@patrickdk77/office-defuse 0.0.0-stage → 0.1.1

package/dist/oleobj.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf16 = exports.latin1 = exports.ByteReader = exports.Truncated = void 0;
+exports.bounded = bounded;
+exports.parseCompObj = parseCompObj;
+exports.readMoniker = readMoniker;
+exports.parseOleStream = parseOleStream;
+exports.parsePackage = parsePackage;
+exports.parseOle1 = parseOle1;
+const cfb_1 = require("./cfb");
+/** Thrown by ByteReader when a structure runs past the end of its bytes. Parsers catch it and keep what they read. */
+class Truncated extends Error {
+}
+exports.Truncated = Truncated;
+/** Runs `read`. A structure that runs past its data gives what `partial` returns instead, and any other error goes up. */
+function bounded(read, partial) {
+    try {
+        return read();
+    }
+    catch (e) {
+        if (e instanceof Truncated)
+            return partial();
+        throw e;
+    }
+}
+/** Little-endian reads over bytes in memory, bounded by their end. */
+class ByteReader {
+    b;
+    pos = 0;
+    constructor(b) {
+        this.b = b;
+    }
+    get left() {
+        return this.b.length - this.pos;
+    }
+    need(n) {
+        if (n < 0 || this.pos + n > this.b.length)
+            throw new Truncated('The structure runs past its data');
+        const at = this.pos;
+        this.pos += n;
+        return at;
+    }
+    u8() {
+        return this.b[this.need(1)];
+    }
+    u16() {
+        const at = this.need(2);
+        return this.b[at] | (this.b[at + 1] << 8);
+    }
+    u32() {
+        const at = this.need(4);
+        return (this.b[at] | (this.b[at + 1] << 8) | (this.b[at + 2] << 16) | (this.b[at + 3] << 24)) >>> 0;
+    }
+    bytes(n) {
+        const at = this.need(n);
+        return this.b.subarray(at, at + n);
+    }
+    skip(n) {
+        this.need(n);
+    }
+    /** An ANSI string ended by a NUL within `max` bytes, read as Latin-1. */
+    ansiz(max = 1024) {
+        const end = this.b.indexOf(0, this.pos);
+        if (end < 0 || end - this.pos >= max)
+            throw new Truncated('No NUL ends the string');
+        const s = (0, exports.latin1)(this.b.subarray(this.pos, end));
+        this.pos = end + 1;
+        return s;
+    }
+    /** A 32-bit byte count, then that many bytes of ANSI text whose last is a NUL. */
+    lengthPrefixedAnsi(max = 65536) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        if (n === 0)
+            return '';
+        const s = this.bytes(n);
+        return (0, exports.latin1)(s[n - 1] === 0 ? s.subarray(0, n - 1) : s);
+    }
+    /** A 32-bit count of UTF-16 code units, then the units, the last of which may be a NUL. */
+    lengthPrefixedUnicode(max = 32768) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        return (0, exports.utf16)(this.bytes(n * 2)).replace(/\0+$/, '');
+    }
+}
+exports.ByteReader = ByteReader;
+const latin1 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString('latin1');
+exports.latin1 = latin1;
+const utf16 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength - (b.byteLength % 2)).toString('utf16le');
+exports.utf16 = utf16;
+function parseCompObj(b) {
+    const r = new ByteReader(b);
+    const out = {};
+    return bounded(() => {
+        r.skip(28);
+        out.userType = r.lengthPrefixedAnsi();
+        const marker = r.u32();
+        if (marker === 0xffffffff || marker === 0xfffffffe)
+            r.skip(4);
+        else if (marker !== 0)
+            r.skip(marker);
+        // MS-OLEDS calls it Reserved1. Windows writes the ProgID there.
+        out.progId = r.lengthPrefixedAnsi();
+        return out;
+    }, () => out);
+}
+/** URL moniker, file moniker and composite moniker class ids (MS-OSHARED 2.3.7). */
+const URL_MONIKER = '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B';
+const FILE_MONIKER = '00000303-0000-0000-C000-000000000046';
+const COMPOSITE_MONIKER = '00000309-0000-0000-C000-000000000046';
+/**
+ * The address a moniker names: a URL moniker's URL, a file moniker's path, or the first of a composite's that names
+ * one. Other monikers name nothing this reads, and give ''. The reader stops after the moniker it reads.
+ */
+function readMoniker(r, depth = 0) {
+    const clsid = (0, cfb_1.guid)(r.bytes(16));
+    if (clsid === URL_MONIKER) {
+        const n = r.u32();
+        const raw = r.bytes(Math.min(n, r.left));
+        return { target: (0, exports.utf16)(raw).split('\0')[0], url: true };
+    }
+    if (clsid === FILE_MONIKER) {
+        const anti = r.u16();
+        const ansi = r.lengthPrefixedAnsi();
+        r.skip(2 + 2 + 16);
+        const unicodeSize = r.u32();
+        let path = ansi;
+        if (unicodeSize > 0) {
+            const bytes = r.u32();
+            r.skip(2);
+            path = (0, exports.utf16)(r.bytes(bytes));
+        }
+        return { target: '..\\'.repeat(Math.min(anti, 64)) + path, url: false };
+    }
+    if (clsid === COMPOSITE_MONIKER && depth < 8) {
+        const count = r.u32();
+        for (let i = 0; i < Math.min(count, 64); i++) {
+            const found = readMoniker(r, depth + 1);
+            if (found.target)
+                return found;
+        }
+    }
+    return { target: '', url: false };
+}
+function parseOleStream(b) {
+    const r = new ByteReader(b);
+    const out = { linked: false, target: '', url: false };
+    return bounded(() => {
+        r.skip(4);
+        out.linked = (r.u32() & 1) === 1;
+        if (!out.linked)
+            return out;
+        r.skip(8);
+        r.skip(r.u32());
+        // The relative moniker comes first, then the absolute one, which Office prefers when both resolve.
+        const monikers = [];
+        for (let i = 0; i < 2; i++) {
+            const size = r.u32();
+            if (size > 0)
+                monikers.push(readMoniker(new ByteReader(r.bytes(size))));
+        }
+        return Object.assign(out, monikers.reverse().find(m => m.target));
+    }, () => out);
+}
+/**
+ * Packager's native data, as oleobj reads it: a 16-bit type, the label and source path ended by NULs, eight bytes,
+ * the temporary path ended by a NUL, and the size of the file's data. Without the size it is a link. Undefined when it
+ * does not read that far.
+ */
+function parsePackage(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(2);
+        const fileName = r.ansiz();
+        const sourcePath = r.ansiz();
+        r.skip(8);
+        const tempPath = r.ansiz();
+        return bounded(() => ({ fileName, sourcePath, tempPath, embedded: true, size: r.u32() }), () => ({ fileName, sourcePath, tempPath, embedded: false, size: 0 }));
+    }, () => undefined);
+}
+function parseOle1(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(4);
+        const formatId = r.u32();
+        if (formatId !== 1 && formatId !== 2)
+            return { formatId, className: '', topicName: '', itemName: '' };
+        const className = r.lengthPrefixedAnsi();
+        const topicName = r.lengthPrefixedAnsi();
+        const itemName = r.lengthPrefixedAnsi();
+        if (formatId === 1)
+            return { formatId, className, topicName, itemName };
+        const size = r.u32();
+        return { formatId, className, topicName, itemName, data: r.bytes(Math.min(size, r.left)) };
+    }, () => undefined);
+}

