feat: support WPS report material workbooks

2026-09-04 17:10:04 +08:00
parent 48d0363920
commit fb39c8b606
29 changed files with 2737 additions and 734 deletions
@@ -0,0 +1,284 @@
+import { BadRequestException } from '@nestjs/common';
+import ExcelJS from 'exceljs';
+import JSZip from 'jszip';
+import { randomUUID } from 'node:crypto';
+import type { EmbeddedImage, ReportWorkbookFormat } from './report-materials.contracts';
+import { normalizeImageExtension, readEmbeddedImages } from './report-materials.helpers';
+
+const MAX_WORKBOOK_BYTES = 100 * 1024 * 1024;
+const MAX_EXPANDED_BYTES = 500 * 1024 * 1024;
+const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
+const MAX_TOTAL_IMAGE_BYTES = 300 * 1024 * 1024;
+const DISPIMG_FORMULA = /^_xlfn\.DISPIMG\(["'](ID_[A-F0-9]{32})["'],1\)$/i;
+
+function decodeXml(value: string) {
+  return value
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
+}
+
+function attributes(source: string) {
+  return Object.fromEntries(
+    [...source.matchAll(/([\w:-]+)="([^"]*)"/g)].map((match) => [match[1], decodeXml(match[2])]),
+  );
+}
+
+function packagePath(target: string) {
+  return `xl/${target.replace(/^\/?xl\//, '').replace(/^\//, '')}`.replace(/\\/g, '/');
+}
+
+function coordinates(address: string) {
+  const match = /^([A-Z]+)(\d+)$/.exec(address.toUpperCase());
+  if (!match) return null;
+  let column = 0;
+  for (const character of match[1]) column = column * 26 + character.charCodeAt(0) - 64;
+  return { row: Number(match[2]), column };
+}
+
+async function text(zip: JSZip, path: string) {
+  return zip.file(path)?.async('string') ?? '';
+}
+
+function validImageSignature(extension: string, buffer: Buffer) {
+  if (extension === 'png')
+    return buffer.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
+  if (extension === 'jpeg') return buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff;
+  if (extension === 'gif') return buffer.subarray(0, 3).toString('ascii') === 'GIF';
+  return false;
+}
+
+function validateWorkbookValues(workbook: ExcelJS.Workbook, allowedWpsIds: Set<string>) {
+  for (const worksheet of workbook.worksheets) {
+    worksheet.eachRow((row) =>
+      row.eachCell((cell) => {
+        const value = cell.value;
+        if (value && typeof value === 'object' && ('formula' in value || 'sharedFormula' in value)) {
+          const formula =
+            typeof (value as { formula?: unknown }).formula === 'string'
+              ? (value as { formula: string }).formula.trim()
+              : '';
+          const match = DISPIMG_FORMULA.exec(formula);
+          if (!match || !allowedWpsIds.has(match[1]))
+            throw new BadRequestException(`工作表 ${worksheet.name} 包含不允许的公式`);
+        }
+        const valueText = typeof value === 'string' ? value.trimStart() : '';
+        if (/^[=+@]/.test(valueText) || /^-[^\d.]/.test(valueText))
+          throw new BadRequestException(`工作表 ${worksheet.name} 包含公式或可执行单元格`);
+      }),
+    );
+  }
+}
+
+async function inspectWpsImages(zip: JSZip) {
+  const cellImagesXml = await text(zip, 'xl/cellimages.xml');
+  if (!cellImagesXml) return { allowedIds: new Set<string>(), imagesBySheet: new Map<string, EmbeddedImage[]>() };
+  const relXml = await text(zip, 'xl/_rels/cellimages.xml.rels');
+  const relTargets = new Map<string, string>();
+  for (const match of relXml.matchAll(/<Relationship\b([^>]*)\/?>(?:<\/Relationship>)?/g)) {
+    const attrs = attributes(match[1]);
+    if (attrs.Id && attrs.Target && /\/image$/.test(attrs.Type ?? ''))
+      relTargets.set(attrs.Id, packagePath(attrs.Target));
+  }
+  const imageTargets = new Map<string, string>();
