@patrickdk77/office-defuse 0.0.0-stage → 0.1.1

package/dist/xls.js

@@ -0,0 +1,174 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.excelRules = excelRules;
+exports.virtualPath = virtualPath;
+exports.hyperlink = hyperlink;
+const biff_1 = require("./biff");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const links_1 = require("./links");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+const STATES = ['visible', 'hidden', 'very hidden', 'hidden'];
+/**
+ * Inspects an Excel 5.0 to 2003 workbook stream. Excel reads the globals substream from the start of the stream,
+ * then each sheet from where its BoundSheet record says the sheet starts. The globals give the macro sheets, the
+ * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
+ * hyperlinks. An encrypted workbook goes through `unlock`.
+ */
+async function excelRules(ctx, cfb, stream, unlock) {
+    const location = stream.name;
+    const records = new biff_1.RecordReader(cfb, stream, 0, ctx.settings.deadline);
+    const first = await records.next();
+    if (first?.type !== biff_1.R.bof || first.body.length < 4)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, `The ${stream.name} stream does not start with a BOF record`, { reason: 'a workbook stream without a BOF record' });
+    const biff8 = (first.body[0] | (first.body[1] << 8)) === 0x0600;
+    let decrypt = r => r.body;
+    const sheets = [];
+    const books = [];
+    const flags = { template: false, addIn: false };
+    for (let r = await records.next(); r && r.type !== biff_1.R.eof; r = await records.next()) {
+        if (r.type === biff_1.R.filePass) {
+            decrypt = await unlock(ctx, r, location);
+            continue;
+        }
+        const body = decrypt(r);
+        if (r.type === biff_1.R.boundSheet)
+            sheets.push((0, biff_1.parseBoundSheet)(body, biff8));
+        else if (r.type === biff_1.R.template)
+            flags.template = true;
+        else if (r.type === biff_1.R.addIn)
+            flags.addIn = true;
+        else if (r.type === biff_1.R.lbl) {
+            const name = (0, biff_1.parseLbl)(body, biff8);
+            const auto = (0, biff_1.autoName)(name.name);
+            if (auto)
+                ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, location, { event: auto.event, name: (0, context_1.clip)(name.name) });
+        }
+        else if (r.type === biff_1.R.supBook && body.length >= 4) {
+            const cch = body[2] | (body[3] << 8);
+            books.push({ ctab: body[0] | (body[1] << 8), cch, path: cch > 0 && cch <= 0xff ? (0, biff_1.xlString)(body, 4, cch).text : '', ole: false, dde: false });
+        }
+        else if (r.type === biff_1.R.externName && body.length >= 2 && books.length) {
+            // fOle and fOleLink mark an OLE object's name. Excel writes StdDocumentName with fOle beside the items of a DDE
+            // link, so a link with any DDE item is a DDE link.
+            if ((body[0] | (body[1] << 8)) & 0x18)
+                books[books.length - 1].ole = true;
+            else
+                books[books.length - 1].dde = true;
+        }
+    }
+    for (const b of books)
+        linkRules(ctx, b, location);
+    for (const s of sheets)
+        await sheetRules(ctx, cfb, stream, s, decrypt, location);
+    return flags;
+}
+/** A SupBook record, read as MS-XLS 2.4.271 and oletools tell its kinds apart. */
+function linkRules(ctx, b, location) {
+    if (b.cch === 0x401 || b.cch === 0x3a01 || b.path === ' ' || b.path === '\0' || !b.path)
+        return;
+    if (b.ctab === 0) {
+        // A DDE or OLE data source: the application or class, U+0003, and the topic or file.
