improvement(files): extend the OOXML size limits to the client previews

[waleedlatif1]

Summary

• Move the OOXML archive size ceilings into a shared, dependency-free module so the server parse guard and the client previews resolve the same numbers from one source
• Apply a lightweight declared-size check (via JSZip.loadAsync, no inflation) in the docx and xlsx previews before they render, matching the guard the pptx preview already has
• No behavior change to the server-side guard

Type of Change

• Improvement

Testing

Unit tests for the shared client guard (per-entry cap, total cap, ordinary-doc acceptance) plus the existing zip-guard suite; type-check and lint clean.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 8:51pm

[cursor]

PR Summary

Medium Risk
Adds client-side resource protection before heavy parsers; declared-size checks can miss lying archives (acknowledged in code), while server-side verification remains unchanged.

Overview
OOXML zip-bomb limits are now shared between the server parse guard and browser previews via a new dependency-free ooxml-limits module (150 MB total / 64 MB per-entry ceilings and ZipBombError).

Docx and xlsx workspace previews call assertOoxmlPreviewWithinLimits before docx-preview or SheetJS runs. The guard loads the ZIP central directory with JSZip and rejects archives whose declared uncompressed sizes exceed those caps—no inflation, matching the lighter check the pptx preview already had.

The server zip-guard only switches to the shared constants and error type; ratio checks and bounded inflation verification stay server-only.

^{Reviewed by Cursor Bugbot for commit e14f56c. Configure here.}

[greptile-apps]

Greptile Summary

The PR centralizes OOXML archive limits and applies a lightweight declared-size check before DOCX and XLSX browser previews parse uploaded files.

• Moves the server guard’s existing size ceilings and error class into a browser-safe shared module.
• Adds a JSZip-based preview guard for aggregate and per-entry declared sizes.
• Integrates the guard into DOCX and XLSX preview lifecycles.
• Adds focused guard tests and updates the existing server guard tests.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issue identified.

The shared constants preserve the server guard’s behavior, and the new DOCX and XLSX checks execute before their parsers while retaining existing cancellation and error handling.

Important Files Changed

Filename	Overview
apps/sim/lib/file-parsers/ooxml-preview-guard.ts	Adds a browser-safe declared-size guard that rejects entries or archives exceeding the shared OOXML limits.
apps/sim/lib/file-parsers/ooxml-limits.ts	Centralizes the unchanged total and per-entry limits plus the shared ZipBombError class.
apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/docx-preview.tsx	Runs the archive guard before loading and invoking the DOCX renderer while preserving cancellation handling.
apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/xlsx-preview.tsx	Runs the archive guard before loading SheetJS and parsing workbook data.
apps/sim/lib/file-parsers/zip-guard.ts	Reuses the shared limits and error class without changing the server-side validation algorithm.
apps/sim/lib/file-parsers/ooxml-preview-guard.test.ts	Covers ordinary archives, per-entry overflow, and aggregate-size overflow.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[OOXML file data] --> B[JSZip reads central directory]
  B --> C{Declared sizes within shared limits?}
  C -->|No| D[Show preview error]
  C -->|Yes| E{Preview type}
  E -->|DOCX| F[docx-preview renderer]
  E -->|XLSX| G[SheetJS parser]

Loading

_{Reviews (1): Last reviewed commit: "improvement(files): extend the OOXML siz..." | Re-trigger Greptile}