@patrickdk77/office-defuse 0.0.0-stage → 0.1.1

package/dist/types.d.ts

@@ -0,0 +1,274 @@
+/** High-level kind of a finding. */
+export declare enum OfficeCategory {
+    Container = "CONTAINER",
+    Xml = "XML",
+    Limit = "LIMIT",
+    Package = "PACKAGE",
+    Encrypted = "ENCRYPTED",
+    Macro = "MACRO",
+    Ui = "UI",
+    Action = "ACTION",
+    Dde = "DDE",
+    Field = "FIELD",
+    External = "EXTERNAL",
+    Link = "LINK",
+    Embedded = "EMBEDDED",
+    Control = "CONTROL"
+}
+/** Exact variant of a finding. Some details appear under more than one category. */
+export declare enum OfficeDetail {
+    NotZip = "NOT_ZIP",
+    AmbiguousEnd = "AMBIGUOUS_END",
+    MultiDisk = "MULTI_DISK",
+    DirectoryMismatch = "DIRECTORY_MISMATCH",
+    OutOfRange = "OUT_OF_RANGE",
+    Overlap = "OVERLAP",
+    HeaderMismatch = "HEADER_MISMATCH",
+    DuplicateName = "DUPLICATE_NAME",
+    UnsafeName = "UNSAFE_NAME",
+    NameEncoding = "NAME_ENCODING",
+    EncryptedEntry = "ENCRYPTED_ENTRY",
+    UnsupportedMethod = "UNSUPPORTED_METHOD",
+    Zip64Mismatch = "ZIP64_MISMATCH",
+    BadExtraField = "BAD_EXTRA_FIELD",
+    DataError = "DATA_ERROR",
+    LeadingBytes = "LEADING_BYTES",
+    HiddenData = "HIDDEN_DATA",
+    TrailingBytes = "TRAILING_BYTES",
+    BadHeader = "BAD_HEADER",
+    BrokenChain = "BROKEN_CHAIN",
+    ChainLoop = "CHAIN_LOOP",
+    DirectoryLoop = "DIRECTORY_LOOP",
+    BadEntry = "BAD_ENTRY",
+    Doctype = "DOCTYPE",
+    InternalSubset = "INTERNAL_SUBSET",
+    ExternalEntity = "EXTERNAL_ENTITY",
+    Malformed = "MALFORMED",
+    Encoding = "ENCODING",
+    FileSize = "FILE_SIZE",
+    EntryCount = "ENTRY_COUNT",
+    DecompressedSize = "DECOMPRESSED_SIZE",
+    TotalDecompressedSize = "TOTAL_DECOMPRESSED_SIZE",
+    XmlDepth = "XML_DEPTH",
+    XmlTokenSize = "XML_TOKEN_SIZE",
+    XmlEntityDepth = "XML_ENTITY_DEPTH",
+    XmlEntityExpansions = "XML_ENTITY_EXPANSIONS",
+    XmlEntitySize = "XML_ENTITY_SIZE",
+    RtfDepth = "RTF_DEPTH",
+    Time = "TIME",
+    Unrecognized = "UNRECOGNIZED",
+    AmbiguousFormat = "AMBIGUOUS_FORMAT",
+    Unreadable = "UNREADABLE",
+    DuplicateEntry = "DUPLICATE_ENTRY",
+    UntypedPart = "UNTYPED_PART",
+    UnreferencedPart = "UNREFERENCED_PART",
+    OdfLayout = "ODF_LAYOUT",
+    PasswordRequired = "PASSWORD_REQUIRED",
+    DefaultPassword = "DEFAULT_PASSWORD",
+    UserPassword = "USER_PASSWORD",
+    Rc4_40 = "RC4_40",