+        const [application, topic = ''] = b.path.split('\x03');
+        if (b.ole && !b.dde) {
+            const data = { source: 'SupBook', className: (0, context_1.clip)(application) };
+            if (topic)
+                ctx.external(types_1.OfficeDetail.Object, topic, location, data, 'linked object');
+            else
+                ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
+        }
+        else
+            ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, location, { application: (0, context_1.clip)(application), topic: (0, context_1.clip)(topic) });
+        return;
+    }
+    ctx.external(types_1.OfficeDetail.Workbook, virtualPath(b.path), location, { source: 'SupBook' }, 'external workbook');
+}
+/**
+ * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
+ * volume, the root, a folder, a step up, a URL's volume or Excel's startup folders.
+ */
+function virtualPath(p) {
+    if (p.charCodeAt(0) !== 1)
+        return p;
+    let out = '';
+    for (let i = 1; i < p.length; i++) {
+        const c = p.charCodeAt(i);
+        if (c === 1) {
+            // A drive letter, or @ for a UNC host. A U+0003 after it starts the path.
+            const v = p[i + 1] ?? '';
+            i++;
+            out += v === '@' ? '\\\\' : `${v}:`;
+        }
+        else if (c === 2 || c === 3)
+            out += '\\';
+        else if (c === 4)
+            out += '..\\';
+        // A long volume, such as a URL, after a character that counts it.
+        else if (c === 5)
+            i++;
+        else if (c >= 6 && c <= 8)
+            out += 'XLSTART\\';
+        else
+            out += p[i];
+    }
+    return out;
+}
+/** One sheet's substream, with any chart substreams inside it: Obj records that run macros, and hyperlinks. */
+async function sheetRules(ctx, cfb, stream, s, decrypt, location) {
+    const records = new biff_1.RecordReader(cfb, stream, s.position, ctx.settings.deadline);
+    const bof = await records.next();
+    if (bof?.type !== biff_1.R.bof || bof.body.length < 4)
+        return;
+    const bofType = bof.body[2] | (bof.body[3] << 8);
+    // The sheet's own BOF says what it is, and so does its BoundSheet record. Either one makes a macro sheet.
+    if (s.type === 1 || bofType === 0x0040)
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, location, { sheet: (0, context_1.clip)(s.name), state: STATES[s.state] });
+    let depth = 1;
+    for (let r = await records.next(); r && depth > 0; r = await records.next()) {
+        if (r.type === biff_1.R.bof)
+            depth++;
+        else if (r.type === biff_1.R.eof)
+            depth--;
+        else if (r.type === biff_1.R.obj) {
+            if (objMacro(decrypt(r)))
+                ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, { sheet: (0, context_1.clip)(s.name) });
+        }
+        else if (r.type === biff_1.R.hlink) {
+            const target = hyperlink(decrypt(r));
+            if (target.trim() && !(0, links_1.isFragment)(target))
+                ctx.link(target, location, { sheet: (0, context_1.clip)(s.name), source: 'HLink record' });
+        }
+    }
+}
+/** Whether an Obj record (MS-XLS 2.4.181) holds an FtMacro subrecord, the macro a click runs. */
+function objMacro(b) {
+    let at = 0;
+    while (at + 4 <= b.length) {
+        const ft = b[at] | (b[at + 1] << 8);
+        const cb = b[at + 2] | (b[at + 3] << 8);
+        // FtEnd ends the list, and FtLbsData's length does not count all its data, so the walk stops there.
+        if (ft === 0x00 || ft === 0x13)
+            return false;
+        if (ft === 0x04)
+            return cb > 0;
+        at += 4 + cb;
+    }
+    return false;
+}
+/** The target of an HLink record: its Hyperlink Object (MS-OSHARED 2.3.7.1) after the cell range and class id. */
+function hyperlink(b) {
+    const r = new oleobj_1.ByteReader(b);
+    return (0, oleobj_1.bounded)(() => {
+        r.skip(8 + 16 + 4);
+        const flags = r.u32();
+        const string = () => (0, oleobj_1.utf16)(r.bytes(r.u32() * 2)).replace(/\0+$/, '');
+        if (flags & 0x10)
+            string();
+        if (flags & 0x80)
+            string();
+        if (!(flags & 0x01))
+            return '';
+        return flags & 0x100 ? string() : (0, oleobj_1.readMoniker)(r).target;
+    }, () => '');
+}

package/dist/xlsb.d.ts

@@ -0,0 +1,19 @@
+export interface DdeLink {
+    application: string;
+    topic: string;
+}
+/**
+ * Reads the records of an .xlsb external link part as its chunks arrive, and collects its DDE links. Each record
+ * body is skipped, except the first 64 KiB of a BrtBeginSupBook. A header that breaks the record format ends the
+ * reading; Excel cannot read such a part either.
