
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@42technologies/xlsx
Advanced tools
Parser and writer for Excel 2007+ (XLSX/XLSM/XLSB) files. Pure-JS cleanroom implementation from the Office Open XML spec, [MS-XLSB], and related documents.
In nodejs:
npm install xlsx
In the browser:
<!-- This is the only file you need (includes xlsx.js and jszip) -->
<script lang="javascript" src="dist/xlsx.core.min.js"></script>
In bower:
bower install js-xlsx
CDNjs automatically pulls the latest version and makes all versions available at http://cdnjs.com/libraries/xlsx
Older versions of this README recommended a more explicit approach:
<!-- JSZip must be included before xlsx.js -->
<script lang="javascript" src="/path/to/jszip.js"></script>
<script lang="javascript" src="/path/to/xlsx.js"></script>
The nodejs version automatically requires modules for additional features. Some of these modules are rather large in size and are only needed in special circumstances, so they do not ship with the core. For browser use, they must be included directly:
<!-- international support from https://github.com/sheetjs/js-codepage -->
<script src="dist/cpexcel.js"></script>
An appropriate version for each dependency is included in the dist/ directory.
The complete single-file version is generated at dist/xlsx.full.min.js
Since xlsx.js uses ES5 functions like Array#forEach
, older browsers require
Polyfills. This repo and the gh-pages branch include
a shim
To use the shim, add the shim before the script tag that loads xlsx.js:
<script type="text/javascript" src="/path/to/shim.js"></script>
For parsing, the first step is to read the file.
if(typeof require !== 'undefined') XLSX = require('xlsx');
var workbook = XLSX.readFile('test.xlsx');
/* DO SOMETHING WITH workbook HERE */
/* set up XMLHttpRequest */
var url = "test_files/formula_stress_test_ajax.xlsx";
var oReq = new XMLHttpRequest();
oReq.open("GET", url, true);
oReq.responseType = "arraybuffer";
oReq.onload = function(e) {
var arraybuffer = oReq.response;
/* convert data to binary string */
var data = new Uint8Array(arraybuffer);
var arr = new Array();
for(var i = 0; i != data.length; ++i) arr[i] = String.fromCharCode(data[i]);
var bstr = arr.join("");
/* Call XLSX */
var workbook = XLSX.read(bstr, {type:"binary"});
/* DO SOMETHING WITH workbook HERE */
}
oReq.send();
/* set up drag-and-drop event */
function handleDrop(e) {
e.stopPropagation();
e.preventDefault();
var files = e.dataTransfer.files;
var i,f;
for (i = 0, f = files[i]; i != files.length; ++i) {
var reader = new FileReader();
var name = f.name;
reader.onload = function(e) {
var data = e.target.result;
/* if binary string, read with type 'binary' */
var workbook = XLSX.read(data, {type: 'binary'});
/* DO SOMETHING WITH workbook HERE */
};
reader.readAsBinaryString(f);
}
}
drop_dom_element.addEventListener('drop', handleDrop, false);
function handleFile(e) {
var files = e.target.files;
var i,f;
for (i = 0, f = files[i]; i != files.length; ++i) {
var reader = new FileReader();
var name = f.name;
reader.onload = function(e) {
var data = e.target.result;
var workbook = XLSX.read(data, {type: 'binary'});
/* DO SOMETHING WITH workbook HERE */
};
reader.readAsBinaryString(f);
}
}
input_dom_element.addEventListener('change', handleFile, false);
This example walks through every cell of every sheet and dumps the values:
var sheet_name_list = workbook.SheetNames;
sheet_name_list.forEach(function(y) {
var worksheet = workbook.Sheets[y];
for (z in worksheet) {
if(z[0] === '!') continue;
console.log(y + "!" + z + "=" + JSON.stringify(worksheet[z].v));
}
});
Complete examples:
Note that older versions of IE does not support HTML5 File API, so the base64 mode is provided for testing. On OSX you can get the base64 encoding with:
$ <target_file.xlsx base64 | pbcopy
http://oss.sheetjs.com/js-xlsx/ajax.html XMLHttpRequest
https://github.com/SheetJS/js-xlsx/blob/master/bin/xlsx.njs nodejs
The nodejs version installs a binary xlsx
which can read XLSX/XLSM/XLSB
files and output the contents in various formats. The source is available at
xlsx.njs
in the bin directory.
