version bump 0.12.2: BIFF2-4 features

- correct BIFF-dependent cell reference wrapping - record layout fixes from sample files - use BIFF version 2.4.338 for BOF (fixes #995 h/t @benjaminleetmaa) - fixed potentially vulnerable regexes (h/t @davisjam) - removed insecure deep dependency (fixes #996 h/t @dcatoday)
SheetJS · Feb 21, 2018 · 8508ad4 · 8508ad4
1 parent 88e9e31
commit 8508ad4
Show file tree

Hide file tree

Showing 36 changed files with 259 additions and 201 deletions.
diff --git a/.gitignore b/.gitignore
@@ -12,7 +12,7 @@ tmp
 *.[pP][rR][nN]
 *.[sS][lL][kK]
 *.socialcalc
-*.[xX][lL][sSwWcCaAtT]
+*.[xX][lL][sSwWcCaAtTmM]
 *.[xX][lL][sSaAtT][xXmMbB]
 *.[oO][dD][sS]
 *.[fF][oO][dD][sS]

diff --git a/.npmignore b/.npmignore
@@ -14,7 +14,7 @@ tmp
 *.[pP][rR][nN]
 *.[sS][lL][kK]
 *.socialcalc
-*.[xX][lL][sSwWcCaAtT]
+*.[xX][lL][sSwWcCaAtTmM]
 *.[xX][lL][sSaAtT][xXmMbB]
 *.[oO][dD][sS]
 *.[fF][oO][dD][sS]

diff --git a/bits/01_version.js b/bits/01_version.js
@@ -1 +1 @@
-XLSX.version = '0.12.1';
+XLSX.version = '0.12.2';
diff --git a/bits/10_ssf.js b/bits/10_ssf.js
@@ -2,7 +2,7 @@
 /*jshint -W041 */
 var SSF/*:SSFModule*/ = ({}/*:any*/);
 var make_ssf = function make_ssf(SSF/*:SSFModule*/){
-SSF.version = '0.10.0';
+SSF.version = '0.10.2';
 function _strrev(x/*:string*/)/*:string*/ { var o = "", i = x.length-1; while(i>=0) o += x.charAt(i--); return o; }
 function fill(c/*:string*/,l/*:number*/)/*:string*/ { var o = ""; while(o.length < l) o+=c; return o; }
 function pad0(v/*:any*/,d/*:number*/)/*:string*/{var t=""+v; return t.length>=d?t:fill('0',d-t.length)+t;}
@@ -791,7 +791,7 @@ function eval_fmt(fmt/*:string*/, v/*:any*/, opts/*:any*/, flen/*:number*/) {
 }
 SSF._eval = eval_fmt;
 var cfregex = /\[[=<>]/;
-var cfregex2 = /\[([=<>]*)(-?\d+\.?\d*)\]/;
+var cfregex2 = /\[(=|>[=]?|<[>=]?)(-?\d+(?:\.\d*)?)\]/;
 function chkcond(v, rr) {
  if(rr == null) return false;
  var thresh = parseFloat(rr[2]);

diff --git a/bits/22_xmlutils.js b/bits/22_xmlutils.js
@@ -1,6 +1,6 @@
 var XML_HEADER = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\r\n';
 var attregexg=/([^"\s?>\/]+)\s*=\s*((?:")([^"]*)(?:")|(?:')([^']*)(?:')|([^'">\s]+))/g;
-var tagregex=/<[\/\?]?[a-zA-Z0-9:]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s]+))*\s?[\/\?]?>/g;
+var tagregex=/<[\/\?]?[a-zA-Z0-9:]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s?[\/\?]?>/g;
 if(!(XML_HEADER.match(tagregex))) tagregex = /<[^>]*>/g;
 var nsregex=/<\w*:/, nsregex2 = /<(\/?)\w+:/;
 function parsexmltag(tag/*:string*/, skip_root/*:?boolean*/)/*:any*/ {

diff --git a/bits/23_binutils.js b/bits/23_binutils.js
@@ -25,7 +25,7 @@ function write_double_le(b/*:RawBytes|CFBlob*/, v/*:number*/, idx/*:number*/) {
  b[idx + 7] = (e >> 4) | bs;
 }
 
-var __toBuffer = function(bufs/*:Array<any>*/) { var x=[],w=10240; for(var i=0;i<bufs[0].length;++i) for(var j=0,L=bufs[0][i].length;j<L;j+=w) x.push.apply(x, bufs[0][i].slice(j,j+w)); return x; };
+var __toBuffer = function(bufs/*:Array<Array<RawBytes> >*/)/*:RawBytes*/ { var x=[],w=10240; for(var i=0;i<bufs[0].length;++i) if(bufs[0][i]) for(var j=0,L=bufs[0][i].length;j<L;j+=w) x.push.apply(x, bufs[0][i].slice(j,j+w)); return x; };
 var ___toBuffer = __toBuffer;
 var __utf16le = function(b/*:RawBytes|CFBlob*/,s/*:number*/,e/*:number*/)/*:string*/ { var ss/*:Array<string>*/=[]; for(var i=s; i<e; i+=2) ss.push(String.fromCharCode(__readUInt16LE(b,i))); return ss.join("").replace(chr0,''); };
 var ___utf16le = __utf16le;

diff --git a/bits/25_cellutils.js b/bits/25_cellutils.js
@@ -22,7 +22,9 @@ function shift_range_xls(cell, range, opts) {
  return out;
 }
 
-function encode_cell_xls(c/*:CellAddress*/)/*:string*/ {
+function encode_cell_xls(c/*:CellAddress*/, biff/*:number*/)/*:string*/ {
+ if(c.cRel && c.c < 0) { c = dup(c); c.c += (biff > 8) ? 0x4000 : 0x100; }
+ if(c.rRel && c.r < 0) { c = dup(c); c.r += (biff > 8) ? 0x100000 : ((biff > 5) ? 0x10000 : 0x4000); }
  var s = encode_cell(c);
  if(c.cRel === 0) s = fix_col(s);
  if(c.rRel === 0) s = fix_row(s);
@@ -31,7 +33,7 @@ function encode_cell_xls(c/*:CellAddress*/)/*:string*/ {
 
 function encode_range_xls(r, opts)/*:string*/ {
  if(r.s.r == 0 && !r.s.rRel) {
- if(r.e.r == (opts.biff >= 12 ? 0xFFFFF : 0xFFFF) && !r.e.rRel) {
+ if(r.e.r == (opts.biff >= 12 ? 0xFFFFF : (opts.biff >= 8 ? 0x10000 : 0x4000)) && !r.e.rRel) {
  return (r.s.cRel ? "" : "$") + encode_col(r.s.c) + ":" + (r.e.cRel ? "" : "$") + encode_col(r.e.c);
  }
  }
@@ -40,5 +42,5 @@ function encode_range_xls(r, opts)/*:string*/ {
  return (r.s.rRel ? "" : "$") + encode_row(r.s.r) + ":" + (r.e.rRel ? "" : "$") + encode_row(r.e.r);
  }
  }
- return encode_cell_xls(r.s) + ":" + encode_cell_xls(r.e);
+ return encode_cell_xls(r.s, opts.biff) + ":" + encode_cell_xls(r.e, opts.biff);
 }
diff --git a/bits/29_xlsenum.js b/bits/29_xlsenum.js
@@ -23,7 +23,7 @@ var VT_UI4 = 0x0013;
 var VT_LPSTR = 0x001E;
 //var VT_LPWSTR = 0x001F;
 var VT_FILETIME = 0x0040;
-//var VT_BLOB = 0x0041;
+var VT_BLOB = 0x0041;
 //var VT_STREAM = 0x0042;
 //var VT_STORAGE = 0x0043;
 //var VT_STREAMED_Object = 0x0044;
@@ -61,6 +61,7 @@ var DocSummaryPIDDSI = {
  /*::[*/0x13/*::]*/: { n: 'SharedDoc', t: VT_BOOL },
  /*::[*/0x16/*::]*/: { n: 'HLinksChanged', t: VT_BOOL },
  /*::[*/0x17/*::]*/: { n: 'AppVersion', t: VT_I4, p: 'version' },
+ /*::[*/0x18/*::]*/: { n: 'DigSig', t: VT_BLOB },
  /*::[*/0x1A/*::]*/: { n: 'ContentType', t: VT_STRING },
  /*::[*/0x1B/*::]*/: { n: 'ContentStatus', t: VT_STRING },
  /*::[*/0x1C/*::]*/: { n: 'Language', t: VT_STRING },

diff --git a/bits/38_xlstypes.js b/bits/38_xlstypes.js
@@ -83,6 +83,7 @@ function parse_dictionary(blob,CodePage) {
 function parse_BLOB(blob) {
  var size = blob.read_shift(4);
  var bytes = blob.slice(blob.l,blob.l+size);
+ blob.l += size;
  if((size & 3) > 0) blob.l += (4 - (size & 3)) & 3;
  return bytes;
 }
@@ -93,7 +94,7 @@ function parse_ClipboardData(blob) {
  var o = {};
  o.Size = blob.read_shift(4);
  //o.Format = blob.read_shift(4);
- blob.l += o.Size;
+ blob.l += o.Size + 3 - (o.Size - 1) % 4;
  return o;
 }
 
@@ -239,6 +240,7 @@ function parse_PropertySetStream(file, PIDSI, clsid) {
  rval.FMTID = FMTID0;
  //rval.PSet0 = PSet0;
  if(NumSets === 1) return rval;
+ if(Offset1 - blob.l == 2) blob.l += 2;
  if(blob.l !== Offset1) throw new Error("Length mismatch 2: " + blob.l + " !== " + Offset1);
  var PSet1;
  try { PSet1 = parse_PropertySet(blob, null); } catch(e) {/* empty */}

diff --git a/bits/39_xlsbiff.js b/bits/39_xlsbiff.js
@@ -155,6 +155,9 @@ function parse_BOF(blob, length) {
  switch(o.BIFFVer) {
  case 0x0600: /* BIFF8 */
  case 0x0500: /* BIFF5 */
+ case 0x0400: /* BIFF4 */
+ case 0x0300: /* BIFF3 */
+ case 0x0200: /* BIFF2 */
  case 0x0002: case 0x0007: /* BIFF2 */
  break;
  default: if(length > 6) throw new Error("Unexpected BIFF Ver " + o.BIFFVer);

diff --git a/bits/44_offcrypto.js b/bits/44_offcrypto.js
@@ -309,7 +309,7 @@ function parse_FilePassHeader(blob, length/*:number*/, oo) {
 function parse_FilePass(blob, length/*:number*/, opts) {
  var o = ({ Type: opts.biff >= 8 ? blob.read_shift(2) : 0 }/*:any*/); /* wEncryptionType */
  if(o.Type) parse_FilePassHeader(blob, length-2, o);
- else parse_XORObfuscation(blob, length-2, opts, o);
+ else parse_XORObfuscation(blob, opts.biff >= 8 ? length : length - 2, opts, o);
  return o;
 }
 

diff --git a/bits/62_fxls.js b/bits/62_fxls.js
@@ -27,8 +27,9 @@ function parse_RgceArea_BIFF2(blob/*::, length, opts*/) {
 }
 
 /* [MS-XLS] 2.5.198.105 ; [MS-XLSB] 2.5.97.90 */
-function parse_RgceAreaRel(blob, length/*::, opts*/) {
- var r=blob.read_shift(length == 12 ? 4 : 2), R=blob.read_shift(length == 12 ? 4 : 2);
+function parse_RgceAreaRel(blob, length, opts) {
+ if(opts.biff < 8) return parse_RgceArea_BIFF2(blob, length, opts);
+ var r=blob.read_shift(opts.biff == 12 ? 4 : 2), R=blob.read_shift(opts.biff == 12 ? 4 : 2);
  var c=parse_ColRelU(blob, 2);
  var C=parse_ColRelU(blob, 2);
  return { s:{r:r, c:c[0], cRel:c[1], rRel:c[2]}, e:{r:R, c:C[0], cRel:C[1], rRel:C[2]} };
@@ -118,7 +119,7 @@ function parse_PtgAreaErr3d(blob, length, opts) {
 /* [MS-XLS] 2.5.198.31 ; [MS-XLSB] 2.5.97.22 */
 function parse_PtgAreaN(blob, length, opts) {
  var type = (blob[blob.l++] & 0x60) >> 5;
- var area = parse_RgceAreaRel(blob, opts && opts.biff > 8 ? 12 : 8, opts);
+ var area = parse_RgceAreaRel(blob, length - 1, opts);
  return [type, area];
 }
 
@@ -372,6 +373,7 @@ function parse_PtgMemFunc(blob, length, opts) {
 function parse_PtgRefErr(blob, length, opts) {
  var type = (blob.read_shift(1) >>> 5) & 0x03;
  blob.l += 4;
+ if(opts.biff < 8) blob.l--;
  if(opts.biff == 12) blob.l += 2;
  return [type];
 }
@@ -675,6 +677,7 @@ function get_ixti(supbooks, ixti/*:number*/, opts)/*:string*/ {
  return formula_quote_sheet_name(get_ixti_raw(supbooks, ixti, opts), opts);
 }
 function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks, opts)/*:string*/ {
+ var biff = (opts && opts.biff) || 8;
  var _range = /*range != null ? range :*/ {s:{c:0, r:0},e:{c:0, r:0}};
  var stack/*:Array<string>*/ = [], e1, e2, /*::type,*/ c/*:CellAddress*/, ixti=0, nameidx=0, r, sname="";
  if(!formula[0] || !formula[0][0]) return "";
@@ -746,24 +749,25 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
 
  case 'PtgRef': /* [MS-XLS] 2.5.198.84 */
  /*::type = f[1][0]; */c = shift_cell_xls((f[1][1]/*:any*/), _range, opts);
- stack.push(encode_cell_xls(c));
+ stack.push(encode_cell_xls(c, biff));
  break;
  case 'PtgRefN': /* [MS-XLS] 2.5.198.88 */
  /*::type = f[1][0]; */c = cell ? shift_cell_xls((f[1][1]/*:any*/), cell, opts) : (f[1][1]/*:any*/);
- stack.push(encode_cell_xls(c));
+ stack.push(encode_cell_xls(c, biff));
  break;
  case 'PtgRef3d': /* [MS-XLS] 2.5.198.85 */
  /*::type = f[1][0]; */ixti = /*::Number(*/f[1][1]/*::)*/; c = shift_cell_xls((f[1][2]/*:any*/), _range, opts);
  sname = get_ixti(supbooks, ixti, opts);
  var w = sname; /* IE9 fails on defined names */ // eslint-disable-line no-unused-vars
- stack.push(sname + "!" + encode_cell_xls(c));
+ stack.push(sname + "!" + encode_cell_xls(c, biff));
  break;
 
  case 'PtgFunc': /* [MS-XLS] 2.5.198.62 */
  case 'PtgFuncVar': /* [MS-XLS] 2.5.198.63 */
  /* f[1] = [argc, func, type] */
  var argc/*:number*/ = (f[1][0]/*:any*/), func/*:string*/ = (f[1][1]/*:any*/);
  if(!argc) argc = 0;
+ argc &= 0x7F;
  var args = argc == 0 ? [] : stack.slice(-argc);
  stack.length -= argc;
  if(func === 'User') func = args.shift();
@@ -798,6 +802,7 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
  stack.push("SUM(" + stack.pop() + ")");
  break;
 
+ case 'PtgAttrBaxcel': /* [MS-XLS] 2.5.198.33 */
  case 'PtgAttrSemi': /* [MS-XLS] 2.5.198.37 */
  break;
 
@@ -931,8 +936,6 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
  case 'PtgElfRwV': /* [MS-XLS] 2.5.198.55 */
  throw new Error("Unsupported ELFs");
 
- case 'PtgAttrBaxcel': /* [MS-XLS] 2.5.198.33 TODO -- find a test case*/
- throw new Error('Unrecognized Formula Token: ' + String(f));
  case 'PtgSxName': /* [MS-XLS] 2.5.198.91 TODO -- find a test case */
  throw new Error('Unrecognized Formula Token: ' + String(f));
  case 'PtgList': /* [MS-XLSB] 2.5.97.52 TODO -- find a test case */

diff --git a/bits/69_chartxml.js b/bits/69_chartxml.js
@@ -3,7 +3,7 @@ function parse_numCache(data/*:string*/)/*:[Array<number>, string]*/ {
 
  /* 21.2.2.150 pt CT_NumVal */
  (data.match(/<c:pt idx="(\d*)">(.*?)<\/c:pt>/mg)||[]).forEach(function(pt) {
- var q = pt.match(/<c:pt idx="(.*?)"><c:v>(.*)<\/c:v><\/c:pt>/);
+ var q = pt.match(/<c:pt idx="(\d*?)"><c:v>(.*)<\/c:v><\/c:pt>/);
  if(!q) return;
  col[+q[1]] = +q[2];
  });

diff --git a/bits/75_xlml.js b/bits/75_xlml.js
@@ -168,7 +168,7 @@ function xlml_normalize(d)/*:string*/ {
 
