[yeroo]

[linux]

Closes #1880.

HTML import now converts <img>. docxcore::import::import_html_with(bytes, &mut resolver) returns HtmlImport { document, media }, and HtmlImport::package() puts each image into a Markdown package as word/media/imageN.<ext>, with its rids renamed (cells and nested tables included). import_html is unchanged and converts no images.

What an <img> becomes

• Source. A data: src is decoded here: percent escapes, then base64, with white space and mail's CRLF wrapping skipped. Any other src goes to the caller's resolver, once per distinct src.
• Limits. The resolver is called at most 1000 times. It is told the most bytes it may return: the budget's room, 64 MiB per image, and what remains of 128 MiB in all. Only PNG, JPEG, GIF and BMP (by image::sniff) are embedded, and equal bytes share one part.
• Size.
  • CSS lengths beat the attributes. auto clears a side; a CSS percentage leaves the attribute's size, so e-mail's width=600 style="width:100%" gives 600 px.
  • With one side given, the other follows the image's aspect; with none, its pixel size.
  • A picture wider than the 6.5" body is scaled down to it.
• Unresolved.
  • Sized: a picture over one shared 1×1 #F2F2F2 PNG with a 1 px A6A6A6 outline and the alt as Alt Text (wp:docPr descr). The colours are by estimate, with no Word oracle.
  • Unsized: the alt text as a run.
  • With neither size nor alt: nothing.
• Nothing made. A hidden image (display:none, mso-hide:all), a zero-sized one, and a list-marker image (<![if !supportLists]>) make nothing and are never resolved.
• Word's markup. Word's <![if !vml]> <img> is read; its VML twin sits in a comment.
• Fixes on the way. A picture is paragraph content: it is not cleared as white space, and it ends its paragraph before a block. take_leading_marker no longer drains a zero-width inline, and never takes a marker past a picture.

The suite

The converting child imports Web Pages through import_html_with and writes the package with its media, so an opened .htm shows its pictures.

Its resolver reads only a relative src under the page's own folder:

• no URI scheme, file: included;
• no absolute, rooted, drive, UNC or device path;
• no : ? * < > | " or NUL after decoding escapes;
• no .. out of the folder, and no name ending in a dot or a space;
• no symlink or Windows reparse point on the way;
• a regular file within the limit, its size checked before it is read.

cid:, http(s): and the rest are placeholders, so opening a page never reaches the network.

This is a deliberate tightening of the agreed plan, which allowed absolute local paths. Review round 1 showed two ways an absolute path reaches the network: macOS's default /net/<host> automounter, and Windows \??\UNC\…. Word, Outlook and browsers' Save Page all write relative page_files/… srcs.

Tests

• docxcore/tests/html_images.rs over the new fixture cid-message.html: a mail with cid: images in nested tables, a CRLF-wrapped data: URI, a refused remote image with and without a size, a hidden pixel and a repeated src. It checks sizes, Alt Text, the media, a save/load round trip, and a truncation loop through import_html_with.
• Unit tests in html_image.rs and html.rs cover decoding, limits, sizing (including extreme aspects), Word's downlevel markup, markers and paragraph content.
• suite/docxy/src/convert_tests.rs: a Word Web Page with its page_files, opened in process and through the real child.
• convert_child tests cover the resolver's refusals (every platform), a relative page folder, and links (unix).
• The existing HTML tests (Open RTF, HTML and PDF as editable documents; Recover Text from Any File; Protected View for downloaded files #633, HTML import: inline CSS, style blocks, table widths/colours, images (data/cid via resolver) and links #1872, HTML import: table widths, cell colours, spans, borders and layout tables #1878) still pass.

The implementer ran:

• cargo fmt --all;
• cargo clippy --workspace --all-targets -D warnings and the same for the suite;
• cargo test -p docxcore;
• cargo test --manifest-path suite/Cargo.toml -p docxy-suite (2802 passed).

The cfg(windows) resolver test was not run here; it is for the Windows CI job.

Review

revmux (claude-only profile) ran two rounds.

• Round 1: 2 Major (the resolver reaching the network: autofs /net, and Windows \??\ on a relative page folder) and 2 minor (docs; a budget test that failed before any image code ran). All fixed in ef3f1c6 and 628d48e.
• Round 2: 0 Major, 1 minor (each declared side clamped at 2112 px on its own, distorting wide pictures) and 1 immaterial (a document clone). Both fixed in 21f13ac.
• The planner's own check of 21f13ac then found a u64 overflow in the box arithmetic with uncapped sides, fixed in 826f06d.

The review stopped at round 2: no Major, all findings fixed.

Out of scope (follow-ups)

• The suite drawing a placeholder's alt text.
• Percentage sizes, max-width and floating images.
• <base href> and MHTML.
• SVG/WebP, background-image and <picture>/srcset.
• <a> around images and links go to HTML import: <a href> links become hyperlinks #1879, and cid mapping to the mail host.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 98.96907% with 9 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
docxcore/src/import/html_image.rs	98.69%	5 Missing ⚠️
docxcore/src/import/html.rs	99.04%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[yeroo]

[linux] Merged as 3526878 after merge-check returned ok for head 826f06d.

• Tests: the suite crate ran 2802 tests and the workspace tests ran on 826f06d, all green. CI is 14/14. ui sweep (linux) failed once on style-gallery.uit (dark/light tiles). The PR touches no ribbon, gallery or harness code, and the rerun passed.
• Review: revmux ran two rounds.
  • Round 1: 2 Major, both the suite resolver reaching the network: autofs /net/<host>, and Windows \??\UNC on a relative page folder. Also 2 minor. All fixed; the resolver now takes only a relative src under the page's folder.
  • Round 2: 0 Major, 1 minor and 1 immaterial, both fixed.
  • The planner's own check found a u64 overflow, fixed in 826f06d.
  • No finding was deferred or disputed.
• Follow-ups: the leftovers issue Leftovers from #1880: HTML import: images (data: URIs, cid:/http via a caller resolver, sized placeholders) #1898 holds four plan items (all minor, out of scope in the plan):
  • plan-alt: the suite drawing a placeholder's alt text;
  • plan-size: percentage sizes, max-width and floating images;
  • plan-base: <base href> and MHTML;
  • plan-fmt: SVG/WebP, background-image and <picture>/srcset.