+    Rc4_128 = "RC4_128",
+    Rc4Other = "RC4_OTHER",
+    Aes128 = "AES_128",
+    Aes192 = "AES_192",
+    Aes256 = "AES_256",
+    UnsupportedAlgorithm = "UNSUPPORTED_ALGORITHM",
+    VbaProject = "VBA_PROJECT",
+    XlmMacrosheet = "XLM_MACROSHEET",
+    WordBasic = "WORDBASIC",
+    OdfBasic = "ODF_BASIC",
+    OdfScripts = "ODF_SCRIPTS",
+    OdfDialogs = "ODF_DIALOGS",
+    EventOnOpen = "EVENT_ON_OPEN",
+    Event = "EVENT",
+    Link = "LINK",
+    Ribbon = "RIBBON",
+    Callback = "CALLBACK",
+    OdfConfiguration = "ODF_CONFIGURATION",
+    RunProgram = "RUN_PROGRAM",
+    OleVerb = "OLE_VERB",
+    ObjectUpdate = "OBJECT_UPDATE",
+    Field = "FIELD",
+    Formula = "FORMULA",
+    Macrobutton = "MACROBUTTON",
+    Computed = "COMPUTED",
+    Template = "TEMPLATE",
+    Object = "OBJECT",
+    Image = "IMAGE",
+    Frame = "FRAME",
+    Include = "INCLUDE",
+    Workbook = "WORKBOOK",
+    Reload = "RELOAD",
+    Other = "OTHER",
+    LocalFile = "LOCAL_FILE",
+    Safe = "SAFE",
+    FileUrl = "FILE_URL",
+    NetworkPath = "NETWORK_PATH",
+    DataUrl = "DATA_URL",
+    ScriptUrl = "SCRIPT_URL",
+    OtherScheme = "OTHER_SCHEME",
+    Credentials = "CREDENTIALS",
+    IpHost = "IP_HOST",
+    LookalikeHost = "LOOKALIKE_HOST",
+    EncodedHost = "ENCODED_HOST",
+    Relative = "RELATIVE",
+    OleObject = "OLE_OBJECT",
+    Package = "PACKAGE",
+    OleFile = "OLE_FILE",
+    Applet = "APPLET",
+    Plugin = "PLUGIN",
+    Equation = "EQUATION",
+    Attachment = "ATTACHMENT",
+    ActiveX = "ACTIVEX"
+}
+export type OfficeFindingAction = 'reject' | 'strip' | 'info';
+/**
+ * A finding as any package of the defuse family reports it. Category and detail are plain strings, since the string
+ * enums of two packages never match each other.
+ */
+export interface DefuseFinding {
+    category: string;
+    detail: string;
+    /** Plain sentence, safe to show the uploader. */
+    description: string;
+    /** Default action after any caller override. */
+    action: 'reject' | 'strip' | 'info';
+    /** Where in the file, such as a part name or a relationship. */
+    location?: string;
+    /** Extra values: the target, the field code, the content type, counts. */
+    data?: Record<string, string | number>;
+    /**
+     * Set when the finding comes from inside a contained file: the file's name, with " > " between nesting levels.
+     * `location` then starts with where that file sits.
