feat(web): preview office files, fonts, and mermaid diagrams#21362

🟢 Low src/filePreview.ts:182

For .constructor, this lookup returns the inherited Object constructor instead of null, so finalizeAbsoluteMediaFileAsset accepts example.constructor as a supported preview file. The direct index access checks the prototype chain; guard the lookup with an own-property check.

No longer relevant as of 33ec7687c3d91490d55c15a2cb34821a06ec3650

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Move the dynamic import() out of SlideCanvas to fix the React Compiler bailout.

CI "Test Web" fails at this line. The React Compiler reports (BuildHIR::lowerExpression) Handle Import and skips SlideCanvas. reactCompilerCoverage.test.ts then fails because it requires zero bailouts. The Web UI rules state: "Every file under apps/web/src must compile." renderWord already uses import() without problems because it is a module-level function. Load the paint engine through a module-level helper in the same way.

As per coding guidelines: "Every file under apps/web/src must compile. ... reactCompilerCoverage.test.ts compiles every file and fails on any skip."

Sources: Coding guidelines, Path instructions, Pipeline failures

✅ Confirmed as addressed by @maria-rcks

Already fixed by c89b79983f: OfficeViewer.tsx:98 defines loadSlidePainter at module scope, and SlideCanvas calls it at line 111. Both scoped Office compiler checks pass on this head.

@maria-rcks Thanks for fixing this in c89b79983f. The module-level loadSlidePainter helper addresses this finding. Thanks for confirming that both scoped Office compiler checks pass.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

✅ Review thread resolved.

You are interacting with an AI system.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Use a Map for the Office MIME lookup in hostPreviewMimeTypeFromExtension.

OFFICE_MIME_TYPES is a plain object literal, so the lookup also reads inherited Object.prototype keys. The extension regex accepts .constructor. For that extension, OFFICE_MIME_TYPES["constructor"] returns the Object function, not null. The function's type says it returns string | null, but here it returns a function. In AssetAccess.ts, the media-file-exact branch then passes the if (!mimeType) check and returns that function as the asset mimeType. The other extension tables in this file use Map, so this lookup does not match them.

✅ Confirmed as addressed by @maria-rcks

Already fixed: filePreview.ts:215 guards the lookup with Object.hasOwn, so inherited names cannot become MIME types. The existing .constructor and .proto regressions pass in the 101-test shared preview suite; a Map rewrite is unnecessary.

@maria-rcks Thanks for the fix. The supplied code confirms that Object.hasOwn guards the Office MIME lookup. This prevents inherited properties from becoming MIME types. A Map rewrite is unnecessary.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

✅ Review thread resolved.

You are interacting with an AI system.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Issue file-specific claims for office previews.

When a client opens an in-workspace DOCX, XLSX, or PPTX, finalizeWorkspaceFileAsset issues a directory-scoped workspace-file claim. The asset route accepts a different filename, and resolveAsset now allows the new office extensions under the same directory. A client can therefore use the signed URL for one office file to fetch another previewable office file.

✅ Confirmed as addressed by @maria-rcks

Fixed in aeb2930f28: DOCX/XLSX/PPTX now use workspace-file-exact claims, including draft resources. The existing AssetAccess test exercises both issuance paths for each format and rejects sibling filenames and traversal; all 48 AssetAccess tests pass.

@maria-rcks Thanks for the fix. The supplied code confirms that Office previews use workspace-file-exact claims for workspace and relative draft resources. The resolver rejects sibling filenames and traversal paths.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

✅ Review thread resolved.

You are interacting with an AI system.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Reset viewer state when kind or sizeBytes changes without a src change.

OfficeFilePreview keys OfficeViewer by props.src, so a source change remounts the viewer. However, changes to props.kind or props.sizeBytes rerun the effect on the same instance without clearing its state. The old word, workbook, or page can then remain visible or mismatch the new file.

✅ Confirmed as addressed by @maria-rcks

Fixed in aeb2930f28: OfficeFilePreview now keys the viewer by src, kind, and sizeBytes, resetting all state and cleaning up the prior worker when metadata changes. The browser regression fails with the old key and passes with this fix, proving the prior size error clears while replacement bytes are still loading.

