- presentation.json gets its own 256 MiB inflation limit instead of the 2 GiB
per-entry allowance, and is parsed in place: only a file that needs its
null-number repair is copied.
- A media member that fails decoding or its CRC is charged for the bytes it
inflated, so later members cannot reuse the shared media budget.
- repair() and Presentation::validate() check slide layouts against a set
built once instead of scanning every layout per slide.
* refactor: explicit imports instead of glob imports in command and test modules (SonarCloud S2208)
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix: geom extra imports
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix: drop unused imports
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* fix: restore explicit imports in test modules (SonarCloud S2208)
---------
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Found while testing crates/format/src/rtf.rs:226 (rtf_to_outline)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* chore: resolve SonarCloud maintainability issues
* fix: address shellcheck SC2059 and fix generic cast ambiguity
* style: apply rustfmt formatting
* fix: restore compile and behaviour in Sonar refactors
- fonts: char::is_alphanumeric takes &self, so filter needs a closure
- h264: keep the mvd accumulator as i32 (prefix is usize)
- model: annotate the non-stacked range accumulators as f64
- engine: chart.options still clears the raw chart XML for upDownBars
and quartiles; smartart goes back to the glob import (cmd! macro)
- web: keep the original viewport meta (behaviour change)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Assign positional parameters to locals in sha256 verification
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Dylan Taylor <dylan@craftmaker.dev>
Found while testing crates/format/src/lib.rs:660-665 (slides_to_outline) and :573-574 (outline_to_slides)
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* M2.1: preserve chart parts through native saves
Serialize retained chart relationships and payloads in native files.
Add native and headless file-command round-trip regressions.
Contribution on behalf of @MMexicann.
* Format: bound opaque chart parts as native ZIP entries
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
* Model: track transient native chart part entries
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
* PPTX: initialize native chart entry metadata
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
* Engine: adapt chart native roundtrip fixtures
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
* Docs: describe bounded chart sidecars and validation
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
* Roadmap: record bounded chart persistence evidence
Address maintainer feedback on the existing PR. Preserve upstream work and document tested scope and validation limits.
---------
Co-authored-by: skylar taylor-barrick <hi@skylar.cc>
Review follow-up. A huge glow or shadow could still arrive through what text and shapes inherit:
the deck's default text style, a master's title, body and other styles, a text box's or table
cell's own list style, and the theme's effect styles that shape styles point at. sane_numbers caps
those too; the test plants 10^18 pt glows in each and checks they come back capped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A .pptx or .deckcraft could give a glow, soft edge, shadow or reflection any size. A glow of
~10^16 pt made vello panic while flattening, one of 10^18 pt made rendering ask for 34 GB and abort.
sane_numbers (run by repair on every opened file) now caps them like line widths and font sizes:
glow 150, soft edges 100, shadows 200, reflections 100 pt; shadow scale and skew are kept sane and
non-numbers become 0, on shapes and on text runs, table cells included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
repair re-id'd repeated slide ids but not shape ids, so such a file opened as a deck that fails
validate, and edits by id found only the first of the shapes sharing one. Repeats on a slide,
layout or master (groups included) now get fresh ids from the deck's counter; the first keeps
its id, and decks without repeats aren't copied.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adds PowerPoint's Outline/RTF save type: slide titles at outline level 0
(bold, larger), body paragraphs indented at their outline level, bold,
italic and underline kept, non-ASCII as \u escapes. RTF outlines (ours,
PowerPoint's or a word processor's, by outline level or indent) open as
a presentation or drop in as slides.
Co-authored-by: Cursor <cursoragent@cursor.com>
Use the pinned shared PDF writer with explicit font embedding errors, preserving app-owned rendering and current main. All seven local gates and fresh Ubuntu/FreeBSD checks passed on the exact integration tree; paired native/WASM PDF bytes, structure, text and pixels match. Original contributor commits are preserved.
Conflicts resolved onto main's newer shape, and the PR's policy applied to
every alloc_id/add_media/new_slide call site main has grown since: commands
answer bad(cmd, NO_ID_SPACE) (slide.reuse, insert.zoom, SmartArt, photo
album, review.accept, handout/notes masters, master placeholders,
background/artistic/compress pictures, transition sound, ink to shape,
paste special, file.new templates); reid/bring_media/renumber/regenerate
and compare::adopt/accept are fallible; outline import keeps what fit.
Tests use expect() on the now-Option results.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix-up in the merge (review): reading older files that hold null numbers re-parses at most
256 MB in all and slices without indexing, so a hostile file can't hang the open.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serde_json writes NaN and infinity as null, which doesn't read back as a number, so one NaN
anywhere in the model (a rotation, position, crop, stroke width…) made the saved file (and its
AutoRecover copy) fail to open as "damaged".
- Writer: presentation.json goes through finite::Finite, a serializer adapter that writes
non-finite floats as 0.
- Loader: files already written that way open; each null where a number belongs reads as 0
(inside tagged enums, where serde only reports the enclosing object, candidates are tried
nearest first and kept only when the parse gets further). Other damage still fails.
- repair() brings shape geometry into range: positions and sizes finite and within ±1e6 pt,
rotation 0–360, picture crop -10..1, font sizes 1–4000 pt, line widths 0–1584 pt.
Animation timings are u32 and can't carry NaN.
Co-authored-by: Cursor <cursoragent@cursor.com>
repair() brings each slide side into PowerPoint's 72–4032 pt (as Design › Slide Size allows;
it accepted 1–4000 before), and replaces a zero, negative or non-finite size with 16:9; a bad
notes size gets the default. The native reader takes a null, string or missing slide/notes
size as NaN for repair to fix, so such a file opens instead of failing as damaged (NaN and
infinity are saved as null). The canvas fit and slide show fit treat a zero or non-finite side
as 1 pt, so an in-memory bad size can't make layout infinite.
Co-authored-by: Cursor <cursoragent@cursor.com>
Brandon Thomas
Dylan M. Taylor
Harrison Booth
aiongg
NetterSilverandClaude Haiku 5.5
Marco Arnulfo
Mexandskylar taylor-barrick
MarekSpodBiedry
ZetenypappandClaude Opus 5.5
Nikita RakitinandCursor
midasmatterhorn