version bump 0.12.2: BIFF2-4 features

- correct BIFF-dependent cell reference wrapping
- record layout fixes from sample files
- use BIFF version 2.4.338 for BOF (fixes #995 h/t @benjaminleetmaa)
- fixed potentially vulnerable regexes (h/t @davisjam)
- removed insecure deep dependency (fixes #996 h/t @dcatoday)

.gitignore

@@ -12,7 +12,7 @@ tmp
 *.[pP][rR][nN]
 *.[sS][lL][kK]
 *.socialcalc
-*.[xX][lL][sSwWcCaAtT]
+*.[xX][lL][sSwWcCaAtTmM]
 *.[xX][lL][sSaAtT][xXmMbB]
 *.[oO][dD][sS]
 *.[fF][oO][dD][sS]

.npmignore

@@ -14,7 +14,7 @@ tmp
 *.[pP][rR][nN]
 *.[sS][lL][kK]
 *.socialcalc
-*.[xX][lL][sSwWcCaAtT]
+*.[xX][lL][sSwWcCaAtTmM]
 *.[xX][lL][sSaAtT][xXmMbB]
 *.[oO][dD][sS]
 *.[fF][oO][dD][sS]

bits/01_version.js

@@ -1 +1 @@
-XLSX.version = '0.12.1';
+XLSX.version = '0.12.2';

bits/10_ssf.js

@@ -2,7 +2,7 @@
 /*jshint -W041 */
 var SSF/*:SSFModule*/ = ({}/*:any*/);
 var make_ssf = function make_ssf(SSF/*:SSFModule*/){
-SSF.version = '0.10.0';
+SSF.version = '0.10.2';
 function _strrev(x/*:string*/)/*:string*/ { var o = "", i = x.length-1; while(i>=0) o += x.charAt(i--); return o; }
 function fill(c/*:string*/,l/*:number*/)/*:string*/ { var o = ""; while(o.length < l) o+=c; return o; }
 function pad0(v/*:any*/,d/*:number*/)/*:string*/{var t=""+v; return t.length>=d?t:fill('0',d-t.length)+t;}
@@ -791,7 +791,7 @@ function eval_fmt(fmt/*:string*/, v/*:any*/, opts/*:any*/, flen/*:number*/) {
 }
 SSF._eval = eval_fmt;
 var cfregex = /\[[=<>]/;
-var cfregex2 = /\[([=<>]*)(-?\d+\.?\d*)\]/;
+var cfregex2 = /\[(=|>[=]?|<[>=]?)(-?\d+(?:\.\d*)?)\]/;
 function chkcond(v, rr) {
 	if(rr == null) return false;
 	var thresh = parseFloat(rr[2]);

bits/22_xmlutils.js

@@ -1,6 +1,6 @@
 var XML_HEADER = '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\r\n';
 var attregexg=/([^"\s?>\/]+)\s*=\s*((?:")([^"]*)(?:")|(?:')([^']*)(?:')|([^'">\s]+))/g;
-var tagregex=/<[\/\?]?[a-zA-Z0-9:]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s]+))*\s?[\/\?]?>/g;
+var tagregex=/<[\/\?]?[a-zA-Z0-9:]+(?:\s+[^"\s?>\/]+\s*=\s*(?:"[^"]*"|'[^']*'|[^'">\s=]+))*\s?[\/\?]?>/g;
 if(!(XML_HEADER.match(tagregex))) tagregex = /<[^>]*>/g;
 var nsregex=/<\w*:/, nsregex2 = /<(\/?)\w+:/;
 function parsexmltag(tag/*:string*/, skip_root/*:?boolean*/)/*:any*/ {

bits/23_binutils.js

@@ -25,7 +25,7 @@ function write_double_le(b/*:RawBytes|CFBlob*/, v/*:number*/, idx/*:number*/) {
 	b[idx + 7] = (e >> 4) | bs;
 }
 
