Update JSZip to 3.2.0

7 files changed, 164 insertions, 97 deletions

diff --git a/NEWS b/NEWS
index d05a41c..9c37dcc 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@
 
 * Handle internal hyperlinks created with complex fields.
 
+* Update JSZip to 3.2.0. This addresses CVE-2021-23413 in JSZip.
+
 # 1.4.17
 
 * Handle w:num with invalid w:abstractNumId.
diff --git a/lib/index.js b/lib/index.js
index 683352b..ac9f634 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -92,8 +92,13 @@ function embedStyleMap(input, styleMap) {
             return docxStyleMap.writeStyleMap(docxFile, styleMap);
         })
         .then(function(docxFile) {
+            return docxFile.toBuffer();
+        })
+        .then(function(buffer) {
             return {
-                toBuffer: docxFile.toBuffer
+                toBuffer: function() {
+                    return buffer;
+                }
             };
         });
 }
diff --git a/lib/zipfile.js b/lib/zipfile.js
index cae9567..d38a9a4 100644
--- a/lib/zipfile.js
+++ b/lib/zipfile.js
@@ -1,41 +1,41 @@
 var JSZip = require("jszip");
 
-var promises = require("./promises");
-
 exports.openArrayBuffer = openArrayBuffer;
 exports.splitPath = splitPath;
 exports.joinPath = joinPath;
 
 function openArrayBuffer(arrayBuffer) {
-    var zipFile = new JSZip(arrayBuffer);
-    function exists(name) {
-        return zipFile.file(name) !== null;
-    }
+    return JSZip.loadAsync(arrayBuffer).then(function(zipFile) {
+        function exists(name) {
+            return zipFile.file(name) !== null;
+        }
 
-    function read(name, encoding) {
-        var array = zipFile.file(name).asUint8Array();
-        var buffer = uint8ArrayToBuffer(array);
-        if (encoding) {
-            return promises.when(buffer.toString(encoding));
-        } else {
-            return promises.when(buffer);
+        function read(name, encoding) {
+            return zipFile.file(name).async("uint8array").then(function(array) {
+                var buffer = uint8ArrayToBuffer(array);
+                if (encoding) {
+                    return buffer.toString(encoding);
+                } else {
+                    return buffer;
+                }
+            });
         }
-    }
 
-    function write(name, contents) {
-        zipFile.file(name, contents);
-    }
+        function write(name, contents) {
+            zipFile.file(name, contents);
+        }
 
-    function toBuffer() {
-        return zipFile.generate({type: "nodebuffer"});
-    }
+        function toBuffer() {
+            return zipFile.generateAsync({type: "nodebuffer"});
+        }
 
-    return {
-        exists: exists,
-        read: read,
-        write: write,
-        toBuffer: toBuffer
-    };
+        return {
+            exists: exists,
+            read: read,
+            write: write,
+            toBuffer: toBuffer
+        };
+    });
 }
 
