fix(editor): the x2t proxy must not fetch a document as if it were a URL

Found reviewing today's changes. Guard 14 turns whatever the vendor
passes into bytes before sending it to the worker, and for strings it
fetched unconditionally. x2t_helper's own handleFileData does not: it
sorts strings into DataURL / BlobURL / FileURL / HttpURL / URL *and*
String, and that last case is not an error -- it encodes the text as
UTF-8 bytes.

So a document handed over as text -- the empty-document template the
offline patch uses, or the latin1 DOCY form of #113 -- would have been
requested as a relative URL instead of converted.

Strings that are not locations now cross untouched, and the worker's own
handleFileData decides, exactly as it did before conversion moved out of
the frame. Same rule for media entries.

looksLikeUrl is exported for the unit test on purpose: it mirrors a
classifier in vendor code that this proxy has to agree with, and getting
it wrong turns a document into a request.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MKNHFQ1kek1cHeqhbH37Pk

Author: chaxus

lib/onlyoffice/guards/x2t-worker.ts

@@ -197,6 +197,24 @@ function fontSources(win: FrameScope): FontSource[] {
   return sources;
 }
 
+/**
+ * The string forms x2t_helper treats as somewhere to fetch from.
+ *
+ * Exported for the unit test: it mirrors a classifier in vendor code that this
+ * proxy has to agree with, and getting it wrong turns a document into a
+ * request. Pinning it directly is cheaper than reaching it through a
+ * conversion.
+ */
+export function looksLikeUrl(value: string): boolean {
+  if (/^(data|blob|file|https?):/i.test(value.trim())) return true;
+  try {
+    new URL(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Anything the vendor hands us -- blob URL, Blob, typed array -- as bytes.
  *
@@ -211,6 +229,13 @@ function fontSources(win: FrameScope): FontSource[] {
 async function toBytes(value: unknown): Promise<Uint8Array | null> {
   if (value == null) return null;
   if (typeof value === 'string') {
+    // Only strings that are locations. x2t_helper's own handleFileData sorts
+    // strings into DataURL / BlobURL / FileURL / HttpURL / URL and *String*,
+    // and the last one is not an error -- it encodes the text as UTF-8 bytes.
+    // Fetching it instead would turn a document into a bogus request, so
+    // anything that is not a location is handed over untouched and the vendor
+    // decides, exactly as it did before conversion moved out of the frame.
+    if (!looksLikeUrl(value)) return null;
     const response = await fetch(value);
     if (!response.ok) throw new Error(`Failed to read document data (${response.status})`);
     return new Uint8Array(await response.arrayBuffer());
@@ -235,7 +260,9 @@ async function mediaToBytes(medias: unknown): Promise<Record<string, Uint8Array>
   for (const [path, url] of Object.entries(medias as Record<string, unknown>)) {
     try {
       const bytes = await toBytes(url);
+      // Same rule as the document itself: unresolved forms cross untouched.
       if (bytes) out[path] = bytes;
+      else if (url != null) out[path] = url as Uint8Array;
     } catch {
       // A medium that cannot be read is one the conversion does without,
       // which is what the in-frame path did with it too.
@@ -281,11 +308,14 @@ export function installX2tWorkerProxy(win: Window): boolean {
   const channel = new WorkerChannel(frame);
 
   converter.convertToBin = async (data: unknown, fileName?: string, fileExt?: string) => {
-    const bytes = await toBytes(data);
-    if (!bytes) throw new Error('Document conversion failed: nothing to convert');
+    if (data == null) throw new Error('Document conversion failed: nothing to convert');
+    // Whatever could not be resolved here crosses as it came: the worker runs
+    // the same handleFileData, so a form this does not know is still the
+    // vendor's to interpret rather than ours to reject.
+    const payload = (await toBytes(data)) ?? data;
     const result = (await channel.send(
       'convertToBin',
-      { data: bytes, fileName, fileExt },
+      { data: payload, fileName, fileExt },
       await fontSourcesWhenReady(frame),
     )) as Record<string, unknown>;
     return { ...result, media: mintMediaUrls(result.media) };

test/unit/x2t-worker-input.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { looksLikeUrl } from '../../lib/onlyoffice/guards/x2t-worker';
+
+/**
+ * Which strings the worker proxy resolves itself, and which it hands over.
+ *
+ * Guard 14 turns whatever the vendor passes into bytes before sending it to
+ * the x2t worker. For strings that is only correct when the string is a
+ * location: x2t_helper's own `handleFileData` sorts strings into
+ * DataURL / BlobURL / FileURL / HttpURL / URL **and `String`**, and that last
+ * one is not an error -- it encodes the text as UTF-8 bytes. Fetching it
+ * instead would turn a document into a bogus request.
+ *
+ * So anything this does not call a location crosses the boundary untouched and
+ * the vendor decides, exactly as it did before conversion moved out of the
+ * frame.
+ */
+describe('what the x2t proxy treats as a location', () => {
+  it('resolves the forms the vendor fetches', () => {
+    for (const url of [
+      'blob:http://127.0.0.1:4173/2f0a-4d1e',
+      'http://example.test/report.docx',
+      'https://example.test/report.docx',
+      'file:///Users/x/report.docx',
+      'data:application/octet-stream;base64,AAAA',
+    ]) {
+      expect(looksLikeUrl(url), url).toBe(true);
+    }
+  });
+
+  it('leaves document text alone', () => {
+    // The empty-document template the offline patch hands the editor, and the
+    // shape #113 was about: a latin1 string carrying its DOCY header.
+    for (const text of ['DOCY;v5;7372;AAAA', 'plain text', '', '   ', 'Editor.bin']) {
+      expect(looksLikeUrl(text), JSON.stringify(text)).toBe(false);
+    }
+  });
+});