+     */
+    attachment?: string;
+    /** How much the finding adds to a score, set by the package that made it. */
+    weight?: number;
+}
+/** A finding office-defuse makes itself. */
+export interface OfficeFinding extends DefuseFinding {
+    category: OfficeCategory;
+    detail: OfficeDetail;
+}
+export declare enum OfficeRisk {
+    None = "NONE",
+    Low = "LOW",
+    Medium = "MEDIUM",
+    High = "HIGH",
+    Critical = "CRITICAL",
+    /** The file could not be inspected: a refusal of the container or XML layer, or a limit, stopped the run. */
+    Unknown = "UNKNOWN"
+}
+export interface OfficeInspection {
+    status: 'clean' | 'strippable' | 'rejected';
+    /** 0 to 100, null when risk is UNKNOWN. */
+    score: number | null;
+    risk: OfficeRisk;
+    findings: DefuseFinding[];
+    /** The format the content says, as its usual file extension without the dot, such as 'docx' or 'ods'. '' when not recognized. */
+    format: string;
+    /** The MIME type of a file in that format. '' when not recognized. */
+    mimeType: string;
+}
+/** Random-access input. A buffer, a local file and an S3 ranged GetObject all fit. */
+export interface ByteSource {
+    size(): Promise<number>;
+    read(offset: number, length: number): Promise<Uint8Array>;
+    close?(): Promise<void>;
+}
+/** Append-only output. Never seeks. */
+export interface ByteSink {
+    write(chunk: Uint8Array): Promise<void>;
+    close(): Promise<void>;
+    /** Called instead of close() when copying to the sink fails, so a partial output is not taken for a whole one. */
+    abort?(error: unknown): Promise<void>;
+}
+export interface OfficeLimits {
+    /** Bytes in the upload. Not enforced unless set. */
+    fileSize?: number;
+    /** Entries in the ZIP central directory. Default 10,000. */
+    entries?: number;
+    /** Declared decompressed size of any one entry, in bytes. Default 512 MiB. */
+    decompressedBytes?: number;
+    /** Declared decompressed sizes of all entries together, in bytes. Default 2 GiB. */
+    totalDecompressedBytes?: number;
+    /** Element nesting depth in one XML part. Default 256. */
+    xmlDepth?: number;
+    /** Characters in one XML tag, comment, processing instruction or CDATA section. Default 16 Mi. */
+    xmlTokenSize?: number;
+    /** Entity references nested inside entity text. Default 16. */
+    xmlEntityDepth?: number;
+    /** Entity references expanded in the whole run. Default 100,000. */
+    xmlEntityExpansions?: number;
+    /** Characters of entity text expanded in the whole run. Default 16 Mi. */
+    xmlEntitySize?: number;
+    /** Group nesting in an RTF file, and destinations open at once. Default 256. */
+    rtfDepth?: number;
+    /** Milliseconds for the whole run. Not enforced unless set. */
+    timeMs?: number;
+}
+/** What a contained file plugin learns of the run, with nothing format-specific, so any package of the family can make one. */
+export interface PluginContext {
+    /** The depth of the file itself: 0 for the upload, 1 for a file inside it, and so on, whatever the formats. */
+    depth: number;
+    /** When a time limit is set, the Date.now() value the whole run must finish by. Nested runs share it. */
+    deadline?: number;
+}
+export interface ContainedFile {
+    name?: string;
+    /** The MIME type the container declares for the file, such as a part's content type. */
+    declaredType?: string;
+    /** From the first bytes. */
+    sniffedType?: string;
+    /** Decoded size. */
+    size: number;
+    location: string;
+    /** The depth of the file itself: 0 for the upload, 1 for a file inside it, and so on, whatever the formats. */
+    depth: number;
+    /** Decoded bytes. */
+    source: ByteSource;
+}
+/** What a file plugin did, plus anything it found inside the file. */
+export interface ContainedFileResult {
+    result: 'scrubbed' | 'passed' | 'removed';
+    /** Findings inside the file as it arrived. They go into the report of the file that contains it. */
+    findings?: DefuseFinding[];
+    /** Findings inside the bytes the plugin kept. They go into the report of the output. */
+    outputFindings?: DefuseFinding[];
+}
+export interface ContainedFilePlugin {
+    kind: 'file';
+    name: string;
+    accepts(file: ContainedFile): boolean | Promise<boolean>;
+    /** Writes the bytes to keep. Returning 'removed' drops the file after all. */
+    process(file: ContainedFile, sink: ByteSink, context: PluginContext): Promise<'scrubbed' | 'passed' | 'removed' | ContainedFileResult>;
+}
+export interface OfficeActionOverride {
+    category: OfficeCategory;
+    detail?: OfficeDetail;
+    action: OfficeFindingAction;
+}
+export interface OfficeScoreWeight {
+    category: OfficeCategory;
+    detail?: OfficeDetail;
+    weight: number;
+}
+/** Lower bound of each band. */
+export interface OfficeScoreBands {
+    low: number;
+    medium: number;
+    high: number;
+    critical: number;
+}
+export interface OfficeOptions {
+    /**
+     * Tried first on an encrypted file: an encrypted OOXML package, or an .xls workbook. If it does not open the file,
+     * the password Excel opens it with by default, VelvetSweatshop, is tried. Pass it in code, never on a command line,
+     * where other users can read it.