-var __toBuffer = function(bufs/*:Array<any>*/) { var x=[],w=10240; for(var i=0;i<bufs[0].length;++i) for(var j=0,L=bufs[0][i].length;j<L;j+=w) x.push.apply(x, bufs[0][i].slice(j,j+w)); return x; };
+var __toBuffer = function(bufs/*:Array<Array<RawBytes> >*/)/*:RawBytes*/ { var x=[],w=10240; for(var i=0;i<bufs[0].length;++i) if(bufs[0][i]) for(var j=0,L=bufs[0][i].length;j<L;j+=w) x.push.apply(x, bufs[0][i].slice(j,j+w)); return x; };
 var ___toBuffer = __toBuffer;
 var __utf16le = function(b/*:RawBytes|CFBlob*/,s/*:number*/,e/*:number*/)/*:string*/ { var ss/*:Array<string>*/=[]; for(var i=s; i<e; i+=2) ss.push(String.fromCharCode(__readUInt16LE(b,i))); return ss.join("").replace(chr0,''); };
 var ___utf16le = __utf16le;

bits/25_cellutils.js

@@ -22,7 +22,9 @@ function shift_range_xls(cell, range, opts) {
 	return out;
 }
 
-function encode_cell_xls(c/*:CellAddress*/)/*:string*/ {
+function encode_cell_xls(c/*:CellAddress*/, biff/*:number*/)/*:string*/ {
+	if(c.cRel && c.c < 0) { c = dup(c); c.c += (biff > 8) ? 0x4000 : 0x100; }
+	if(c.rRel && c.r < 0) { c = dup(c); c.r += (biff > 8) ? 0x100000 : ((biff > 5) ? 0x10000 : 0x4000); }
 	var s = encode_cell(c);
 	if(c.cRel === 0) s = fix_col(s);
 	if(c.rRel === 0) s = fix_row(s);
@@ -31,7 +33,7 @@ function encode_cell_xls(c/*:CellAddress*/)/*:string*/ {
 
 function encode_range_xls(r, opts)/*:string*/ {
 	if(r.s.r == 0 && !r.s.rRel) {
-		if(r.e.r == (opts.biff >= 12 ? 0xFFFFF : 0xFFFF) && !r.e.rRel) {
+		if(r.e.r == (opts.biff >= 12 ? 0xFFFFF : (opts.biff >= 8 ? 0x10000 : 0x4000)) && !r.e.rRel) {
 			return (r.s.cRel ? "" : "$") + encode_col(r.s.c) + ":" + (r.e.cRel ? "" : "$") + encode_col(r.e.c);
 		}
 	}
@@ -40,5 +42,5 @@ function encode_range_xls(r, opts)/*:string*/ {
 			return (r.s.rRel ? "" : "$") + encode_row(r.s.r) + ":" + (r.e.rRel ? "" : "$") + encode_row(r.e.r);
 		}
 	}
-	return encode_cell_xls(r.s) + ":" + encode_cell_xls(r.e);
+	return encode_cell_xls(r.s, opts.biff) + ":" + encode_cell_xls(r.e, opts.biff);
 }

bits/29_xlsenum.js

@@ -23,7 +23,7 @@ var VT_UI4      = 0x0013;
 var VT_LPSTR    = 0x001E;
 //var VT_LPWSTR   = 0x001F;
 var VT_FILETIME = 0x0040;
-//var VT_BLOB     = 0x0041;
+var VT_BLOB     = 0x0041;
 //var VT_STREAM   = 0x0042;
 //var VT_STORAGE  = 0x0043;
 //var VT_STREAMED_Object  = 0x0044;
@@ -61,6 +61,7 @@ var DocSummaryPIDDSI = {
 	/*::[*/0x13/*::]*/: { n: 'SharedDoc', t: VT_BOOL },
 	/*::[*/0x16/*::]*/: { n: 'HLinksChanged', t: VT_BOOL },
 	/*::[*/0x17/*::]*/: { n: 'AppVersion', t: VT_I4, p: 'version' },
+	/*::[*/0x18/*::]*/: { n: 'DigSig', t: VT_BLOB },
 	/*::[*/0x1A/*::]*/: { n: 'ContentType', t: VT_STRING },
 	/*::[*/0x1B/*::]*/: { n: 'ContentStatus', t: VT_STRING },
 	/*::[*/0x1C/*::]*/: { n: 'Language', t: VT_STRING },

bits/38_xlstypes.js

@@ -83,6 +83,7 @@ function parse_dictionary(blob,CodePage) {
 function parse_BLOB(blob) {
 	var size = blob.read_shift(4);
 	var bytes = blob.slice(blob.l,blob.l+size);
+	blob.l += size;
 	if((size & 3) > 0) blob.l += (4 - (size & 3)) & 3;
 	return bytes;
 }
@@ -93,7 +94,7 @@ function parse_ClipboardData(blob) {
 	var o = {};
 	o.Size = blob.read_shift(4);
 	//o.Format = blob.read_shift(4);
-	blob.l += o.Size;
+	blob.l += o.Size + 3 - (o.Size - 1) % 4;
 	return o;
 }
 
