Skip to content

Commit 3542d62

Browse files
LivingInSynLivingInSyn
committed
version bump 0.17.0
- Explicit errors on inconsistent XLS records - DBF cap worksheet to 1<<20 rows
1 parent 6c5db36 commit 3542d62

24 files changed

+1772
-112
lines changed

‎.npmignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ tmp
3939
.gitattributes
4040
.fossaignore
4141
.spelling
42+
.eslintignore
4243
.eslintrc
4344
.jshintrc
4445
CONTRIBUTING.md

‎bin/xlsx.njs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
/* vim: set ts=2 ft=javascript: */
55
var n = "xlsx";
66
var X = require('../');
7+
try { X = require('../xlsx.flow'); } catch(e) {}
78
require('exit-on-epipe');
89
var fs = require('fs'), program = require('commander');
910
program

‎bits/01_version.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
XLSX.version = '0.16.9';
1+
XLSX.version = '0.17.0';

‎bits/22_xmlutils.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
var XML_HEADER = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\r\n';
22
var attregexg=/([^"\s?>\/]+)\s*=\s*((?:")([^"]*)(?:")|(?:')([^']*)(?:')|([^'">\s]+))/g;
3-
var tagregex=/<[\/\?]?[a-zA-Z0-9:_-]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s?[\/\?]?>/mg;
3+
var tagregex=/<[\/\?]?[a-zA-Z0-9:_-]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s*[\/\?]?>/mg;
44

55
if(!(XML_HEADER.match(tagregex))) tagregex = /<[^>]*>/g;
66
var nsregex=/<\w*:/, nsregex2 = /<(\/?)\w+:/;

‎bits/28_binstructs.js

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,10 @@ var write_UncheckedRfX = write_RfX;
177177

178178
/* [MS-XLS] 2.5.342 ; [MS-XLSB] 2.5.171 */
179179
/* TODO: error checking, NaN and Infinity values are not valid Xnum */
180-
function parse_Xnum(data/*::, length*/) { return data.read_shift(8, 'f'); }
180+
function parse_Xnum(data/*::, length*/) {
181+
if(data.length - data.l < 8) throw "XLS Xnum Buffer underflow";
182+
return data.read_shift(8, 'f');
183+
}
181184
function write_Xnum(data, o) { return (o || new_buf(8)).write_shift(8, data, 'f'); }
182185

183186
/* [MS-XLSB] 2.4.324 BrtColor */

‎bits/39_xlsbiff.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -697,7 +697,7 @@ function parse_Lbl(blob, length, opts) {
697697
var name = parse_XLUnicodeStringNoCch(blob, cch, opts);
698698
if(flags & 0x20) name = XLSLblBuiltIn[name.charCodeAt(0)];
699699
var npflen = target - blob.l; if(opts && opts.biff == 2) --npflen;
700-
var rgce = target == blob.l || cce === 0 ? [] : parse_NameParsedFormula(blob, npflen, opts, cce);
700+
var rgce = (target == blob.l || cce === 0 || !(npflen > 0)) ? [] : parse_NameParsedFormula(blob, npflen, opts, cce);
701701
return {
702702
chKey: chKey,
703703
Name: name,

‎bits/40_harb.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ function dbf_to_aoa(buf, opts)/*:AOA*/ {
8585
var /*filedate = new Date(),*/ nrow = 0, fpos = 0;
8686
if(ft == 0x02) nrow = d.read_shift(2);
8787
/*filedate = new Date(d.read_shift(1) + 1900, d.read_shift(1) - 1, d.read_shift(1));*/d.l += 3;
88-
if(ft != 0x02) nrow = d.read_shift(4);
88+
if(ft != 0x02) nrow = d.read_shift(4); if(nrow > 1048576) nrow = 1e6;
8989
if(ft != 0x02) fpos = d.read_shift(2);
9090
var rlen = d.read_shift(2);
9191

@@ -822,7 +822,6 @@ var PRN = (function() {
822822
}
823823
// If line ends in \r OR \n
824824
else if(str.charCodeAt(5) == 13 || str.charCodeAt(5) == 10 ) {
825-
//
826825
sep = str.charAt(4); str = str.slice(6);
827826
}
828827
}

‎bits/67_wsxml.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -238,6 +238,8 @@ function parse_ws_xml_sheetviews(data, wb/*:WBWBProps*/) {
238238
// $FlowIgnore
239239
if(!wb.Views[i]) wb.Views[i] = {};
240240
// $FlowIgnore
241+
if(+tag.zoomScale) wb.Views[i].zoom = +tag.zoomScale;
242+
// $FlowIgnore
241243
if(parsexmlbool(tag.rightToLeft)) wb.Views[i].RTL = true;
242244
});
243245
}

‎bits/76_xls.js

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,12 @@ function slurp(R, blob, length/*:number*/, opts)/*:any*/ {
3838
var l = length;
3939
var bufs = [];
4040
var d = blob.slice(blob.l,blob.l+l);
41-
if(opts && opts.enc && opts.enc.insitu) switch(R.n) {
42-
case 'BOF': case 'FilePass': case 'FileLock': case 'InterfaceHdr': case 'RRDInfo': case 'RRDHead': case 'UsrExcl': break;
41+
if(opts && opts.enc && opts.enc.insitu && d.length > 0) switch(R.n) {
42+
case 'BOF': case 'FilePass': case 'FileLock': case 'InterfaceHdr': case 'RRDInfo': case 'RRDHead': case 'UsrExcl': case 'EOF':
43+
break;
44+
case 'BoundSheet8':
45+
break;
4346
default:
44-
if(d.length === 0) break;
4547
opts.enc.insitu(d);
4648
}
4749
bufs.push(d);
@@ -52,15 +54,19 @@ function slurp(R, blob, length/*:number*/, opts)/*:any*/ {
5254
l = __readUInt16LE(blob,blob.l+2);
5355
start = blob.l + 4;
5456
if(next.n == 'ContinueFrt') start += 4;
55-
else if(next.n.slice(0,11) == 'ContinueFrt') start += 12;
56-
bufs.push(blob.slice(start,blob.l+4+l));
57+
else if(next.n.slice(0,11) == 'ContinueFrt') {
58+
start += 12;
59+
}
60+
d = blob.slice(start,blob.l+4+l);
61+
bufs.push(d);
5762
blob.l += 4+l;
5863
next = (XLSRecordEnum[__readUInt16LE(blob, blob.l)]);
5964
}
6065
var b = (bconcat(bufs)/*:any*/);
6166
prep_blob(b, 0);
6267
var ll = 0; b.lens = [];
6368
for(var j = 0; j < bufs.length; ++j) { b.lens.push(ll); ll += bufs[j].length; }
69+
if(b.length < length) throw "XLS Record " + (R && R.n || "??") + " Truncated: " + b.length + " < " + length;
6470
return R.f(b, b.length, opts);
6571
}
6672

‎dist/xlsx.core.min.js

Lines changed: 13 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy