@patrickdk77/office-defuse 0.0.0-stage → 0.1.0

package/dist/ooxml.js

@@ -0,0 +1,516 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectOoxml = inspectOoxml;
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const formats_1 = require("./formats");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const xlsb_1 = require("./xlsb");
+const xml_1 = require("./xml");
+const zip_1 = require("./zip");
+const CONTENT_TYPES_NS = 'http://schemas.openxmlformats.org/package/2006/content-types';
+const RELS_NS = 'http://schemas.openxmlformats.org/package/2006/relationships';
+const T = 'http://schemas.openxmlformats.org/officedocument/2006/relationships/';
+const S = 'http://purl.oclc.org/ooxml/officedocument/relationships/';
+const MS = 'http://schemas.microsoft.com/office/2006/relationships/';
+const both = (name) => [T + name, S + name];
+/** Relationship types, lowercased, as OPC compares them without regard to case. */
+const REL = {
+    main: new Set([...both('officedocument'), 'http://schemas.microsoft.com/visio/2010/relationships/document']),
+    hyperlink: new Set(both('hyperlink')),
+    template: new Set(both('attachedtemplate')),
+    image: new Set([...both('image'), 'http://schemas.microsoft.com/office/2007/relationships/hdphoto']),
+    frame: new Set(both('frame')),
+    subDocument: new Set(both('subdocument')),
+    workbook: new Set([
+        ...both('externallinkpath'),
+        `${MS}xlexternallinkpath/xlpathmissing`,
+        `${MS}xlexternallinkpath/xlstartup`,
+        `${MS}xlexternallinkpath/xlalternatestartup`,
+        `${MS}xlexternallinkpath/xllibrary`,
+    ]),
+};
+/** Relationship types that say what the part they reach is. Each is a bit of Part.reachedAs. */
+const AS = { vba: 1, macrosheet: 2, ole: 4, package: 8, control: 16, controlBinary: 32 };
+const REACHED_AS = new Map([
+    [`${MS}vbaproject`, AS.vba],
+    [`${MS}xlmacrosheet`, AS.macrosheet],
+    [`${MS}xlintlmacrosheet`, AS.macrosheet],
+    ...both('oleobject').map((t) => [t, AS.ole]),
+    ...both('package').map((t) => [t, AS.package]),
+    ...both('control').map((t) => [t, AS.control]),
+    [`${MS}activexcontrolbinary`, AS.controlBinary],
+]);
+/** Content types, lowercased. */
+const TYPE = {
+    vba: new Set(['application/vnd.ms-office.vbaproject']),
+    macrosheet: new Set(['application/vnd.ms-excel.macrosheet+xml', 'application/vnd.ms-excel.intlmacrosheet+xml', 'application/vnd.ms-excel.macrosheet', 'application/vnd.ms-excel.intlmacrosheet']),
+    ole: new Set(['application/vnd.openxmlformats-officedocument.oleobject']),
+    control: new Set(['application/vnd.ms-office.activex+xml']),
+    controlBinary: new Set(['application/vnd.ms-office.activex']),
+    vml: 'application/vnd.openxmlformats-officedocument.vmldrawing',
+    xlsbExternalLink: 'application/vnd.ms-excel.externallink',
+};
+/** Relationship types that leave the package, by the finding they make. Any other is EXTERNAL/OTHER. */
+const EXTERNAL_KINDS = [
+    [REL.template, types_1.OfficeDetail.Template],
+    [new Set([...both('oleobject'), ...both('package')]), types_1.OfficeDetail.Object],
+    [REL.image, types_1.OfficeDetail.Image],
+    [REL.frame, types_1.OfficeDetail.Frame],
+    [REL.subDocument, types_1.OfficeDetail.Include],
+    [REL.workbook, types_1.OfficeDetail.Workbook],
+];
+const WORD_NS = new Set(['http://schemas.openxmlformats.org/wordprocessingml/2006/main', 'http://purl.oclc.org/ooxml/wordprocessingml/main']);
+const SHEET_NS = new Set(['http://schemas.openxmlformats.org/spreadsheetml/2006/main', 'http://purl.oclc.org/ooxml/spreadsheetml/main']);