@@ -239,6 +240,7 @@ function parse_PropertySetStream(file, PIDSI, clsid) {
 	rval.FMTID = FMTID0;
 	//rval.PSet0 = PSet0;
 	if(NumSets === 1) return rval;
+	if(Offset1 - blob.l == 2) blob.l += 2;
 	if(blob.l !== Offset1) throw new Error("Length mismatch 2: " + blob.l + " !== " + Offset1);
 	var PSet1;
 	try { PSet1 = parse_PropertySet(blob, null); } catch(e) {/* empty */}

bits/39_xlsbiff.js

@@ -155,6 +155,9 @@ function parse_BOF(blob, length) {
 	switch(o.BIFFVer) {
 		case 0x0600: /* BIFF8 */
 		case 0x0500: /* BIFF5 */
+		case 0x0400: /* BIFF4 */
+		case 0x0300: /* BIFF3 */
+		case 0x0200: /* BIFF2 */
 		case 0x0002: case 0x0007: /* BIFF2 */
 			break;
 		default: if(length > 6) throw new Error("Unexpected BIFF Ver " + o.BIFFVer);

bits/44_offcrypto.js

@@ -309,7 +309,7 @@ function parse_FilePassHeader(blob, length/*:number*/, oo) {
 function parse_FilePass(blob, length/*:number*/, opts) {
 	var o = ({ Type: opts.biff >= 8 ? blob.read_shift(2) : 0 }/*:any*/); /* wEncryptionType */
 	if(o.Type) parse_FilePassHeader(blob, length-2, o);
-	else parse_XORObfuscation(blob, length-2, opts, o);
+	else parse_XORObfuscation(blob, opts.biff >= 8 ? length : length - 2, opts, o);
 	return o;
 }
 

bits/62_fxls.js

@@ -27,8 +27,9 @@ function parse_RgceArea_BIFF2(blob/*::, length, opts*/) {
 }
 
 /* [MS-XLS] 2.5.198.105 ; [MS-XLSB] 2.5.97.90 */
-function parse_RgceAreaRel(blob, length/*::, opts*/) {
-	var r=blob.read_shift(length == 12 ? 4 : 2), R=blob.read_shift(length == 12 ? 4 : 2);
+function parse_RgceAreaRel(blob, length, opts) {
+	if(opts.biff < 8) return parse_RgceArea_BIFF2(blob, length, opts);
+	var r=blob.read_shift(opts.biff == 12 ? 4 : 2), R=blob.read_shift(opts.biff == 12 ? 4 : 2);
 	var c=parse_ColRelU(blob, 2);
 	var C=parse_ColRelU(blob, 2);
 	return { s:{r:r, c:c[0], cRel:c[1], rRel:c[2]}, e:{r:R, c:C[0], cRel:C[1], rRel:C[2]} };
@@ -118,7 +119,7 @@ function parse_PtgAreaErr3d(blob, length, opts) {
 /* [MS-XLS] 2.5.198.31 ; [MS-XLSB] 2.5.97.22 */
 function parse_PtgAreaN(blob, length, opts) {
 	var type = (blob[blob.l++] & 0x60) >> 5;
-	var area = parse_RgceAreaRel(blob, opts && opts.biff > 8 ? 12 : 8, opts);
+	var area = parse_RgceAreaRel(blob, length - 1, opts);
 	return [type, area];
 }
 
@@ -372,6 +373,7 @@ function parse_PtgMemFunc(blob, length, opts) {
 function parse_PtgRefErr(blob, length, opts) {
 	var type = (blob.read_shift(1) >>> 5) & 0x03;
 	blob.l += 4;
+	if(opts.biff < 8) blob.l--;
 	if(opts.biff == 12) blob.l += 2;
 	return [type];
 }
@@ -675,6 +677,7 @@ function get_ixti(supbooks, ixti/*:number*/, opts)/*:string*/ {
 	return formula_quote_sheet_name(get_ixti_raw(supbooks, ixti, opts), opts);
 }
 function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks, opts)/*:string*/ {
+	var biff = (opts && opts.biff) || 8;
 	var _range = /*range != null ? range :*/ {s:{c:0, r:0},e:{c:0, r:0}};
 	var stack/*:Array<string>*/ = [], e1, e2, /*::type,*/ c/*:CellAddress*/, ixti=0, nameidx=0, r, sname="";
 	if(!formula[0] || !formula[0][0]) return "";
@@ -746,24 +749,25 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
 