 function uint8ArrayToBuffer(array) {
diff --git a/package-lock.json b/package-lock.json
index 6a11760..8c59589 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "mammoth",
-  "version": "1.4.16",
+  "version": "1.4.17",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -580,8 +580,7 @@
     "core-util-is": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=",
-      "dev": true
+      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac="
     },
     "create-ecdh": {
       "version": "4.0.0",
@@ -1244,6 +1243,11 @@
       "integrity": "sha1-JujaBkS+C7TLOVFvbHnw4PT/5Iw=",
       "dev": true
     },
+    "immediate": {
+      "version": "3.0.6",
+      "resolved": "https://registry.npmjs.org/immediate/-/immediate-3.0.6.tgz",
+      "integrity": "sha1-nbHb0Pr43m++D13V5Wu2BigN5ps="
+    },
     "imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@@ -1269,8 +1273,7 @@
     "inherits": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-      "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4=",
-      "dev": true
+      "integrity": "sha1-Yzwsg+PaQqUC9SRmAiSA9CCCYd4="
     },
     "inline-source-map": {
       "version": "0.6.2",
@@ -1395,8 +1398,7 @@
     "isarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=",
-      "dev": true
+      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE="
     },
     "jade": {
       "version": "0.26.3",
@@ -1460,11 +1462,48 @@
       "dev": true
     },
     "jszip": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/jszip/-/jszip-2.5.0.tgz",
-      "integrity": "sha1-dET9hVHd8+XacZj+oMkbyDCMwnQ=",
-      "requires": {
-        "pako": "~0.2.5"
+      "version": "3.7.1",
+      "resolved": "https://registry.npmjs.org/jszip/-/jszip-3.7.1.tgz",
+      "integrity": "sha512-ghL0tz1XG9ZEmRMcEN2vt7xabrDdqHHeykgARpmZ0BiIctWxM47Vt63ZO2dnp4QYt/xJVLLy5Zv1l/xRdh2byg==",
+      "requires": {
+        "lie": "~3.3.0",
+        "pako": "~1.0.2",
+        "readable-stream": "~2.3.6",
+        "set-immediate-shim": "~1.0.1"
+      },
+      "dependencies": {
+        "pako": {
+          "version": "1.0.11",
+          "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
+          "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="
+        },
+        "process-nextick-args": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+          "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="
+        },
+        "readable-stream": {
+          "version": "2.3.7",
+          "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.7.tgz",
+          "integrity": "sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==",
+          "requires": {
+            "core-util-is": "~1.0.0",
+            "inherits": "~2.0.3",
+            "isarray": "~1.0.0",
+            "process-nextick-args": "~2.0.0",
+            "safe-buffer": "~5.1.1",
+            "string_decoder": "~1.1.1",
+            "util-deprecate": "~1.0.1"
+          }
+        },
+        "string_decoder": {
+          "version": "1.1.1",
+          "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+          "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+          "requires": {
+            "safe-buffer": "~5.1.0"
+          }
+        }
       }
     },
     "labeled-stream-splicer": {
@@ -1526,6 +1565,14 @@
         }
       }
     },
+    "lie": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/lie/-/lie-3.3.0.tgz",
+      "integrity": "sha512-UaiMJzeWRlEujzAuw5LokY1L5ecNQYZKfmyZ9L7wDHb/p5etKaxXhohBcrw0EYby+G/NA52vRSN4N39dxHAIwQ==",
+      "requires": {
+        "immediate": "~3.0.5"
+      }
+    },
     "lodash.memoize": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-3.0.4.tgz",
@@ -1832,7 +1879,8 @@
     "pako": {
       "version": "0.2.9",
       "resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
-      "integrity": "sha1-8/dSL073gjSNqBYbrZ7P1Rv4OnU="
+      "integrity": "sha1-8/dSL073gjSNqBYbrZ7P1Rv4OnU=",
+      "dev": true
     },
     "parents": {
       "version": "1.0.1",
@@ -2104,11 +2152,21 @@
       "integrity": "sha1-Gc5QLKVyZl87ZHsQk5+X/RYV8QI=",
       "dev": true
     },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+    },
     "sax": {
       "version": "1.1.6",
       "resolved": "http://registry.npmjs.org/sax/-/sax-1.1.6.tgz",
       "integrity": "sha1-XWFr6KXmB9VOEUr65Vt+ry/MMkA="
     },
+    "set-immediate-shim": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/set-immediate-shim/-/set-immediate-shim-1.0.1.tgz",
+      "integrity": "sha1-SysbJ+uAip+NzEgaWOXlb1mfP2E="
+    },
     "sha.js": {
       "version": "2.4.8",
       "resolved": "http://registry.npmjs.org/sha.js/-/sha.js-2.4.8.tgz",
@@ -2480,8 +2538,7 @@
     "util-deprecate": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8=",
-      "dev": true
+      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
     },
     "vm-browserify": {
       "version": "0.0.4",
diff --git a/package.json b/package.json
index 65cee7a..1655593 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
     "argparse": "~1.0.3",
     "bluebird": "~3.4.0",
     "dingbat-to-unicode": "^1.0.1",
-    "jszip": "~2.5.0",
+    "jszip": "^3.7.1",
     "lop": "^0.4.1",
     "path-is-absolute": "^1.0.0",
     "sax": "~1.1.1",
diff --git a/test/docx/style-map.tests.js b/test/docx/style-map.tests.js
index 4ddb127..5f60dd6 100644
--- a/test/docx/style-map.tests.js
+++ b/test/docx/style-map.tests.js
@@ -7,77 +7,77 @@ var styleMap = require("../../lib/docx/style-map");
 var test = require("../test")(module);
 
 test('reading embedded style map on document without embedded style map returns null', function() {
-    var zip = normalDocx();
-    
-    return styleMap.readStyleMap(zip).then(function(contents) {
-        assert.equal(contents, null);
+    return normalDocx().then(function(zip) {
+        return styleMap.readStyleMap(zip).then(function(contents) {
+            assert.equal(contents, null);
+        });
     });
 });
 
 test('embedded style map can be read after being written', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return styleMap.readStyleMap(zip).then(function(contents) {
-            assert.equal(contents, "p => h1");
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return styleMap.readStyleMap(zip).then(function(contents) {
+                assert.equal(contents, "p => h1");
+            });
         });
     });
 });
 
