@patrickdk77/office-defuse 0.0.0-stage → 0.1.1

package/dist/odf.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectOdf = inspectOdf;
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const formats_1 = require("./formats");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const zip_1 = require("./zip");
+const NS = {
+    manifest: 'urn:oasis:names:tc:opendocument:xmlns:manifest:1.0',
+    office: 'urn:oasis:names:tc:opendocument:xmlns:office:1.0',
+    script: 'urn:oasis:names:tc:opendocument:xmlns:script:1.0',
+    presentation: 'urn:oasis:names:tc:opendocument:xmlns:presentation:1.0',
+    text: 'urn:oasis:names:tc:opendocument:xmlns:text:1.0',
+    draw: 'urn:oasis:names:tc:opendocument:xmlns:drawing:1.0',
+    table: 'urn:oasis:names:tc:opendocument:xmlns:table:1.0',
+    form: 'urn:oasis:names:tc:opendocument:xmlns:form:1.0',
+    meta: 'urn:oasis:names:tc:opendocument:xmlns:meta:1.0',
+    style: 'urn:oasis:names:tc:opendocument:xmlns:style:1.0',
+    database: 'urn:oasis:names:tc:opendocument:xmlns:database:1.0',
+    xlink: 'http://www.w3.org/1999/xlink',
+};
+/**
+ * Folders of code and settings. Each is reported by name, as a whole, so the files in them are inflated and checked
+ * but not parsed.
+ */
+const FOLDERS = [
+    ['basic', types_1.OfficeDetail.OdfBasic, types_1.OfficeCategory.Macro],
+    ['scripts', types_1.OfficeDetail.OdfScripts, types_1.OfficeCategory.Macro],
+    ['dialogs', types_1.OfficeDetail.OdfDialogs, types_1.OfficeCategory.Macro],
+    ['configurations2', types_1.OfficeDetail.OdfConfiguration, types_1.OfficeCategory.Ui],
+];
+/** Event names that fire as the document opens. Focus and activation count only for the document's own events. */
+const ON_OPEN = new Set(['load', 'new', 'create', 'loadfinished', 'viewcreated']);
+const ON_OPEN_DOCUMENT = new Set(['focus', 'activate']);
+const LINK_ELEMENTS = new Set([`${NS.text} a`, `${NS.draw} a`, `${NS.draw} area-rectangle`, `${NS.draw} area-circle`, `${NS.draw} area-polygon`]);
+const EXTERNAL_KIND = new Map([
+    [`${NS.meta} template`, types_1.OfficeDetail.Template],
+    [`${NS.meta} auto-reload`, types_1.OfficeDetail.Reload],
+    [`${NS.draw} image`, types_1.OfficeDetail.Image],
+    [`${NS.draw} fill-image`, types_1.OfficeDetail.Image],
+    [`${NS.style} background-image`, types_1.OfficeDetail.Image],
+    [`${NS.text} section-source`, types_1.OfficeDetail.Include],
+    [`${NS.table} table-source`, types_1.OfficeDetail.Include],
+    [`${NS.draw} object`, types_1.OfficeDetail.Object],
+    [`${NS.draw} object-ole`, types_1.OfficeDetail.Object],
+    [`${NS.draw} floating-frame`, types_1.OfficeDetail.Frame],
+]);
+/** Elements whose reference always leaves the package: it resolves against the document's own location. */
+const ALWAYS_OUTSIDE = new Set([`${NS.meta} template`, `${NS.meta} auto-reload`, `${NS.text} section-source`, `${NS.table} table-source`]);
+/**
+ * LibreOffice reads urn:oasis:names:tc:<any>:xmlns:<name>:1.<any> as the OpenDocument namespace <name> 1.0, so this
+ * does too. The comparison ignores case, which can only find more.