+ */
+export declare class XlsbLinks {
+    readonly dde: DdeLink[];
+    private head;
+    private left;
+    private body;
+    private kept;
+    private broken;
+    write(chunk: Uint8Array): void;
+    private finish;
+}

package/dist/xlsb.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XlsbLinks = void 0;
+/** BrtBeginSupBook, the record that opens each link of an .xlsb external link part. */
+const BEGIN_SUPBOOK = 360;
+/** The link type BrtBeginSupBook gives a DDE link. */
+const SUPBOOK_DDE = 1;
+/** How much of one BrtBeginSupBook is kept: far more than the two names of a DDE link need. */
+const KEEP = 65536;
+/**
+ * The record header at the start of `b`: the record's type and size, undefined while `b` is too short, or 'bad' when
+ * the header runs longer than the format allows. A type takes one or two bytes and a size one to four, seven bits to
+ * a byte, and a byte with its high bit clear ends each.
+ */
+function header(b) {
+    let i = 0;
+    let type = 0;
+    for (let shift = 0;; shift += 7) {
+        if (i >= b.length)
+            return undefined;
+        type |= (b[i] & 0x7f) << shift;
+        if (!(b[i++] & 0x80))
+            break;
+        if (shift === 7)
+            return 'bad';
+    }
+    let size = 0;
+    for (let shift = 0;; shift += 7) {
+        if (i >= b.length)
+            return undefined;
+        size += (b[i] & 0x7f) * 2 ** shift;
+        if (!(b[i++] & 0x80))
+            break;
+        if (shift === 21)
+            return 'bad';
+    }
+    return { type, size };
+}
+/** An XLWideString at `at`: a 32-bit character count, then UTF-16LE. Cut short at the end of what was kept. */
+function wideString(b, at) {
+    if (at + 4 > b.length)
+        return { text: '', next: b.length };
+    const end = Math.min(b.length, at + 4 + b.readUInt32LE(at) * 2);
+    return { text: b.toString('utf16le', at + 4, end), next: end };
+}
+/**
+ * Reads the records of an .xlsb external link part as its chunks arrive, and collects its DDE links. Each record
+ * body is skipped, except the first 64 KiB of a BrtBeginSupBook. A header that breaks the record format ends the
+ * reading; Excel cannot read such a part either.
+ */
+class XlsbLinks {
+    dde = [];
+    head = [];
+    left = 0;
+    body;
+    kept = 0;
+    broken = false;
+    write(chunk) {
+        let i = 0;
+        while (i < chunk.length && !this.broken) {
+            if (this.left > 0) {
+                const n = Math.min(this.left, chunk.length - i);
+                if (this.body && this.kept < KEEP) {
+                    const part = Buffer.from(chunk.subarray(i, i + Math.min(n, KEEP - this.kept)));
+                    this.body.push(part);
+                    this.kept += part.length;
+                }
+                this.left -= n;
+                i += n;
+                if (this.left === 0)
+                    this.finish();
+                continue;
+            }
+            this.head.push(chunk[i++]);
+            const h = header(this.head);
+            if (h === undefined)
+                continue;
+            if (h === 'bad') {
+                this.broken = true;
+                return;
+            }
+            this.head = [];
+            this.body = h.type === BEGIN_SUPBOOK ? [] : undefined;
+            this.kept = 0;
+            this.left = h.size;
+            if (this.left === 0)
+                this.finish();
+        }
+    }
+    finish() {
+        if (!this.body)
+            return;
+        const b = Buffer.concat(this.body);
+        this.body = undefined;
+        if (b.length < 2 || b.readUInt16LE(0) !== SUPBOOK_DDE)
+            return;
+        const application = wideString(b, 2);
+        this.dde.push({ application: application.text, topic: wideString(b, application.next).text });
+    }
+}
+exports.XlsbLinks = XlsbLinks;

package/dist/xml.d.ts

@@ -0,0 +1,256 @@
+export declare const XML_NS = "http://www.w3.org/XML/1998/namespace";
+export declare const XMLNS_NS = "http://www.w3.org/2000/xmlns/";
+/**
+ * Stands in text for a reference to an external entity, whose content office-defuse never fetches: UNKNOWN, the
+ * entity's name, UNKNOWN again. U+FFFF cannot occur in XML, so nothing a part holds is taken for it.