+const XDR_NS = new Set(['http://schemas.openxmlformats.org/drawingml/2006/spreadsheetdrawing', 'http://purl.oclc.org/ooxml/drawingml/spreadsheetdrawing']);
+const R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/relationships', 'http://purl.oclc.org/ooxml/officedocument/relationships']);
+const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/customui', 'http://schemas.microsoft.com/office/2009/07/customui']);
+const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
+const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
+const VISIO_CODE = /\b(RUNADDON|RUNADDONWARGS|CALLTHIS|RUNMACRO|OPENFILE|DOOLEVERB)\s*\(/i;
+/** How much of a field code is kept, counted from its first word, which names the field. */
+const MAX_FIELD_CODE = 4096;
+/** A Word attribute, qualified as Word writes it or unqualified. */
+const wordAttr = (el, local) => el.attributes.find(a => a.local === local && (a.ns === '' || WORD_NS.has(a.ns.toLowerCase())))?.value;
+/** The key of the part a relationships part belongs to, '' for the package, or undefined for any other part. */
+const relsSource = (relsName) => {
+    const m = /^(.*?)_rels\/([^/]*)\.rels$/i.exec(relsName);
+    return m ? (0, zip_1.nameKey)(m[1] + m[2]) : undefined;
+};
+/**
+ * Resolves an internal target against the folder of the part it belongs to, as RFC 3986 resolves a relative
+ * reference: a ".." at the root of the package stays at the root. LibreOffice writes "../customXml/item1.xml" in the
+ * package relationships of workbooks it saves.
+ */
+function resolveTarget(relsName, target) {
+    const folder = relsName.slice(0, relsName.toLowerCase().indexOf('_rels/'));
+    const path = (target.startsWith('/') ? target.slice(1) : folder + target).split('#')[0];
+    const out = [];
+    for (const seg of path.split('/')) {
+        if (seg === '..')
+            out.pop();
+        else if (seg !== '.' && seg !== '')
+            out.push(seg);
+    }
+    return (0, zip_1.nameKey)(out.join('/'));
+}
+const duplicate = (ctx, location, kind, name) => ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, location, { kind, name: (0, context_1.clip)(name) });
+/**
+ * The defaults and overrides of [Content_Types].xml. Only those that type an entry of the archive are kept, so a
+ * part full of declarations costs no memory. Two that type the same entry make PACKAGE/DUPLICATE_ENTRY.
+ */
+async function readContentTypes(ctx, entry) {
+    const keys = new Set(ctx.zip.entries.map(e => (0, zip_1.nameKey)(e.name)));
+    const extensions = new Set(ctx.zip.entries.map(e => /\.([^./]*)$/.exec(e.name)?.[1]?.toLowerCase() ?? ''));
+    const defaults = new Map();
+    const overrides = new Map();
+    await ctx.parse(entry, {
+        start(el) {
+            if (el.ns.toLowerCase() !== CONTENT_TYPES_NS)
+                return;
+            const type = (0, xml_1.attr)(el, '', 'ContentType')?.trim().toLowerCase();
+            if (type === undefined)
+                return;
+            if (el.local === 'Default') {
+                const ext = (0, xml_1.attr)(el, '', 'Extension')?.toLowerCase();
+                if (ext === undefined || !extensions.has(ext))
+                    return;
+                if (defaults.has(ext))
+                    duplicate(ctx, entry.name, 'content type default', ext);
+                defaults.set(ext, type);
+            }
+            else if (el.local === 'Override') {
+                const name = (0, xml_1.attr)(el, '', 'PartName');
+                if (name === undefined)
+                    return;
+                const key = (0, zip_1.nameKey)(name.replace(/^\//, ''));
+                if (!keys.has(key))
+                    return;
+                if (overrides.has(key))
+                    duplicate(ctx, entry.name, 'content type override', name);
+                overrides.set(key, type);
+            }
+        },
+    });
+    return { defaults, overrides };
+}
+/** Reads a relationships part and hands each relationship to `each` as it is read. Ids given twice are reported. */
+async function readRelationships(ctx, entry, each) {
+    const ids = new Set();
+    await ctx.parse(entry, {
+        start(el) {
+            if (el.ns.toLowerCase() !== RELS_NS || el.local !== 'Relationship')
+                return;
+            const id = (0, xml_1.attr)(el, '', 'Id') ?? '';
+            if (ids.has(id))
+                duplicate(ctx, entry.name, 'relationship Id', id);
+            ids.add(id);
+            const target = (0, xml_1.attr)(el, '', 'Target');
+            if (target === undefined)
+                return;
+            const mode = ((0, xml_1.attr)(el, '', 'TargetMode') ?? 'Internal').trim().toLowerCase();
+            each({ id, type: ((0, xml_1.attr)(el, '', 'Type') ?? '').trim().toLowerCase(), target, external: mode !== 'internal' || (0, links_1.isAbsoluteTarget)(target) });
+        },
+    });
+}
+/** Word field codes, followed through nested fields, as one part's fields run. */
+class Fields {
+    ctx;
+    part;
+    stack = [];
+    capture = false;
+    constructor(ctx, part) {
+        this.ctx = ctx;
+        this.part = part;
+    }
+    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
+    nest() {
+        const top = this.stack[this.stack.length - 1];
+        if (top?.inCode && top.code === '')
+            top.computed = true;
+    }
+    start(el) {
+        if (el.local === 'fldSimple') {
+            this.nest();
+            this.evaluate(wordAttr(el, 'instr') ?? '', false);
+        }
+        else if (el.local === 'fldChar') {
+            const kind = wordAttr(el, 'fldCharType');
+            if (kind === 'begin') {
+                this.nest();
+                this.stack.push({ code: '', inCode: true, computed: false });
+            }
+            else if (kind === 'separate') {
+                const top = this.stack[this.stack.length - 1];
+                if (top)
+                    top.inCode = false;
+            }
+            else if (kind === 'end') {
+                const f = this.stack.pop();
+                if (f)
+                    this.evaluate(f.code, f.computed);
+            }
+        }
+        else if (el.local === 'instrText' || el.local === 'delInstrText')
+            this.capture = true;
+    }
+    end(el) {
+        if (el.local === 'instrText' || el.local === 'delInstrText')
+            this.capture = false;
+    }
+    /** White space before the first word counts for nothing, so no amount of it can push the field's name out. */
+    text(t) {
+        const top = this.stack[this.stack.length - 1];
+        if (this.capture && top?.inCode && top.code.length < MAX_FIELD_CODE)
+            top.code = top.code ? top.code + t : t.trimStart();
+    }
+    /** A part can end inside a field. Word still reads the code it has. */
+    finish() {
+        for (let f = this.stack.pop(); f; f = this.stack.pop())
+            this.evaluate(f.code, f.computed);
+    }
+    /**
+     * Reports a field by its code. A field whose name holds the content of an external entity has a type the file does
+     * not say, as one whose name another field builds does.
