Skip to content

Commit 3b790fb

Browse files
authored
Fix OOXML schema validity, correctness, perf, and security issues (#30)
Correctness: - Tables: derive column count from the rowspan grid so cells in later, wider rows are no longer silently dropped - Tables: thread FootnoteIndex/BookmarkId through per-cell contexts and seed FootnoteIndex from the existing part, so footnote and bookmark IDs no longer collide across cells or across Build calls - Emit w:rPr and w:tcPr children in OOXML schema order; previously the output was schema-invalid and only tolerated by Word - Cell margins emit w:left/w:right instead of the invalid w:start/w:end - ColorParser: accept percentage and decimal rgb()/rgba() components - vertical-align is matched case-insensitively - word-spacing no longer doubles letter-spacing - @page: match the closing brace and skip nested margin-box rules so sibling declarations (margin/size) are not lost Performance: - Parse each element's inline style once instead of twice - Allocate list numbering IDs from the threaded NextNumId counter rather than rescanning the numbering part per list (O(m^2) -> O(m)) - Compute ordered-list item indices in a single pass (O(n^2) -> O(n)) Security: - Image fetch: disable auto-redirect and re-check each redirect hop against the image policy (closes a SafeDomains/SSRF bypass), cap the response size, set a timeout, and parse width/height with InvariantCulture Tests: - Add rowspan, footnote-id, bookmark-id, and OpenXmlValidator round-trip tests, plus rgb() percentage cases - Regenerate affected verified baselines (structural reordering only; rendered text/image output unchanged)
1 parent 580b4d3 commit 3b790fb

72 files changed

Lines changed: 563 additions & 158 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

src/OpenXmlHtml.Tests/ColorParserTests.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ public class ColorParserTests
1616
[TestCase("rgba(0, 128, 0, 1)", "008000")]
1717
[TestCase("rgba(0,0,255,0)", "0000FF")]
1818
[TestCase("rgba(100, 200, 50, 0.8)", "64C832")]
19+
[TestCase("rgb(100%, 0%, 0%)", "FF0000")]
20+
[TestCase("rgb(0%, 100%, 0%)", "00FF00")]
21+
[TestCase("rgba(0%, 0%, 100%, 0.5)", "0000FF")]
22+
[TestCase("rgb(255.0, 0, 0)", "FF0000")]
1923
public void ValidColors(string input, string expected) =>
2024
Assert.That(ColorParser.Parse(input), Is.EqualTo(expected));
2125

Binary file not shown.
Binary file not shown.

src/OpenXmlHtml.Tests/Samples/WordSamples.RichDocument.DotNet.verified.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">All systems </w:t></w:r><w:r><w:rPr><w:b /><w:color w:val="008000" /></w:rPr><w:t xml:space="preserve">operational</w:t></w:r><w:r><w:t xml:space="preserve">.</w:t></w:r></w:p>
33
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">● </w:t></w:r><w:r><w:t xml:space="preserve">Server: </w:t></w:r><w:r><w:rPr><w:color w:val="008000" /></w:rPr><w:t xml:space="preserve">OK</w:t></w:r></w:p>
44
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">● </w:t></w:r><w:r><w:t xml:space="preserve">Cache: </w:t></w:r><w:r><w:rPr><w:color w:val="FF0000" /></w:rPr><w:t xml:space="preserve">Down</w:t></w:r></w:p>
5-
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Contact </w:t></w:r><w:r><w:rPr><w:u w:val="single" /><w:color w:val="0563C1" /></w:rPr><w:t xml:space="preserve">ops team</w:t></w:r><w:r><w:t xml:space="preserve"> (mailto:ops@example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for details.</w:t></w:r></w:p>
5+
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Contact </w:t></w:r><w:r><w:rPr><w:color w:val="0563C1" /><w:u w:val="single" /></w:rPr><w:t xml:space="preserve">ops team</w:t></w:r><w:r><w:t xml:space="preserve"> (mailto:ops@example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for details.</w:t></w:r></w:p>