+ */
+export declare const UNKNOWN: string;
+/** A value with each reference to an external entity written back as `&name;`, for a finding to show. */
+export declare const showReferences: (s: string) => string;
+/** The name of the first external entity whose content stands in `s`, or undefined when none does. */
+export declare const unknownEntity: (s: string) => string | undefined;
+export interface XmlAttribute {
+    /** Namespace URI, '' for none. */
+    ns: string;
+    local: string;
+    qname: string;
+    /** Normalized value, with references expanded. An attribute-list declaration can give it a default or normalize it further. */
+    value: string;
+}
+export interface XmlElement {
+    /** Namespace URI, '' for none. */
+    ns: string;
+    local: string;
+    qname: string;
+    /** Attributes other than namespace declarations. */
+    attributes: XmlAttribute[];
+    /** 1 for the root element. */
+    depth: number;
+    /**
+     * Offsets of the start tag in the decoded text, end exclusive. An element from an entity's text has the offsets of
+     * the reference to that entity in the part, or of the outermost one when references nest.
+     */
+    start: number;
+    end: number;
+}
+export interface XmlHandler {
+    start?(el: XmlElement): void;
+    /** `start` and `end` are the offsets of the end tag, or of the start tag again for an empty element. */
+    end?(el: XmlElement, start: number, end: number): void;
+    /** Character data and CDATA content, decoded, in pieces of any size. A reference to an external entity comes as one piece. */
+    text?(text: string): void;
+}
+export interface XmlLimits {
+    depth: number;
+    tokenSize: number;
+    /** Entity references nested inside entity text. */
+    entityDepth: number;
+    /** Entity references expanded, counted in the budget. */
+    entityExpansions: number;
+    /** Characters of entity text expanded, counted in the budget. */
+    entitySize: number;
+}
+/** Entity expansion so far. One inspection shares it among its parts, so the limits bound the whole package. */
+export interface EntityBudget {
+    expansions: number;
+    size: number;
+}
+/** A document type declaration. */
+export interface XmlDoctype {
+    /** The root element type it names. */
+    name: string;
+    publicId?: string;
+    systemId?: string;
+    /** Whether it has an internal subset, declarations between square brackets. */
+    internalSubset: boolean;
+    /** General entities the internal subset declares, and how many of them are external. */
+    entities: number;
+    externalEntities: number;
+    /** Attribute defaults the internal subset declares. */
+    attributeDefaults: number;
+    /** Entity and attribute-list declarations skipped after a parameter entity that was not read. */
+    skipped: number;
+    /** Offsets of the declaration in the decoded text, end exclusive. */
+    start: number;
+    end: number;
+}
+/** A reference to an external entity in content, which is never fetched. */
+export interface XmlExternalReference {
+    name: string;
+    publicId?: string;
+    systemId: string;
+    /** Offsets of the reference in the decoded text, or of the outermost reference whose entity text holds it. */
+    start: number;
+    end: number;
+}
+/** What the tokenizer reports besides elements and text. */
+export interface XmlNotes {
+    doctype?(d: XmlDoctype): void;
+    externalEntity?(r: XmlExternalReference): void;
+}
+export interface XmlOptions {
+    /** Reads the dialect Office writes in VML drawing parts. See XmlTokenizer. */
+    vml?: boolean;
+    notes?: XmlNotes;
+    /** Shared with the other parts of a package. A tokenizer without one counts on its own. */
+    budget?: EntityBudget;
+}
+/** The value of the attribute with this namespace and local name. */
+export declare function attr(el: XmlElement, ns: string, local: string): string | undefined;
+/** An XML name without a colon. */
+export declare const isNcName: (s: string) => boolean;
+/**
+ * A streaming XML 1.0 tokenizer with namespaces. It refuses references to entities nothing declares, encodings other
+ * than UTF-8 and UTF-16, and anything not well-formed. It holds one markup token at a time; text goes to the handler
+ * in pieces.