+     */
+    password?: string;
+    limits?: OfficeLimits;
+    actionOverrides?: OfficeActionOverride[];
+    scoreWeights?: OfficeScoreWeight[];
+    scoreBands?: OfficeScoreBands;
+}

package/dist/types.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OfficeRisk = exports.OfficeDetail = exports.OfficeCategory = void 0;
+/** High-level kind of a finding. */
+var OfficeCategory;
+(function (OfficeCategory) {
+    OfficeCategory["Container"] = "CONTAINER";
+    OfficeCategory["Xml"] = "XML";
+    OfficeCategory["Limit"] = "LIMIT";
+    OfficeCategory["Package"] = "PACKAGE";
+    OfficeCategory["Encrypted"] = "ENCRYPTED";
+    OfficeCategory["Macro"] = "MACRO";
+    OfficeCategory["Ui"] = "UI";
+    OfficeCategory["Action"] = "ACTION";
+    OfficeCategory["Dde"] = "DDE";
+    OfficeCategory["Field"] = "FIELD";
+    OfficeCategory["External"] = "EXTERNAL";
+    OfficeCategory["Link"] = "LINK";
+    OfficeCategory["Embedded"] = "EMBEDDED";
+    OfficeCategory["Control"] = "CONTROL";
+})(OfficeCategory || (exports.OfficeCategory = OfficeCategory = {}));
+/** Exact variant of a finding. Some details appear under more than one category. */
+var OfficeDetail;
+(function (OfficeDetail) {
+    // CONTAINER
+    OfficeDetail["NotZip"] = "NOT_ZIP";
+    OfficeDetail["AmbiguousEnd"] = "AMBIGUOUS_END";
+    OfficeDetail["MultiDisk"] = "MULTI_DISK";
+    OfficeDetail["DirectoryMismatch"] = "DIRECTORY_MISMATCH";
+    OfficeDetail["OutOfRange"] = "OUT_OF_RANGE";
+    OfficeDetail["Overlap"] = "OVERLAP";
+    OfficeDetail["HeaderMismatch"] = "HEADER_MISMATCH";
+    OfficeDetail["DuplicateName"] = "DUPLICATE_NAME";
+    OfficeDetail["UnsafeName"] = "UNSAFE_NAME";
+    OfficeDetail["NameEncoding"] = "NAME_ENCODING";
+    OfficeDetail["EncryptedEntry"] = "ENCRYPTED_ENTRY";
+    OfficeDetail["UnsupportedMethod"] = "UNSUPPORTED_METHOD";
+    OfficeDetail["Zip64Mismatch"] = "ZIP64_MISMATCH";
+    OfficeDetail["BadExtraField"] = "BAD_EXTRA_FIELD";
+    OfficeDetail["DataError"] = "DATA_ERROR";
+    OfficeDetail["LeadingBytes"] = "LEADING_BYTES";
+    OfficeDetail["HiddenData"] = "HIDDEN_DATA";
+    OfficeDetail["TrailingBytes"] = "TRAILING_BYTES";
+    OfficeDetail["BadHeader"] = "BAD_HEADER";
+    OfficeDetail["BrokenChain"] = "BROKEN_CHAIN";
+    OfficeDetail["ChainLoop"] = "CHAIN_LOOP";
+    OfficeDetail["DirectoryLoop"] = "DIRECTORY_LOOP";
+    OfficeDetail["BadEntry"] = "BAD_ENTRY";
+    // XML
+    OfficeDetail["Doctype"] = "DOCTYPE";
+    OfficeDetail["InternalSubset"] = "INTERNAL_SUBSET";
+    OfficeDetail["ExternalEntity"] = "EXTERNAL_ENTITY";
+    OfficeDetail["Malformed"] = "MALFORMED";
+    OfficeDetail["Encoding"] = "ENCODING";
+    // LIMIT
+    OfficeDetail["FileSize"] = "FILE_SIZE";
+    OfficeDetail["EntryCount"] = "ENTRY_COUNT";
+    OfficeDetail["DecompressedSize"] = "DECOMPRESSED_SIZE";
+    OfficeDetail["TotalDecompressedSize"] = "TOTAL_DECOMPRESSED_SIZE";
+    OfficeDetail["XmlDepth"] = "XML_DEPTH";
+    OfficeDetail["XmlTokenSize"] = "XML_TOKEN_SIZE";
+    OfficeDetail["XmlEntityDepth"] = "XML_ENTITY_DEPTH";
+    OfficeDetail["XmlEntityExpansions"] = "XML_ENTITY_EXPANSIONS";
+    OfficeDetail["XmlEntitySize"] = "XML_ENTITY_SIZE";
+    OfficeDetail["RtfDepth"] = "RTF_DEPTH";
+    OfficeDetail["Time"] = "TIME";
+    // PACKAGE
+    OfficeDetail["Unrecognized"] = "UNRECOGNIZED";
+    OfficeDetail["AmbiguousFormat"] = "AMBIGUOUS_FORMAT";
+    OfficeDetail["Unreadable"] = "UNREADABLE";
+    OfficeDetail["DuplicateEntry"] = "DUPLICATE_ENTRY";
+    OfficeDetail["UntypedPart"] = "UNTYPED_PART";
+    OfficeDetail["UnreferencedPart"] = "UNREFERENCED_PART";
+    OfficeDetail["OdfLayout"] = "ODF_LAYOUT";
+    // ENCRYPTED
+    OfficeDetail["PasswordRequired"] = "PASSWORD_REQUIRED";
+    OfficeDetail["DefaultPassword"] = "DEFAULT_PASSWORD";
+    OfficeDetail["UserPassword"] = "USER_PASSWORD";
+    OfficeDetail["Rc4_40"] = "RC4_40";
+    OfficeDetail["Rc4_128"] = "RC4_128";
+    OfficeDetail["Rc4Other"] = "RC4_OTHER";
+    OfficeDetail["Aes128"] = "AES_128";
+    OfficeDetail["Aes192"] = "AES_192";
+    OfficeDetail["Aes256"] = "AES_256";
+    OfficeDetail["UnsupportedAlgorithm"] = "UNSUPPORTED_ALGORITHM";
+    // MACRO
+    OfficeDetail["VbaProject"] = "VBA_PROJECT";
+    OfficeDetail["XlmMacrosheet"] = "XLM_MACROSHEET";
+    OfficeDetail["WordBasic"] = "WORDBASIC";
+    OfficeDetail["OdfBasic"] = "ODF_BASIC";
+    OfficeDetail["OdfScripts"] = "ODF_SCRIPTS";
+    OfficeDetail["OdfDialogs"] = "ODF_DIALOGS";
+    OfficeDetail["EventOnOpen"] = "EVENT_ON_OPEN";
+    OfficeDetail["Event"] = "EVENT";
+    OfficeDetail["Link"] = "LINK";
+    // UI
+    OfficeDetail["Ribbon"] = "RIBBON";
+    OfficeDetail["Callback"] = "CALLBACK";
+    OfficeDetail["OdfConfiguration"] = "ODF_CONFIGURATION";
+    // ACTION
+    OfficeDetail["RunProgram"] = "RUN_PROGRAM";
+    OfficeDetail["OleVerb"] = "OLE_VERB";
+    OfficeDetail["ObjectUpdate"] = "OBJECT_UPDATE";
+    // DDE
+    OfficeDetail["Field"] = "FIELD";
+    OfficeDetail["Formula"] = "FORMULA";
+    // FIELD
+    OfficeDetail["Macrobutton"] = "MACROBUTTON";
+    OfficeDetail["Computed"] = "COMPUTED";
+    // EXTERNAL
+    OfficeDetail["Template"] = "TEMPLATE";
+    OfficeDetail["Object"] = "OBJECT";
+    OfficeDetail["Image"] = "IMAGE";
+    OfficeDetail["Frame"] = "FRAME";
+    OfficeDetail["Include"] = "INCLUDE";
+    OfficeDetail["Workbook"] = "WORKBOOK";
+    OfficeDetail["Reload"] = "RELOAD";
+    OfficeDetail["Other"] = "OTHER";
+    OfficeDetail["LocalFile"] = "LOCAL_FILE";
+    // LINK
+    OfficeDetail["Safe"] = "SAFE";
+    OfficeDetail["FileUrl"] = "FILE_URL";
+    OfficeDetail["NetworkPath"] = "NETWORK_PATH";
+    OfficeDetail["DataUrl"] = "DATA_URL";
