cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git fetch origin develop

git rebase origin/develop

git log --oneline origin/develop..HEAD
pnpm --filter ep_etherpad-lite run test --grep '#7538'

git push fork feat/native-docx-export-7538 --force-with-lease

gh pr view 7568 --repo ether/etherpad --json mergeStateStatus,mergeable

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538/src
pnpm add pdfkit htmlparser2 mammoth
pnpm add -D @types/pdfkit

grep -E 'pdfkit|htmlparser2|mammoth|html-to-docx' src/package.json

"html-to-docx": "^1.8.0",
"htmlparser2": "^9.x.x",
"mammoth": "^1.x.x",
"pdfkit": "^0.x.x",
"@types/pdfkit": "^0.x.x",

cd src && node -e "require('pdfkit'); require('htmlparser2'); require('mammoth'); console.log('OK')"

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/package.json pnpm-lock.yaml
git commit -m "chore(7538): add pdfkit, htmlparser2, mammoth deps"

  describe('stripRemoteImages', function () {
    const {stripRemoteImages} = require('../../../node/utils/ExportSanitizeHtml');

    it('keeps data: URIs', function () {
      const out = stripRemoteImages(
          '<p>x</p>');
      assert.match(out, /]+src="data:image\/png/);
    });

    it('keeps relative URLs', function () {
      const out = stripRemoteImages('');
      assert.match(out, /]+src="\/foo\/bar\.png"/);
    });

    it('drops absolute http(s) URLs and falls back to alt', function () {
      const out = stripRemoteImages(
          '<p>beforeafter</p>');
      assert.doesNotMatch(out, /evil\.example/);
      assert.match(out, /before/);
      assert.match(out, /cat/);
      assert.match(out, /after/);
    });

    it('drops protocol-relative URLs', function () {
      const out = stripRemoteImages('');
      assert.doesNotMatch(out, /evil\.example/);
    });

    it('passes non-image markup through unchanged', function () {
      const html = '<h1>hi</h1><p>body <a href="/x">link</a></p>';
      assert.strictEqual(stripRemoteImages(html), html);
    });
  });

cd src && pnpm test --grep 'stripRemoteImages'

'use strict';

import {Parser} from 'htmlparser2';

const isLocalSrc = (src: string): boolean => {
  if (!src) return true;
  if (src.startsWith('data:')) return true;
  if (src.startsWith('//')) return false;
  if (/^[a-z][a-z0-9+.-]*:/i.test(src)) return false;
  return true;
};

const escapeAttr = (s: string): string =>
    s.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');

const escapeText = (s: string): string =>
    s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');

const VOID_TAGS = new Set([
  'area', 'base', 'br', 'col', 'embed', 'hr', 'img', 'input',
  'link', 'meta', 'source', 'track', 'wbr',
]);

export const stripRemoteImages = (html: string): string => {
  let out = '';
  const parser = new Parser({
    onopentag(name, attribs) {
      if (name === 'img') {
        const src = attribs.src || '';
        if (isLocalSrc(src)) {
          let tag = '';
          out += tag;
        } else {
          out += escapeText(attribs.alt || '');
        }
        return;
      }
      let tag = `<${name}`;
      for (const [k, v] of Object.entries(attribs)) {
        tag += ` ${k}="${escapeAttr(v)}"`;
      }
      tag += '>';
      out += tag;
    },
    ontext(text) {
      out += text;
    },
    onclosetag(name) {
      if (VOID_TAGS.has(name)) return;
      out += `</${name}>`;
    },
  }, {decodeEntities: false, lowerCaseTags: true});
  parser.write(html);
  parser.end();
  return out;
};

cd src && pnpm test --grep 'stripRemoteImages'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/utils/ExportSanitizeHtml.ts src/tests/backend/specs/export.ts
git commit -m "feat(7538): add stripRemoteImages HTML sanitizer

Drops  elements pointing at non-data, non-relative URLs to
prevent the DOCX/PDF converters from making outbound requests via
plugin-modified HTML. Closes Qodo finding #4 against the
html-to-docx path; will be wired into both export branches in
the cascade refactor."

