@patrickdk77/office-defuse 0.0.0-stage → 0.1.1

package/dist/rtf.js

@@ -0,0 +1,539 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectRtf = inspectRtf;
+const cfb_1 = require("./cfb");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const fields_1 = require("./fields");
+const io_1 = require("./io");
+const links_1 = require("./links");
+const objects_1 = require("./objects");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+/**
+ * The destinations of the RTF 1.9.1 specification, which rtfobj lists too. Word sends the text of each to its own
+ * place, so none of it is object data or a field code. \rtf is not one, though it opens the document.
+ */
+const DESTINATIONS = new Set(('aftncn aftnsep aftnsepc annotation atnauthor atndate atnid atnparent atnref atrfend atrfstart author background bkmkend bkmkstart ' +
+    'blipuid buptim category colorschememapping colortbl comment company creatim datafield datastore defchp defpap do doccomm docvar ' +
+    'dptxbxtext ebcend ebcstart factoidname falt fchars ffdeftext ffentrymcr ffexitmcr ffformat ffhelptext ffl ffname ffstattext field ' +
+    'file filetbl fldinst fldrslt fldtype fontemb fonttbl footer footerf footerl footerr footnote formfield ftncn ftnsep ftnsepc g ' +
+    'generator gridtbl header headerf headerl headerr hl hlfr hlinkbase hlloc hlsrc hsv info keywords latentstyles lchars levelnumbers ' +
+    'leveltext lfolevel linkval list listlevel listname listoverride listoverridetable listpicture liststylename listtable listtext ' +
+    'lsdlockedexcept macc maccPr mailmerge malnScr manager margPr mbar mbarPr mbaseJc mbegChr mborderBox mborderBoxPr mbox mboxPr mchr ' +
+    'mcount mctrlPr md mdeg mdegHide mden mdiff mdPr me mendChr meqArr meqArrPr mf mfName mfPr mfunc mfuncPr mgroupChr mgroupChrPr mgrow ' +
+    'mhideBot mhideLeft mhideRight mhideTop mlim mlimLoc mlimLow mlimLowPr mlimUpp mlimUppPr mm mmaddfieldname mmathPict mmaxDist mmc ' +
+    'mmcJc mmconnectstr mmconnectstrdata mmcPr mmcs mmdatasource mmheadersource mmmailsubject mmodso mmodsofilter mmodsofldmpdata ' +
+    'mmodsomappedname mmodsoname mmodsorecipdata mmodsosort mmodsosrc mmodsotable mmodsoudl mmodsoudldata mmodsouniquetag mmPr mmquery ' +
+    'mmr mnary mnaryPr mnoBreak mnum mobjDist moMath moMathPara moMathParaPr mopEmu mphant mphantPr mplcHide mpos mr mrad mradPr mrPr ' +
+    'msepChr mshow mshp msPre msPrePr msSub msSubPr msSubSup msSubSupPr msSup msSupPr mstrikeBLTR mstrikeH mstrikeTLBR mstrikeV msub ' +
+    'msubHide msup msupHide mtransp mtype mvertJc mvfmf mvfml mvtof mvtol mzeroAsc mzeroDesc mzeroWid nesttableprops nonesttables ' +
+    'objalias objclass objdata object objname objsect oldcprops oldpprops oldsprops oldtprops oleclsid operator panose password ' +
+    'passwordhash pgp pgptbl picprop pict pn pnseclvl pntext pntxta pntxtb printim propname protend protstart protusertbl result revtbl ' +
+    'revtim rxe shp shpgrp shpinst shppict shprslt shptxt sn sp staticval stylesheet subject sv svb tc template themedata title txe ud ' +
+    'upr userprops wgrffmtfilter windowcaption writereservation writereservhash xe xform xmlattrname xmlattrvalue xmlclose xmlname ' +
+    'xmlnstbl xmlopen margSz pnaiu pnaiud').split(' '));
+/** Destinations whose content holds no field, object or link, so their groups are skipped whole: tables, styles, pictures, metadata. */
+const INERT = new Set(('fonttbl colortbl stylesheet info pict themedata colorschememapping datastore latentstyles listtable listoverridetable revtbl ' +
+    'generator xmlnstbl filetbl pgptbl protusertbl blipuid datafield fontemb panose falt password passwordhash wgrffmtfilter').split(' '));
+/** Object kinds, from the control word that sets them. */
+const OBJECT_KINDS = new Set(['objemb', 'objlink', 'objautlink', 'objsub', 'objpub', 'objicemb', 'objhtml', 'objocx']);
+/** Word reads at most this many letters of a control word's name and digits of its parameter. */
+const MAX_WORD = 250;
+const CHUNK = 262144;
+/** Collected text other than an object's data is short: a class name, a template path, a link. */
+const MAX_TEXT = 4096;
+/** An object's data as Word decodes its hex digits, with the quirks rtfobj documents. */
+class HexData {
+    limit;
+    bytes;
+    length = 0;
+    /** A hex digit read and not yet paired, or -1. */
+    nibble = -1;
+    offset;
+    constructor(offset, limit) {
+        this.limit = limit;
+        this.offset = offset;
+        this.bytes = new Uint8Array(1024);
+    }
+    digit(v) {
+        if (this.nibble < 0) {
+            this.nibble = v;
+            return;
+        }
+        this.push((this.nibble << 4) | v);
+        this.nibble = -1;
+    }
+    /** Word drops a hex digit left unpaired before a \'hh, and so does rtfobj. */
+    quote() {
+        this.nibble = -1;
+    }
+    /** \bin data in hex goes in as its bytes, two digits each, so an unpaired digit stays unpaired. */
+    binary(b) {
+        for (const x of b) {
+            this.digit(x >> 4);
+            this.digit(x & 15);
+        }
+    }
+    push(b) {
+        if (this.length >= this.limit)
+            throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, `The data of the object at offset ${this.offset} decodes past ${this.limit} bytes`, { limit: this.limit });
+        if (this.length === this.bytes.length) {
+            const grown = new Uint8Array(Math.min(this.limit, this.bytes.length * 2));
+            grown.set(this.bytes);
+            this.bytes = grown;
+        }
+        this.bytes[this.length++] = b;
+    }
+    /** The decoded bytes. A last digit left unpaired is dropped, as Word drops it. */
+    result() {
+        return this.bytes.subarray(0, this.length);
+    }
+}
+const hexValue = (c) => (c >= 0x30 && c <= 0x39 ? c - 0x30 : c >= 0x41 && c <= 0x46 ? c - 0x37 : c >= 0x61 && c <= 0x66 ? c - 0x57 : -1);
+const isLetter = (c) => (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a);
+const isDigit = (c) => c >= 0x30 && c <= 0x39;
+/**
+ * Inspects an RTF file the way Word reads one. Objects with their data, fields, the attached template and shape
+ * hyperlinks are reported. Unknown destinations marked with \* are skipped, unknown control words are ignored, and
+ * text after the document's last brace is still read, as rtfobj reads it, and reported as trailing data.
+ */
+async function inspectRtf(ctx, source, size) {
+    ctx.format = { format: 'rtf', mimeType: 'application/rtf' };
+    const reader = new RtfReader(ctx, size);
+    for (let pos = 0; pos < size; pos += CHUNK) {
+        (0, errors_1.checkTime)(ctx.settings.deadline);
+        const chunk = await source.read(pos, Math.min(CHUNK, size - pos));
+        await reader.write(chunk, pos + chunk.length >= size);
+    }
+    await reader.end();
+}
+class RtfReader {
+    ctx;
+    size;
+    frames;
+    fields;
+    depth = 0;
+    /** A partial token carried from one chunk to the next. */
+    carry = new Uint8Array(0);
+    /** The file offset of the first byte of the buffer being read. */
+    base = 0;
+    /** \bin bytes still to take, and where they go. */
+    binLeft = 0;
+    /** Fallback characters still to skip after a \u. */
+    skipChars = 0;
+    /** Set by \*, which makes an unknown destination that follows skipped. */
+    starred = false;
+    /** Where the document's outermost group closed, and how much that is not white space comes after it. */
+    closedAt = -1;
+    trailing = 0;
+    decoded = 0;
+    /** Objects whose groups closed, read in order once the chunk is done. */
+    pending = [];
+    constructor(ctx, size) {
+        this.ctx = ctx;
+        this.size = size;
+        this.frames = [{ kind: 'document', depth: 0, uc: 1 }];
+        this.fields = new fields_1.FieldStack(ctx, 'document');
+    }
+    get top() {
+        return this.frames[this.frames.length - 1];
+    }
+    async write(chunk, last) {
+        const b = this.carry.length ? Buffer.concat([this.carry, chunk]) : chunk;
+        let i = 0;
+        while (i < b.length) {
+            if (this.binLeft > 0) {
+                const n = Math.min(this.binLeft, b.length - i);
+                const top = this.top;
+                if (top.kind === 'objdata') {
+                    top.hex.binary(b.subarray(i, i + n));
+                    top.alt.binary(b.subarray(i, i + n));
+                }
+                else if (top.kind === 'objskip')
+                    top.data.hex.binary(b.subarray(i, i + n));
+                this.note(b, i, i + n);
+                this.binLeft -= n;
+                i += n;
+                continue;
+            }
+            const c = b[i];
+            if (c === 0x7b) {
+                this.note(b, i, i + 1);
+                this.open();
+                i++;
+            }
+            else if (c === 0x7d) {
+                this.note(b, i, i + 1);
+                this.close(this.base + i);
+                i++;
+            }
+            else if (c === 0x5c) {
+                const used = this.control(b, i, last);
+                if (used === 0)
+                    break;
+                this.note(b, i, i + used);
+                i += used;
+            }
+            else {
+                let j = i;
+                while (j < b.length && b[j] !== 0x7b && b[j] !== 0x7d && b[j] !== 0x5c)
+                    j++;
+                this.note(b, i, j);
+                this.text(b, i, j);
+                i = j;
+            }
+        }
+        this.carry = i < b.length ? b.slice(i) : new Uint8Array(0);
+        this.base += i;
+        await this.objects();
+    }
+    async objects() {
+        for (const o of this.pending.splice(0))
+            await objectRules(this.ctx, o);
+    }
+    async end() {
+        // A file can end inside groups. Word reads what it has, and so does this.
+        while (this.depth > 0)
+            this.close(this.size);
+        this.fields.finish();
+        await this.objects();
+        if (this.trailing > 0)
+            this.ctx.report(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, undefined, { bytes: this.trailing });
+    }
+    /** Counts bytes past the document's outermost group that are not white space or NUL. */
+    note(b, from, to) {
+        if (this.closedAt < 0)
+            return;
+        for (let k = from; k < to; k++)
+            if (b[k] > 0x20)
+                this.trailing++;
+    }
+    open() {
+        this.depth++;
+        this.skipChars = 0;
+        const limit = this.ctx.settings.rtfDepth;
+        if (this.depth > limit)
+            throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, `Groups nest deeper than ${limit}`, { limit });
+    }
+    close(offset) {
+        this.skipChars = 0;
+        this.starred = false;
+        while (this.frames.length > 1 && this.top.depth >= this.depth)
+            this.finishFrame(this.frames.pop());
+        if (this.depth === 0)
+            return;
+        this.depth--;
+        if (this.depth === 0 && this.closedAt < 0)
+            this.closedAt = offset;
+    }
+    /**
+     * Opens a destination for the rest of the group. One opened in the same group as the last ends that one, as in
+     * rtfobj, unless the last is a field or an object, whose group the destination belongs to.
+     */
+    push(body) {
+        const top = this.top;
+        if (this.frames.length > 1 && top.depth === this.depth && top.kind !== 'field' && top.kind !== 'object')
+            this.finishFrame(this.frames.pop());
+        const limit = this.ctx.settings.rtfDepth;
+        if (this.frames.length > limit)
+            throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, `More than ${limit} destinations are open at once`, { limit });
+        this.frames.push({ ...body, depth: this.depth, uc: this.top.uc });
+    }
+    /** Reads a control word or symbol at `i`. Returns the bytes it takes, or 0 when the buffer ends inside it. */
+    control(b, i, last) {
+        if (i + 1 >= b.length)
+            return last ? 1 : 0;
+        const c = b[i + 1];
+        if (!isLetter(c)) {
+            if (c === 0x27) {
+                if (i + 3 >= b.length && !last)
+                    return 0;
+                this.quoted(b, i + 2);
+                return Math.min(4, b.length - i);
+            }
+            if (c === 0x2a)
+                this.starred = true;
+            else if (c === 0x5c || c === 0x7b || c === 0x7d)
+                this.char(String.fromCharCode(c));
+            else if (c === 0x0a || c === 0x0d)
+                this.char('\n');
+            else if (c === 0x7e)
+                this.char(' ');
+            return 2;
+        }
+        let j = i + 1;
+        while (j < b.length && isLetter(b[j]) && j - i - 1 < MAX_WORD)
+            j++;
+        let k = j;
+        if (k < b.length && b[k] === 0x2d && k + 1 < b.length && isDigit(b[k + 1]))
+            k++;
+        while (k < b.length && isDigit(b[k]) && k - j < MAX_WORD)
+            k++;
+        if (k >= b.length && !last)
+            return 0;
+        const name = (0, oleobj_1.latin1)(b.subarray(i + 1, j));
+        const digits = (0, oleobj_1.latin1)(b.subarray(j, k));
+        const param = digits === '' ? undefined : Number(digits);
+        // A space ends the control word and belongs to it.
+        const used = k - i + (k < b.length && b[k] === 0x20 ? 1 : 0);
+        this.word(name, param, this.base + i);
+        return used;
+    }
+    word(name, param, offset) {
+        const starred = this.starred;
+        this.starred = false;
+        // \bin data is taken whole wherever it is, since its bytes may hold braces.
+        if (name === 'bin') {
+            // Word reads a negative or missing length as none.
+            this.binLeft = param !== undefined && param > 0 ? Math.min(param, Number.MAX_SAFE_INTEGER) : 0;
+            return;
+        }
+        const top = this.top;
+        if (top.kind === 'skip')
+            return;
+        if (name === 'u' && param !== undefined) {
+            this.skipChars = 0;
+            this.char(String.fromCharCode(param < 0 ? param + 65536 : param & 0xffff));
+            this.skipChars = top.uc;
+            return;
+        }
+        this.skipChars = 0;
+        if (name === 'uc') {
+            top.uc = param ?? 1;
+            return;
+        }
+        const object = this.object();
+        if (INERT.has(name))
+            this.push({ kind: 'skip' });
+        else if (name === 'field') {
+            this.fields.begin();
+            this.push({ kind: 'field' });
+        }
+        else if (name === 'fldinst')
+            this.push({ kind: 'fldinst' });
+        else if (name === 'fldrslt') {
+            this.fields.separate();
+            this.push({ kind: 'fldrslt' });
+        }
+        else if (name === 'object')
+            this.push({ kind: 'object', object: { offset, kinds: new Set(), update: false, className: '' } });
+        else if (name === 'objupdate') {
+            if (object)
+                object.update = true;
+        }
+        else if (OBJECT_KINDS.has(name))
+            object?.kinds.add(name);
+        else if (name === 'objdata') {
+            const limit = this.ctx.settings.decompressedBytes;
+            this.push({
+                kind: 'objdata',
+                object: object ?? { offset, kinds: new Set(), update: false, className: '' },
+                hex: new HexData(offset, limit),
+                alt: new HexData(offset, limit),
+                standalone: !object,
+            });
+        }
+        else if (name === 'objclass')
+            this.push({ kind: 'objclass', text: '', object });
+        else if (name === 'template' || (name === 'hlsrc' && this.frames.some(f => f.kind === 'hl')))
+            this.push({ kind: name, text: '' });
+        else if (name === 'hl')
+            this.push({ kind: 'hl' });
+        // Any other destination takes its own text. What it holds is still read for fields and objects.
+        else if (DESTINATIONS.has(name))
+            this.push({ kind: 'document' });
+        // Word skips a group that \* marks when it does not know its control word. Inside object data rtfobj keeps it, and
+        // a sample Word opens hides its hex digits in groups such as {\*\par574 0}. Both readings of the data are kept.
+        else if (starred && (top.kind === 'objdata' || top.kind === 'objskip'))
+            this.push({ kind: 'objskip', data: top.kind === 'objdata' ? top : top.data });
+        else if (starred)
+            this.push({ kind: 'skip' });
+    }
+    /** The object of the innermost object group the reader is in. */
+    object() {
+        for (let k = this.frames.length - 1; k > 0; k--) {
+            const f = this.frames[k];
+            if (f.kind === 'object')
+                return f.object;
+        }
+        return undefined;
+    }
+    quoted(b, at) {
+        const top = this.top;
+        if (top.kind === 'skip')
+            return;
+        this.starred = false;
+        if (top.kind === 'objdata') {
+            top.hex.quote();
+            top.alt.quote();
+            return;
+        }
+        if (top.kind === 'objskip') {
+            top.data.hex.quote();
+            return;
+        }
+        // A file can end before the two characters of a \'hh.
+        const hi = hexValue(b[at] ?? -1);
+        const lo = hexValue(b[at + 1] ?? -1);
+        if (hi >= 0 && lo >= 0)
+            this.char(String.fromCharCode((hi << 4) | lo));
+    }
+    text(b, from, to) {
+        const top = this.top;
+        if (top.kind === 'skip')
+            return;
+        this.starred = false;
+        if (top.kind === 'objdata' || top.kind === 'objskip') {
+            const both = top.kind === 'objdata';
+            const hex = both ? top.hex : top.data.hex;
+            for (let k = from; k < to; k++) {
+                const v = hexValue(b[k]);
+                if (v < 0)
+                    continue;
+                hex.digit(v);
+                if (both)
+                    top.alt.digit(v);
+            }
+            return;
+        }
+        // Line ends in RTF text are not text.
+        let s = '';
+        for (let k = from; k < to; k++) {
+            const c = b[k];
+            if (c === 0x0a || c === 0x0d)
+                continue;
+            if (this.skipChars > 0) {
+                this.skipChars--;
+                continue;
+            }
+            s += String.fromCharCode(c);
+        }
+        if (s)
+            this.char(s, true);
+    }
+    /** Text decoded from the file, for the destination being read. */
+    char(s, counted = false) {
+        if (!counted && this.skipChars > 0) {
+            this.skipChars--;
+            return;
+        }
+        const top = this.top;
+        if (top.kind === 'fldinst')
+            this.fields.text(s);
+        else if ((top.kind === 'objclass' || top.kind === 'template' || top.kind === 'hlsrc') && top.text.length < MAX_TEXT)
+            top.text += s;
+    }
+    finishFrame(f) {
+        if (f.kind === 'field')
+            this.fields.end();
+        else if (f.kind === 'objclass') {
+            if (f.object)
+                f.object.className = f.text.trim();
+        }
+        else if (f.kind === 'template') {
+            const path = f.text.trim();
+            if (path)
+                this.ctx.external(types_1.OfficeDetail.Template, path, 'template', { source: 'RTF template' }, 'template');
+        }
+        else if (f.kind === 'hlsrc') {
+            const target = f.text.trim();
+            if (target && !(0, links_1.isFragment)(target))
+                this.ctx.link(target, 'hyperlink', { source: 'RTF shape hyperlink' });
+        }
+        else if (f.kind === 'objdata') {
+            f.object.data = f.hex.result();
+            const alt = f.alt.result();
+            if (!Buffer.from(alt).equals(Buffer.from(f.object.data)))
+                f.object.alt = alt;
+            this.decoded += f.object.data.length + (f.object.alt ? alt.length : 0);
+            const total = this.ctx.settings.totalDecompressedBytes;
+            if (this.decoded > total)
+                throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, `The objects decode past ${total} bytes`, { limit: total });
+            // An objdata outside any object is an object of its own, as rtfobj reads it.
+            if (f.standalone)
+                this.pending.push(f.object);
+        }
+        else if (f.kind === 'object')
+            this.pending.push(f.object);
+    }
+}
+/** One embedded or linked object: what its OLE 1.0 header names, and what its data holds. */
+async function objectRules(ctx, o) {
+    const location = `object at offset ${o.offset}`;
+    const kinds = [...o.kinds];
+    const base = { object: location, ...(kinds.length ? { kind: kinds.join(' ') } : {}) };
+    if (o.update)
+        ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, location, base);
+    if (o.kinds.has('objocx')) {
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...base, ...(o.className ? { className: (0, context_1.clip)(o.className) } : {}) });
+        return;
+    }
+    await objectData(ctx, o, o.data, location, base);
+    // The data read without the groups \* marks, where that reads differently, is the object a reader that skips them sees.
+    if (o.alt)
+        await objectData(ctx, o, o.alt, location, { ...base, reading: 'without the groups \\* marks' });
+}
+/** An object's data: its OLE 1.0 header, and the Packager data or storage it holds. */
+async function objectData(ctx, o, bytes, location, base) {
+    const ole1 = bytes?.length ? (0, oleobj_1.parseOle1)(bytes) : undefined;
+    const className = (ole1?.className || o.className).replace(/\0+$/, '');
+    const data = { ...base, ...(className ? { className: (0, context_1.clip)(className) } : {}) };
+    const link = { object: location, ...(className ? { className: (0, context_1.clip)(className) } : {}) };
+    let equation = (0, objects_1.isEquationClass)(className);
+    if (ole1?.formatId === 1 || (!bytes?.length && (o.kinds.has('objlink') || o.kinds.has('objautlink')))) {
+        const target = ole1?.topicName ?? '';
+        if (target)
+            ctx.external(types_1.OfficeDetail.Object, target, location, link, 'linked object');
+        else
+            ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
+        return;
+    }
+    if (!bytes?.length)
+        return;
+    if (!ole1)
+        data.reason = 'its data is not an OLE 1.0 object';
+    const native = ole1?.data;
+    if (native && className.toLowerCase() === 'package') {
+        const pkg = (0, oleobj_1.parsePackage)(native);
+        if (pkg)
+            Object.assign(data, (0, objects_1.packageData)(pkg));
+    }
+    else if (native && native.length >= 8 && cfb_1.CFB_SIGNATURE.every((v, i) => native[i] === v)) {
+        let cfb;
+        try {
+            cfb = await cfb_1.CompoundFile.open((0, io_1.bufferSource)(native), ctx.settings, ctx.settings.deadline);
+        }
+        catch (e) {
+            if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+                throw e;
+            data.reason = `its storage does not read: ${e.message}`;
+        }
+        if (cfb) {
+            (0, objects_1.nestedNotes)(ctx, cfb, location);
+            const d = await (0, objects_1.describeObject)(cfb, cfb.root, location);
+            if (d.clsid)
+                data.clsid = d.clsid;
+            if (d.progId)
+                data.progId = (0, context_1.clip)(d.progId);
+            if (d.pkg)
+                Object.assign(data, (0, objects_1.packageData)(d.pkg));
+            equation ||= d.equation;
+            await (0, objects_1.compoundRules)(ctx, cfb, location, false);
+            if (d.linked) {
+                (0, objects_1.linkedObject)(ctx, d, location, link);
+                if (equation)
+                    ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
+                return;
+            }
+        }
+    }
+    // OLE2Link is the class of a linked object, CVE-2017-0199's. Its storage names the target, and when the storage does
+    // not read, the class still says the object loads from outside.