+    OfficeDetail["ScriptUrl"] = "SCRIPT_URL";
+    OfficeDetail["OtherScheme"] = "OTHER_SCHEME";
+    OfficeDetail["Credentials"] = "CREDENTIALS";
+    OfficeDetail["IpHost"] = "IP_HOST";
+    OfficeDetail["LookalikeHost"] = "LOOKALIKE_HOST";
+    OfficeDetail["EncodedHost"] = "ENCODED_HOST";
+    OfficeDetail["Relative"] = "RELATIVE";
+    // EMBEDDED
+    OfficeDetail["OleObject"] = "OLE_OBJECT";
+    OfficeDetail["Package"] = "PACKAGE";
+    OfficeDetail["OleFile"] = "OLE_FILE";
+    OfficeDetail["Applet"] = "APPLET";
+    OfficeDetail["Plugin"] = "PLUGIN";
+    OfficeDetail["Equation"] = "EQUATION";
+    OfficeDetail["Attachment"] = "ATTACHMENT";
+    // CONTROL
+    OfficeDetail["ActiveX"] = "ACTIVEX";
+})(OfficeDetail || (exports.OfficeDetail = OfficeDetail = {}));
+var OfficeRisk;
+(function (OfficeRisk) {
+    OfficeRisk["None"] = "NONE";
+    OfficeRisk["Low"] = "LOW";
+    OfficeRisk["Medium"] = "MEDIUM";
+    OfficeRisk["High"] = "HIGH";
+    OfficeRisk["Critical"] = "CRITICAL";
+    /** The file could not be inspected: a refusal of the container or XML layer, or a limit, stopped the run. */
+    OfficeRisk["Unknown"] = "UNKNOWN";
+})(OfficeRisk || (exports.OfficeRisk = OfficeRisk = {}));

package/dist/word.d.ts

@@ -0,0 +1,9 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+import type { RunContext } from './context';
+/**
+ * Inspects a Word 6.0 to 2003 document: its FIB, whether it is encrypted, the fields in its text and the template it
+ * attaches. Returns whether it is a template, or undefined for an `optional` stream that holds no FIB.
+ */
+export declare function wordRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, optional?: boolean): Promise<{
+    template: boolean;
+} | undefined>;

package/dist/word.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wordRules = wordRules;
+const errors_1 = require("./errors");
+const fields_1 = require("./fields");
+const io_1 = require("./io");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+/** wIdent of Word 97 and later, and of Word 6.0 and 95 (MS-DOC 2.5.2). */
+const WORD8 = 0xa5ec;
+const WORD6 = 0xa5dc;
+/** FibRgFcLcb97 pairs (MS-DOC 2.5.6): the attached template's table and the piece table. */
+const FC_STTBF_ASSOC = 32;
+const FC_CLX = 33;
+/** In a Word 6.0 or 95 FIB, the length of the macro table that holds WordBasic macros. Word writes 2 for an empty one. */
+const WORD6_MACROS = 0x11c;
+/** Text is read in pieces of at most this many characters. */
+const PIECE = 65536;
+const u16 = (b, at) => b[at] | (b[at + 1] << 8);
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+/**
+ * Inspects a Word 6.0 to 2003 document: its FIB, whether it is encrypted, the fields in its text and the template it
+ * attaches. Returns whether it is a template, or undefined for an `optional` stream that holds no FIB.