  describe('htmlToPdfBuffer', function () {
    let htmlToPdfBuffer: (html: string) => Promise<Buffer>;

    before(function () {
      try {
        require.resolve('pdfkit');
        require.resolve('htmlparser2');
      } catch {
        this.skip();
        return;
      }
      htmlToPdfBuffer = require('../../../node/utils/ExportPdfNative').htmlToPdfBuffer;
    });

    it('produces a buffer starting with %PDF-', async function () {
      const buf = await htmlToPdfBuffer('<p>hello world</p>');
      assert.ok(Buffer.isBuffer(buf), 'must return Buffer');
      assert.ok(buf.length > 100, `buffer suspiciously small: ${buf.length} bytes`);
      assert.strictEqual(buf.slice(0, 5).toString('ascii'), '%PDF-');
    });
  });

cd src && pnpm test --grep 'htmlToPdfBuffer'

'use strict';

import {Parser} from 'htmlparser2';
import {PassThrough} from 'stream';

const PDFDocument = require('pdfkit');

interface InlineState {
  bold: boolean;
  italic: boolean;
  underline: boolean;
  strike: boolean;
  link?: string;
  fontSize?: number;
}

const HEADING_SIZES: Record<string, number> = {
  h1: 24, h2: 20, h3: 16, h4: 14, h5: 12, h6: 11,
};

const decodeDataUri = (src: string): Buffer | null => {
  const m = /^data:[^;,]+;base64,(.+)$/i.exec(src);
  if (!m) return null;
  try {
    return Buffer.from(m[1], 'base64');
  } catch {
    return null;
  }
};

export const htmlToPdfBuffer = (html: string): Promise<Buffer> =>
  new Promise((resolve, reject) => {
    const doc = new PDFDocument({margin: 50});
    const stream = new PassThrough();
    const chunks: Buffer[] = [];
    stream.on('data', (c: Buffer) => chunks.push(c));
    stream.on('end', () => resolve(Buffer.concat(chunks)));
    stream.on('error', reject);
    doc.pipe(stream);

    const styleStack: InlineState[] = [{
      bold: false, italic: false, underline: false, strike: false,
    }];
    let listType: ('ul' | 'ol' | null)[] = [];
    let listIndex: number[] = [];
    let pendingNewline = false;

    const top = () => styleStack[styleStack.length - 1];

    const applyFont = () => {
      const s = top();
      const variant =
        s.bold && s.italic ? 'Helvetica-BoldOblique' :
        s.bold ? 'Helvetica-Bold' :
        s.italic ? 'Helvetica-Oblique' :
        'Helvetica';
      doc.font(variant);
      doc.fontSize(s.fontSize || 11);
    };

    const writeText = (raw: string) => {
      if (!raw) return;
      if (pendingNewline) {
        doc.moveDown(0.5);
        pendingNewline = false;
      }
      const s = top();
      applyFont();
      const opts: any = {continued: true};
      if (s.underline) opts.underline = true;
      if (s.strike) opts.strike = true;
      if (s.link) opts.link = s.link;
      doc.text(raw, opts);
    };

    const flushLine = () => {
      doc.text('', {continued: false});
    };

    const parser = new Parser({
      onopentag(name, attribs) {
        const cur = top();
        const next: InlineState = {...cur};
        switch (name) {
          case 'b': case 'strong': next.bold = true; break;
          case 'i': case 'em': next.italic = true; break;
          case 'u': next.underline = true; break;
          case 's': case 'strike': case 'del': next.strike = true; break;
          case 'a': next.link = attribs.href; next.underline = true; break;
          case 'h1': case 'h2': case 'h3': case 'h4': case 'h5': case 'h6':
            next.fontSize = HEADING_SIZES[name];
            next.bold = true;
            if (!pendingNewline) flushLine();
            doc.moveDown(0.5);
            break;
          case 'p': case 'div':
            if (!pendingNewline) flushLine();
            doc.moveDown(0.3);
            break;
          case 'ul': case 'ol':
            listType.push(name as 'ul' | 'ol');
            listIndex.push(0);
            flushLine();
            break;
          case 'li': {
            flushLine();
            const t = listType[listType.length - 1] || 'ul';
            if (t === 'ol') listIndex[listIndex.length - 1] += 1;
            const prefix = t === 'ul'
              ? '• '
              : `${listIndex[listIndex.length - 1]}. `;
            const indent = '   '.repeat(Math.max(0, listType.length - 1));
            applyFont();
            doc.text(`${indent}${prefix}`, {continued: true});
            break;
          }
          case 'br':
            flushLine();
            break;
          case 'img': {
            const buf = decodeDataUri(attribs.src || '');
            if (buf) {
              flushLine();
              try { doc.image(buf, {fit: [400, 300]}); } catch { /* ignore */ }
            }
            break;
          }
        }
        styleStack.push(next);
      },