 test('embedded style map is written to separate file', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return zip.read("mammoth/style-map", "utf8").then(function(contents) {
-            assert.equal(contents, "p => h1");
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return zip.read("mammoth/style-map", "utf8").then(function(contents) {
+                assert.equal(contents, "p => h1");
+            });
         });
     });
 });
 
 test('embedded style map is referenced in relationships', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return zip.read("word/_rels/document.xml.rels", "utf8").then(function(contents) {
-            assert.equal(contents, expectedRelationshipsXml);
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return zip.read("word/_rels/document.xml.rels", "utf8").then(function(contents) {
+                assert.equal(contents, expectedRelationshipsXml);
+            });
         });
     });
 });
 
 test('re-embedding style map replaces original', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return styleMap.writeStyleMap(zip, "p => h2");
-    }).then(function() {
-        return zip.read("word/_rels/document.xml.rels", "utf8").then(function(contents) {
-            assert.equal(contents, expectedRelationshipsXml);
-        });
-    }).then(function() {
-        return styleMap.readStyleMap(zip).then(function(contents) {
-            assert.equal(contents, "p => h2");
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return styleMap.writeStyleMap(zip, "p => h2");
+        }).then(function() {
+            return zip.read("word/_rels/document.xml.rels", "utf8").then(function(contents) {
+                assert.equal(contents, expectedRelationshipsXml);
+            });
+        }).then(function() {
+            return styleMap.readStyleMap(zip).then(function(contents) {
+                assert.equal(contents, "p => h2");
+            });
         });
     });
 });
 
 test('embedded style map has override content type in [Content_Types].xml', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return zip.read("[Content_Types].xml", "utf8").then(function(contents) {
-            assert.equal(contents, expectedContentTypesXml);
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return zip.read("[Content_Types].xml", "utf8").then(function(contents) {
+                assert.equal(contents, expectedContentTypesXml);
+            });
         });
     });
 });
 
 test('replacing style map keeps content type', function() {
-    var zip = normalDocx();
-    
-    return styleMap.writeStyleMap(zip, "p => h1").then(function() {
-        return styleMap.writeStyleMap(zip, "p => h2");
-    }).then(function() {
-        return zip.read("[Content_Types].xml", "utf8").then(function(contents) {
-            assert.equal(contents, expectedContentTypesXml);
+    return normalDocx().then(function(zip) {
+        return styleMap.writeStyleMap(zip, "p => h1").then(function() {
+            return styleMap.writeStyleMap(zip, "p => h2");
+        }).then(function() {
+            return zip.read("[Content_Types].xml", "utf8").then(function(contents) {
+                assert.equal(contents, expectedContentTypesXml);
+            });
         });
     });
 });
@@ -106,7 +106,8 @@ function normalDocx() {
         '</Types>';
     zip.file("word/_rels/document.xml.rels", originalRelationshipsXml);
     zip.file("[Content_Types].xml", originalContentTypesXml);
-    var buffer = zip.generate({type: "arraybuffer"});
-    return zipfile.openArrayBuffer(buffer);
+    return zip.generateAsync({type: "arraybuffer"}).then(function(buffer) {
+        return zipfile.openArrayBuffer(buffer);
+    });
 }
 
diff --git a/test/zipfile.tests.js b/test/zipfile.tests.js
index 5383c49..cf11804 100644
--- a/test/zipfile.tests.js
+++ b/test/zipfile.tests.js
@@ -6,21 +6,23 @@ var zipfile = require("../lib/zipfile");
 var test = require("./test")(module);
 
 test('file in zip can be read after being written', function() {
-    var zip = emptyZipFile();
-    assert(!zip.exists("song/title"));
-    
-    zip.write("song/title", "Dark Blue");
-    
-    assert(zip.exists("song/title"));
-    return zip.read("song/title", "utf8").then(function(contents) {
-        assert.equal(contents, "Dark Blue");
+    return emptyZipFile().then(function(zip) {
+        assert(!zip.exists("song/title"));
+
+        zip.write("song/title", "Dark Blue");
+
+        assert(zip.exists("song/title"));
+        return zip.read("song/title", "utf8").then(function(contents) {
+            assert.equal(contents, "Dark Blue");
+        });
     });
 });
 
 function emptyZipFile() {
     var zip = new JSZip();
-    var buffer = zip.generate({type: "arraybuffer"});
-    return zipfile.openArrayBuffer(buffer);
+    return zip.generateAsync({type: "arraybuffer"}).then(function(arrayBuffer) {
+        return zipfile.openArrayBuffer(arrayBuffer);
+    });
 }