+ */
+async function wordRules(ctx, cfb, stream, optional = false) {
+    const source = cfb.source(stream);
+    const fib = await source.read(0, 1024);
+    const ident = fib.length >= 32 ? u16(fib, 0) : 0;
+    if (ident !== WORD8 && ident !== WORD6) {
+        if (optional)
+            return undefined;
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The WordDocument stream does not start with a Word FIB', { reason: 'a WordDocument stream without a FIB' });
+    }
+    const flags = u16(fib, 10);
+    // fEncrypted, set for both RC4 encryption and XOR obfuscation.
+    if (flags & 0x0100)
+        throw new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'The document is encrypted', { stream: stream.name });
+    const location = stream.name;
+    const fields = new fields_1.FieldStack(ctx, location);
+    // Word marks a field's start, separator and end with 0x13, 0x14 and 0x15 in the text. Other control characters in
+    // a field's code, such as the 0x01 of a hyperlink's data, are not part of what it says.
+    const text = (s) => {
+        for (const ch of s) {
+            if (ch === '\x13')
+                fields.begin();
+            else if (ch === '\x14')
+                fields.separate();
+            else if (ch === '\x15')
+                fields.end();
+            else if (fields.inCode && (ch >= ' ' || ch === '\t'))
+                fields.text(ch);
+        }
+    };
+    const reader = new io_1.Reader(source, stream.size, 65536, 8);
+    if (ident === WORD6) {
+        // Word 6.0 and 95 keep their text as 8-bit characters from fcMin to fcMac. A file saved fast adds pieces to the
+        // end, and this reads every byte between, as msodde does.
+        const from = u32(fib, 0x18);
+        const to = Math.min(u32(fib, 0x1c), stream.size);
+        for (let at = from; at < to; at += PIECE) {
+            (0, errors_1.checkTime)(ctx.settings.deadline);
+            text(latin(await reader.read(at, Math.min(PIECE, to - at))));
+        }
+        if (fib.length >= WORD6_MACROS + 4 && u32(fib, WORD6_MACROS) > 2)
+            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.WordBasic, location, { stream: location, bytes: u32(fib, WORD6_MACROS) });
+    }
+    else {
+        const pairs = fcLcb(fib);
+        const table = cfb.child(cfb.root, flags & 0x0200 ? '1Table' : '0Table');
+        if (table?.kind === 'stream') {
+            const tableSource = cfb.source(table);
+            const clx = pairs[FC_CLX];
+            if (clx && clx.lcb > 0 && clx.fc + clx.lcb <= table.size) {
+                for (const p of pieces(await tableSource.read(clx.fc, clx.lcb))) {
+                    for (let cp = 0; cp < p.length; cp += PIECE) {
+                        (0, errors_1.checkTime)(ctx.settings.deadline);
+                        const n = Math.min(PIECE, p.length - cp);
+                        if (p.compressed)
+                            text(latin(await reader.read(p.fc + cp, n)));
+                        else
+                            text((0, oleobj_1.utf16)(await reader.read(p.fc + cp * 2, n * 2)));
+                    }
+                }
+            }
+            const assoc = pairs[FC_STTBF_ASSOC];
+            if (assoc && assoc.lcb > 0 && assoc.fc + assoc.lcb <= table.size) {
+                // The attached template is string 1 of SttbfAssoc (MS-DOC 2.9.271).