      ontext(text) {
        writeText(text);
      },

      onclosetag(name) {
        switch (name) {
          case 'h1': case 'h2': case 'h3': case 'h4': case 'h5': case 'h6':
          case 'p': case 'div':
            flushLine();
            pendingNewline = true;
            break;
          case 'li':
            flushLine();
            break;
          case 'ul': case 'ol':
            listType.pop();
            listIndex.pop();
            doc.moveDown(0.3);
            break;
        }
        styleStack.pop();
        if (styleStack.length === 0) {
          styleStack.push({bold: false, italic: false, underline: false, strike: false});
        }
      },
    }, {decodeEntities: true, lowerCaseTags: true});

    parser.write(html);
    parser.end();
    flushLine();
    doc.end();
  });

cd src && pnpm test --grep 'htmlToPdfBuffer'

    const renderText = async (html: string): Promise<string> => {
      const buf = await htmlToPdfBuffer(html);
      // pdfkit emits text uncompressed-ish; we look for substrings inside
      // the raw PDF stream. This is intentionally fragile-friendly: we
      // assert the words show up at all, not their layout.
      return buf.toString('latin1');
    };

    it('renders headings, paragraphs, and lists', async function () {
      const raw = await renderText(`
        <h1>Title</h1>
        <p>Body paragraph here.</p>
        <ul><li>one</li><li>two</li></ul>
        <ol><li>alpha</li><li>beta</li></ol>
      `);
      assert.ok(raw.includes('Title'));
      assert.ok(raw.includes('Body paragraph here.'));
      assert.ok(raw.includes('one'));
      assert.ok(raw.includes('two'));
      assert.ok(raw.includes('alpha'));
      assert.ok(raw.includes('beta'));
    });

    it('emits link annotations for <a href>', async function () {
      const raw = await renderText('<p><a href="https://etherpad.org">site</a></p>');
      assert.ok(raw.includes('site'));
      assert.ok(raw.includes('etherpad.org'));
    });

    it('embeds data: URI images without throwing', async function () {
      const tinyPng =
        'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=';
      const buf = await htmlToPdfBuffer(``);
      assert.ok(buf.length > 200);
    });

    it('ignores unknown tags rather than crashing', async function () {
      const buf = await htmlToPdfBuffer(
          '<custom-tag><p>still works</p></custom-tag>');
      assert.ok(buf.slice(0, 5).toString('ascii') === '%PDF-');
    });
  });

cd src && pnpm test --grep 'htmlToPdfBuffer'

wc -l src/node/utils/ExportPdfNative.ts

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/utils/ExportPdfNative.ts src/tests/backend/specs/export.ts
git commit -m "feat(7538): native PDF export via pdfkit + htmlparser2 walker

Renders pad HTML to a PDF Buffer in-process: headings, paragraphs,
lists, links, inline emphasis, data:-URI images. Remote images are
explicitly skipped at the walker (defense-in-depth on top of the
shared stripRemoteImages sanitizer)."

mkdir -p src/tests/backend/specs/fixtures
cd src && node -e "
const fs = require('fs');
const htmlToDocx = require('html-to-docx');
htmlToDocx('<h1>Heading</h1><p>Paragraph body.</p><ul><li>one</li><li>two</li></ul>').then((buf) => {
  fs.writeFileSync('tests/backend/specs/fixtures/sample.docx', buf);
  console.log('wrote', buf.length, 'bytes');
});
"

head -c 4 src/tests/backend/specs/fixtures/sample.docx | xxd

'use strict';

import {MapArrayType} from '../../../node/types/MapType';
import path from 'path';
import {promises as fs} from 'fs';

const assert = require('assert').strict;
const common = require('../common');
const padManager = require('../../../node/db/PadManager');
import settings from '../../../node/utils/Settings';

describe(__filename, function () {
  const settingsBackup: MapArrayType<any> = {};
  let agent: any;

  before(async function () {
    agent = await common.init();
    settingsBackup.soffice = settings.soffice;
  });

  after(function () {
    Object.assign(settings, settingsBackup);
  });