+ *
+ * A document type declaration goes to `notes.doctype`. No external DTD or other external entity is ever loaded. The
+ * internal subset is read as XML 1.0 (5.1) has a processor read it that reads internal parameter entities and no
+ * external ones: it keeps the general entities and attribute-list declarations, reads the text of each internal
+ * parameter entity it refers to, and skips the entity and attribute-list declarations after a parameter entity it
+ * does not read, unless the XML declaration says standalone="yes".
+ *
+ * A reference to an internal entity is expanded, within the entity limits, and the handler sees its text, markup
+ * included, as if the part held it. A reference to an external entity in content goes to `notes.externalEntity`, and
+ * stands in the text as UNKNOWN marks it. One in an attribute value, directly or through other entities, is refused,
+ * as XML 1.0 refuses it. An attribute an element leaves out gets the default its attribute-list declaration gives, and
+ * an attribute declared with a type other than CDATA is normalized further, as expat does. Each default added counts
+ * as an expansion against the entity limits.
+ */
+export declare class XmlTokenizer {
+    private readonly handler;
+    private readonly limits;
+    private readonly part;
+    private decoder?;
+    private head;
+    private buf;
+    private pos;
+    /** Offset in the decoded text of buf[0]. */
+    private base;
+    private readonly stack;
+    private rootSeen;
+    private doctypeSeen;
+    /** The XML declaration says standalone="yes". */
+    private standalone;
+    private encoding;
+    /** The last text piece ended in CR, so an LF that starts the next piece belongs to the same line end. */
+    private lastCr;
+    private scan?;
+    /** General entities the internal subset declares, by name. */
+    private readonly entities;
+    /** Parameter entities the internal subset declares, by name. */
+    private readonly parameters;
+    /** What the attribute-list declarations say, by element type as written. */
+    private readonly declared;
+    /** The entities being expanded, outermost first. A parameter entity's name has "%" in front. */
+    private readonly active;
+    /** While entity text is read, the offsets of the outermost reference, which its elements report. */
+    private span?;
+    /** The stack depth at which the entity text being read started. Its end tags close nothing below it. */
+    private floor;
+    private readonly vml;
+    private readonly notes;
+    private readonly budget;
+    /**
+     * `options.vml` reads the dialect Office writes in VML drawing parts, which is not well-formed XML: it skips the
+     * `<![if ...]>` and `<![endif]>` markers around content and takes an unclosed `<br>` as an empty element. Both
+     * branches of a marker reach the handler.