+                const template = sttb(await tableSource.read(assoc.fc, Math.min(assoc.lcb, 65536)))[1] ?? '';
+                if (template.trim())
+                    ctx.external(types_1.OfficeDetail.Template, template, location, { source: 'SttbfAssoc' }, 'template');
+            }
+        }
+    }
+    fields.finish();
+    return { template: (flags & 1) === 1 };
+}
+/** The fc and lcb pairs of a Word 97 FIB, after its variable-length arrays of 16- and 32-bit values. */
+function fcLcb(fib) {
+    const r = new oleobj_1.ByteReader(fib);
+    const out = [];
+    return (0, oleobj_1.bounded)(() => {
+        r.skip(32);
+        r.skip(r.u16() * 2);
+        r.skip(r.u16() * 4);
+        const n = r.u16();
+        for (let i = 0; i < n; i++)
+            out.push({ fc: r.u32(), lcb: r.u32() });
+        return out;
+    }, () => out);
+}
+/** The pieces of a Clx (MS-DOC 2.9.38): where each run of text is, and whether it is stored 8 bits a character. */
+function pieces(clx) {
+    const r = new oleobj_1.ByteReader(clx);
+    const out = [];
+    return (0, oleobj_1.bounded)(() => {
+        // Prc entries of formatting come first, each with its size.
+        while (r.left > 0 && clx[r.pos] === 0x01) {
+            r.skip(1);
+            r.skip(r.u16());
+        }
+        if (r.u8() !== 0x02)
+            return out;
+        const lcb = r.u32();
+        const n = Math.floor((lcb - 4) / 12);
+        const plc = new oleobj_1.ByteReader(r.bytes(Math.min(lcb, r.left)));
+        const cps = [];
+        for (let i = 0; i <= n; i++)
+            cps.push(plc.u32());
+        for (let i = 0; i < n; i++) {
+            plc.skip(2);
+            const fc = plc.u32();
+            plc.skip(2);
+            const length = cps[i + 1] - cps[i];
+            if (length <= 0)
+                continue;
+            const compressed = (fc & 0x40000000) !== 0;
+            out.push({ fc: compressed ? (fc & 0x3fffffff) / 2 : fc, length, compressed });
+        }
+        return out;
+    }, () => []);
+}
+/** The strings of an STTB (MS-DOC 2.2.4), in 16-bit characters when it starts with 0xFFFF, as Word 97 writes one. */
+function sttb(b) {
+    const r = new oleobj_1.ByteReader(b);
+    const out = [];
+    return (0, oleobj_1.bounded)(() => {
+        const wide = r.u16() === 0xffff;
+        if (!wide)
+            r.pos = 0;
+        const count = r.u16();
+        const extra = r.u16();
+        for (let i = 0; i < count; i++) {
+            const n = wide ? r.u16() : r.u8();
+            out.push(wide ? (0, oleobj_1.utf16)(r.bytes(n * 2)) : latin(r.bytes(n)));
+            r.skip(extra);
+        }
+        return out;
+    }, () => out);
+}
+const latin = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString('latin1');

package/dist/xls.d.ts

@@ -0,0 +1,27 @@
+import { type BiffRecord } from './biff';
+import type { CfbEntry, CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/** Turns an encrypted record body into its plain bytes. Without encryption the body is as stored. */
+export type Decrypt = (r: BiffRecord) => Uint8Array;
+/**
+ * Opens a workbook encrypted by its FILEPASS record, or says it cannot. Set by the decryption module, so this module
+ * reads workbooks without knowing how they are encrypted.
+ */
+export type Unlock = (ctx: RunContext, filePass: BiffRecord, stream: string) => Decrypt | Promise<Decrypt>;
+/**
+ * Inspects an Excel 5.0 to 2003 workbook stream. Excel reads the globals substream from the start of the stream,
+ * then each sheet from where its BoundSheet record says the sheet starts. The globals give the macro sheets, the
+ * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
+ * hyperlinks. An encrypted workbook goes through `unlock`.
+ */
+export declare function excelRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, unlock: Unlock): Promise<{
+    template: boolean;
+    addIn: boolean;
+}>;
+/**
+ * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
+ * volume, the root, a folder, a step up, a URL's volume or Excel's startup folders.
+ */
+export declare function virtualPath(p: string): string;
+/** The target of an HLink record: its Hyperlink Object (MS-OSHARED 2.3.7.1) after the cell range and class id. */
+export declare function hyperlink(b: Uint8Array): string;