  describe('docxBufferToHtml (#7538)', function () {
    let docxBufferToHtml: (b: Buffer) => Promise<string>;

    before(function () {
      try { require.resolve('mammoth'); }
      catch { this.skip(); return; }
      docxBufferToHtml = require('../../../node/utils/ImportDocxNative').docxBufferToHtml;
    });

    it('converts the sample.docx fixture to HTML', async function () {
      const buf = await fs.readFile(
          path.join(__dirname, 'fixtures', 'sample.docx'));
      const html = await docxBufferToHtml(buf);
      assert.match(html, /Heading/);
      assert.match(html, /Paragraph body\./);
      assert.match(html, /one/);
      assert.match(html, /two/);
    });

    it('emits no remote image URLs', async function () {
      const buf = await fs.readFile(
          path.join(__dirname, 'fixtures', 'sample.docx'));
      const html = await docxBufferToHtml(buf);
      assert.doesNotMatch(html, /]+src="https?:/);
      assert.doesNotMatch(html, /]+src="\/\//);
    });
  });
});

cd src && pnpm test --grep 'docxBufferToHtml'

'use strict';

const mammoth = require('mammoth');

export const docxBufferToHtml = async (buffer: Buffer): Promise<string> => {
  const result = await mammoth.convertToHtml(
    {buffer},
    {
      convertImage: mammoth.images.imgElement(async (image: any) => {
        const buf: Buffer = await image.read();
        const contentType = image.contentType || 'application/octet-stream';
        return {src: `data:${contentType};base64,${buf.toString('base64')}`};
      }),
    },
  );
  return result.value || '';
};

cd src && pnpm test --grep 'docxBufferToHtml'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/utils/ImportDocxNative.ts \
        src/tests/backend/specs/import.ts \
        src/tests/backend/specs/fixtures/sample.docx
git commit -m "feat(7538): native DOCX import via mammoth

Wraps mammoth.convertToHtml so a soffice-less Etherpad can ingest
.docx files. Images are coerced to data: URIs at the converter
boundary so the import pipeline never sees a remote src=."

  describe('native DOCX export (#7538)', function () {
    before(function () {
      try {
        require.resolve('html-to-docx');
      } catch {
        this.skip();
        return;
      }
      settings.soffice = 'false';
      settings.nativeDocxExport = true;
    });

  describe('native DOCX export (#7538)', function () {
    before(function () {
      try {
        require.resolve('html-to-docx');
      } catch {
        this.skip();
        return;
      }
      settings.soffice = null;
    });

    settings.soffice = 'false'; // '/bin/false' doesn't work on Windows
    settings.nativeDocxExport = false;

    settings.soffice = '/bin/false'; // forces a soffice spawn that errors

    settingsBackup.nativeDocxExport = settings.nativeDocxExport;

  describe('odt without soffice (#7538)', function () {
    before(function () { settings.soffice = null; });
    it('returns the "not enabled" message for odt', async function () {
      const res = await agent.get('/p/testExportPad/export/odt').expect(200);
      assert.match(res.text, /This export is not enabled/);
    });
  });

  describe('native PDF export (#7538)', function () {
    before(function () {
      try {
        require.resolve('pdfkit');
        require.resolve('htmlparser2');
      } catch {
        this.skip();
        return;
      }
      settings.soffice = null;
    });

    it('returns a valid %PDF- document', async function () {
      const res = await agent.get('/p/testExportPad/export/pdf')
          .buffer(true)
          .parse((resp: any, callback: any) => {
            const chunks: Buffer[] = [];
            resp.on('data', (chunk: Buffer) => chunks.push(chunk));
            resp.on('end', () => callback(null, Buffer.concat(chunks)));
          })
          .expect(200);
      const body: Buffer = res.body as Buffer;
      assert.ok(body.length > 200, 'PDF body must be non-trivial');
      assert.strictEqual(body.slice(0, 5).toString('ascii'), '%PDF-');
    });

    it('sends application/pdf content-type', async function () {
      const res = await agent.get('/p/testExportPad/export/pdf').expect(200);
      assert.match(res.headers['content-type'], /application\/pdf/);
    });
  });

cd src && pnpm test --grep '#7538'

