oclc.org/ooxml/officeDocument/relationships/image"; + assert!(type_is(strict, &format!("{RT_BASE}image"))); + assert!(type_is(strict, "image")); + assert!(type_is("image", "image")); + assert!(!type_is(strict, "images")); + assert!(!type_is(&format!("{RT_BASE}notimage"), "image")); + assert!(!type_is("", "image")); + } + + #[test] + fn many_relationships_are_found_by_index_and_first_id_wins() { + let n = 50_000; + let mut x = format!(r#""#); + for i in 0..n { + x.push_str(&format!(r#""#)); + } + x.push_str(&format!(r#""#)); + let rels = Rels::parse(x.as_bytes(), "ppt/slides/slide1.xml"); + assert_eq!(rels.target("rId0"), Some("ppt/media/image0.png"), "the first of a repeated id wins"); + assert!((0..n).all(|i| rels.target(&format!("rId{i}")) == Some(&*format!("ppt/media/image{i}.png")))); + assert!(rels.by_id(&format!("rId{n}")).is_none()); + assert_eq!(rels.all("image").count(), n + 1); + } + + #[test] + fn targets_keep_what_was_written_and_resolve() { + let x = format!( + r#""# + ); + let rels = Rels::parse(x.as_bytes(), "/ppt/slides/slide1.xml"); + assert_eq!(rels.list.len(), 2, "a relationship without an id is left out"); + let a = rels.by_id("a").unwrap(); + assert_eq!((a.target.as_str(), a.target_raw.as_str(), a.kind(), a.external), ("ppt/media/a b.png", "../media/a%20b.png#x", "image", false)); + let b = rels.first("hyperlink").unwrap(); + assert_eq!((b.target.as_str(), b.external), ("https://example.com/a%20b", true), "an external target is not resolved"); + assert!(Rels::parse(b""#; + let stored = |n: &str| ["word/a%20b.png", "word/C d.png"].iter().find(|s| s.eq_ignore_ascii_case(n)).map(|s| s.to_string()); + let rels = Rels::parse_in(x.as_bytes(), "word/document.xml", stored); + assert_eq!(rels.target("a"), Some("word/a%20b.png")); + assert_eq!(rels.target("b"), Some("word/C d.png"), "decoded, in the stored spelling"); + } + + #[test] + fn content_types_by_override_then_extension() { + let ct = ContentTypes::parse( + br#""#, + ); + assert_eq!(ct.of("word/document.xml"), Some("main"), "the first override wins, in any case"); + assert_eq!(ct.of("/word/media/A.PNG"), Some("image/png")); + assert_eq!(ct.of("word/styles.xml"), None); + assert_eq!(ct.of("noextension"), None); + assert_eq!(ContentTypes::parse(b" Compression { + const PACKED: [&str; 19] = + ["png", "jpg", "jpeg", "gif", "webp", "mp4", "m4v", "m4a", "mov", "mp3", "wmv", "wma", "avi", "ogg", "webm", "zip", "docx", "xlsx", "pptx"]; + let ext = name.rsplit_once('.').map_or("", |(_, e)| e); + if PACKED.iter().any(|p| ext.eq_ignore_ascii_case(p)) { Compression::Store } else { Compression::Deflate } +} + +/// A ZIP archive being written. The output is deterministic: deflate level 6 and the same +/// (1980) timestamp on every entry. +pub struct ZipOut { + zip: zip::ZipWriter>>, +} + +impl Default for ZipOut { + fn default() -> ZipOut { + ZipOut { zip: zip::ZipWriter::new(Cursor::new(Vec::new())) } + } +} + +impl ZipOut { + pub fn new() -> ZipOut { + ZipOut::default() + } + + /// Adds an entry. The caller keeps names unique. + pub fn add(&mut self, name: &str, data: &[u8], compression: Compression) -> Result<(), Error> { + let method = match compression { + Compression::Deflate => zip::CompressionMethod::Deflated, + Compression::Store => zip::CompressionMethod::Stored, + }; + let opts = zip::write::SimpleFileOptions::default() + .compression_method(method) + .compression_level((compression == Compression::Deflate).then_some(6)) + .last_modified_time(zip::DateTime::default()) + // Deflate can grow incompressible data a little, so well before 4 GiB. + .large_file(data.len() as u64 >= u64::from(u32::MAX) / 2); + self.zip.start_file(name, opts).map_err(|e| Error::Write(e.to_string()))?; + self.zip.write_all(data).map_err(|e| Error::Write(e.to_string())) + } + + pub fn finish(self) -> Result, Error> { + self.zip.finish().map(Cursor::into_inner).map_err(|e| Error::Write(e.to_string())) + } +} + +/// A ZIP archive of `entries` in order, each stored as [`compression_for`] its name says. +pub fn zip_entries(entries: &[(String, Vec)]) -> Result, Error> { + let mut zip = ZipOut::new(); + for (name, bytes) in entries { + zip.add(name, bytes, compression_for(name))?; + } + zip.finish() +} + +/// One relationship being written. +#[derive(Clone, Debug, PartialEq, Eq)] +pub struct RelOut { + pub id: String, + /// The full relationship type URI. + pub ty: String, + pub target: String, + pub external: bool, +} + +/// The relationships being built for one part. Ids are `rId1`, `rId2`… in the order added. +#[derive(Clone, Debug, Default)] +pub struct RelsOut { + pub items: Vec, + /// (type, target, external) → id of the first relationship made for it. + added: HashMap<(String, String, bool), String>, +} + +fn full_type(kind: &str) -> String { + if kind.starts_with("http") { kind.to_string() } else { format!("{RT_BASE}{kind}") } +} + +impl RelsOut { + /// Adds a relationship, or reuses the one already made for this type, target and mode. + /// `kind` is a full type URI or a last segment of the standard namespace ([`RT_BASE`]). + /// Returns its id. + pub fn add(&mut self, kind: &str, target: &str, external: bool) -> String { + let key = (full_type(kind), target.to_string(), external); + match self.added.get(&key) { + Some(id) => id.clone(), + None => self.add_new(kind, target, external), + } + } + + /// Always adds a new relationship, even if an identical one exists. [`RelsOut::add`] reuses + /// the first relationship for a target, whichever call made it. + pub fn add_new(&mut self, kind: &str, target: &str, external: bool) -> String { + let ty = full_type(kind); + let id = format!("rId{}", self.items.len() + 1); + self.added.entry((ty.clone(), target.to_string(), external)).or_insert_with(|| id.clone()); + self.items.push(RelOut { id: id.clone(), ty, target: target.to_string(), external }); + id + } + + pub fn is_empty(&self) -> bool { + self.items.is_empty() + } + + /// The relationships part. + pub fn to_xml(&self) -> Vec { + let mut w = Writer::document(); + w.open("Relationships", &[("xmlns", NS_RELATIONSHIPS)]); + for r in &self.items { + w.tag("Relationship") + .attr("Id", &r.id) + .attr("Type", &r.ty) + .attr("Target", &r.target) + .attr_opt("TargetMode", r.external.then_some("External")) + .empty(); + } + w.into_bytes() + } +} + +/// A package being written: parts, their content types, and `[Content_Types].xml` as the first +/// entry. +pub struct PackageOut { + files: Vec<(String, Vec, Compression)>, + defaults: Vec<(String, String)>, + overrides: Vec<(String, String)>, +} + +impl Default for PackageOut { + fn default() -> PackageOut { + PackageOut { + files: Vec::new(), + defaults: vec![("rels".into(), CT_RELATIONSHIPS.into()), ("xml".into(), "application/xml".into())], + overrides: Vec::new(), + } + } +} + +impl PackageOut { + /// Adds an XML part with a content type Override. + pub fn xml_part(&mut self, name: &str, content_type: &str, data: Vec) { + self.overrides.push((format!