 			case 'PtgRef': /* [MS-XLS] 2.5.198.84 */
 				/*::type = f[1][0]; */c = shift_cell_xls((f[1][1]/*:any*/), _range, opts);
-				stack.push(encode_cell_xls(c));
+				stack.push(encode_cell_xls(c, biff));
 				break;
 			case 'PtgRefN': /* [MS-XLS] 2.5.198.88 */
 				/*::type = f[1][0]; */c = cell ? shift_cell_xls((f[1][1]/*:any*/), cell, opts) : (f[1][1]/*:any*/);
-				stack.push(encode_cell_xls(c));
+				stack.push(encode_cell_xls(c, biff));
 				break;
 			case 'PtgRef3d': /* [MS-XLS] 2.5.198.85 */
 				/*::type = f[1][0]; */ixti = /*::Number(*/f[1][1]/*::)*/; c = shift_cell_xls((f[1][2]/*:any*/), _range, opts);
 				sname = get_ixti(supbooks, ixti, opts);
 				var w = sname; /* IE9 fails on defined names */ // eslint-disable-line no-unused-vars
-				stack.push(sname + "!" + encode_cell_xls(c));
+				stack.push(sname + "!" + encode_cell_xls(c, biff));
 				break;
 
 			case 'PtgFunc': /* [MS-XLS] 2.5.198.62 */
 			case 'PtgFuncVar': /* [MS-XLS] 2.5.198.63 */
 				/* f[1] = [argc, func, type] */
 				var argc/*:number*/ = (f[1][0]/*:any*/), func/*:string*/ = (f[1][1]/*:any*/);
 				if(!argc) argc = 0;
+				argc &= 0x7F;
 				var args = argc == 0 ? [] : stack.slice(-argc);
 				stack.length -= argc;
 				if(func === 'User') func = args.shift();
@@ -798,6 +802,7 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
 				stack.push("SUM(" + stack.pop() + ")");
 				break;
 
+			case 'PtgAttrBaxcel': /* [MS-XLS] 2.5.198.33 */
 			case 'PtgAttrSemi': /* [MS-XLS] 2.5.198.37 */
 				break;
 
@@ -931,8 +936,6 @@ function stringify_formula(formula/*Array<any>*/, range, cell/*:any*/, supbooks,
 			case 'PtgElfRwV': /* [MS-XLS] 2.5.198.55 */
 				throw new Error("Unsupported ELFs");
 
-			case 'PtgAttrBaxcel': /* [MS-XLS] 2.5.198.33 TODO -- find a test case*/
-				throw new Error('Unrecognized Formula Token: ' + String(f));
 			case 'PtgSxName': /* [MS-XLS] 2.5.198.91 TODO -- find a test case */
 				throw new Error('Unrecognized Formula Token: ' + String(f));
 			case 'PtgList': /* [MS-XLSB] 2.5.97.52 TODO -- find a test case */

bits/69_chartxml.js

@@ -3,7 +3,7 @@ function parse_numCache(data/*:string*/)/*:[Array<number>, string]*/ {
 
 	/* 21.2.2.150 pt CT_NumVal */
 	(data.match(/<c:pt idx="(\d*)">(.*?)<\/c:pt>/mg)||[]).forEach(function(pt) {
-		var q = pt.match(/<c:pt idx="(.*?)"><c:v>(.*)<\/c:v><\/c:pt>/);
+		var q = pt.match(/<c:pt idx="(\d*?)"><c:v>(.*)<\/c:v><\/c:pt>/);
 		if(!q) return;
 		col[+q[1]] = +q[2];
 	});

bits/75_xlml.js

@@ -168,7 +168,7 @@ function xlml_normalize(d)/*:string*/ {
 
 /* TODO: Everything */
 /* UOS uses CJK in tags */
-var xlmlregex = /<(\/?)([^\s?>!\/:]*:|)([^\s?>]*[^\s?>\/])[^>]*>/mg;
+var xlmlregex = /<(\/?)([^\s?>!\/:]*:|)([^\s?>:\/]+)[^>]*>/mg;
 //var xlmlregex = /<(\/?)([a-z0-9]*:|)(\w+)[^>]*>/mg;
 function parse_xlml_xml(d, _opts)/*:Workbook*/ {
 	var opts = _opts || {};