+     */
+    evaluate(code, computed) {
+        const data = { code: (0, context_1.clip)(code.trim()) };
+        const words = (0, formulas_1.fieldWords)(code);
+        const first = words[0]?.text ?? '';
+        const entity = (0, xml_1.unknownEntity)(first);
+        if (computed || entity !== undefined)
+            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, this.part, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) });
+        const name = first.toUpperCase();
+        // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
+        const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
+        const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
+        if (name === 'DDE' || name === 'DDEAUTO')
+            this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, this.part, data);
+        else if (name === 'MACROBUTTON')
+            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, this.part, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') });
+        else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
+            const target = arg(name === 'LINK' ? 2 : 1);
+            if (target === undefined)
+                this.ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, this.part, data);
+            else
+                this.ctx.external(types_1.OfficeDetail.Include, target, this.part, data, 'field');
+        }
+        else if (name === 'HYPERLINK') {
+            const target = arg(1);
+            if (target !== undefined && !(0, links_1.isFragment)(target))
+                this.ctx.link(target, this.part, { ...data, source: 'HYPERLINK field' });
+        }
+    }
+}
+/** Text that may run long. Detection needs only whether it holds more than white space; the report shows its start. */
+class Shown {
+    text = '';
+    content = false;
+    add(t) {
+        if (/\S/.test(t))
+            this.content = true;
+        if (this.text.length < 200)
+            this.text = this.text ? this.text + t : t.trimStart();
+    }
+}
+/** The rules that read inside one XML part of an OOXML package. */
+class PartRules {
+    ctx;
+    part;
+    fields;
+    /**
+     * The formula being read, with a check for DDE that sees all of it however long it is, and the first external
+     * entity whose content stands in it, which could hold the DDE reference or move the quotes around one.
+     */
+    formula;
+    macroText;
+    /** The last namespace seen and its lowercase form. Neighboring elements share one, and this spares a copy each. */
+    ns = '';
+    lower = '';
+    constructor(ctx, part) {
+        this.ctx = ctx;
+        this.part = part;
+        this.fields = new Fields(ctx, part);
+    }
+    lowerNs(el) {
+        if (el.ns !== this.ns) {
+            this.ns = el.ns;
+            this.lower = el.ns.toLowerCase();
+        }
+        return this.lower;
+    }
+    start(el) {
+        const ns = this.lowerNs(el);
+        if (CUSTOM_UI_NS.has(ns)) {
+            if (el.depth === 1)
+                this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Ribbon, this.part);
+            for (const a of el.attributes) {
+                if (a.ns === '' && a.value.trim() && /^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
+                    this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` });
+            }
+            return;
+        }
+        if (WORD_NS.has(ns))
+            this.fields.start(el);
+        else if (SHEET_NS.has(ns)) {
+            if (el.local === 'f' || el.local === 'definedName')
+                this.formula = { shown: new Shown(), quotes: new formulas_1.Quotes(), ddeBar: false };
+            else if (el.local === 'ddeLink')
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, this.part, { application: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeService') ?? ''), topic: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeTopic') ?? '') });
+        }
+        else if (XDR_NS.has(ns)) {
+            const macro = (0, xml_1.attr)(el, '', 'macro');
+            if (macro?.trim())
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) });
+        }
+        else if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro')
+            this.macroText = new Shown();
+        else if (ns === VISIO_NS && el.local === 'Cell')
+            this.visioCell(el);
+        if (el.local === 'hlinkClick' || el.local === 'hlinkHover' || el.local === 'hlinkMouseOver')
+            this.drawingAction(el);
+    }
+    text(t) {
+        this.fields.text(t);
+        const f = this.formula;
+        if (f) {
+            f.shown.add(t);
+            // Excel writes a DDE reference as application|topic!item, and "|" means nothing else outside quotes.