("/{name}"), content_type.to_string())); + self.files.push((name.to_string(), data, Compression::Deflate)); + } + + /// Adds (or replaces) the relationships part of `part`; of the package itself for `""`. + /// Nothing is written for no relationships. + pub fn rels(&mut self, part: &str, rels: &RelsOut) { + if rels.is_empty() { + return; + } + let path = rels_path(part); + match self.files.iter_mut().find(|(name, ..)| *name == path) { + Some(existing) => existing.1 = rels.to_xml(), + None => self.files.push((path, rels.to_xml(), Compression::Deflate)), + } + } + + /// Adds a part with no content type entry of its own: one the `rels` and `xml` Defaults + /// cover. + pub fn raw(&mut self, name: &str, data: Vec) { + self.files.push((name.to_string(), data, compression_for(name))); + } + + /// Adds a binary part. Its extension gets a Default content type; when the extension + /// already has another, the part gets an Override. + pub fn binary(&mut self, name: &str, content_type: &str, data: Vec) { + let ext = name.rsplit('.').next().unwrap_or("bin").to_ascii_lowercase(); + if !self.defaults.iter().any(|(e, _)| *e == ext) { + self.defaults.push((ext, content_type.to_string())); + } else if !self.defaults.iter().any(|(e, c)| *e == ext && c == content_type) { + self.overrides.push((format!("/{name}"), content_type.to_string())); + } + self.files.push((name.to_string(), data, compression_for(name))); + } + + /// `[Content_Types].xml` for what has been added. + pub fn content_types_xml(&self) -> Vec { + let mut w = Writer::document(); + w.open("Types", &[("xmlns", NS_CONTENT_TYPES)]); + for (e, c) in &self.defaults { + w.empty("Default", &[("Extension", e), ("ContentType", c)]); + } + for (p, c) in &self.overrides { + w.empty("Override", &[("PartName", p), ("ContentType", c)]); + } + w.into_bytes() + } + + /// The archive. A second part under a name already written (in any case) is left out with + /// a logged warning: entry names must be unique, or readers reject the package or resolve + /// it differently. + pub fn finish(self) -> Result, Error> { + let mut zip = ZipOut::new(); + zip.add("[Content_Types].xml", &self.content_types_xml(), Compression::Deflate)?; + let mut written = HashSet::new(); + for (name, data, compression) in &self.files { + if !written.insert(normalize(name)) { + log::warn!("opc: part {name} written twice; keeping the first"); + continue; + } + zip.add(name, data, *compression)?; + } + zip.finish() + } +} diff --git a/crates/opc/tests/package.rs b/crates/opc/tests/package.rs new file mode 100644 index 000000000..67e8ac924 --- /dev/null +++ b/crates/opc/tests/package.rs @@ -0,0 +1,350 @@ +//! The package readers and writer against the cases the DOCX, XLSX and PPTX readers they came +//! from were tested with. + +use std::collections::BTreeMap; +use std::io::{Cursor, Write}; +use std::sync::Arc; + +use craft_opc::{ + Compression, Error, LazyPackage, Limits, Oversized, Package, PackageOut, RT_BASE, RelsOut, ZipOut, compression_for, declared_oversized, + zip_entries, +}; + +const LIMITS: Limits = Limits::new(20_000, 256 << 20, 512 << 20); + +fn