+  for (const match of cellImagesXml.matchAll(
+    /<etc:cellImage\b[^>]*>[\s\S]*?<xdr:cNvPr\b([^>]*)\/?>(?:[\s\S]*?)<a:blip\b([^>]*)\/?>(?:[\s\S]*?)<\/etc:cellImage>/g,
+  )) {
+    const id = attributes(match[1]).name;
+    const target = relTargets.get(attributes(match[2])['r:embed']);
+    if (id && target) imageTargets.set(id, target);
+  }
+  const workbookXml = await text(zip, 'xl/workbook.xml');
+  const workbookRelsXml = await text(zip, 'xl/_rels/workbook.xml.rels');
+  const sheetRelTargets = new Map<string, string>();
+  for (const match of workbookRelsXml.matchAll(/<Relationship\b([^>]*)\/?>(?:<\/Relationship>)?/g)) {
+    const attrs = attributes(match[1]);
+    if (attrs.Id && attrs.Target && /\/worksheet$/.test(attrs.Type ?? ''))
+      sheetRelTargets.set(attrs.Id, packagePath(attrs.Target));
+  }
+  const allowedIds = new Set<string>();
+  const imagesBySheet = new Map<string, EmbeddedImage[]>();
+  for (const match of workbookXml.matchAll(/<sheet\b([^>]*)\/?>(?:<\/sheet>)?/g)) {
+    const attrs = attributes(match[1]);
+    const path = sheetRelTargets.get(attrs['r:id']);
+    if (!attrs.name || !path) continue;
+    const sheetXml = await text(zip, path);
+    const images: EmbeddedImage[] = [];
+    for (const cell of sheetXml.matchAll(/<c\b([^>]*)>([\s\S]*?)<\/c>/g)) {
+      const formulaText = decodeXml(cell[2].match(/<f(?:\s[^>]*)?>([\s\S]*?)<\/f>/)?.[1]?.trim() ?? '');
+      if (!formulaText) continue;
+      const formula = DISPIMG_FORMULA.exec(formulaText);
+      if (!formula) throw new BadRequestException(`工作簿包含不允许的公式：${formulaText.slice(0, 80)}`);
+      const target = imageTargets.get(formula[1]);
+      const cellPosition = coordinates(attributes(cell[1]).r);
+      if (!target || !cellPosition) throw new BadRequestException('WPS单元格图片关系不完整');
+      const imageEntry = zip.file(target);
+      if (!imageEntry) throw new BadRequestException('WPS单元格图片文件缺失');
+      const extension = normalizeImageExtension(target.split('.').pop() ?? 'png');
+      if (!['png', 'jpeg', 'gif'].includes(extension)) throw new BadRequestException('WPS单元格图片格式不受支持');
+      const imageBuffer = await imageEntry.async('nodebuffer');
+      if (imageBuffer.length > MAX_IMAGE_BYTES) throw new BadRequestException('单张WPS图片不能超过20MB');
+      if (!validImageSignature(extension, imageBuffer)) throw new BadRequestException('WPS单元格图片内容与格式不匹配');
+      images.push({ ...cellPosition, extension, buffer: imageBuffer });
+      allowedIds.add(formula[1]);
+    }
+    imagesBySheet.set(attrs.name, images);
+  }
+  const totalImageBytes = [...imagesBySheet.values()].flat().reduce((sum, image) => sum + image.buffer.length, 0);
+  if (totalImageBytes > MAX_TOTAL_IMAGE_BYTES) throw new BadRequestException('WPS图片总量不能超过300MB');
+  return { allowedIds, imagesBySheet };
+}
+
+export async function loadCompatibleWorkbook(buffer: Buffer) {
+  if (buffer.length > MAX_WORKBOOK_BYTES) throw new BadRequestException('导入文件不能超过100MB');
+  let zip: JSZip;
+  try {
+    zip = await JSZip.loadAsync(buffer);
+  } catch {
+    throw new BadRequestException('仅支持有效的 XLSX 文件');
+  }
+  const expandedBytes = Object.values(zip.files).reduce(
+    (sum, entry) =>
+      sum + Number((entry as unknown as { _data?: { uncompressedSize?: number } })._data?.uncompressedSize ?? 0),
+    0,
+  );
+  if (Object.keys(zip.files).length > 3000) throw new BadRequestException('工作簿ZIP条目数量超过安全限制');
+  if (expandedBytes > MAX_EXPANDED_BYTES) throw new BadRequestException('工作簿解压后超过500MB安全限制');
+  if (Object.keys(zip.files).some((name) => /(^|\/)(vbaProject|externalLinks|embeddings|activeX)(\/|\.)/i.test(name)))