    // Soffice-first dispatch (issue #7538). When soffice is configured
    // we keep the legacy convert-via-tempfile path; when it's not, we
    // hand DOCX to html-to-docx and PDF to our pdfkit walker — both
    // pure-JS, in-process. No fallback chain: native errors surface as
    // 5xx so admins see real failures instead of silent shadowing.
    const {sofficeAvailable} = require('../utils/Settings');
    const offline = sofficeAvailable() === 'no'
        || (sofficeAvailable() === 'withoutPDF' && type === 'pdf');

    if (offline) {
      const {stripRemoteImages} = require('../utils/ExportSanitizeHtml');
      const safeHtml = stripRemoteImages(html);
      html = null;
      try {
        if (type === 'docx') {
          const htmlToDocx = require('html-to-docx');
          const buf = await htmlToDocx(safeHtml);
          res.contentType(
              'application/vnd.openxmlformats-officedocument.wordprocessingml.document');
          res.send(buf);
          return;
        }
        if (type === 'pdf') {
          const {htmlToPdfBuffer} = require('../utils/ExportPdfNative');
          const buf = await htmlToPdfBuffer(safeHtml);
          res.contentType('application/pdf');
          res.send(buf);
          return;
        }
        // soffice-only formats (odt, doc) are blocked at the route guard
        // when soffice is null; reaching here means the guard is wrong.
        res.status(500).send(`Cannot export ${type} without soffice configured`);
        return;
      } catch (err) {
        console.error(
            `native ${type} export failed for pad "${padId}":`,
            err && (err as Error).stack ? (err as Error).stack : err);
        res.status(500).send(`Failed to export pad as ${type}.`);
        return;
      }
    }

    // soffice path — write the html export to a file
    const randNum = Math.floor(Math.random() * 0xFFFFFFFF);
    const srcFile = `${tempDirectory}/etherpad_export_${randNum}.html`;
    await fsp_writeFile(srcFile, html);

    // ensure html can be collected by the garbage collector
    html = null;

    // send the convert job to the converter (libreoffice)
    const destFile = `${tempDirectory}/etherpad_export_${randNum}.${type}`;

    // Allow plugins to overwrite the convert in export process
    const result = await hooks.aCallAll('exportConvert', {srcFile, destFile, req, res});
    if (result.length > 0) {
      // console.log("export handled by plugin", destFile);
    } else {
      const converter = require('../utils/LibreOffice');
      await converter.convertFile(srcFile, destFile, type);
    }

    // send the file
    await res.sendFile(destFile, null);

    // clean up temporary files
    await fsp_unlink(srcFile);

    // 100ms delay to accommodate for slow windows fs
    if (os.type().indexOf('Windows') > -1) {
      await new Promise((resolve) => setTimeout(resolve, 100));
    }

    await fsp_unlink(destFile);

cd src && pnpm test --grep '#7538'

cd src && pnpm test --grep 'htmlToPdfBuffer\|docxBufferToHtml\|stripRemoteImages'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/handler/ExportHandler.ts src/tests/backend/specs/export.ts
git commit -m "feat(7538): soffice-first cascade in ExportHandler

Replaces the flag-gated DOCX branch with a deterministic dispatch:
soffice if configured, native DOCX/PDF otherwise, 5xx on native
error. Both native paths run plugin-modified HTML through
stripRemoteImages first."

      // if soffice is disabled, and this is a format we only support with soffice, output a message
      if (exportAvailable() === 'no' &&
          ['odt', 'pdf', 'doc', 'docx'].indexOf(req.params.type) !== -1) {
        console.error(`Impossible to export pad "${req.params.pad}" in ${req.params.type} format.` +
                      ' There is no converter configured');

        // ACHTUNG: do not include req.params.type in res.send() because there is
        // no HTML escaping and it would lead to an XSS
        res.send('This export is not enabled at this Etherpad instance. Set the path to soffice ' +
                 '(LibreOffice) in settings.json to enable this feature');
        return;
      }

      // When soffice is disabled, only block formats with no native path.
      // pdf and docx fall through to ExportHandler, which dispatches to
      // the in-process converters (issue #7538).
      if (exportAvailable() === 'no' &&
          ['odt', 'doc'].indexOf(req.params.type) !== -1) {
        console.error(`Impossible to export pad "${req.params.pad}" in ${req.params.type} format.` +
                      ' There is no converter configured');

