Skip to content

v7.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 Jul 22:01
v7.4.0
a4a5546

v7.4.0: 📝 Markdown Output Dialects, Metadata Overrides & Robust Validation

I am thrilled to announce the release of officeParser v7.4.0! This release brings major enhancements to our Markdown generation capabilities with targeted dialects, introduces metadata overrides for document authors, enables granular HTML attribute pass-through, and applies another critical layer of validation and security hardening across spreadsheet parsing and recursive nesting.

Warning

Behavior changes in this release:

  • RTF hyperlink scheme restriction: RTF hyperlinks are now restricted to the same safe schemes allowed in HTML and Markdown. Local intranet file:// or UNC path links will lose their click targets (the link text is kept).
  • styleMap default mappings in HTML: styleMap's output.tag now takes effect in HTML output. This activates built-in default style mappings for HTML (e.g. mapping Heading N/Quote/Title-styled paragraphs to their respective semantic tags).
  • Clamped repeated spreadsheet cells: ODF spreadsheets with table:number-columns-repeated or table:number-rows-repeated are now capped at decompressionLimits.maxTableCells (default: 1,000,000) to prevent memory exhaustion from zip bomb constructs.
  • Lowered HTML nesting-depth guard: Lowered the HTML parser's nesting-depth guard to 256 (from 1000) so a deeply nested document raises the typed error instead of a range error.

🌟 Key Pillars of the v7.4.0 Update

1. Markdown Output Dialects & HTML Fallbacks

I've significantly upgraded the Markdown generator to support real-world flavors:

  • Targeted Dialects (MdGeneratorConfig.dialect): Generate output optimized for specific platforms: 'github', 'gitlab', 'obsidian', 'pandoc', strict 'commonmark', or the default 'extended'. You can also pass a detailed MarkdownDialectConfig object to toggle admonitions, footnotes, citations, wikilinks, math, tables, list markers, and emphasis on a per-feature basis.
  • Granular HTML Fallbacks (MdGeneratorConfig.fallbackToHtml): The fallback flag can now accept a FallbackToHtmlConfig object to independently control how text formatting, alignment, anchors, tables, embeds, and cell line breaks degrade to HTML when not natively representable. The plain boolean form remains supported.

2. Metadata Overrides & Document Reproducibility

  • Metadata Overrides (GeneratorConfig.metadataOverrides): Author metadata can now be specified at the generation stage (including title, author, subject, keywords, created, modified, language, and custom properties) without mutating the parsed AST. This applies across HTML, EPUB, Markdown, RTF, and plain text/CSV headers.
  • EPUB Reproducibility: Specifying the modified override metadata yields byte-stable EPUB output by fixing the dcterms:modified property and all zip entry modification times (which previously defaulted to the current runtime).
  • Keywords and Subject: These properties are now written out to HTML <meta>, Markdown frontmatter, EPUB dc:subject, and RTF \info.

3. HTML Attribute Pass-through

  • Preserve Attributes (htmlParserConfig.preserveAttributes, default false): You can now opt-in to preserve generic HTML attributes on round-trips. They will map to BaseContentNode.htmlAttributes. High-risk attributes like event handlers (on*), srcdoc, inline style, and id are filtered out.

4. Expanded Markdown/Text Parsing

  • Parsers have been expanded to handle reference-style links/images, backslash escapes, underscore emphasis, multi-backtick inline code, setext headings, <url> autolinks, HTML entity and character references, and ~~~-fenced blocks.
  • Footnotes now degrade gracefully when disabled or under strict CommonMark, rendering as parentheticals rather than disappearing.

5. Security & DoS Hardening

  • Spreadsheet Cell Cap: Clamps pathologically large repetition counts in ODF spreadsheets, preventing memory exhaustion.
  • Recursive Nesting Guard: The HTML parser's nesting guard has been lowered to 256 (from 1000) to safely throw a typed error before Node.js stacks overflow.
  • Config pollution protection: Standardized deep config merges now explicitly guard against __proto__ pollution during JSON parsing.
  • CSS sanitization bypass fixed: sanitizeCssValue now strips backslash escapes before checking for prohibited patterns like url().
  • RTF Hyperlink schema restrictions: hyperlinked paths are restricted to safe web schemes.
  • Contextual escaping: Fixed missing escapes in Markdown generation for math blocks, wikilinks, citation keys, admonition types, and footnote IDs.

🔧 Also in This Release

  • Fixed: Plain-text .to('text') and .to('md') output no longer trims document-level whitespace, resolving issue #102 by only stripping the generator's internal separator artifacts.
  • Fixed: .to('text') now preserves chart data series, CSV comments, and separates adjacent table cells cleanly instead of merging them.
  • Fixed: CSV formula safety prefixing is now tested against trimmed cell values.
  • Fixed: Inline stylesheet parsing is now powered by a real CSS declaration parser rather than substring matching.

Acknowledgements

Thanks to EQSTLab for identifying the ODF spreadsheet cell-expansion issue behind this release's memory-exhaustion hardening. Expansion is now bounded per document by decompressionLimits.maxTableCells (default 1,000,000), which clamps and emits a TABLE_CELL_LIMIT_EXCEEDED warning instead of expanding without limit.

🛠 Getting Started

npm install officeparser@7.4.0

🔗 Full Changelog: View v7.4.0 details
🔗 Documentation & Visualizer: officeparser.harshankur.com

Assets 9
Loading