@patrickdk77/archive-defuse 0.1.3 → 0.2.1

package/README.md

@@ -175,6 +175,8 @@ Every file entry goes to `filePlugins` in order, with pdf-defuse's shapes. A plu
 
 The plugin's findings come into the report with `attachment` set to the entry's name. A `reject` inside the entry becomes `strip`, since the entry goes and the archive stays. When no plugin accepts an entry, ENTRY/NO_PLUGIN removes it. As `info`, the entry stays.
 
+A plugin's answer is final, and its findings are all the entry adds to the score. ENTRY/PLUGIN_PASSED and PLUGIN_SCRUBBED weigh 0, in the upload's score and the output's. ENTRY/PLUGIN_FAILED weighs 30, what NO_PLUGIN weighs, since no plugin answered for the entry.
+
 Before the plugins, a type check reports ENTRY/TYPE_MISMATCH (`info`) when the name's extension and the content disagree, as pdf-defuse does for attached files. A plugin never checks types.
 
 `passThrough(types)` keeps entries by MIME type or extension, such as `passThrough(['text/csv', '.txt'])`.

package/dist/engine.js

@@ -38,7 +38,6 @@ async function endRun(run) {
         await run.temp.cleanup();
     }
 }
-const PLUGIN_KEPT = new Set([types_1.ArchiveDetail.PluginPassed, types_1.ArchiveDetail.PluginScrubbed]);
 /** Kinds whose content the rewrite drops whatever their action, so an info override leaves CONTENT_REMOVED. */
 const DROPPED_ANYWAY = new Set([types_1.ArchiveDetail.HiddenData, types_1.ArchiveDetail.NonFileData, types_1.ArchiveDetail.ExtraField]);
 /**
@@ -52,7 +51,9 @@ function finish(findings, options, incomplete, archive, isOutput = false) {
     const rejected = findings.some(f => f.action === 'reject');
     // In an upload, a plugin rewrite or a metadata strip changes the file, so the output must be written.
     const strippable = findings.some(f => f.action === 'strip' || (!isOutput && (f.detail === types_1.ArchiveDetail.PluginScrubbed || f.detail === types_1.ArchiveDetail.Stripped) && f.attachment === undefined));
-    const { score, risk } = (0, score_1.scoreFindings)(isOutput ? findings : findings.filter(f => !PLUGIN_KEPT.has(f.detail)), options);
+    // What a plugin decided counts at the weights of the plugin's own findings; the PLUGIN_* findings that record its
+    // answer weigh nothing.
+    const { score, risk } = (0, score_1.scoreFindings)(findings, options);
     return { status: rejected ? 'rejected' : strippable ? 'strippable' : 'clean', score, risk, findings, ...named };
 }
 /** A value from the archive, such as a name, cut to a length a report can carry. */

package/dist/findings.js

@@ -89,9 +89,9 @@ def(types_1.ArchiveCategory.Compression, types_1.ArchiveDetail.UnsupportedFeatur
 // ENTRY
 def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.NoPlugin, 'strip', 30, '<Entry "{name}"|An entry> (<{sniffed}|unknown type>) removed. No plugin accepts this type');
 def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.TypeMismatch, 'info', 40, 'The types of <entry "{name}"|an unnamed entry> disagree: <its name says {nameType}|its name has no known extension>, and <its content looks like {sniffed}|its content is not recognized>');
-def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginPassed, 'info', 20, 'Entry kept by plugin <plugin> with nothing removed');
-def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginScrubbed, 'info', 10, 'Entry cleaned and kept by plugin <plugin>');
-def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginFailed, 'strip', 0, 'Plugin <plugin> failed, so the entry was removed');
+def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginPassed, 'info', 0, 'Entry kept by plugin <plugin> with nothing removed');
+def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginScrubbed, 'info', 0, 'Entry cleaned and kept by plugin <plugin>');
+def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginFailed, 'strip', 30, 'Plugin <plugin> failed, so the entry was removed');
 def(types_1.ArchiveCategory.Entry, types_1.ArchiveDetail.PluginRemoved, 'strip', 0, 'Entry removed by plugin <plugin>');
 // METADATA
 def(types_1.ArchiveCategory.Metadata, types_1.ArchiveDetail.Comment, 'info', 0, 'The archive or an entry carries a comment');

package/dist/tar.js

@@ -133,7 +133,7 @@ class TarArchive {
         const reader = new io_1.Reader(source, size);
         const notes = [];
         const entries = [];
-        let global = [];
+        let globalRecords = [];
         let pending = { pax: [] };
         let pos = 0;
         let total = 0;
@@ -203,7 +203,7 @@ class TarArchive {
                 if (typeflag === 'g') {
                     // Later global records replace earlier ones of the same key.
                     const keys = new Set(parsed.records.map(r => r.key));
-                    global = [...global.filter(r => !keys.has(r.key)), ...parsed.records];
+                    globalRecords = [...globalRecords.filter(r => !keys.has(r.key)), ...parsed.records];
                     const c = parsed.records.find(r => r.key === 'comment');
                     if (c)
                         comment = c.value.toString('utf8');
@@ -230,7 +230,7 @@ class TarArchive {
                 continue;
             }
             // The records that apply: global ones, then this entry's own, the later winning.
-            const records = [...global.filter(g => !pending.pax.some(r => r.key === g.key)), ...pending.pax];
+            const records = [...globalRecords.filter(g => !pending.pax.some(r => r.key === g.key)), ...pending.pax];
             const last = (key) => {
                 let found;
                 for (const r of records)
@@ -315,7 +315,7 @@ class TarArchive {
                 devmajor: posix || ustar === 'ustar ' ? num(329, 8, 'devmajor') : 0,
                 devminor: posix || ustar === 'ustar ' ? num(337, 8, 'devminor') : 0,
                 // Global records apply to every entry after them, so each entry keeps its own copy. A global comment is the archive's.
-                pax: records.filter(r => !isStructural(r.key) && !(r.key === 'comment' && global.includes(r))),
+                pax: records.filter(r => !isStructural(r.key) && !(r.key === 'comment' && globalRecords.includes(r))),
             };
             if (kind === 'symlink' || kind === 'hardlink')
                 e.linkTarget = linkTarget;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/archive-defuse",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "description": "Sanitize zip, tar, gzip, bzip2, zstd, Brotli, cab, 7z, xz and lzma archives. Detects path traversal, links out of the tree, device files, duplicate names, overlapping entries, hidden and prepended data, encrypted entries and compression bombs, hands every entry to file plugins, scores the risk, and writes a defused archive in the same format with no runtime dependencies.",
   "license": "MIT AND Apache-2.0",
   "author": "patrickdk77",