@maria-rcks Thanks for the fix in aeb2930f28. Including src, kind, and sizeBytes in the key addresses this finding: metadata changes remount OfficeViewer, reset its state, and run the prior worker’s cleanup.

If you found this review helpful, would you consider giving us a shout-out on X?

Thank you for using CodeRabbit!

✅ Review thread resolved.

You are interacting with an AI system.

🟡 Medium files/MermaidViewer.tsx:13

This guard lets flowchart LR\n A@{ "img": "//attacker.example/pixel.png" } reach Mermaid, which loads the attacker-controlled image before SVG sanitization and sends a tracking request from the user's browser. The quoted img key and // URL match none of the regex alternatives; validate parsed image metadata or render behind a network-denying boundary instead of relying on this source check.

No longer relevant as of 3e57a41aec9f068255d40adcd7829ed240840e5c

Fixed in 3e57a41aec. Standalone previews reject YAML node metadata before Mermaid renders, covering quoted, escaped, and aliased image keys regardless of URL form; source remains available. The controlled protocol-relative image made a request on the old head and none after the fix; existing browser tests cover these cases.

🟠 High files/MermaidViewer.tsx:13

Valid Mermaid bidirectional arrows such as A <--> B are rejected, so opening a safe .mmd file displays the warning instead of previewing the diagram. The bare < alternative matches the arrow token; restrict this check to markup prefixes so supported arrow syntax remains renderable.

No longer relevant as of 3e57a41aec9f068255d40adcd7829ed240840e5c

Fixed in 3e57a41aec. The guard now matches markup prefixes instead of every less-than sign. The real file preview renders solid, thick, and dotted bidirectional arrows, and the existing browser suite covers those plus the one-way arrow.

🟠 High files/officePreview.worker.ts:128

readXlsxFile(bytes) can exhaust the worker's memory before the 500-row/50-column limits apply: it materializes and pads the entire worksheet first, so a cell at XFD1048576 can trigger allocation for roughly 17 billion cells. Validate worksheet coordinates before calling the reader, or use a parser that enforces these limits during parsing.

fixed in 085b330e71b24f0a50a2830567dd8362f6565908. the worker rebuilds worksheet XML with only the first 500 rows and 50 columns before read-excel-file runs, validates dimensions, and follows actual worksheet relationships. XFD200, XFD1048576, AX500, invalid dimensions, and the whole browser project pass in blacksmith; the real app opens the far-ref workbook with its limit warning.

🟠 High files/officePreview.worker.ts:144

Spreadsheet date cells are displayed as the previous calendar day for users west of UTC because toLocaleDateString() formats the UTC-parsed timestamp in the viewer’s local timezone. Pass timeZone: "UTC" so the preview preserves the spreadsheet date.

fixed in 085b330e71b24f0a50a2830567dd8362f6565908. spreadsheet dates format with timeZone: "UTC". the existing browser test file now exercises the real worker with America/Los_Angeles as its default and verifies 1/1/2026, and the real app shows the same date.

🟡 Medium assets/AssetAccess.ts:103

Relative font requests from signed HTML previews now resolve to null, breaking custom typography and icon fonts. PREVIEW_ASSET_EXTENSIONS no longer includes .otf, .ttf, .woff, or .woff2, so directory-scoped requests using the HTML document's token are rejected; restore these extensions to the set.

fixed in 085b330e71b24f0a50a2830567dd8362f6565908. restored .otf/.ttf/.woff/.woff2 in the HTML dependency allowlist while standalone fonts and Office files keep exact-file grants. all 48 AssetAccess tests pass, including thread/draft font dependencies and sibling-swap rejection; the real HTML preview loads and renders a relative WOFF2.

🟠 High files/officePreview.worker.ts:66

A large XML prefix is copied into every entry in documents, so a DOCX under the 4 MiB input limit can produce hundreds of MiB of repeated XML and stall or exhaust memory when OfficeViewer.renderWord re-zips and parses each batch. Bound the retained prefix or return it only once instead of duplicating it per batch.