+     */
+    constructor(handler: XmlHandler, limits: XmlLimits, part: string, options?: XmlOptions);
+    private stop;
+    private malformed;
+    write(bytes: Uint8Array): void;
+    end(): void;
+    /** Picks the encoding from the first bytes, as XML 1.0 Appendix F does, and reads the bytes held so far. */
+    private begin;
+    private decode;
+    /** Checks the XML declaration against the encoding the bytes are in, and notes whether it says standalone="yes". */
+    private declaration;
+    private feed;
+    /** Reads the text and markup in buf from pos. Entity text is read with `final` set, since all of it is there. */
+    private loop;
+    /** The offset in the decoded text of buf[i], or while entity text is read, that of the reference to it. */
+    private at;
+    /**
+     * Character data at `offset` in the decoded text. References are expanded and line ends turned into LF. Entity
+     * text had its line ends normalized where it was declared, so a CR in it, which only a character reference makes,
+     * stays.
+     */
+    private text;
+    /** Hands decoded text to the handler. Outside the root element only white space may stand. */
+    private characters;
+    /**
+     * Normalizes an attribute value as XML 1.0 (3.3.3) says: references expanded, and each white space character a
+     * space, except one written as a character reference. `normalized` marks entity text, whose line ends were
+     * normalized where it was declared, so a CR and LF in it are two characters.
+     */
+    private attributeValue;
+    /** The text a predefined entity or a character reference stands for, or undefined for any other entity. */
+    private plainReference;
+    private characterReference;
+    /** The entity a reference names. A reference to one nothing declares is refused. */
+    private entity;
+    /** Starts expanding an entity, within the limits. */
+    private enter;
+    /**
+     * Counts one expansion of `size` characters of declared text, an entity's or an attribute default's, against the
+     * limits, so a document type cannot make the part cost more than they allow.
+     */
+    private charge;
+    /** A reference to a general entity in content. Its text is read as content, in place of the reference. */
+    private contentReference;
+    /** A reference to a general entity in an attribute value. Its text is normalized into the value. */
+    private attributeReference;
+    /** Reads one markup token at pos. Returns false when the buffer does not yet hold all of it. */
+    private markup;
+    private wait;
+    private advance;
+    private checkChars;
+    private instruction;
+    /**
+     * Finds the end of the document type declaration at p: the ">" outside its literals and its internal subset, where
+     * comments, processing instructions and declarations may hold either. Returns the offset after it, or -1 when buf
+     * does not hold all of it yet. The scan goes on from where it stopped.
+     */
+    private scanDoctype;
+    /** Reads a whole document type declaration, keeping the entities and attributes its internal subset declares. */
+    private doctype;
+    /** SYSTEM and a system literal, or PUBLIC and a public and a system literal, or undefined when neither is next. */
+    private externalId;
+    /**
+     * Reads markup declarations: the internal subset up to and past its "]", or with `nested` the whole text of a
+     * parameter entity.
+     */
+    private declarations;
+    /**
+     * A parameter entity reference between declarations. An internal entity's text is read as declarations, with a
+     * space on each side as XML 1.0 (4.4.8) says. An external or undeclared one is not read, and the entity and
+     * attribute-list declarations after it are skipped, since it could have declared the same names first.
+     */
+    private parameterReference;
+    /**
+     * Reads an entity declaration after its keyword, and keeps the entity unless it comes after a parameter entity that
+     * was not read, or gives one of the predefined names, or a name already declared: the first declaration binds.
+     */
+    private entityDeclaration;
+    /**
+     * The text an entity value expands to: line ends normalized, unless `normalized` says they were, and character
+     * references replaced. References to general entities stay as written, to be expanded where the entity is used. A
+     * parameter entity reference cannot stand inside a declaration in the internal subset.
+     */
+    private entityValue;
+    /**
+     * Reads an attribute-list declaration after its keyword. Each attribute it names for the first time is kept, with
+     * its default normalized now, as the entities declared so far give it. After a parameter entity that was not read,
+     * the declaration is skipped.
+     */
+    private attributeListDeclaration;
+    /** Reads an attribute type and tells whether its values are tokens, normalized further than CDATA. */
+    private attributeType;
+    /** An enumerated type: name tokens between parentheses, separated by "|". */
+    private enumeration;
+    private lookup;
+    private split;
+    private startTag;
+    private endTag;
+}