 /* TODO: Everything */
 /* UOS uses CJK in tags */
-var xlmlregex = /<(\/?)([^\s?>!\/:]*:|)([^\s?>]*[^\s?>\/])[^>]*>/mg;
+var xlmlregex = /<(\/?)([^\s?>!\/:]*:|)([^\s?>:\/]+)[^>]*>/mg;
 //var xlmlregex = /<(\/?)([a-z0-9]*:|)(\w+)[^>]*>/mg;
 function parse_xlml_xml(d, _opts)/*:Workbook*/ {
  var opts = _opts || {};

diff --git a/bits/76_xls.js b/bits/76_xls.js
@@ -213,7 +213,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
  last_Rn = R.n;
  if(R.r === 2 || R.r == 12) {
  var rt = blob.read_shift(2); length -= 2;
- if(!opts.enc && rt !== RecordType) throw new Error("rt mismatch: " + rt + "!=" + RecordType);
+ if(!opts.enc && rt !== RecordType && (((rt&0xFF)<<8)|(rt>>8)) !== RecordType) throw new Error("rt mismatch: " + rt + "!=" + RecordType);
  if(R.r == 12){ blob.l += 10; length -= 10; } // skip FRT
  }
  //console.error(R,blob.l,length,blob.length);
@@ -232,7 +232,6 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
  case 'FilePass':
  if(!opts.enc) blob.l = 0;
  opts.enc = val;
- if(opts.WTF) console.error(val);
  if(!options.password) throw new Error("File is password-protected");
  if(val.valid == null) throw new Error("Encryption scheme unsupported");
  if(!val.valid) throw new Error("Password is incorrect");
@@ -337,6 +336,9 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
  /*::[*/0x0209/*::]*/:3,
  /*::[*/0x0409/*::]*/:4
  }[RecordType] || {
+ /*::[*/0x0200/*::]*/:2,
+ /*::[*/0x0300/*::]*/:3,
+ /*::[*/0x0400/*::]*/:4,
  /*::[*/0x0500/*::]*/:5,
  /*::[*/0x0600/*::]*/:8,
  /*::[*/0x0002/*::]*/:2,
@@ -517,7 +519,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
  for(rngR = val[0].s.r; rngR <= val[0].e.r; ++rngR)
  for(rngC = val[0].s.c; rngC <= val[0].e.c; ++rngC) {
  cc = options.dense ? (out[rngR]||[])[rngC] : out[encode_cell({c:rngC,r:rngR})];
- if(cc) cc.l.Tooltip = val[1];
+ if(cc && cc.l) cc.l.Tooltip = val[1];
  }
  } break;
 

diff --git a/demos/angular2/Makefile b/demos/angular2/Makefile
@@ -1,23 +1,9 @@
-.PHONY: angular
-angular:
- # Test Angular2 build
- cp package.json-angular2 package.json
- rm -rf node_modules
- npm install
- if [ ! -e node_modules ]; then mkdir node_modules; fi
- if [ ! -e node_modules/xlsx ]; then cd node_modules; ln -s ../../../ xlsx; cd -; fi
- npm run build
-
- # Test Angular4 build
- cp package.json-angular4 package.json
- rm -rf node_modules
- npm install
- if [ ! -e node_modules ]; then mkdir node_modules; fi
- if [ ! -e node_modules/xlsx ]; then cd node_modules; ln -s ../../../ xlsx; cd -; fi
- npm run build
+.PHONY: all
+all: angular5
 
- # Test Angular5 build
- cp package.json-angular5 package.json
+.PHONY: angular2 angular4 angular5
+angular2 angular4 angular5:
+ cp package.json-$@ package.json
  rm -rf node_modules
  npm install
  if [ ! -e node_modules ]; then mkdir node_modules; fi

diff --git a/demos/extendscript/aftereffects.jsx b/demos/extendscript/aftereffects.jsx
@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/demos/extendscript/estoolkit.jsx b/demos/extendscript/estoolkit.jsx
@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/demos/extendscript/illustrator.jsx b/demos/extendscript/illustrator.jsx
@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/demos/extendscript/indesign.jsx b/demos/extendscript/indesign.jsx
@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/demos/extendscript/photoshop.jsx b/demos/extendscript/photoshop.jsx
@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/demos/extendscript/test.jsx b/demos/extendscript/test.jsx
@@ -6,7 +6,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

diff --git a/dist/xlsx.core.min.js b/dist/xlsx.core.min.js
diff --git a/dist/xlsx.core.min.map b/dist/xlsx.core.min.map