ExaDev · Mearman · Sep 12, 2026 · Sep 12, 2026 · Sep 12, 2026 · Sep 13, 2026
diff --git a/packages/odf.js/eslint.config.ts b/packages/odf.js/eslint.config.ts
@@ -22,8 +22,8 @@ export default tseslint.config(
     preferReadonlyParams: "off",
   }),
   {
-    // fast-xml-parser@5 deprecates the whole XMLBuilder class, not one of its options, and ships no replacement of its own -- it points at a separate `fast-xml-builder` package that is not a declared dependency here. Swapping it is a real dependency decision with round-trip fidelity to re-verify (this builder is what keeps XML byte-faithful), so it is tracked rather than guessed at inside a tooling change. Scoped to the one module that constructs the builder.
-    files: ["src/xml/build.ts"],
+    // fast-xml-parser@5 deprecates the whole XMLBuilder class, not one of its options, and ships no replacement of its own — it points at a separate `fast-xml-builder` package that is not a declared dependency here. Swapping it is a real dependency decision with round-trip fidelity to re-verify (this builder is what keeps XML byte-faithful), so it is tracked rather than guessed at inside a tooling change. Scoped to the one module that constructs the builder, plus its own test file, which necessarily references the identical deprecated class to reach BUILDER's shared prototype.
+    files: ["src/xml/build.ts", "src/xml/build.test.ts"],
     rules: { "@typescript-eslint/no-deprecated": "off" },
   },
 );
diff --git a/packages/odf.js/src/image/sniff.test.ts b/packages/odf.js/src/image/sniff.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+import { sniffImageFormat } from "./sniff";
+
+function bytesOf(values: number[]): Uint8Array<ArrayBuffer> {
+  return new Uint8Array(values);
+}
+
+function asciiBytes(text: string): number[] {
+  return Array.from(text, (c) => c.charCodeAt(0));
+}
+
+describe("sniffImageFormat", () => {
+  it("detects a PNG from its 8-byte magic signature", () => {
+    expect(
+      sniffImageFormat(
+        bytesOf([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff]),
+      ),
+    ).toBe("png");
+  });
+
+  it("detects a JPEG from its 3-byte magic signature", () => {
+    expect(sniffImageFormat(bytesOf([0xff, 0xd8, 0xff, 0xe0]))).toBe("jpeg");
+  });
+
+  it("detects a GIF87a header", () => {
+    expect(sniffImageFormat(bytesOf(asciiBytes("GIF87a").concat([0x00])))).toBe(
+      "gif",
+    );
+  });
+
+  it("detects a GIF89a header", () => {
+    expect(sniffImageFormat(bytesOf(asciiBytes("GIF89a").concat([0x00])))).toBe(
+      "gif",
+    );
+  });
+
+  it("returns undefined for bytes shorter than every signature it checks", () => {
+    expect(sniffImageFormat(bytesOf([0x89, 0x50]))).toBeUndefined();
+  });
+
+  it("returns undefined for an empty byte array", () => {
+    expect(sniffImageFormat(bytesOf([]))).toBeUndefined();
+  });
+
+  it("detects SVG from an XML prolog, with no '<svg' tag present in the sniffed window", () => {
+    const bytes = bytesOf(asciiBytes('<?xml version="1.0"?><notsvg/>'));
+    expect(sniffImageFormat(bytes)).toBe("svg");
+  });
+
+  it("detects SVG from a bare '<svg' root tag, with no XML prolog", () => {
+    const bytes = bytesOf(
+      asciiBytes('<svg xmlns="http://www.w3.org/2000/svg"></svg>'),
+    );
+    expect(sniffImageFormat(bytes)).toBe("svg");
+  });
+
+  it("skips leading whitespace before the '<?xml' prolog", () => {
+    const bytes = bytesOf(asciiBytes('   <?xml version="1.0"?><svg/>'));
+    expect(sniffImageFormat(bytes)).toBe("svg");
+  });
+
+  it("returns undefined for text that starts with neither '<?xml' nor '<svg'", () => {
+    const bytes = bytesOf(asciiBytes("<html><body/></html>"));
+    expect(sniffImageFormat(bytes)).toBeUndefined();
+  });
+
+  it("never finds a root element hidden behind more leading whitespace than the sniff window covers", () => {
+    // The sniff window is capped at a fixed size specifically so a caller can't be made to scan an unboundedly large file — a real SVG's root element always appears well within it (see sniff.ts's own comment), so padding past the window with plain spaces before the real tag is exactly the case the cap is meant to give up on, not a bug to work around.