        // ACHTUNG: do not include req.params.type in res.send() because there is
        // no HTML escaping and it would lead to an XSS
        res.send('This export is not enabled at this Etherpad instance. Set the path to soffice ' +
                 '(LibreOffice) in settings.json to enable this feature');
        return;
      }

cd src && pnpm test --grep '#7538'

cd src && pnpm test --grep 'export\.ts'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/hooks/express/importexport.ts
git commit -m "fix(7538): allow docx/pdf through export guard without soffice

Tightens the no-soffice block to ['odt','doc'] only — formats with
no native path. docx and pdf are handed to ExportHandler, which
dispatches to the in-process converters. Closes Qodo finding #2."

  describe('end-to-end DOCX import (#7538)', function () {
    before(function () {
      try { require.resolve('mammoth'); }
      catch { this.skip(); return; }
      settings.soffice = null;
    });

    it('imports a docx into a pad without soffice', async function () {
      const padId = 'test7538DocxImport';
      // Reset pad
      try { await padManager.removePad(padId); } catch { /* noop */ }
      const fixture = path.join(__dirname, 'fixtures', 'sample.docx');
      const res = await agent
          .post(`/p/${padId}/import`)
          .attach('file', fixture)
          .expect(200);
      assert.strictEqual(res.body.code, 0, `import failed: ${JSON.stringify(res.body)}`);
      const pad = await padManager.getPad(padId);
      const text = pad.text();
      assert.match(text, /Heading/);
      assert.match(text, /Paragraph body/);
      assert.match(text, /one/);
      assert.match(text, /two/);
    });

    it('rejects odt extension when soffice is null', async function () {
      const padId = 'test7538OdtReject';
      try { await padManager.removePad(padId); } catch { /* noop */ }
      const fixture = path.join(__dirname, 'fixtures', 'sample.docx');
      // copy fixture to a .odt name
      const odtPath = path.join(__dirname, 'fixtures', 'sample.odt');
      await fs.copyFile(fixture, odtPath);
      try {
        const res = await agent
            .post(`/p/${padId}/import`)
            .attach('file', odtPath);
        // either 400 with a known status or rejected payload
        assert.ok(
            res.status >= 400 || res.body.code !== 0,
            `expected odt import to fail when soffice is null, got: ${res.status} ${JSON.stringify(res.body)}`);
      } finally {
        await fs.unlink(odtPath).catch(() => undefined);
      }
    });
  });

cd src && pnpm test --grep 'end-to-end DOCX import'

let converter:any = null;
let exportExtension = 'htm';

// load soffice only if it is enabled
if (settings.soffice != null) {
  converter = require('../utils/LibreOffice');
  exportExtension = 'html';
}

let converter: any = null;
let exportExtension = 'htm';

// load soffice only if it is enabled
if (settings.soffice != null) {
  converter = require('../utils/LibreOffice');
  exportExtension = 'html';
}

const NATIVE_NO_SOFFICE_OFFICE_FORMATS = new Set(['.pdf', '.odt', '.doc', '.rtf']);

  // Native DOCX import (issue #7538): when soffice isn't configured we
  // hand .docx files to mammoth, which produces HTML — then we feed that
  // through the existing setPadHTML pipeline by writing it to destFile.
  if (settings.soffice == null && fileEnding === '.docx') {
    const buf = await fs.readFile(srcFile);
    const {docxBufferToHtml} = require('../utils/ImportDocxNative');
    let nativeHtml: string;
    try {
      nativeHtml = await docxBufferToHtml(buf);
    } catch (err: any) {
      logger.warn(`Native DOCX import failed: ${err.stack || err}`);
      throw new ImportError('convertFailed');
    }
    const destFileNative = path.join(tmpDirectory, `etherpad_import_${randNum}.html`);
    await fs.writeFile(destFileNative, nativeHtml);
    const pad = await padManager.getPad(padId, '\n', authorId);
    try {
      await importHtml.setPadHTML(pad, nativeHtml, authorId);
    } catch (err: any) {
      logger.warn(`Error importing native DOCX HTML: ${err.stack || err}`);
      throw new ImportError('convertFailed');
    }
    padManager.unloadPad(padId);
    const reloaded = await padManager.getPad(padId, '\n', authorId);
    padManager.unloadPad(padId);
    await padMessageHandler.updatePadClients(reloaded);
    rm(srcFile);
    rm(destFileNative);
    return false;
  }