limits(max_part: u64, max_total: u64) -> Limits { + Limits::new(20_000, max_part, max_total) +} + +fn zip_of(entries: &[(&str, Vec)]) -> Vec { + let e: Vec<(String, Vec)> = entries.iter().map(|(n, b)| (n.to_string(), b.clone())).collect(); + zip_entries(&e).unwrap() +} + +/// Flips the stored checksum of every entry, in its central and local header. +fn break_checksums(z: &mut [u8]) -> usize { + let mut patched = 0; + for sig in [[0x50u8, 0x4B, 0x01, 0x02], [0x50, 0x4B, 0x03, 0x04]] { + let crc_at = if sig[2] == 1 { 16 } else { 14 }; + let found: Vec = z.windows(4).enumerate().filter(|(_, w)| *w == sig).map(|(i, _)| i).collect(); + for pos in found { + z[pos + crc_at] ^= 0xFF; + patched += 1; + } + } + patched +} + +#[test] +fn case_colliding_entries_are_one_part() { + let z = zip_of(&[("word/media/Image.png", b"upper".to_vec()), ("word/media/image.png", b"lower".to_vec())]); + let p = Package::open(&z, &LIMITS).unwrap(); + for spelling in ["word/media/Image.png", "word/media/image.png", "/WORD/MEDIA/IMAGE.PNG", "word\\media\\image.png"] { + assert_eq!(p.canonical(spelling), Some("word/media/Image.png"), "{spelling}"); + assert_eq!(p.get(spelling), Some(&b"upper"[..]), "{spelling}"); + } + assert_eq!(p.names().count(), 1); +} + +#[test] +fn the_spelling_a_relationship_names_is_kept() { + // The first spelling in byte order ("Image.png") was kept even when the document's + // relationship named the other one, so the picture shown was not the one it pointed at. + let rels = r#""#; + let z = zip_of(&[ + ("word/_rels/document.xml.rels", rels.as_bytes().to_vec()), + ("word/media/Image.png", b"upper".to_vec()), + ("word/media/image.png", b"lower".to_vec()), + ("word/media/Other.png", b"first".to_vec()), + ("word/media/other.png", b"second".to_vec()), + ("word/media/Spaced name.png", b"one".to_vec()), + ("word/media/SPACED name.png", b"two".to_vec()), + ]); + let p = Package::open(&z, &LIMITS).unwrap(); + assert_eq!(p.canonical("word/media/IMAGE.png"), Some("word/media/image.png")); + assert_eq!(p.get("word/media/Image.png"), Some(&b"lower"[..])); + assert_eq!(p.get("word/media/OTHER.PNG"), Some(&b"first"[..]), "no relationship names it: first in byte order"); + assert_eq!(p.get("word/media/spaced name.png"), Some(&b"two"[..]), "named with an escape"); + assert_eq!(p.names().count(), 4); + let r = p.rels("word/document.xml"); + assert_eq!(r.target("rId1"), Some("word/media/image.png")); + assert_eq!(r.target("rId2"), Some("word/media/SPACED name.png")); +} + +#[test] +fn the_entry_count_zip_finds_is_checked() { + let z = zip_of(&[("a", vec![]), ("b", vec![]), ("c", vec![])]); + let two = Limits::new(2, 100, 100); + assert_eq!(Package::open(&z, &two).err(), Some(Error::TooManyEntries { declared: 3, limit: 2 })); + assert_eq!(LazyPackage::open(&z, &two).err(), Some(Error::TooManyEntries { declared: 3, limit: 2 })); + assert!(Package::open(&z, &two).is_err_and(|e| e.is_limit())); + assert!(Package::open(&z, &Limits::new(3, 100, 100)).is_ok()); + assert!(matches!(Package::open(b"not a zip", &LIMITS), Err(Error::Zip(e)) if !Error::Zip(e.clone()).is_limit())); +} + +#[test] +fn relationships_are_looked_up_by_id_the_first_one_winning() { + let mut rels = String::from(r#""#); + for i in 0..20_000 { + rels.push_str(&format!