From 009364e72e84b4b2cba172dfd2daaf1b243f2ba4 Mon Sep 17 00:00:00 2001
From: lloyd <lloyd@stackworx.io>
Date: Sun, 11 Oct 2026 23:25:44 +0200
Subject: [PATCH] XLSX: pin the UTF-16LE password encoding with a msoffcrypto
 known answer (#11)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 crates/xlsx/src/crypto/tests.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/crates/xlsx/src/crypto/tests.rs b/crates/xlsx/src/crypto/tests.rs
index eb7d322..0fb0b92 100644
--- a/crates/xlsx/src/crypto/tests.rs
+++ b/crates/xlsx/src/crypto/tests.rs
@@ -145,3 +145,13 @@ fn damaged_files_are_malformed_not_panics() {
     assert!(bad(xml.replace("<keyData", "<other")));
     assert!(bad("<encryption".into()));
 }
+
+#[test]
+fn non_ascii_passwords_hash_as_utf16le_like_msoffcrypto() {
+    // "Pässwörd€" plus an emoji outside the BMP, a surrogate pair in UTF-16.
+    let h = iterated_hash(Hash::Sha512, "P\u{e4}ssw\u{f6}rd\u{20ac}\u{1F511}", &salt(), 1000);
+    assert_eq!(
+        h,
+        hex("2bca96ca0a7e8d88d9314a2eb1819a1ece94ff9ce34266ff82f891a88c4240c4c9f39c729b7c5c410c27fc8e2b7ad90d8c005eb68a603377b8a4ab858041c76a")
+    );
+}