+    const paddingLength = 2000;
+    const bytes = bytesOf([
+      ...Array<number>(paddingLength).fill(0x20),
+      ...asciiBytes("<?xml?>"),
+    ]);
+    expect(bytes.length).toBeGreaterThan(1024);
+    expect(sniffImageFormat(bytes)).toBeUndefined();
+  });
+
+  it("does not match bytes that merely end with, rather than start with, an SVG marker", () => {
+    const bytes = bytesOf(
+      asciiBytes("<html>embeds a literal <?xml tag</html>"),
+    );
+    expect(sniffImageFormat(bytes)).toBeUndefined();
+  });
+});
diff --git a/packages/odf.js/src/image/sniff.ts b/packages/odf.js/src/image/sniff.ts
@@ -12,13 +12,11 @@ const GIF89A_SIGNATURE: readonly number[] = [
   0x47, 0x49, 0x46, 0x38, 0x39, 0x61,
 ];
 
+// No separate "bytes too short" guard: when bytes.length < signature.length, some index i in the loop below reads past the end of bytes, and an out-of-bounds array read is `undefined` in JS -- which is never strictly equal to signature[i] (always a real 0-255 byte value), so the loop's own mismatch check already returns false for every too-short input. A dedicated length guard would only ever produce a result the loop already produces on its own.
 function startsWith(
   bytes: Uint8Array<ArrayBuffer>,
   signature: readonly number[],
 ): boolean {
-  if (bytes.length < signature.length) {
-    return false;
-  }
   for (let i = 0; i < signature.length; i++) {
     if (bytes[i] !== signature[i]) {
       return false;

diff --git a/packages/odf.js/src/model/node.test.ts b/packages/odf.js/src/model/node.test.ts
@@ -0,0 +1,156 @@
+import { describe, expect, it } from "vitest";
+import { isXmlNode } from "./node";
+
+// isXmlNode is a hand-written recursive structural guard (used via z.custom, since a genuinely recursive Zod schema collapses to `unknown` under z.lazy in this pinned version) with no direct unit tests at all -- every place it runs is exercised only as a side effect of parsing a real XML document, which never constructs the malformed shapes below.
+
+describe("isXmlNode: non-object/malformed input", () => {
+  it("rejects null, a primitive, and an array outright", () => {
+    expect(isXmlNode(null)).toBe(false);
+    expect(isXmlNode("a string")).toBe(false);
+    expect(isXmlNode(42)).toBe(false);
+    expect(isXmlNode([])).toBe(false);
+  });
+
+  it("rejects a plain object with no type field", () => {
+    expect(isXmlNode({})).toBe(false);
+  });
+
+  it("rejects an unrecognised type value", () => {
+    expect(isXmlNode({ type: "bogus" })).toBe(false);
+  });
+});
+
+describe("isXmlNode: text/cdata/comment", () => {
+  it.each(["text", "cdata", "comment"] as const)(
+    "accepts type %s with a string value",
+    (type) => {
+      expect(isXmlNode({ type, value: "hello" })).toBe(true);
+    },
+  );
+
+  it.each(["text", "cdata", "comment"] as const)(
+    "rejects type %s when value is not a string",
+    (type) => {
+      expect(isXmlNode({ type, value: 5 })).toBe(false);
+      expect(isXmlNode({ type })).toBe(false);
+    },
+  );
+});
+
+describe("isXmlNode: declaration", () => {
+  it("accepts a declaration with an empty attributes array", () => {
+    expect(isXmlNode({ type: "declaration", attributes: [] })).toBe(true);
+  });
+
+  it("accepts a declaration whose every attribute is a valid {name, value} pair", () => {
+    expect(
+      isXmlNode({
+        type: "declaration",
+        attributes: [{ name: "version", value: "1.0" }],
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects a declaration whose attributes is not an array", () => {
+    expect(isXmlNode({ type: "declaration", attributes: "nope" })).toBe(false);
+  });
+
+  it("rejects a declaration with one malformed attribute among otherwise-valid ones", () => {
+    expect(
+      isXmlNode({
+        type: "declaration",
+        attributes: [
+          { name: "version", value: "1.0" },
+          { name: "encoding" }, // missing value
+        ],
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("isXmlNode: pi", () => {
+  it("accepts a pi with string target and content", () => {
+    expect(
