Explicitly map XML namespaces for safety

1 files changed, 12 insertions, 2 deletions

diff --git a/lib/docx-reader.js b/lib/docx-reader.js
index 35f1627..1012068 100644
--- a/lib/docx-reader.js
+++ b/lib/docx-reader.js
@@ -87,9 +87,19 @@ function openZip(zipPath) {
 }
 
 function readXmlFile(docxFile, path) {
+    var xmlNamespaceMap = {
+        "http://schemas.openxmlformats.org/wordprocessingml/2006/main": "w",
+        "http://schemas.openxmlformats.org/officeDocument/2006/relationships": "r",
+        "http://schemas.openxmlformats.org/drawingml/2006/wordprocessingDrawing": "wp",
+        "http://schemas.openxmlformats.org/drawingml/2006/main": "a",
+        "http://schemas.openxmlformats.org/drawingml/2006/picture": "pic"
+    };
+    
     if (docxFile.exists(path)) {
         return docxFile.read(path, "utf-8")
-            .then(xmlreader.read);
+            .then(function(xmlString) {
+                return xmlreader.read(xmlString, xmlNamespaceMap);
+            });
     } else {
         return null;
     }
@@ -98,7 +108,7 @@ function readXmlFile(docxFile, path) {
 function readRelationships(relationshipsXml) {
     var relationships = {};
     relationshipsXml.root.children.forEach(function(child) {
-        if (child.name === "Relationship") {
+        if (child.name === "{http://schemas.openxmlformats.org/package/2006/relationships}:Relationship") {
             relationships[child.attributes.Id] = {
                 target: child.attributes.Target
             };