+            for (const c of t)
+                if (f.quotes.outside(c) && c === '|')
+                    f.ddeBar = true;
+            if (f.entity === undefined && t.includes(xml_1.UNKNOWN))
+                f.entity = (0, xml_1.unknownEntity)(t);
+        }
+        this.macroText?.add(t);
+    }
+    end(el) {
+        const ns = this.lowerNs(el);
+        if (WORD_NS.has(ns))
+            this.fields.end(el);
+        if (SHEET_NS.has(ns) && (el.local === 'f' || el.local === 'definedName') && this.formula) {
+            const { ddeBar, entity, shown } = this.formula;
+            if (ddeBar)
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text) });
+            else if (entity !== undefined)
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text), entity: (0, context_1.clip)(entity) });
+            this.formula = undefined;
+        }
+        if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
+            if (this.macroText.content)
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.text.trim()) });
+            this.macroText = undefined;
+        }
+        if (el.depth === 1)
+            this.fields.finish();
+    }
+    /** PowerPoint action settings, in a DrawingML hyperlink's action attribute. The relationship it names is reported on its own. */
+    drawingAction(el) {
+        const written = ((0, xml_1.attr)(el, '', 'action') ?? '').trim();
+        const action = written.toLowerCase();
+        if (!action)
+            return;
+        const id = el.attributes.find(a => a.local === 'id' && R_NS.has(a.ns.toLowerCase()))?.value;
+        const data = { trigger: el.local, action: (0, context_1.clip)(written), ...(id === undefined ? {} : { relationship: (0, context_1.clip)(id) }) };
+        if (action.startsWith('ppaction://program'))
+            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data);
+        else if (action.startsWith('ppaction://macro'))
+            this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data);
+        else if (action.startsWith('ppaction://ole'))
+            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data);
+    }
+    visioCell(el) {
+        const n = (0, xml_1.attr)(el, '', 'N') ?? '';
+        const formula = (0, xml_1.attr)(el, '', 'F') ?? '';
+        if (VISIO_CODE.test(formula)) {
+            if (n.startsWith('Event'))
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, this.part, { event: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+            else
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { cell: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+        }
+        const v = (0, xml_1.attr)(el, '', 'V');
+        if (n === 'Address' && v?.trim() && !(0, links_1.isFragment)(v))
+            this.ctx.link(v, this.part, { source: 'Visio hyperlink' });
+    }
+}
+/**
+ * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
+ * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
+ * leave behind only which parts they reach and how.
+ */
+async function inspectOoxml(ctx, contentTypes) {
+    const { defaults, overrides } = await readContentTypes(ctx, contentTypes);
+    const parts = new Map();
+    const relsOf = new Map();
+    for (const entry of ctx.zip.entries) {
+        if (entry === contentTypes)
+            continue;
+        // OPC has no folders. A directory entry is still inflated once, so its bytes are checked like any other.
+        if (entry.directory) {
+            await ctx.drain(entry);
+            continue;
+        }
+        const source = relsSource(entry.name);
+        if (source !== undefined) {
+            relsOf.set(source, entry);
+            continue;
+        }
+        const key = (0, zip_1.nameKey)(entry.name);
+        const ext = /\.([^./]*)$/.exec(entry.name)?.[1]?.toLowerCase();
+        parts.set(key, { entry, contentType: overrides.get(key) ?? (ext === undefined ? undefined : defaults.get(ext)), reachedAs: 0, claimed: false, targets: new Set(), ole: false });
+    }
+    const roots = new Set();
+    const mains = [];
+    const relate = (rels, from, r) => {
+        const location = `${rels.name}, ${(0, context_1.clip)(r.id)}`;
+        const part = r.external ? undefined : parts.get(resolveTarget(rels.name, r.target));
+        if (part) {
+            part.reachedAs |= REACHED_AS.get(r.type) ?? 0;
+            if (TYPE.control.has(from?.contentType ?? ''))
+                part.claimed = true;
+            (from?.targets ?? roots).add(part);
+        }
+        // A hyperlink to a part of the package, or to a place in the document, goes nowhere else.