(r#""#)); + } + rels.push_str(r#""#); + let z = zip_of(&[("word/_rels/document.xml.rels", rels.into_bytes())]); + let r = Package::open(&z, &LIMITS).unwrap().rels("word/document.xml"); + assert_eq!(r.by_id("rId7").map(|r| r.target.as_str()), Some("https://example.com/7"), "the first rId7 wins"); + assert_eq!(r.by_id("rId19999").map(|r| r.target.as_str()), Some("https://example.com/19999")); + assert!(r.by_id("rId20000").is_none()); + assert_eq!((0..20_000).filter(|i| r.by_id(&format!("rId{i}")).is_some()).count(), 20_000); +} + +#[test] +fn decompression_bomb_is_rejected() { + let z = zip_of(&[("word/document.xml", vec![b' '; 2_000_000])]); + assert!(z.len() < 100_000); + assert_eq!( + Package::open(&z, &limits(1_000_000, 10_000_000)).err(), + Some(Error::PartTooLarge { part: "word/document.xml".into(), limit: 1_000_000 }) + ); + assert_eq!(Package::open(&z, &limits(10_000_000, 1_000_000)).err(), Some(Error::PackageTooLarge { limit: 1_000_000 })); + assert_eq!(Package::open(&z, &limits(10_000_000, 10_000_000)).map(|p| p.size()), Ok(2_000_000)); +} + +#[test] +fn entries_that_fail_their_check_still_count_against_the_total() { + // Each entry inflates in full before its CRC is checked; a failed one dropped without being + // charged would let any number of them inflate. + let names: Vec = (0..20).map(|i| format!("p{i}.bin")).collect(); + let entries: Vec<(&str, Vec)> = names.iter().map(|n| (n.as_str(), vec![0u8; 1_000_000])).collect(); + let mut z = zip_of(&entries); + assert_eq!(break_checksums(&mut z), 40); + assert_eq!(Package::open(&z, &limits(2_000_000, 4_000_000)).err(), Some(Error::PackageTooLarge { limit: 4_000_000 })); + // With room for all of them the damaged entries are left out, not fatal. + let p = Package::open(&z, &limits(2_000_000, 40_000_000)).unwrap(); + assert_eq!(p.names().count(), 0); +} + +#[test] +fn lying_declared_size_is_rejected_or_bounded() { + let mut z = zip_of(&[("a.xml", b"".to_vec())]); + // Patch the uncompressed size in the central directory and local header to ~4 GB. + let mut patched = 0; + for sig in [[0x50u8, 0x4B, 0x01, 0x02], [0x50, 0x4B, 0x03, 0x04]] { + if let Some(pos) = z.windows(4).position(|w| w == sig) { + let off = if sig[2] == 1 { pos + 24 } else { pos + 22 }; + z[off..off + 4].copy_from_slice(&0xFFFF_FFF0u32.to_le_bytes()); + patched += 1; + } + } + assert_eq!(patched, 2); + assert_eq!(declared_oversized(&z, &LIMITS), Some(("a.xml".to_string(), 0xFFFF_FFF0))); + match Package::open(&z, &LIMITS) { + Err(_) => {} + Ok(p) => assert!(p.get("a.xml").is_none_or(|b| b.len() < 1024)), + } + let mut lazy = LazyPackage::open(&z, &LIMITS).unwrap(); + assert!(lazy.read("a.xml").is_err()); +} + +#[test] +fn parts_are_shared_not_copied() { + let z = zip_of(&[("word/media/pic.png", b"\x89PNG picture bytes".to_vec())]); + let pkg = Package::open(&z, &LIMITS).unwrap(); + let held = Arc::clone(pkg.get_shared("/WORD/media/PIC.png").unwrap()); + assert!(Arc::ptr_eq(&held, pkg.get_shared("word/media/pic.png").unwrap())); + assert_eq!