From edc871d3aa33bded7ee766a7374fcdbfe93a01bd Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sat, 27 Apr 2013 17:04:37 +0100 Subject: Use getElementsByTagName for safer image parsing --- lib/document-xml-reader.js | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) (limited to 'lib/document-xml-reader.js') diff --git a/lib/document-xml-reader.js b/lib/document-xml-reader.js index a391a21..1724b5b 100644 --- a/lib/document-xml-reader.js +++ b/lib/document-xml-reader.js @@ -23,9 +23,7 @@ function DocumentXmlReader(relationships, docxFile) { function readXmlElements(elements) { var results = elements.map(readXmlElement); - var values = _.flatten(_.pluck(results, "value")); - var messages = _.flatten(_.pluck(results, "messages"), true); - return new Result(values, messages); + return Result.combine(results); } function readXmlElement(element) { @@ -108,19 +106,24 @@ function DocumentXmlReader(relationships, docxFile) { return readXmlElements(element.children); }, "wp:inline": function(element) { - var relationshipId = element - .first("a:graphic") - .first("a:graphicData") - .first("pic:pic") - .first("pic:blipFill") - .first("a:blip") - .attributes["r:embed"]; - var imagePath = relationships[relationshipId].target; - var readImage = docxFile.read.bind(docxFile, path.join("word", imagePath)); - var altText = element.first("wp:docPr").attributes.descr; + var blips = element + .getElementsByTagName("a:graphic") + .getElementsByTagName("a:graphicData") + .getElementsByTagName("pic:pic") + .getElementsByTagName("pic:blipFill") + .getElementsByTagName("a:blip"); - var image = documents.Image(readImage, altText) - return new Result(image); + var results = blips.map(function(blip) { + var relationshipId = blip.attributes["r:embed"]; + var imagePath = relationships[relationshipId].target; + var readImage = docxFile.read.bind(docxFile, path.join("word", imagePath)); + var altText = element.first("wp:docPr").attributes.descr; + + var image = documents.Image(readImage, altText) + return new Result(image); + }); + + return Result.combine(results); } }; return { -- cgit v1.2.3