+    if (className.toLowerCase() === 'ole2link')
+        ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
+    else
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data);
+    if (equation)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
+}

package/dist/score.d.ts

@@ -0,0 +1,17 @@
+import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeOptions, OfficeRisk, type OfficeScoreBands } from './types';
+export declare const DEFAULT_BANDS: OfficeScoreBands;
+interface Combination {
+    name: string;
+    weight: number;
+    test(has: (c: C, d?: D) => boolean): boolean;
+}
+export declare const COMBINATIONS: Combination[];
+/** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
+export declare function weightOf(f: DefuseFinding, options: OfficeOptions): number;
+/** Highest weight in full, a quarter of each other kind's weight, plus combinations, capped at 100. */
+export declare function scoreFindings(findings: DefuseFinding[], options: OfficeOptions): {
+    score: number;
+    risk: OfficeRisk;
+};
+export declare function riskFor(score: number, bands: OfficeScoreBands): OfficeRisk;
+export {};

package/dist/score.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMBINATIONS = exports.DEFAULT_BANDS = void 0;
+exports.weightOf = weightOf;
+exports.scoreFindings = scoreFindings;
+exports.riskFor = riskFor;
+const findings_1 = require("./findings");
+const types_1 = require("./types");
+exports.DEFAULT_BANDS = { low: 1, medium: 25, high: 50, critical: 80 };
+/** Code that runs, in any of its forms. */
+const runsCode = (has) => has(types_1.OfficeCategory.Macro) || has(types_1.OfficeCategory.Dde);
+exports.COMBINATIONS = [
+    {
+        name: 'code with a template, object or include from outside',
+        weight: 20,
+        test: has => (runsCode(has) || has(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram)) && (has(types_1.OfficeCategory.External, types_1.OfficeDetail.Template) || has(types_1.OfficeCategory.External, types_1.OfficeDetail.Object) || has(types_1.OfficeCategory.External, types_1.OfficeDetail.Include)),
+    },
+    { name: 'code with an embedded object or control', weight: 15, test: has => runsCode(has) && (has(types_1.OfficeCategory.Embedded) || has(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX)) },
+    {
+        name: 'code with data hidden in the archive',
+        weight: 10,
+        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
+    },
+];
+/** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
+function weightOf(f, options) {
+    const w = options.scoreWeights ?? [];
+    const exact = w.find(x => x.category === f.category && x.detail === f.detail);
+    if (exact)
+        return exact.weight;
+    const cat = w.find(x => x.category === f.category && x.detail === undefined);
+    if (cat)
+        return cat.weight;
+    return (0, findings_1.findingSpec)(f.category, f.detail)?.weight ?? f.weight ?? 0;
+}
+/** Highest weight in full, a quarter of each other kind's weight, plus combinations, capped at 100. */
+function scoreFindings(findings, options) {
+    // Each kind of finding counts once, so twenty links of one kind do not add up to a critical file.
+    const byKind = new Map();
+    for (const f of findings) {
+        const k = `${f.category}/${f.detail}`;
+        byKind.set(k, Math.max(byKind.get(k) ?? 0, weightOf(f, options)));
+    }
+    const weights = [...byKind.values()].sort((a, b) => b - a);
+    let score = weights.length ? weights[0] + weights.slice(1).reduce((s, w) => s + w / 4, 0) : 0;
+    const has = (c, d) => findings.some(f => f.category === c && (d === undefined || f.detail === d) && weightOf(f, options) > 0);
+    for (const combo of exports.COMBINATIONS)
+        if (combo.test(has))
+            score += combo.weight;
+    score = Math.min(100, Math.round(score));
+    return { score, risk: riskFor(score, options.scoreBands ?? exports.DEFAULT_BANDS) };
+}
+function riskFor(score, bands) {
+    if (score >= bands.critical)
+        return types_1.OfficeRisk.Critical;
+    if (score >= bands.high)
+        return types_1.OfficeRisk.High;
+    if (score >= bands.medium)
+        return types_1.OfficeRisk.Medium;
+    if (score >= bands.low)
+        return types_1.OfficeRisk.Low;
+    return types_1.OfficeRisk.None;
+}