SheetJS / js-cfb

:floppy_disk: OLE File Container Format
https://sheetjs.com/cfb-editor
Apache License 2.0
69 stars 15 forks source link

stream names should be limited to 32 UTF-16 code points, including the terminating null character #18

Closed shearer12345 closed 1 year ago

shearer12345 commented 1 year ago

Thanks for js-cfb, and for the changes to truncate stream names introduced in 0e33eb6e.

The MS-CFB spec says

storage and stream names are limited to 32 UTF-16 code points, including the terminating null character.

Currently, cfb.js truncates stream name to 32 characters, but as the name has to be null terminated, it should be truncated to 31, allowing WriteShift to pad the rest with 0.

So, in cfb.js#894

        if(_nm.length > 32) {
            console.error("Name " + _nm + " will be truncated to " + _nm.slice(0,32));
            _nm = _nm.slice(0, 32);
        }

all the 32s should be 31.

In my testing this doesn't break any of my tools, but some throw warnings:

I can submit a PR for this if you'd like

shearer12345 commented 1 year ago

link for MS-CFB docs for reference - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cfb/53989ce4-7b05-4f8d-829b-d08d6148375b

SheetJSDev commented 1 year ago

Good catch! When we tested at the time, Excel happily accepted files with 32 UTF-16 characters without a null terminator, but it makes more sense to use the lower limit. Changing 32 -> 31 works. Also make the change in bits/66_dir.js