  // Without soffice, the legacy office formats (pdf, odt, doc, rtf) have
  // no in-process path. Reject explicitly so the user sees a clear error
  // instead of a silent ASCII-only fallback.
  if (settings.soffice == null && NATIVE_NO_SOFFICE_OFFICE_FORMATS.has(fileEnding)) {
    throw new ImportError('uploadFailed');
  }

cd src && pnpm test --grep 'end-to-end DOCX import'

cd src && pnpm test --grep 'import\.ts'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/handler/ImportHandler.ts src/tests/backend/specs/import.ts
git commit -m "feat(7538): native DOCX import path in ImportHandler

When soffice is null and the upload is .docx, run mammoth and feed
the resulting HTML through setPadHTML. Other office formats
(pdf/odt/doc/rtf) are explicitly rejected with uploadFailed instead
of silently falling through to the ASCII-only path."

      // hide stuff thats not avaible if soffice is disabled
      const wordFormat = clientVars.docxExport ? 'docx' : 'doc';
      if (clientVars.exportAvailable === 'no') {
        $('#exportworda').remove();
        $('#exportpdfa').remove();
        $('#exportopena').remove();
        $('#importmessagenoconverter').prop('hidden', false);
      } else if (clientVars.exportAvailable === 'withoutPDF') {
        $('#exportpdfa').remove();

        $('#exportworda').attr('href', `${padRootPath}/export/${wordFormat}`);
        $('#exportopena').attr('href', `${padRootPath}/export/odt`);

        $('#importexport').css({height: '142px'});
        $('#importexportline').css({height: '142px'});
      } else {
        $('#exportworda').attr('href', `${padRootPath}/export/${wordFormat}`);
        $('#exportpdfa').attr('href', `${padRootPath}/export/pdf`);
        $('#exportopena').attr('href', `${padRootPath}/export/odt`);
      }

      // DOCX and PDF are always available — soffice when configured,
      // native pure-JS converters otherwise (issue #7538). ODT still
      // requires soffice. The 'withoutPDF' branch (Windows soffice
      // without PDF) is handled by the server-side cascade routing PDF
      // through native; the UI link stays.
      const wordFormat = clientVars.docxExport ? 'docx' : 'doc';
      $('#exportworda').attr('href', `${padRootPath}/export/${wordFormat}`);
      $('#exportpdfa').attr('href', `${padRootPath}/export/pdf`);
      if (clientVars.exportAvailable === 'no') {
        $('#exportopena').remove();
        $('#importmessagenoconverter').prop('hidden', false);
      } else {
        $('#exportopena').attr('href', `${padRootPath}/export/odt`);
      }

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538/src
pnpm exec tsc --noEmit -p .

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538/src
SOFFICE=null pnpm run dev

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/static/js/pad_impexp.ts
git commit -m "fix(7538): always show DOCX/PDF export links

Native paths (#7538) make DOCX and PDF available regardless of
soffice presence, so unconditionally render those links. ODT still
gates on exportAvailable. Closes Qodo finding #2 on the UI side."

  nativeDocxExport: boolean,

grep -n 'nativeDocxExport\|NATIVE_DOCX' settings.json.template settings.json.docker doc/docker.md src/node/utils/Settings.ts

  /*
   * Convert DOCX exports in-process via html-to-docx instead of shelling
   * out to LibreOffice. Auto-falls back to the LibreOffice path on error.
   */
  "nativeDocxExport": "${NATIVE_DOCX_EXPORT:false}",

| `NATIVE_DOCX_EXPORT`              | Convert DOCX exports in-process with the bundled `html-to-docx` library instead of shelling out to LibreOffice. Auto-falls back to LibreOffice on error. Lets you skip installing `soffice` entirely for deployments that only need DOCX. | `false`               |

grep -rn 'nativeDocxExport\|NATIVE_DOCX_EXPORT' src/ doc/ settings.json.template settings.json.docker 2>/dev/null

cd src && pnpm exec tsc --noEmit -p .

cd src && pnpm test --grep 'export\.ts\|import\.ts'

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
git add src/node/utils/Settings.ts settings.json.template settings.json.docker doc/docker.md
git commit -m "refactor(7538): drop nativeDocxExport flag

Selection is now purely soffice-presence-driven (Task 5 cascade).
The opt-in setting and its NATIVE_DOCX_EXPORT env var are no longer
needed — soffice configured means soffice path; soffice null means
native path. Reverts the additive surface introduced earlier in
this PR."