Some helper functions in XLSX.utils
generate different views of the sheets:
XLSX.utils.sheet_to_csv
generates CSVXLSX.utils.sheet_to_json
generates an array of objectsXLSX.utils.sheet_to_formulae
generates a list of formulaeAssuming workbook
is a workbook object, just call write:
/* output format determined by filename */
XLSX.writeFile(workbook, 'out.xlsx');
/* bookType can be 'xlsx' or 'xlsm' or 'xlsb' */
var wopts = { bookType:'xlsx', bookSST:false, type:'binary' };
var wbout = XLSX.write(workbook,wopts);
function s2ab(s) {
var buf = new ArrayBuffer(s.length);
var view = new Uint8Array(buf);
for (var i=0; i!=s.length; ++i) view[i] = s.charCodeAt(i) & 0xFF;
return buf;
}
saveAs(new Blob([s2ab(wbout)],{type:""}), "test.xlsx")
Complete examples:
XLSX
is the exposed variable in the browser and the exported nodejs variable
XLSX.version
is the version of the library (added by the build script).
XLSX.SSF
is an embedded version of the format library.
XLSX.read(data, read_opts)
attempts to parse data
.
XLSX.readFile(filename, read_opts)
attempts to read filename
and parse.
XLSX.write(wb, write_opts)
attempts to write the workbook wb
XLSX.writeFile(wb, filename, write_opts)
attempts to write wb
to filename
Utilities are available in the XLSX.utils
object:
Exporting:
sheet_to_json
converts a workbook object to an array of JSON objects.sheet_to_csv
generates delimiter-separated-values outputsheet_to_formulae
generates a list of the formulae (with value fallbacks)Cell and cell address manipulation:
format_cell
generates the text value for a cell (using number formats){en,de}code_{row,col}
convert between 0-indexed rows/cols and A1 forms.{en,de}code_cell
converts cell addresses{en,de}code_range
converts cell rangesjs-xlsx conforms to the Common Spreadsheet Format (CSF):
Cell address objects are stored as {c:C, r:R}
where C
and R
are 0-indexed
column and row numbers, respectively. For example, the cell address B5
is
represented by the object {c:1, r:4}
.
Cell range objects are stored as {s:S, e:E}
where S
is the first cell and
E
is the last cell in the range. The ranges are inclusive. For example, the
range A3:B7
is represented by the object {s:{c:0, r:2}, e:{c:1, r:6}}
. Utils
use the following pattern to walk each of the cells in a range:
for(var R = range.s.r; R <= range.e.r; ++R) {
for(var C = range.s.c; C <= range.e.c; ++C) {
var cell_address = {c:C, r:R};
}
}
Key | Description |
---|---|
v | raw value ** |
w | formatted text (if applicable) |
t | cell type: b Boolean, n Number, e error, s/str String |
f | cell formula (if applicable) |
r | rich text encoding (if applicable) |
h | HTML rendering of the rich text (if applicable) |
c | comments associated with the cell ** |
z | number format string associated with the cell (if requested) |
l | cell hyperlink object (.Target holds link, .tooltip is tooltip) |
s | the style/theme of the cell (if applicable) |
.v
holds the raw date code from the sheet and .w
holds the textBuilt-in export utilities (such as the CSV exporter) will use the w
text if it
is available. To change a value, be sure to delete cell.w
(or set it to
undefined
) before attempting to export. The utilities will regenerate the w
text from the number format (cell.z
) and the raw value if possible.
Each key that does not start with !
maps to a cell (using A-1
notation)
worksheet[address]
returns the cell object for the specified address.
Special worksheet keys (accessible as worksheet[key]
, each starting with !
):
ws['!ref']
: A-1 based range representing the worksheet range. Functions that
work with sheets should use this parameter to determine the range. Cells that
are assigned outside of the range are not processed. In particular, when
writing a worksheet by hand, be sure to update the range. For a longer
discussion, see http://git.io/KIaNKQ
Functions that handle worksheets should test for the presence of !ref
field.
If the !ref
is omitted or is not a valid range, functions are free to treat
the sheet as empty or attempt to guess the range. The standard utilities that
ship with this library treat sheets as empty (for example, the CSV output is an
empty string).