+    throw new BadRequestException('工作簿包含不允许的外部对象或宏');
+  const wps = await inspectWpsImages(zip);
+  const workbook = new ExcelJS.Workbook();
+  await workbook.xlsx.load(buffer as never);
+  validateWorkbookValues(workbook, wps.allowedIds);
+  return { workbook, wpsImagesBySheet: wps.imagesBySheet };
+}
+
+export function compatibleImages(
+  workbook: ExcelJS.Workbook,
+  worksheet: ExcelJS.Worksheet,
+  wpsImagesBySheet: Map<string, EmbeddedImage[]>,
+) {
+  const merged = new Map<string, EmbeddedImage>();
+  const wpsImages = wpsImagesBySheet.get(worksheet.name) ?? [];
+  for (const image of readEmbeddedImages(workbook, worksheet)) {
+    if (wpsImages.length && image.buffer.length <= 128) continue;
+    const extension = normalizeImageExtension(image.extension);
+    if (image.buffer.length > MAX_IMAGE_BYTES) throw new BadRequestException('单张工作簿图片不能超过20MB');
+    if (!validImageSignature(extension, image.buffer)) throw new BadRequestException('工作簿图片内容与格式不匹配');
+    merged.set(`${image.row}:${image.column}`, image);
+  }
+  for (const image of wpsImages) merged.set(`${image.row}:${image.column}`, image);
+  return [...merged.values()];
+}
+
+export async function convertWorkbookOutput(content: Buffer, outputFormat: ReportWorkbookFormat = 'excel_drawing') {
+  if (outputFormat === 'excel_drawing') return content;
+  if (outputFormat !== 'wps_cell_image') throw new BadRequestException('不支持的报备文件格式');
+  const workbook = new ExcelJS.Workbook();
+  await workbook.xlsx.load(content as never);
+  const pictures: Array<{
+    sheetName: string;
+    address: string;
+    extension: string;
+    buffer: Buffer;
+    id: string;
+    relId: string;
+    mediaPath: string;
+  }> = [];
+  for (const sheet of workbook.worksheets) {
+    for (const image of readEmbeddedImages(workbook, sheet)) {
+      const extension = normalizeImageExtension(image.extension);
+      pictures.push({
+        sheetName: sheet.name,
+        address: `${sheet.getColumn(image.column).letter}${image.row}`,
+        extension,
+        buffer: image.buffer,
+        id: `ID_${randomUUID().replace(/-/g, '').toUpperCase()}`,
+        relId: `rId${pictures.length + 1}`,
+        mediaPath: `xl/media/wps-cell-image-${pictures.length + 1}.${extension === 'jpeg' ? 'jpg' : extension}`,
+      });
+    }
+  }
+  if (!pictures.length) return content;
+  const zip = await JSZip.loadAsync(content);
+  Object.keys(zip.files)
+    .filter((name) => /^xl\/media\//.test(name))
+    .forEach((name) => zip.remove(name));
+  const workbookXml = await text(zip, 'xl/workbook.xml');
+  let workbookRels = await text(zip, 'xl/_rels/workbook.xml.rels');
+  const relTargets = new Map<string, string>();
+  for (const match of workbookRels.matchAll(/<Relationship\b([^>]*)\/?>(?:<\/Relationship>)?/g)) {
+    const attrs = attributes(match[1]);
+    if (attrs.Id && attrs.Target && /\/worksheet$/.test(attrs.Type ?? ''))
+      relTargets.set(attrs.Id, packagePath(attrs.Target));
+  }
+  const sheetTargets = new Map<string, string>();
+  for (const match of workbookXml.matchAll(/<sheet\b([^>]*)\/?>(?:<\/sheet>)?/g)) {
+    const attrs = attributes(match[1]);
+    const target = relTargets.get(attrs['r:id']);
+    if (attrs.name && target) sheetTargets.set(attrs.name, target);
+  }
+  for (const [sheetName, path] of sheetTargets) {
+    const sheetPictures = pictures.filter((picture) => picture.sheetName === sheetName);
+    if (!sheetPictures.length) continue;
+    let sheetXml = await text(zip, path);
+    sheetXml = sheetXml.replace(/<drawing\b[^>]*\/?>(?:<\/drawing>)?/g, '');
