refactor: replace crypto-js

CHANGELOG.md

@@ -13,6 +13,7 @@
 - Support outlines that jump to specific page positions with custom zoom level
 - Add robust handling of null byte padding in JPEG images
 - Replace outdated jpeg-exif with minimal implementation
+- Replace outdated crypto-js with maintained small alternatives
 
 ### [v0.17.2] - 2025-08-30
 

lib/crypto/aes.js

@@ -0,0 +1,9 @@
+import { cbc, ecb } from '@noble/ciphers/aes';
+
+export function aesCbcEncrypt(data, key, iv, padding = true) {
+  return cbc(key, iv, { disablePadding: !padding }).encrypt(data);
+}
+
+export function aesEcbEncrypt(data, key) {
+  return ecb(key, { disablePadding: true }).encrypt(data);
+}

lib/crypto/md5.js

@@ -0,0 +1,9 @@
+import md5 from 'js-md5';
+
+export function md5Hash(data) {
+  return new Uint8Array(md5.arrayBuffer(data));
+}
+
+export function md5Hex(data) {
+  return md5(data);
+}

lib/crypto/random.js

@@ -0,0 +1,10 @@
+export default function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  if (globalThis.crypto?.getRandomValues) {
+    globalThis.crypto.getRandomValues(bytes);
+  } else {
+    // Node.js < 18.4 fallback
+    require('crypto').randomFillSync(bytes);
+  }
+  return bytes;
+}

lib/crypto/rc4.js

@@ -0,0 +1,23 @@
+// RC4 (for legacy PDF 1.3-1.5)
+export default function rc4(data, key) {
+  const s = new Uint8Array(256);
+  for (let i = 0; i < 256; i++) {
+    s[i] = i;
+  }
+
+  let j = 0;
+  for (let i = 0; i < 256; i++) {
+    j = (j + s[i] + key[i % key.length]) & 0xff;
+    [s[i], s[j]] = [s[j], s[i]];
+  }
+
+  const output = new Uint8Array(data.length);
+  for (let i = 0, j = 0, k = 0; k < data.length; k++) {
+    i = (i + 1) & 0xff;
+    j = (j + s[i]) & 0xff;
+    [s[i], s[j]] = [s[j], s[i]];
+    output[k] = data[k] ^ s[(s[i] + s[j]) & 0xff];
+  }
+
+  return output;
+}

lib/crypto/sha256.js

@@ -0,0 +1,5 @@
+import { sha256 } from '@noble/hashes/sha256';
+
+export default function sha256Hash(data) {
+  return sha256(data);
+}

lib/mixins/attachments.js

@@ -1,5 +1,5 @@
 import fs from 'fs';
-import CryptoJS from 'crypto-js';
+import { md5Hex } from '../crypto/md5';
 
 export default {
   /**
@@ -65,9 +65,7 @@ export default {
     }
 
     // add checksum and size information
-    const checksum = CryptoJS.MD5(
-      CryptoJS.lib.WordArray.create(new Uint8Array(data)),
-    );
+    const checksum = md5Hex(new Uint8Array(data));
     refBody.Params.CheckSum = new String(checksum);
     refBody.Params.Size = data.byteLength;