When reading a worksheet with the sheetRows
property set, the ref parameter
will use the restricted range. The original range is set at ws['!fullref']
ws['!cols']
: array of column properties objects. Column widths are actually
stored in files in a normalized manner, measured in terms of the "Maximum
Digit Width" (the largest width of the rendered digits 0-9, in pixels). When
parsed, the column objects store the pixel width in the wpx
field, character
width in the wch
field, and the maximum digit width in the MDW
field.
ws['!merges']
: array of range objects corresponding to the merged cells in
the worksheet. Plaintext utilities are unaware of merge cells. CSV export
will write all cells in the merge range if they exist, so be sure that only
the first cell (upper-left) in the range is set.
workbook.SheetNames
is an ordered list of the sheets in the workbook
wb.Sheets[sheetname]
returns an object representing the worksheet.
wb.Props
is an object storing the standard properties. wb.Custprops
stores
custom properties.
The exported read
and readFile
functions accept an options argument:
Option Name | Default | Description |
---|---|---|
cellFormula | true | Save formulae to the .f field |
cellHTML | true | Parse rich text and save HTML to the .h field |
cellNF | false | Save number format string to the .z field |
cellStyles | false | Save style/theme info to the .s field |
sheetStubs | false | Create cell objects for stub cells |
sheetRows | 0 | If >0, read the first sheetRows rows ** |
bookDeps | false | If true, parse calculation chains |
bookFiles | false | If true, add raw files to book object ** |
bookProps | false | If true, only parse enough to get book metadata ** |
bookSheets | false | If true, only parse enough to get the sheet names |
bookVBA | false | If true, expose vbaProject.bin to vbaraw field ** |
cellNF
is false, formatted text (.w) will be generatedbookSheets
is false.bookSheets
and bookProps
combine to give both sets of informationDeps
will be an empty object if bookDeps
is falsybookFiles
adds a keys
array (paths in the ZIP) and a files
hash (whose
keys are paths and values are objects representing the files)sheetRows-1
rows will be generated when looking at the JSON object output
(since the header row is counted as a row when parsing the data)bookVBA
merely exposes the raw vba object. It does not parse the data.The defaults are enumerated in bits/84_defaults.js
The exported write
and writeFile
functions accept an options argument:
Option Name | Default | Description |
---|---|---|
bookSST | false | Generate Shared String Table ** |
bookType | 'xlsx' | Type of Workbook ("xlsx" or "xlsm" or "xlsb") |
bookSST
is slower and more memory intensive, but has better compatibility
with older versions of iOS NumbersbookType = 'xlsb'
is stubbed and far from completeTests utilize the mocha testing framework. Travis-CI and Sauce Labs links:
Test files are housed in another repo.
Running make init
will refresh the test_files
submodule and get the files.
make test
will run the nodejs-based tests. To run the in-browser tests, clone
the oss.sheetjs.com repo and
replace the xlsx.js file (then fire up the browser and go to stress.html
):
$ cp xlsx.js ../SheetJS.github.io
$ cd ../SheetJS.github.io
$ simplehttpserver # or "python -mSimpleHTTPServer" or "serve"
$ open -a Chromium.app http://localhost:8000/stress.html
For a much smaller test, run make test_misc
.
Due to the precarious nature of the Open Specifications Promise, it is very important to ensure code is cleanroom. Consult CONTRIBUTING.md
The xlsx.js file is constructed from the files in the bits
subdirectory. The
build script (run make
) will concatenate the individual bits to produce the
script. Before submitting a contribution, ensure that running make will produce
the xlsx.js file exactly. The simplest way to test is to move the script:
$ mv xlsx.js xlsx.new.js
$ make
$ diff xlsx.js xlsx.new.js
XLS is available in js-xls.
Please consult the attached LICENSE file for details. All rights not explicitly granted by the Apache 2.0 license are reserved by the Original Author.
It is the opinion of the Original Author that this code conforms to the terms of the Microsoft Open Specifications Promise, falling under the same terms as OpenOffice (which is governed by the Apache License v2). Given the vagaries of the promise, the Original Author makes no legal claim that in fact end users are protected from future actions. It is highly recommended that, for commercial uses, you consult a lawyer before proceeding.
ISO/IEC 29500:2012(E) "Information technology — Document description and processing languages — Office Open XML File Formats"
OSP-covered specifications:
FAQs
Excel 2007+ spreadsheet (XLSB/XLSX/XLSM) parser and writer
We found that @42technologies/xlsx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.