cd /home/jose/etherpad/etherpad-lite/.claude/worktrees/pr-7538
pnpm --filter ep_etherpad-lite run test

git push fork feat/native-docx-export-7538

sleep 30 && gh pr checks 7568 --repo ether/etherpad

gh pr comment 7568 --repo ether/etherpad --body "$(cat <<'EOF'
Qodo follow-up:

1. **Requirement gap (DOCX still needs soffice)** — addressed. Removed the `nativeDocxExport` flag entirely. Selection is now purely soffice-presence-driven: soffice configured → soffice; soffice null → native (html-to-docx for DOCX, pdfkit for PDF). No fallback chain.
2. **DOCX blocked without soffice** — fixed. Tightened the route guard to `['odt','doc']` only when `exportAvailable() === 'no'`; pdf/docx fall through to ExportHandler's native dispatch. UI in pad_impexp.ts always shows DOCX + PDF links now.
3. **Native DOCX test bypass** — fixed. Tests use `settings.soffice = null` (was `'false'`) so they exercise the real no-soffice deployment shape.
4. **Unrestricted HTML-to-DOCX I/O** — addressed. New `stripRemoteImages` sanitizer drops non-`data:`/non-relative `` before either DOCX or PDF conversion. The PDF walker also rejects remote `` at its own boundary as defense-in-depth. No converter ever sees a remote URL.

Also added native PDF export (issue #7538's other half) and native DOCX import via mammoth — design committed at `docs/superpowers/specs/2026-05-08-native-docx-pdf-export-import-design.md`.
EOF
)"

gh pr ready 7568 --repo ether/etherpad

gh pr edit 7568 --repo ether/etherpad --body "$(cat <<'EOF'
## Summary

Closes #7538. With this PR an Etherpad deployment with `settings.soffice = null` can:
- export pads as `html`, `txt`, `etherpad`, `docx`, `pdf` — all in-process, no subprocess, no native binaries
- import `.html`, `.txt`, `.etherpad`, `.docx` files — all in-process

Deployments with `settings.soffice` configured retain today's behavior bit-for-bit.

## Shape

Selection is purely soffice-presence-driven — there is no opt-in flag:
- `sofficeAvailable() === 'yes'` → existing soffice path
- `'withoutPDF'` (Windows) → soffice for everything except `pdf`, which goes native
- `'no'` (soffice null) → native DOCX/PDF; ODT/DOC remain blocked with a clear message

Native DOCX export uses `html-to-docx`; native PDF uses a small `pdfkit` + `htmlparser2` walker we own; native DOCX import uses `mammoth`. Plugin-modified HTML is run through `stripRemoteImages` first to close the SSRF surface Qodo flagged.

## Files

| File | Change |
|---|---|
| `src/node/utils/ExportSanitizeHtml.ts` | new — `stripRemoteImages` |
| `src/node/utils/ExportPdfNative.ts` | new — pdfkit walker |
| `src/node/utils/ImportDocxNative.ts` | new — mammoth wrapper |
| `src/node/handler/ExportHandler.ts` | soffice-first cascade for DOCX + PDF |
| `src/node/handler/ImportHandler.ts` | native DOCX import branch |
| `src/node/hooks/express/importexport.ts` | route guard tightened to `['odt','doc']` |
| `src/static/js/pad_impexp.ts` | DOCX + PDF links always visible |
| `src/package.json` | `pdfkit`, `htmlparser2`, `mammoth`, `html-to-docx` |
| `src/tests/backend/specs/export.ts` | revised + new tests |
| `src/tests/backend/specs/import.ts` | new — DOCX import tests |
| `src/tests/backend/specs/fixtures/sample.docx` | new fixture |
| `docs/superpowers/specs/...` | design spec |

## Out of scope (follow-ups)

- Native ODT export — no mature pure-JS writer
- Native PDF / ODT / DOC / RTF import — no mature pure-JS readers
- Memory/timeout caps on conversion — add when production signal warrants

## Test plan
- [x] `pnpm run ts-check` clean
- [x] Backend tests: sanitizer, walker, mammoth wrapper, DOCX + PDF integration, ODT negative, end-to-end DOCX import
- [x] Manual: with `SOFFICE=null`, export DOCX and PDF; both produce valid files
- [x] Manual: with `SOFFICE=null`, import the fixture .docx and verify pad content

Closes #7538
EOF
)"