+ */
+function odfNs(ns) {
+    const m = /^urn:oasis:names:tc:[^:]*:xmlns:([^:]*):1\.[^:]+$/i.exec(ns);
+    return m ? `urn:oasis:names:tc:opendocument:xmlns:${m[1].toLowerCase()}:1.0` : ns;
+}
+/** An attribute by normalized namespace and local name. */
+function oattr(el, ns, local) {
+    for (const a of el.attributes)
+        if (a.local === local && odfNs(a.ns) === ns)
+            return a.value;
+    return undefined;
+}
+/** A path inside the package as the manifest and the zip name it: without "./" and leading slashes. */
+const packagePath = (href) => (0, zip_1.nameKey)(href.trim().replace(/^(\.\/)+/, ''));
+/** The rules that read inside one XML entry of an ODF package. */
+class EntryRules {
+    ctx;
+    entry;
+    oleRefs;
+    /** Depth of the office:scripts element being read, 0 outside one. */
+    scriptsDepth = 0;
+    /** An office:script element being read, with whether it holds anything. */
+    script;
+    constructor(ctx, entry, 
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    oleRefs) {
+        this.ctx = ctx;
+        this.entry = entry;
+        this.oleRefs = oleRefs;
+    }
+    report(category, detail, data) {
+        this.ctx.report(category, detail, this.entry, data);
+    }
+    start(raw) {
+        if (this.script)
+            this.script.content = true;
+        const el = { ...raw, ns: odfNs(raw.ns) };
+        const key = `${el.ns} ${el.local}`;
+        const href = oattr(el, NS.xlink, 'href');
+        if (el.ns === NS.office && el.local === 'scripts' && !this.scriptsDepth)
+            this.scriptsDepth = el.depth;
+        else if (el.ns === NS.office && el.local === 'script')
+            this.script = { depth: el.depth, language: oattr(el, NS.script, 'language') ?? '', content: false };
+        else if (el.ns === NS.script && el.local === 'event-listener')
+            this.scriptEvent(el, href);
+        else if (el.ns === NS.presentation && el.local === 'event-listener')
+            this.presentationEvent(el, href);
+        else if ((el.ns === NS.text && el.local === 'dde-connection-decl') || (el.ns === NS.office && el.local === 'dde-source')) {
+            this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, { application: (0, context_1.clip)(oattr(el, NS.office, 'dde-application') ?? ''), topic: (0, context_1.clip)(oattr(el, NS.office, 'dde-topic') ?? '') });
+        }
+        else if (el.ns === NS.draw && el.local === 'applet') {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, { code: (0, context_1.clip)(oattr(el, NS.draw, 'code') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+            return;
+        }
+        else if (el.ns === NS.draw && el.local === 'plugin') {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, { mimeType: (0, context_1.clip)(oattr(el, NS.draw, 'mime-type') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+            return;
+        }
+        else if (el.ns === NS.draw && el.local === 'object-ole' && (href === undefined || (0, links_1.isInsidePackage)(href))) {
+            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, href ? { target: (0, context_1.clip)(href) } : undefined);
+            if (href && this.oleRefs.has(packagePath(href)))
+                this.oleRefs.set(packagePath(href), true);
+        }
+        for (const a of el.attributes) {
+            if (odfNs(a.ns) === NS.table && (a.local === 'formula' || a.local === 'expression') && (0, formulas_1.callsDde)(a.value))
+                this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, { formula: (0, context_1.clip)(a.value) });
+        }
+        if (href === undefined || (0, links_1.isFragment)(href) || (el.ns === NS.script && el.local === 'event-listener') || (el.ns === NS.presentation && el.local === 'event-listener'))
+            return;
+        // A database document names its own embedded database this way.
+        if (el.ns === NS.database && el.local === 'connection-resource' && /^sdbc:embedded:/i.test(href.trim()))
+            return;
+        if (LINK_ELEMENTS.has(key) || (el.ns === NS.form && el.local !== 'form'))
+            this.ctx.link(href, this.entry, { element: (0, context_1.clip)(el.qname) });
+        else if ((ALWAYS_OUTSIDE.has(key) || !(0, links_1.isInsidePackage)(href)) && !(el.ns === NS.form && el.local === 'form')) {
+            this.ctx.external(EXTERNAL_KIND.get(key) ?? types_1.OfficeDetail.Other, href, this.entry, { element: (0, context_1.clip)(el.qname) }, (0, context_1.clip)(el.local));
+        }
+    }
+    text(t) {
+        if (this.script && t.trim())
+            this.script.content = true;
+    }
+    end(el) {
+        if (this.scriptsDepth === el.depth && odfNs(el.ns) === NS.office && el.local === 'scripts')
+            this.scriptsDepth = 0;
+        if (this.script && this.script.depth === el.depth) {
+            if (this.script.content)
+                this.report(types_1.OfficeCategory.Macro, /basic/i.test(this.script.language) ? types_1.OfficeDetail.OdfBasic : types_1.OfficeDetail.OdfScripts, { language: (0, context_1.clip)(this.script.language) });
+            this.script = undefined;
+        }
+    }
+    scriptEvent(el, href) {
+        const event = oattr(el, NS.script, 'event-name') ?? '';
+        // LibreOffice runs nothing for a listener whose script URL and macro name are both empty. An empty href does not
+        // hide a macro name.
+        const target = [href, oattr(el, NS.script, 'macro-name')].find(v => v !== undefined && v !== '');
+        if (target === undefined)
+            return;
+        const name = event
+            .slice(event.lastIndexOf(':') + 1)
+            .toLowerCase()
+            .replace(/^on/, '')
+            .replace(/-/g, '');
+        const onOpen = ON_OPEN.has(name) || (this.scriptsDepth > 0 && ON_OPEN_DOCUMENT.has(name));
+        const data = { event: (0, context_1.clip)(event), target: (0, context_1.clip)(target), language: (0, context_1.clip)(oattr(el, NS.script, 'language') ?? '') };
+        if (onOpen)
+            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.EventOnOpen, data);
+        else
+            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, data);
+    }
+    presentationEvent(el, href) {
+        const action = oattr(el, NS.presentation, 'action') ?? '';
+        const data = { event: (0, context_1.clip)(oattr(el, NS.script, 'event-name') ?? ''), action: (0, context_1.clip)(action), ...(href ? { target: (0, context_1.clip)(href) } : {}) };
+        if (action === 'execute')
+            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, data);
+        else if (action === 'verb')
+            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, data);
+        else if (href !== undefined && !(0, links_1.isFragment)(href))
+            this.ctx.link(href, this.entry, data);
+    }
+}
+/** The manifest. Only paths that name an entry of the archive are kept, so a manifest of millions costs no memory. */
+async function readManifest(ctx, entry) {
+    const keys = new Set(ctx.zip.entries.map(e => (0, zip_1.nameKey)(e.name)));
+    const m = { paths: new Set(), encrypted: false };
+    await ctx.parse(entry, {
+        start(el) {
+            if (odfNs(el.ns) !== NS.manifest)
+                return;
+            if (el.local === 'encryption-data')
+                m.encrypted = true;
+            if (el.local !== 'file-entry')
+                return;
+            const path = oattr(el, NS.manifest, 'full-path');
+            if (path === undefined)
+                return;
+            if (path === '/') {
+                if (m.root !== undefined)
+                    ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, entry.name, { kind: 'manifest path', name: '/' });
+                m.root = oattr(el, NS.manifest, 'media-type') ?? '';
+                return;
+            }
+            const key = packagePath(path);
+            if (!keys.has(key))
+                return;
+            if (m.paths.has(key))
+                ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, entry.name, { kind: 'manifest path', name: (0, context_1.clip)(path) });
+            m.paths.add(key);
+        },
+    });
+    return m;
+}
+/** The code folder an entry sits in, as the folder's path and its finding. */
+function folderOf(name) {
+    const segs = name.split('/');
+    for (let i = 0; i < segs.length - 1; i++) {
+        const hit = FOLDERS.find(([folder]) => folder === segs[i].toLowerCase());
+        if (hit)
+            return { prefix: `${segs.slice(0, i + 1).join('/')}/`, detail: hit[1], category: hit[2] };
+    }
+    return undefined;
+}
+/** The most of the mimetype entry that is kept. The longest media type in the table is 56 characters. */
+const MAX_MIMETYPE = 256;
+/** Inspects an OpenDocument package. */
+async function inspectOdf(ctx) {
+    const zip = ctx.zip;
+    const mimetype = zip.entries.find(e => e.name === 'mimetype');
+    const manifestEntry = zip.get('META-INF/manifest.xml');
+    const layout = (reason) => ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.OdfLayout, mimetype?.name ?? 'META-INF/manifest.xml', { reason });
+    let declared;
+    if (mimetype) {
+        let head = Buffer.alloc(0);
+        await ctx.drain(mimetype, c => {
+            if (head.length < MAX_MIMETYPE)
+                head = Buffer.concat([head, c.subarray(0, MAX_MIMETYPE - head.length)]);
+        });
+        // A longer entry holds no media type this package reads, whatever its start says.