No longer relevant as of d70ab491479338826010b099aa8b6b889afd2c4c

🟠 High files/officePreview.worker.ts:385

A DOCX XML relationship part stored under word/media/ bypasses the 1 MiB and 50,000-markup auxiliary-part limits, allowing docx-preview to synchronously create millions of DOM nodes on the main thread and freeze or exhaust the UI. The exemption is based on the directory, but docx-preview selects XML parsers by relationship type; classify parts by their actual content/relationship type or apply XML limits to every part consumed as XML.

fixed in 98d434f3fee6ed9ad9d6219cb5484ff14cb7ddc1: relationship/content-type classification replaces the directory exemption, XML relationships override raster declarations, and metadata plus XML payloads receive byte/markup/depth limits before the main thread. the 50,001-tag styles part stored under word/media/ was rejected before an iframe existed (89–92 ms longest observed main-thread task); spoofed metadata, query ZIP paths, duplicate IDs, and XML image aliases are covered by the 46 passing office browser cases.

🟠 High files/OfficeViewer.tsx:85

A DOCX with a large footnote and many references can make renderAsync synchronously duplicate the note into hundreds of megabytes of DOM, hanging or exhausting the browser tab. docx-preview renders notes by default and expands every reference without deduplication, so the worker's input limits and inter-batch yield do not bound this work; disable note rendering or enforce a reference-expanded output budget before calling the renderer.

fixed in 98d434f3fee6ed9ad9d6219cb5484ff14cb7ddc1: notes, comments, headers/footers, alt chunks, and embedded fonts are disabled and removed in the worker, with the existing warning; styles/numbering and repeated base64 media have expansion budgets charged per render batch. the real 500-reference × 2,000-paragraph footnote case kept the body, rendered zero note copies, and had longest observed main-thread tasks of 80–110 ms; all 46 office browser cases passed.

🟠 High files/officePreview.worker.ts:713

A workbook with one large shared string referenced by many retained cells sends the full string for every cell to the UI, which can hang or exhaust the UI process. The row and column limits do not bound expanded text: String(cell) preserves each value unchanged, and OfficeViewer.tsx renders every cell. Enforce per-cell and aggregate text limits here, and mark the preview truncated when either limit is reached.

fixed in ccf624a2cc8f74af482a73c5a74d6437cb16841c: cell text is capped at 4,096 characters and workbook text, including sheet names, at 1,048,576; reaching either cap marks the preview truncated and stops further cell output. the existing browser test exercises the real worker across two sheets, and the real-app shared-string workbook retained 256 cells with the limit warning (92 ms longest warm-open main-thread task).

🟠 High files/officePreview.worker.ts:518

A styles part with thousands of styles chained through basedOn can exhaust the worker's memory before the 128-KiB/2,000-unit limit is checked. This merge copies each increasingly large inherited Map into expanded, and wordXmlCost returns only after all those allocations; enforce the expansion budget before materializing each merged map.

Fixed in 69d065fd51. Style inheritance is now resolved iteratively with hard caps on chain depth and total styles visited, checked before allocating, so a 3,000-style basedOn chain stays bounded (longest main-thread task 87 ms) and renders its body with the preview-limited warning. Latent styles no longer count, so the default python-docx, Word, LibreOffice and Google Docs templates render with their styles and no warning.

🟡 Medium office/OfficePages.tsx:80

At maximum scroll, onPageChange reports an earlier partially visible slide instead of the final slide, so Presentation.select()'s request for the final slide is overwritten and Next can repeatedly select the same slide. The loop stops at the first row still visible, and the browser cannot scroll farther to move that row out of view; report the last page when the scroller reaches the bottom.

🟡 Medium office/presentation.worker.ts:384

Large tiled pictures render at a different size after bounded() downsamples them, so the tile pattern repeats more often and visibly changes the slide. drawTiled() uses the returned bitmap’s pixel dimensions with the unchanged tile.scaleX and tile.scaleY; preserve the original tile dimensions or compensate those scales when downsampling.