+      isXmlNode({ type: "pi", target: "xml-stylesheet", content: "foo" }),
+    ).toBe(true);
+  });
+
+  it("rejects a pi missing either target or content", () => {
+    expect(isXmlNode({ type: "pi", target: "x" })).toBe(false);
+    expect(isXmlNode({ type: "pi", content: "x" })).toBe(false);
+  });
+
+  it("rejects a pi whose target or content is not a string", () => {
+    expect(isXmlNode({ type: "pi", target: 1, content: "x" })).toBe(false);
+    expect(isXmlNode({ type: "pi", target: "x", content: 1 })).toBe(false);
+  });
+});
+
+describe("isXmlNode: element", () => {
+  function validElement(overrides: Record<string, unknown> = {}) {
+    return {
+      type: "element",
+      tag: "text:p",
+      attributes: [],
+      children: [],
+      ...overrides,
+    };
+  }
+
+  it("accepts a leaf element with no attributes or children", () => {
+    expect(isXmlNode(validElement())).toBe(true);
+  });
+
+  it("rejects an element whose tag is not a string", () => {
+    expect(isXmlNode(validElement({ tag: 5 }))).toBe(false);
+  });
+
+  it("rejects an element whose attributes is not an array", () => {
+    expect(isXmlNode(validElement({ attributes: "nope" }))).toBe(false);
+  });
+
+  it("rejects an element with one malformed attribute", () => {
+    expect(isXmlNode(validElement({ attributes: [{ name: "x" }] }))).toBe(
+      false,
+    );
+  });
+
+  it("rejects an element whose children is not an array", () => {
+    expect(isXmlNode(validElement({ children: "nope" }))).toBe(false);
+  });
+
+  it("accepts an element whose children are all valid nodes, recursively", () => {
+    const child = { type: "text", value: "hi" };
+    expect(isXmlNode(validElement({ children: [child] }))).toBe(true);
+  });
+
+  it("rejects an element with one malformed child among otherwise-valid ones", () => {
+    const goodChild = { type: "text", value: "hi" };
+    const badChild = { type: "text", value: 5 };
+    expect(isXmlNode(validElement({ children: [goodChild, badChild] }))).toBe(
+      false,
+    );
+  });
+
+  it("rejects an element nested two levels deep whose innermost grandchild is malformed", () => {
+    const malformedGrandchild = { type: "comment", value: 5 };
+    const child = {
+      type: "element",
+      tag: "text:span",
+      attributes: [],
+      children: [malformedGrandchild],
+    };
+    expect(isXmlNode(validElement({ children: [child] }))).toBe(false);
+  });
+
+  it("accepts an element nested two levels deep whose every descendant is well-formed", () => {
+    const grandchild = { type: "text", value: "deep" };
+    const child = {
+      type: "element",
+      tag: "text:span",
+      attributes: [],
+      children: [grandchild],
+    };
+    expect(isXmlNode(validElement({ children: [child] }))).toBe(true);
+  });
+});
diff --git a/packages/odf.js/src/ooo1/ns.test.ts b/packages/odf.js/src/ooo1/ns.test.ts
@@ -140,6 +140,21 @@ describe("isOoo1Package", () => {
     expect(isOoo1Package(pkg)).toBe(true);
   });
 
+  it("recognises a bare, default (non-prefixed) xmlns declaration too", () => {
+    const pkg = packageOf({
+      "content.xml": `<office:document-content xmlns="http://openoffice.org/2000/office"><office:body/></office:document-content>`,
+    });
+    expect(isOoo1Package(pkg)).toBe(true);
+  });
+
+  it("does not treat an ordinary attribute whose value happens to equal an OOo1 URI as a namespace declaration", () => {
+    // office:version here is neither "xmlns" nor "xmlns:"-prefixed -- only its VALUE coincides with a real OOo1 namespace URI, which must not be enough on its own.
+    const pkg = packageOf({
+      "content.xml": `<office:document-content office:version="http://openoffice.org/2000/office"><office:body/></office:document-content>`,
+    });
+    expect(isOoo1Package(pkg)).toBe(false);
+  });
+
   it("rejects a real ODF package", () => {
     const pkg = packageOf({
       "content.xml": `<office:document-content xmlns:office="${ODF_NAMESPACES.office}" xmlns:text="${ODF_NAMESPACES.text}" office:version="1.3"><office:body><office:text><text:p>hi</text:p></office:text></office:body></office:document-content>`,