0.26.1: HWP review fixes — copy-protected text stays out of DOCX, record cap, header once

[CocoRoF]

Why

A review of 0.26.0 before the XGEN merges found three issues.

Changes

• Copy-protected distribution documents (배포용, option 0x01) are refused by hwp_to_docx.
  • DOCX is the path that hands text out: Doc* editing, and the agent's file read (text goes to the LLM).
  • Viewing stays with hwp_html, which blocks selection and printing.
  • 0.24.0 refused every distribution document. This keeps that protection for text while allowing viewing.
  • The flags are read when the file opens: the options sit in the 256-byte data record, so no decryption is needed.
• Record cap per stream (2,000,000; real documents peak at about 26k).
  • A crafted file of tiny records could otherwise exhaust memory through record objects alone.
  • The 256 MB decompression cap does not bound that.
  • This matters now that the documents service parses HWP in-process rather than in a hwp5html subprocess.
• Headers/footers drawn once. hwp_html draws them only in the section that defines them, instead of repeating them (and their pictures) for every following section.

Verification

• 5 new tests:
  • record cap
  • protection known at open
  • copy-protected: refused for DOCX, rendered as HTML
  • unprotected distribution document still converts
  • header drawn once
• Full suite: 962 passed, 1 skipped.
• 31 real/fixture HWP files: all convert to HTML. DOCX succeeds for all except the one copy-protected distribution document (the HWP spec), which is refused as intended.

🤖 Generated with Claude Code