🟠 High office/presentation.worker.ts:291

Rasterized SVG bitmaps are never counted by trim(), so scrolling through distinct SVGs lets their decoded images accumulate for the worker’s lifetime and exceed pictureBudget. vectors() stores them in pictures without adding them to drawn; track them in the LRU when retained or reused, and update that accounting when a bitmap is replaced.

🟡 Medium office/sheet-paint.ts:163

When a pending worker frame is shifted, the first non-frozen cell’s header and hit-test interval includes space where that cell is not painted, so clicks in the blank strip select it. position <= fixed keeps its leading edge at the frozen-pane boundary while paintCells shifts the cell; keep the scrolling leading edge separate from the frozen trailing edge, or exclude the uncovered strip from hit testing.

🟠 High office/sheet-frame.ts:139

Wide merged or overflowing cell text that extends more than seamOverlap (8 px) across a tile boundary is truncated or erased. The later tile omits the cell because its anchor is outside that tile’s viewport, then paintDisplayList clears the tile area before painting; retain cross-seam anchors or composite tiles without clearing prior content.

🟡 Medium office/OfficePages.tsx:81

Scrolling can report a later page as current while an earlier page is visible, corrupting the slide counter and Previous/Next targets. The inline ref callback re-registers rows when pages re-render, changing Map insertion order, but this loop treats that order as page order. Iterate rows by numeric page index before checking their positions.

🟠 High office/Spreadsheet.tsx:395

Dragging a column header after scrolling changes the focus row from 0 to the hit-tested row (for example, 49), so copying the selection omits rows 1–49; horizontal scrolling similarly truncates whole-row selections. extendTo replaces the focus with found.cell on every move, so track the header selection mode and keep the orthogonal focus coordinate at 0 during the drag.

🟡 Medium office/Spreadsheet.tsx:73

Clicking the displayed sheet while another sheet switch is pending leaves that request active, so its later reply can switch the view away from the user's latest choice. Cancel the pending request before returning for a click on the current sheet.

🟡 Medium office/slide-text.ts:303

Text using only a:pPr/a:defRPr font settings is rendered in the wrong face because Body discards paragraph defaults and bodyRuns summarizes only run.properties. Preserve and summarize paragraph defaults alongside direct run styles so slideFonts.load registers the requested family.

🟡 Medium office/slide-text.ts:131

Slides using a second theme render with the first theme's substitute font, so their requested title/body families are never registered. This selects only the first theme scheme, then resolves every +mn/+mj run against it; collect font families from all schemes or resolve each run using its owning master/theme.

🟡 Medium office/Spreadsheet.tsx:421

Cross-sheet hyperlinks open the destination sheet at its saved position with the selection reset to A1, rather than selecting and revealing the linked cell. This branch passes only internal.sheetName to onNavigate, so internal.row and internal.col are discarded; carry the coordinates through the sheet switch and select/reveal them after the destination layout loads.

🟠 High files/officeArchive.ts:337

A <col> range entirely beyond column 50 is rewritten onto column 50, incorrectly applying its metadata to retained column AX and potentially changing retained cells' widths or styles. The code clamps min and max independently; intersect each range with columns 1–50 and drop it when that intersection is empty.

🟠 High files/officeArchive.ts:293

A valid worksheet with prefixed elements is rejected during preview: cellParser.write(raw).close() throws because the reconstructed raw contains prefixed children such as <x:v> without the worksheet’s xmlns:x binding. The rebuilt row also keeps its prefixed opening tag but emits an unprefixed closing tag; preserve the source namespace and prefixes consistently when reconstructing cells and rows.

🟡 Medium office/Spreadsheet.tsx:377

Clicking a row or column header can open a hyperlink in the clamped cell instead of only selecting the header. hit() clamps header coordinates to cell zero, and pointerUp follows that cell's link without checking whether the gesture began in a header; exclude header-origin gestures from link activation.

🟡 Medium files/officeArchive.ts:251

When a row without r starts with a cell whose explicit coordinate skips rows, reconstruction drops the original row metadata, such as its height or visibility. rowTags is keyed before row changes to position.line, so the lookup uses a different key; move the saved tag to the new row number when updating row.