(pkg.get("word/media/pic.png"), Some(&b"\x89PNG picture bytes"[..])); +} + +#[test] +fn skipped_parts_count_against_the_inflate_budget() { + // Kept bytes cap at 100: b, c and d are inflated past what's left and left out. That work + // is charged, so after d the budget (130) is spent and e is not read, although it would + // have fit. + let mut zw = zip::ZipWriter::new(Cursor::new(Vec::new())); + let o = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated); + for (name, len) in [("a", 80), ("b", 80), ("c", 80), ("d", 80), ("e", 5), ("big", 2000)] { + zw.start_file(name, o).unwrap(); + zw.write_all(&vec![b'x'; len]).unwrap(); + } + let z = zw.finish().unwrap().into_inner(); + let skip = |max_work| Limits { max_entries: 100, max_part: 1000, max_total: 100, max_work, oversized: Oversized::Skip }; + let p = Package::open(&z, &skip(130)).unwrap(); + assert!(p.get("a").is_some()); + assert!(p.get("b").is_none() && p.get("d").is_none()); + assert!(p.get("e").is_none(), "the inflate budget stops reading"); + // With room to spare the same small part is kept, and a part declaring more than the part + // limit is left out without being inflated. + let p = Package::open(&z, &skip(10_000)).unwrap(); + assert!(p.get("e").is_some()); + assert!(p.get("big").is_none()); + assert_eq!(p.size(), 85); + // The same package under `Refuse` is an error at the first part that does not fit. + let refuse = Limits { oversized: Oversized::Refuse, ..skip(10_000) }; + assert_eq!(Package::open(&z, &refuse).err(), Some(Error::PackageTooLarge { limit: 100 })); +} + +#[test] +fn backslash_zip_entry_names_are_found() { + let z = zip_of(&[("PPT\\Slides\\Slide1.xml", b"".to_vec()), ("/docProps/core.xml", b"".to_vec())]); + let p = Package::open(&z, &LIMITS).unwrap(); + assert!(p.get("ppt/slides/slide1.xml").is_some()); + assert_eq!(p.canonical("ppt/slides/slide1.xml"), Some("PPT/Slides/Slide1.xml")); + assert_eq!(p.canonical("docprops/core.xml"), Some("docProps/core.xml")); + let mut lazy = LazyPackage::open(&z, &LIMITS).unwrap(); + assert_eq!(lazy.names(), ["docprops/core.xml", "ppt/slides/slide1.xml"]); + assert_eq!(lazy.read("PPT/slides/slide1.xml").unwrap().as_deref(), Some(&b""[..])); +} + +#[test] +fn xml_parts_are_read_with_the_callers_options() { + let z = zip_of(&[("a.xml", b"".to_vec()), ("bad.xml", b"".to_vec())]); + let p = Package::open(&z, &LIMITS).unwrap(); + let local = craft_xml::Options::local(); + assert_eq!(p.xml("a.xml", &local).unwrap().map(|e| e.name), Some("a".to_string())); + assert_eq!(p.xml("a.xml", &craft_xml::Options::default()).unwrap().map(|e| e.name), Some("w:a".to_string())); + assert_eq!(p.xml("missing.xml", &local), Ok(None)); + assert!(p.xml("bad.xml", &local).unwrap().is_some(), "lenient"); + assert!(matches!(p.xml("bad.xml", &local.strict()), Err(Error::Xml { part, .. }) if part == "bad.xml")); + let tiny = local.with_limits(craft_xml::Limits { max_nodes: 1, ..craft_xml::Limits::DEFAULT }); + assert!(p.xml("a.xml", &tiny).is_err_and(|e| e.is_limit())); + let mut lazy = LazyPackage::open(&z, &LIMITS).unwrap(); + assert_eq!(lazy.read_xml("a.xml", &local).unwrap().map(|e| e.name), Some("a".to_string())); + assert!(lazy.read_xml("bad.xml", &local.strict()).is_err()); +} + +#[test] +fn from_parts_behaves_like_an_opened_package() { + let mut parts = BTreeMap::new(); + parts.insert("/word/document.xml".to_string(), b"".to_vec()); + parts.insert( + "word/_rels/document.xml.rels".to_string(), + br#""#.to_vec(), + ); + parts.insert("word/styles.xml".to_string(), b"".to_vec()); + let p = Package::from_parts(parts); + assert_eq!(p.get("word/document.xml"), Some(&b""[..])); + assert_eq!(p.rels("word/document.xml").first("styles").map(|r| r.target.as_str()), Some("word/styles.xml"), "the stored spelling"); + assert!