src/OpenXmlHtml.Tests/Samples/WordSamples.RichDocument.Net.verified.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">All systems </w:t></w:r><w:r><w:rPr><w:b /><w:color w:val="008000" /></w:rPr><w:t xml:space="preserve">operational</w:t></w:r><w:r><w:t xml:space="preserve">.</w:t></w:r></w:p>
33
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">● </w:t></w:r><w:r><w:t xml:space="preserve">Server: </w:t></w:r><w:r><w:rPr><w:color w:val="008000" /></w:rPr><w:t xml:space="preserve">OK</w:t></w:r></w:p>
44
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">● </w:t></w:r><w:r><w:t xml:space="preserve">Cache: </w:t></w:r><w:r><w:rPr><w:color w:val="FF0000" /></w:rPr><w:t xml:space="preserve">Down</w:t></w:r></w:p>
5-
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Contact </w:t></w:r><w:r><w:rPr><w:u w:val="single" /><w:color w:val="0563C1" /></w:rPr><w:t xml:space="preserve">ops team</w:t></w:r><w:r><w:t xml:space="preserve"> (mailto:ops@example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for details.</w:t></w:r></w:p>
5+
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Contact </w:t></w:r><w:r><w:rPr><w:color w:val="0563C1" /><w:u w:val="single" /></w:rPr><w:t xml:space="preserve">ops team</w:t></w:r><w:r><w:t xml:space="preserve"> (mailto:ops@example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for details.</w:t></w:r></w:p>
Binary file not shown.
Binary file not shown.
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:hyperlink w:anchor="section2"><w:r><w:rPr><w:u w:val="single" /><w:color w:val="0563C1" /></w:rPr><w:t xml:space="preserve">Jump to Section 2</w:t></w:r></w:hyperlink></w:p>
1+
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:hyperlink w:anchor="section2"><w:r><w:rPr><w:color w:val="0563C1" /><w:u w:val="single" /></w:rPr><w:t xml:space="preserve">Jump to Section 2</w:t></w:r></w:hyperlink></w:p>
22
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:pPr><w:pStyle w:val="Heading2" /></w:pPr><w:bookmarkStart w:name="section2" w:id="1" /><w:r><w:rPr><w:b /></w:rPr><w:t xml:space="preserve">Section 2</w:t></w:r><w:bookmarkEnd w:id="1" /></w:p>
33
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Content here.</w:t></w:r></w:p>
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:hyperlink w:anchor="section2"><w:r><w:rPr><w:u w:val="single" /><w:color w:val="0563C1" /></w:rPr><w:t xml:space="preserve">Jump to Section 2</w:t></w:r></w:hyperlink></w:p>
1+
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:hyperlink w:anchor="section2"><w:r><w:rPr><w:color w:val="0563C1" /><w:u w:val="single" /></w:rPr><w:t xml:space="preserve">Jump to Section 2</w:t></w:r></w:hyperlink></w:p>
22
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:pPr><w:pStyle w:val="Heading2" /></w:pPr><w:bookmarkStart w:name="section2" w:id="1" /><w:r><w:rPr><w:b /></w:rPr><w:t xml:space="preserve">Section 2</w:t></w:r><w:bookmarkEnd w:id="1" /></w:p>
33
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Content here.</w:t></w:r></w:p>
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Visit </w:t></w:r><w:r><w:rPr><w:u w:val="single" /><w:color w:val="0563C1" /></w:rPr><w:t xml:space="preserve">our site</w:t></w:r><w:r><w:t xml:space="preserve"> (https://example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for more info.</w:t></w:r></w:p>
1+
<w:p xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main"><w:r><w:t xml:space="preserve">Visit </w:t></w:r><w:r><w:rPr><w:color w:val="0563C1" /><w:u w:val="single" /></w:rPr><w:t xml:space="preserve">our site</w:t></w:r><w:r><w:t xml:space="preserve"> (https://example.com)</w:t></w:r><w:r><w:t xml:space="preserve"> for more info.</w:t></w:r></w:p>

0 commit comments

Comments
 (0)