+        if (REL.hyperlink.has(r.type)) {
+            if (!part && !(0, links_1.isFragment)(r.target))
+                ctx.link(r.target, location);
+        }
+        else if (r.external) {
+            const kind = EXTERNAL_KINDS.find(([types]) => types.has(r.type))?.[1] ?? types_1.OfficeDetail.Other;
+            ctx.external(kind, r.target, location, { type: (0, context_1.clip)(r.type) }, (0, context_1.clip)(r.type.slice(r.type.lastIndexOf('/') + 1)));
+        }
+    };
+    const packageRels = relsOf.get('');
+    if (packageRels) {
+        await readRelationships(ctx, packageRels, r => {
+            if (REL.main.has(r.type))
+                mains.push(r.external ? undefined : parts.get(resolveTarget(packageRels.name, r.target)));
+            relate(packageRels, undefined, r);
+        });
+    }
+    if (mains.length > 1)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The package names more than one main part', { reason: 'more than one main part' });
+    const main = mains[0];
+    if (!main)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The package has no main part', { reason: 'no main document part' });
+    const format = formats_1.OOXML_FORMATS.get(main.contentType ?? '');
+    if (!format)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The main part has an unknown content type', { contentType: (0, context_1.clip)(main.contentType ?? '') });
+    ctx.format = format;
+    for (const [key, p] of parts) {
+        const ct = p.contentType;
+        if (ct === undefined) {
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, p.entry.name, { part: p.entry.name });
+            p.ole = await ctx.drain(p.entry);
+        }
+        else if (ct.endsWith('+xml') || ct === 'application/xml' || ct === 'text/xml' || ct === TYPE.vml) {
+            await ctx.parse(p.entry, new PartRules(ctx, p.entry.name), ct === TYPE.vml);
+        }
+        else if (ct === TYPE.xlsbExternalLink) {
+            // The binary form of an Excel ddeLink.
+            const links = new xlsb_1.XlsbLinks();
+            p.ole = await ctx.drain(p.entry, c => links.write(c));
+            for (const l of links.dde)
+                ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, p.entry.name, { application: (0, context_1.clip)(l.application), topic: (0, context_1.clip)(l.topic) });
+        }
+        else
+            p.ole = await ctx.drain(p.entry);
+        const rels = relsOf.get(key);
+        if (rels)
+            await readRelationships(ctx, rels, r => relate(rels, p, r));
+    }
+    // Relationships of parts that are not there still say what the parts they reach are.
+    for (const [source, rels] of relsOf)
+        if (source !== '' && !parts.has(source))
+            await readRelationships(ctx, rels, r => relate(rels, undefined, r));
+    for (const p of parts.values())
+        partRules(ctx, p);
+    unreferenced(ctx, parts, relsOf, roots);
+}
+/** Findings about a whole part, from its content type and the relationships that reach it. */
+function partRules(ctx, p) {
+    const ct = p.contentType ?? '';
+    const loc = p.entry.name;
+    const data = { part: loc, contentType: (0, context_1.clip)(ct) };
+    const as = (bit) => (p.reachedAs & bit) !== 0;
+    const vba = TYPE.vba.has(ct) || as(AS.vba);
+    const ole = TYPE.ole.has(ct) || as(AS.ole);
+    const control = TYPE.control.has(ct) || as(AS.control);
+    const controlBinary = TYPE.controlBinary.has(ct) || as(AS.controlBinary);
+    const pkg = as(AS.package);
+    if (vba)
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data);
+    if (TYPE.macrosheet.has(ct) || as(AS.macrosheet))
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data);
+    if (ole)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data);
+    if (pkg)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data);
+    if (control || (controlBinary && !p.claimed))
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data);
+    if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data);
+}
+/** Parts that no chain of internal relationships reaches from the package. */
+function unreferenced(ctx, parts, relsOf, roots) {
+    const reached = new Set(roots);
+    const queue = [...roots];
+    for (let p = queue.pop(); p; p = queue.pop()) {
+        for (const t of p.targets) {
+            if (reached.has(t))
+                continue;
+            reached.add(t);
+            queue.push(t);
+        }
+    }