(p.rels("word/styles.xml").list.is_empty()); + assert_eq!(p.content_types().of("word/document.xml"), None); +} + +/// An over-budget read must spend the package's allowance once and for all: loops over many +/// broken parts otherwise re-decompress the remaining allowance again and again. +#[test] +fn a_failed_lazy_read_ends_the_package_budget() { + let z = zip_of(&[("a.xml", b"0123456789".to_vec()), ("b.xml", b"hello".to_vec())]); + let mut pkg = LazyPackage::open(&z, &limits(100, 12)).unwrap(); + assert!(pkg.has("A.xml") && !pkg.has("c.xml")); + assert_eq!(pkg.read("c.xml"), Ok(None)); + assert!(pkg.read("a.xml").unwrap().is_some()); + assert_eq!(pkg.spent(), 10); + assert_eq!(pkg.read("b.xml"), Err(Error::PackageTooLarge { limit: 12 })); + assert_eq!(pkg.spent(), 12, "the failed read is charged"); + assert_eq!(pkg.read("b.xml"), Err(Error::PackageTooLarge { limit: 12 })); + // The per-read maximum is its own error and costs nothing: the declared size is enough. + let mut pkg = LazyPackage::open(&z, &limits(100, 100)).unwrap(); + assert_eq!(pkg.read_limited("a.xml", 4), Err(Error::PartTooLarge { part: "a.xml".into(), limit: 4 })); + assert_eq!(pkg.spent(), 0); + assert_eq!(pkg.read_limited("b.xml", 5).unwrap().as_deref(), Some(&b"hello"[..])); +} + +/// A part the reader can do without, damaged inside an intact archive, costs its own +/// allowance: the parts after it are still read. +#[test] +fn a_damaged_optional_part_costs_only_its_allowance() { + let mut w = ZipOut::new(); + w.add("a.xml", b"damaged", Compression::Store).unwrap(); + w.add("b.xml", b"hello", Compression::Deflate).unwrap(); + w.add( + "xl/_rels/workbook.xml.rels", + b"", + Compression::Deflate, + ) + .unwrap(); + let mut z = w.finish().unwrap(); + let at = z.windows(7).position(|x| x == b"damaged").unwrap(); + z[at] ^= 0x20; + let max_total = 1 << 20; + let mut pkg = LazyPackage::open(&z, &limits(1 << 16, max_total)).unwrap(); + assert!(matches!(pkg.read_optional_limited("a.xml", 1024), Err(Error::Zip(_)))); + assert_eq!(pkg.spent(), 1025, "the failed read is charged its allowance"); + assert_eq!(pkg.read("b.xml").unwrap().as_deref(), Some(&b"hello"[..])); + let rels = pkg.rels("xl/workbook.xml").unwrap(); + assert_eq!(rels.first("worksheet").map(|r| (r.target.as_str(), r.kind())), Some(("B.XML", "worksheet"))); + assert!(pkg.rels("xl/styles.xml").unwrap().list.is_empty()); + // An ordinary read of it still ends the package's budget. + assert!(pkg.read("a.xml").is_err()); + assert_eq!(pkg.spent(), max_total); +} + +#[test] +fn relationships_being_written_reuse_identical_targets() { + let n = 5_000; + let mut out = RelsOut::default(); + let ids: Vec = (0..n).map(|i| out.add("hyperlink", &format!("https://example.com/{i}"), true)).collect(); + assert_eq!(out.add("hyperlink", "https://example.com/7", true), ids[7], "an identical target reuses its id"); + assert_eq!(out.add("hyperlink", "https://example.com/7", false), format!("rId{}", n + 1), "internal is distinct"); + let fresh = out.add_new("image", "../media/a.png", false); + assert_ne!(out.add_new("image", "../media/a.png", false), fresh); + assert_eq!(out.add("image", "../media/a.png", false), fresh, "add reuses the first add_new made"); + assert_eq!(out.add("http://schemas.microsoft.com/office/2007/relationships/media", "a&b.mp4", false), format!