Skip to content

v0.3.0

v0.3.0 - public API parity with mammoth + security hardening
@mattmilesi mattmilesi tagged this 28 Apr 01:29 
Added
- Converter options: idPrefix, ignoreEmptyParagraphs, prettyPrint,
  transformDocument
- Transforms helpers (paragraph, run, elementsOfType, elements,
  getDescendants, getDescendantsOfType) backed by HasChildren
  interface
- Checkbox form fields (w:sdt[wordml:checkbox] and FORMCHECKBOX)
  rendered as <input type="checkbox"> / [x] / [ ]
- numStyleLink chasing in numbering and findLevelByParagraphStyleId
  fallback in body reader
- DSL: backslash escape sequences in strings, :separator('text')
  modifier on path elements

Fixed (security)
- r:link images no longer fetched via file_get_contents
  (closes SSRF / LFI / phar deserialisation)
- javascript: / vbscript: / data: hyperlinks strip their <a>
  wrapper (XSS guard)
- XML parsing rejects DOCTYPE and explicitly sets LIBXML_NONET
  (XXE and billion-laughs guard)

400 tests, PHPStan level 8 clean, Pint clean.
Assets 2
Loading