+        declared = head.toString('latin1') + (mimetype.size > MAX_MIMETYPE ? '...' : '');
+        const first = zip.entries.reduce((a, b) => (b.localOffset < a.localOffset ? b : a));
+        if (first !== mimetype)
+            layout('mimetype is not the first entry');
+        if (mimetype.method !== 0)
+            layout('mimetype is compressed');
+        if (mimetype.localExtra)
+            layout('mimetype has an extra field');
+        if (declared !== declared.trim())
+            layout('mimetype has white space around the media type');
+        declared = declared.trim();
+    }
+    else
+        layout('there is no mimetype entry');
+    const manifest = manifestEntry ? await readManifest(ctx, manifestEntry) : undefined;
+    if (!manifest)
+        layout('there is no manifest');
+    const root = manifest?.root;
+    if (declared !== undefined && root !== undefined && declared !== root && formats_1.ODF_FORMATS.has(declared) && formats_1.ODF_FORMATS.has(root)) {
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The mimetype entry and the manifest name different formats', { mimetype: (0, context_1.clip)(declared), manifest: (0, context_1.clip)(root) });
+    }
+    const type = declared ?? root ?? '';
+    const format = formats_1.ODF_FORMATS.get(type);
+    if (!format)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The OpenDocument media type is not one this package reads', { mediaType: (0, context_1.clip)(type) });
+    ctx.format = format;
+    if (manifest?.encrypted)
+        throw new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'The manifest lists encrypted entries');
+    const folders = new Map();
+    const oleRefs = new Map(zip.entries.map(e => [(0, zip_1.nameKey)(e.name), false]));
+    const oleEntries = [];
+    for (const entry of zip.entries) {
+        if (entry === mimetype || entry === manifestEntry)
+            continue;
+        const folder = folderOf(entry.name);
+        if (folder) {
+            // LibreOffice writes an empty Configurations2/accelerator/current.xml into the documents it saves. An empty
+            // file holds no code or setting.
+            if (entry.size > 0) {
+                const f = folders.get(folder.prefix) ?? { detail: folder.detail, category: folder.category, entries: 0 };
+                f.entries++;
+                folders.set(folder.prefix, f);
+            }
+            await ctx.drain(entry);
+        }
+        else if (!entry.directory && /\.xml$/i.test(entry.name))
+            await ctx.parse(entry, new EntryRules(ctx, entry.name, oleRefs));
+        else if (await ctx.drain(entry))
+            oleEntries.push(entry);
+    }
+    for (const [prefix, f] of folders)
+        ctx.report(f.category, f.detail, prefix, { entries: f.entries });
+    for (const e of oleEntries)
+        if (!oleRefs.get((0, zip_1.nameKey)(e.name)))
+            ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name });
+    if (manifest) {
+        for (const e of zip.entries) {
+            if (e.directory || e === mimetype || e === manifestEntry || /^meta-inf\//i.test(e.name))
+                continue;
+            if (!manifest.paths.has((0, zip_1.nameKey)(e.name)))
+                ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, e.name, { part: e.name });
+        }
+    }
+}

package/dist/offcrypto.d.ts

@@ -0,0 +1,31 @@
+import type { BiffRecord } from './biff';
+import type { CfbEntry, CompoundFile } from './cfb';
+import type { RunContext } from './context';
+import { type ByteSource } from './types';
+import type { Decrypt } from './xls';
+/** The password Excel opens a workbook with when nobody set one to open it (MS-OFFCRYPTO 2.4.3). */
+export declare const DEFAULT_PASSWORD = "VelvetSweatshop";
+/** RC4, which OpenSSL 3 leaves out of its default provider. */
+export declare class Rc4 {
+    private readonly s;
+    private i;
+    private j;
+    constructor(key: Uint8Array);
+    /** XORs the next keystream bytes into a copy of `data`. */
+    crypt(data: Uint8Array): Uint8Array;
+}
+/**
+ * Opens a workbook that its FILEPASS record (MS-XLS 2.4.117) encrypts with RC4 or RC4 CryptoAPI, with the caller's
+ * password or VelvetSweatshop. The records after FILEPASS are encrypted in 1024-byte blocks of the stream, each with its
+ * own key. Their headers are not, but take keystream bytes, and some records are never encrypted.
+ */
+export declare function unlockWorkbook(ctx: RunContext, filePass: BiffRecord, stream: string): Decrypt;
+/**
+ * Inspects an encrypted OOXML package: EncryptionInfo (MS-OFFCRYPTO 2.3.4) names the cipher, and the caller's password
+ * or VelvetSweatshop gives the key. The package it decrypts goes through the OOXML rules, read in place: Agile
+ * encryption works in 4,096-byte segments and Standard in 16-byte blocks, so nothing is decrypted that is not read.
+ */
+export declare function openPackage(ctx: RunContext, cfb: CompoundFile, info: CfbEntry, pkg: CfbEntry): Promise<{
+    source: ByteSource;
+    size: number;
+}>;