("rId{}", n + 4)); + let back = craft_opc::Rels::parse(&out.to_xml(), "ppt/slides/slide1.xml"); + assert_eq!(back.list.len(), n + 4); + assert_eq!(back.by_id(&fresh).map(|r| (r.ty.clone(), r.target.as_str())), Some((format!("{RT_BASE}image"), "ppt/media/a.png"))); + assert_eq!(back.first("media").map(|r| r.target_raw.as_str()), Some("a&b.mp4"), "escaped on the way out"); + assert!(back.by_id("rId8").is_some_and(|r| r.external)); +} + +#[test] +fn a_written_package_reads_back() { + let mut out = PackageOut::default(); + out.xml_part("ppt/presentation.xml", "application/presentation+xml", b"

".to_vec()); + out.binary("ppt/media/image1.png", "image/png", b"png".to_vec()); + out.binary("ppt/media/image2.png", "image/png", b"png2".to_vec()); + out.binary("ppt/media/odd.png", "image/x-odd", b"odd".to_vec()); + out.raw("docProps/thumbnail.xml", b"".to_vec()); + out.xml_part("PPT/Presentation.xml", "second", b"".to_vec()); + let mut rels = RelsOut::default(); + let id = rels.add("image", "media/image1.png", false); + out.rels("ppt/presentation.xml", &RelsOut::default()); + out.rels("ppt/presentation.xml", &rels); + rels.add("image", "media/image2.png", false); + out.rels("ppt/presentation.xml", &rels); + let mut root = RelsOut::default(); + root.add("officeDocument", "ppt/presentation.xml", false); + out.rels("", &root); + let bytes = out.finish().unwrap(); + + let p = Package::open(&bytes, &LIMITS).unwrap(); + assert_eq!(p.names().next(), Some("[Content_Types].xml"), "names sort it first; it is also the first entry"); + assert!(bytes.windows(19).position(|w| w == b"[Content_Types].xml").is_some_and(|at| at < 64)); + assert_eq!(p.get("ppt/presentation.xml"), Some(&b"

"[..]), "the first part under a name is the one written"); + let ct = p.content_types(); + assert_eq!(ct.of("ppt/presentation.xml"), Some("application/presentation+xml")); + assert_eq!(ct.of("ppt/media/image2.png"), Some("image/png")); + assert_eq!(ct.of("ppt/media/odd.png"), Some("image/x-odd"), "an Override where the extension is taken"); + assert_eq!(ct.of("ppt/_rels/presentation.xml.rels"), Some(craft_opc::CT_RELATIONSHIPS)); + assert_eq!(ct.of("docProps/thumbnail.xml"), Some("application/xml")); + let main = p.rels("").first("officeDocument").map(|r| r.target.clone()).unwrap(); + let r = p.rels(&main); + assert_eq!(r.target(&id), Some("ppt/media/image1.png")); + assert_eq!(r.list.len(), 2, "the relationships part was replaced, not written twice"); + // Writing the same package again gives the same bytes. + assert_eq!(zip_entries(&[("a.xml".into(), b"".to_vec())]), zip_entries(&[("a.xml".into(), b"".to_vec())])); +} + +#[test] +fn packed_media_are_stored() { + assert_eq!(compression_for("word/media/image1.PNG"), Compression::Store); + assert_eq!(compression_for("ppt/media/movie.mp4"), Compression::Store); + assert_eq!(compression_for("word/document.xml"), Compression::Deflate); + assert_eq!(compression_for("word/media/image1.emf"), Compression::Deflate); + assert_eq!(compression_for("noextension"), Compression::Deflate); + let data = vec![b'a'; 100_000]; + let stored = zip_entries(&[("a.png".into(), data.clone())]).unwrap(); + let deflated = zip_entries(&[("a.xml".into(), data.clone())]).unwrap(); + assert!(stored.len() > 100_000 && deflated.len() < 10_000); + for z in [stored, deflated] { + let p = Package::open(&z, &LIMITS).unwrap(); + assert_eq!(p.size(), 100_000); + } +}