Repository navigation
feat: accept passwords for encrypted OOXML files - #103
Open
patriksimms wants to merge 3 commits into
Open
patriksimms wants to merge 3 commits into
patriksimms wants to merge 3 commits into
Conversation
Summary: - decrypt password-protected OOXML before format detection and conversion - expose optional passwords through Node, Python, wasm, and the CLI - cover successful, missing, and incorrect password behavior with fixtures Rationale: - callers with a known password can now convert encrypted Office files without changing the existing behavior for callers without one - explicit Rust variants preserve compatibility with existing signatures Tests: - cargo fmt --all --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --locked - npm run build && npm test (node) - maturin build --release --locked and Python unit tests Closes firecrawl#102 AI-Assisted: true AI-Agent: codex AI-Model: openai/gpt-5.6-sol
Merge upstream main and resolve conflicts while keeping password support alongside the new hosted OCR wrappers and CLI options. Use office-crypto 0.4.0, whose published crypto.rs and ole.rs match the malformed-container fixes in udbhav1/office-crypto#7. Forward passwords through the public Node and Python wrappers, and add a regression for an oversized encrypted package declaration. Validation: - cargo fmt --all --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --locked: 302 passed, one local-samples test ignored - Node release build and all 24 tests passed - Python release wheel build and all 14 tests passed - Independently encrypted a real Excel workbook with msoffcrypto-tool; Python output matched the original workbook exactly - CLI converted that workbook from a path and stdin; missing and wrong Excel passwords returned encrypted errors Wasm target execution remains for CI; this machine lacks the target. Related to firecrawl#103 and udbhav1/office-crypto#7. AI-Assisted: true AI-Agent: codex AI-Model: openai/gpt-6.1-sol
patriksimms
marked this pull request as ready for review
November 6, 2026 09:13
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 26 files
Reply to a comment to ask cubic a question or push back. It learns from your replies.
Click Fix with cubic on a comment, or reply @cubic-dev-ai fix this, and cubic writes the fix.
View guided diff | Re-trigger cubic
Probe encrypted containers before rejecting a path without a recognized extension, so password-based conversion works for renamed workbooks. Keep encrypted errors for unrecognized decrypted bytes because office-crypto can return garbage rather than an error for wrong passwords. Clarify the OOXML password docs, exercise Python and Wasm document-model password forwarding, and use valid encryption metadata and ciphertext in the oversized-length fixture so only the declared size is malformed. Validation: - New Node path regression failed before the fix and passes afterward - cargo fmt --all --check - cargo clippy --workspace --all-targets --all-features -- -D warnings - cargo test --locked: 302 passed, one local-samples test ignored - Node release build and 25 tests passed - Python release wheel build and 14 tests passed - Verified malformed fixture differs from valid DOCX only in its package length field; Wasm target execution remains pending CI Related to firecrawl#103. AI-Assisted: true AI-Agent: codex AI-Model: openai/gpt-6.1-sol
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Callers who know the password for an encrypted Office document cannot convert it through anydoc's bindings or CLI.
Solution
Decrypt encrypted OOXML before detecting and parsing its inner format. Expose optional passwords in Rust, Node, Python, and Wasm, plus
--passwordandANYDOC_PASSWORDin the CLI. Node Markdown functions acceptoptions.passwordalongside the existing OCR options; Python Markdown functions acceptpassword=. Existing calls keep their behavior.Closes #102
Validation
cargo fmt --all --checkcargo clippy --workspace --all-targets --all-features -- -D warningscargo test --locked: 302 passed; one local-samples test ignored67933fa..f78a00bfound no blockers; no initial full-review baseline was suppliedChanges were made with
openai/gpt-6.1-solthrough the Codex harness in T3 Code.