bits/76_xls.js

@@ -213,7 +213,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 			last_Rn = R.n;
 			if(R.r === 2 || R.r == 12) {
 				var rt = blob.read_shift(2); length -= 2;
-				if(!opts.enc && rt !== RecordType) throw new Error("rt mismatch: " + rt + "!=" + RecordType);
+				if(!opts.enc && rt !== RecordType && (((rt&0xFF)<<8)|(rt>>8)) !== RecordType) throw new Error("rt mismatch: " + rt + "!=" + RecordType);
 				if(R.r == 12){ blob.l += 10; length -= 10; } // skip FRT
 			}
 			//console.error(R,blob.l,length,blob.length);
@@ -232,7 +232,6 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 				case 'FilePass':
 					if(!opts.enc) blob.l = 0;
 					opts.enc = val;
-					if(opts.WTF) console.error(val);
 					if(!options.password) throw new Error("File is password-protected");
 					if(val.valid == null) throw new Error("Encryption scheme unsupported");
 					if(!val.valid) throw new Error("Password is incorrect");
@@ -337,6 +336,9 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 						/*::[*/0x0209/*::]*/:3,
 						/*::[*/0x0409/*::]*/:4
 					}[RecordType] || {
+						/*::[*/0x0200/*::]*/:2,
+						/*::[*/0x0300/*::]*/:3,
+						/*::[*/0x0400/*::]*/:4,
 						/*::[*/0x0500/*::]*/:5,
 						/*::[*/0x0600/*::]*/:8,
 						/*::[*/0x0002/*::]*/:2,
@@ -517,7 +519,7 @@ function parse_workbook(blob, options/*:ParseOpts*/)/*:Workbook*/ {
 					for(rngR = val[0].s.r; rngR <= val[0].e.r; ++rngR)
 						for(rngC = val[0].s.c; rngC <= val[0].e.c; ++rngC) {
 							cc = options.dense ? (out[rngR]||[])[rngC] : out[encode_cell({c:rngC,r:rngR})];
-							if(cc) cc.l.Tooltip = val[1];
+							if(cc && cc.l) cc.l.Tooltip = val[1];
 							}
 				} break;
 

demos/angular2/Makefile

@@ -1,23 +1,9 @@
-.PHONY: angular
-angular:
-	# Test Angular2 build
-	cp package.json-angular2 package.json
-	rm -rf node_modules
-	npm install
-	if [ ! -e node_modules ]; then mkdir node_modules; fi
-	if [ ! -e node_modules/xlsx ]; then cd node_modules; ln -s ../../../ xlsx; cd -; fi
-	npm run build
-
-	# Test Angular4 build
-	cp package.json-angular4 package.json
-	rm -rf node_modules
-	npm install
-	if [ ! -e node_modules ]; then mkdir node_modules; fi
-	if [ ! -e node_modules/xlsx ]; then cd node_modules; ln -s ../../../ xlsx; cd -; fi
-	npm run build
+.PHONY: all
+all: angular5
 
-	# Test Angular5 build
-	cp package.json-angular5 package.json
+.PHONY: angular2 angular4 angular5
+angular2 angular4 angular5:
+	cp package.json-$@ package.json
 	rm -rf node_modules
 	npm install
 	if [ ! -e node_modules ]; then mkdir node_modules; fi

demos/extendscript/aftereffects.jsx

@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

demos/extendscript/estoolkit.jsx

@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

demos/extendscript/illustrator.jsx

@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

demos/extendscript/indesign.jsx

@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

demos/extendscript/photoshop.jsx

@@ -7,7 +7,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];

demos/extendscript/test.jsx

@@ -6,7 +6,7 @@ var basePath = thisFile.path;
 var filename = "/sheetjs.xlsx";
 
 /* Read file from disk */
-var workbook = XLSX.readFile(basePath + filename);
+var workbook = XLSX.readFile(basePath + filename, {cellDates:true});
 
 /* Display first worksheet */
 var first_sheet_name = workbook.SheetNames[0], first_worksheet = workbook.Sheets[first_sheet_name];