+    for (const p of parts.values())
+        if (!reached.has(p))
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, p.entry.name, { part: p.entry.name });
+    for (const [source, rels] of relsOf) {
+        const owner = parts.get(source);
+        if (source !== '' && !(owner && reached.has(owner)))
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, rels.name, { part: rels.name });
+    }
+}

package/dist/score.d.ts

@@ -0,0 +1,17 @@
+import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeOptions, OfficeRisk, type OfficeScoreBands } from './types';
+export declare const DEFAULT_BANDS: OfficeScoreBands;
+interface Combination {
+    name: string;
+    weight: number;
+    test(has: (c: C, d?: D) => boolean): boolean;
+}
+export declare const COMBINATIONS: Combination[];
+/** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
+export declare function weightOf(f: DefuseFinding, options: OfficeOptions): number;
+/** Highest weight in full, a quarter of each other kind's weight, plus combinations, capped at 100. */
+export declare function scoreFindings(findings: DefuseFinding[], options: OfficeOptions): {
+    score: number;
+    risk: OfficeRisk;
+};
+export declare function riskFor(score: number, bands: OfficeScoreBands): OfficeRisk;
+export {};

package/dist/score.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMBINATIONS = exports.DEFAULT_BANDS = void 0;
+exports.weightOf = weightOf;
+exports.scoreFindings = scoreFindings;
+exports.riskFor = riskFor;
+const findings_1 = require("./findings");
+const types_1 = require("./types");
+exports.DEFAULT_BANDS = { low: 1, medium: 25, high: 50, critical: 80 };
+/** Code that runs, in any of its forms. */
+const runsCode = (has) => has(types_1.OfficeCategory.Macro) || has(types_1.OfficeCategory.Dde);
+exports.COMBINATIONS = [
+    {
+        name: 'code with a template, object or include from outside',
+        weight: 20,
+        test: has => (runsCode(has) || has(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram)) && (has(types_1.OfficeCategory.External, types_1.OfficeDetail.Template) || has(types_1.OfficeCategory.External, types_1.OfficeDetail.Object) || has(types_1.OfficeCategory.External, types_1.OfficeDetail.Include)),
+    },
+    { name: 'code with an embedded object or control', weight: 15, test: has => runsCode(has) && (has(types_1.OfficeCategory.Embedded) || has(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX)) },
+    {
+        name: 'code with data hidden in the archive',
+        weight: 10,
+        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
+    },
+];
+/** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
+function weightOf(f, options) {
+    const w = options.scoreWeights ?? [];
+    const exact = w.find(x => x.category === f.category && x.detail === f.detail);
+    if (exact)
+        return exact.weight;
+    const cat = w.find(x => x.category === f.category && x.detail === undefined);
+    if (cat)
+        return cat.weight;
+    return (0, findings_1.findingSpec)(f.category, f.detail)?.weight ?? f.weight ?? 0;
+}
+/** Highest weight in full, a quarter of each other kind's weight, plus combinations, capped at 100. */
+function scoreFindings(findings, options) {
+    // Each kind of finding counts once, so twenty links of one kind do not add up to a critical file.
+    const byKind = new Map();
+    for (const f of findings) {
+        const k = `${f.category}/${f.detail}`;
+        byKind.set(k, Math.max(byKind.get(k) ?? 0, weightOf(f, options)));
+    }
+    const weights = [...byKind.values()].sort((a, b) => b - a);
+    let score = weights.length ? weights[0] + weights.slice(1).reduce((s, w) => s + w / 4, 0) : 0;
+    const has = (c, d) => findings.some(f => f.category === c && (d === undefined || f.detail === d) && weightOf(f, options) > 0);
+    for (const combo of exports.COMBINATIONS)
+        if (combo.test(has))
+            score += combo.weight;
+    score = Math.min(100, Math.round(score));
+    return { score, risk: riskFor(score, options.scoreBands ?? exports.DEFAULT_BANDS) };
+}
+function riskFor(score, bands) {
+    if (score >= bands.critical)
+        return types_1.OfficeRisk.Critical;
+    if (score >= bands.high)
+        return types_1.OfficeRisk.High;
+    if (score >= bands.medium)
+        return types_1.OfficeRisk.Medium;
+    if (score >= bands.low)
+        return types_1.OfficeRisk.Low;
+    return types_1.OfficeRisk.None;
+}