+    for (const picture of sheetPictures) {
+      const fullCell = new RegExp(`<c\\b([^>]*\\br="${picture.address}"[^>]*)>[\\s\\S]*?<\\/c>`);
+      const emptyCell = new RegExp(`<c\\b([^>]*\\br="${picture.address}"[^>]*)\\/>`);
+      const replaceCell = (opening: string) =>
+        `<c${opening.replace(/\s+t="[^"]*"/g, '')} t="str"><f>_xlfn.DISPIMG(&quot;${picture.id}&quot;,1)</f><v>=DISPIMG(&quot;${picture.id}&quot;,1)</v></c>`;
+      if (fullCell.test(sheetXml))
+        sheetXml = sheetXml.replace(fullCell, (_match, opening: string) => replaceCell(opening));
+      else if (emptyCell.test(sheetXml))
+        sheetXml = sheetXml.replace(emptyCell, (_match, opening: string) => replaceCell(opening));
+      else throw new BadRequestException(`无法生成WPS单元格图片：${sheetName}!${picture.address}`);
+      zip.file(picture.mediaPath, picture.buffer);
+    }
+    zip.file(path, sheetXml);
+    const sheetRelsPath = path.replace(/\/([^/]+)$/, '/_rels/$1.rels');
+    const sheetRels = await text(zip, sheetRelsPath);
+    if (sheetRels)
+      zip.file(
+        sheetRelsPath,
+        sheetRels.replace(/<Relationship\b[^>]*Type="[^"]*\/drawing"[^>]*\/?>(?:<\/Relationship>)?/g, ''),
+      );
+  }
+  Object.keys(zip.files)
+    .filter((name) => /^xl\/drawings\//.test(name))
+    .forEach((name) => zip.remove(name));
+  const cellImages = pictures
+    .map(
+      (picture, index) =>
+        `<etc:cellImage><xdr:pic><xdr:nvPicPr><xdr:cNvPr id="${index + 1}" name="${picture.id}"/><xdr:cNvPicPr><a:picLocks noChangeAspect="1"/></xdr:cNvPicPr></xdr:nvPicPr><xdr:blipFill><a:blip r:embed="${picture.relId}"/><a:stretch><a:fillRect/></a:stretch></xdr:blipFill><xdr:spPr><a:xfrm><a:off x="0" y="0"/><a:ext cx="914400" cy="914400"/></a:xfrm><a:prstGeom prst="rect"><a:avLst/></a:prstGeom><a:noFill/><a:ln w="9525"><a:noFill/></a:ln></xdr:spPr></xdr:pic></etc:cellImage>`,
+    )
+    .join('');
+  zip.file(
+    'xl/cellimages.xml',
+    `<?xml version="1.0" encoding="UTF-8" standalone="yes"?><etc:cellImages xmlns:xdr="http://schemas.openxmlformats.org/drawingml/2006/spreadsheetDrawing" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" xmlns:etc="http://www.wps.cn/officeDocument/2017/etCustomData">${cellImages}</etc:cellImages>`,
+  );
+  zip.file(
+    'xl/_rels/cellimages.xml.rels',
+    `<?xml version="1.0" encoding="UTF-8" standalone="yes"?><Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">${pictures.map((picture) => `<Relationship Id="${picture.relId}" Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/image" Target="${picture.mediaPath.replace(/^xl\//, '')}"/>`).join('')}</Relationships>`,
+  );
+  const nextRel = Math.max(0, ...[...workbookRels.matchAll(/Id="rId(\d+)"/g)].map((match) => Number(match[1]))) + 1;
+  workbookRels = workbookRels.replace(
+    '</Relationships>',
+    `<Relationship Id="rId${nextRel}" Type="http://www.wps.cn/officeDocument/2020/cellImage" Target="cellimages.xml"/></Relationships>`,
+  );
+  zip.file('xl/_rels/workbook.xml.rels', workbookRels);
+  let contentTypes = await text(zip, '[Content_Types].xml');
+  contentTypes = contentTypes.replace(
+    /<Override\b[^>]*PartName="\/xl\/drawings\/[^"]+"[^>]*\/?>(?:<\/Override>)?/g,
+    '',
+  );
+  if (!contentTypes.includes('/xl/cellimages.xml'))
+    contentTypes = contentTypes.replace(
+      '</Types>',
+      '<Override PartName="/xl/cellimages.xml" ContentType="application/vnd.wps-officedocument.cellimage+xml"/></Types>',
+    );
+  zip.file('[Content_Types].xml', contentTypes);
+  return zip.generateAsync({ type: 'nodebuffer', compression: 'DEFLATE', compressionOptions: { level: 6 } });
+}