package/dist/ooxml.d.ts

@@ -0,0 +1,8 @@
+import { type ZipContext } from './context';
+import { type ZipEntry } from './zip';
+/**
+ * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
+ * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
+ * leave behind only which parts they reach and how.
+ */
+export declare function inspectOoxml(ctx: ZipContext, contentTypes: ZipEntry): Promise<void>;

package/dist/ooxml.js

@@ -0,0 +1,468 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectOoxml = inspectOoxml;
+const biff_1 = require("./biff");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const fields_1 = require("./fields");
+const formats_1 = require("./formats");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const xlsb_1 = require("./xlsb");
+const xml_1 = require("./xml");
+const zip_1 = require("./zip");
+const CONTENT_TYPES_NS = 'http://schemas.openxmlformats.org/package/2006/content-types';
+const RELS_NS = 'http://schemas.openxmlformats.org/package/2006/relationships';
+const T = 'http://schemas.openxmlformats.org/officedocument/2006/relationships/';
+const S = 'http://purl.oclc.org/ooxml/officedocument/relationships/';
+const MS = 'http://schemas.microsoft.com/office/2006/relationships/';
+const both = (name) => [T + name, S + name];
+/** Relationship types, lowercased, as OPC compares them without regard to case. */
+const REL = {
+    main: new Set([...both('officedocument'), 'http://schemas.microsoft.com/visio/2010/relationships/document']),
+    hyperlink: new Set(both('hyperlink')),
+    template: new Set(both('attachedtemplate')),
+    image: new Set([...both('image'), 'http://schemas.microsoft.com/office/2007/relationships/hdphoto']),
+    frame: new Set(both('frame')),
+    subDocument: new Set(both('subdocument')),
+    workbook: new Set([
+        ...both('externallinkpath'),
+        `${MS}xlexternallinkpath/xlpathmissing`,
+        `${MS}xlexternallinkpath/xlstartup`,
+        `${MS}xlexternallinkpath/xlalternatestartup`,
+        `${MS}xlexternallinkpath/xllibrary`,
+    ]),
+};
+/** Relationship types that say what the part they reach is. Each is a bit of Part.reachedAs. */
+const AS = { vba: 1, macrosheet: 2, ole: 4, package: 8, control: 16, controlBinary: 32 };
+const REACHED_AS = new Map([
+    [`${MS}vbaproject`, AS.vba],
+    [`${MS}xlmacrosheet`, AS.macrosheet],
+    [`${MS}xlintlmacrosheet`, AS.macrosheet],
+    ...both('oleobject').map((t) => [t, AS.ole]),
+    ...both('package').map((t) => [t, AS.package]),
+    ...both('control').map((t) => [t, AS.control]),
+    [`${MS}activexcontrolbinary`, AS.controlBinary],
+]);
+/** Content types, lowercased. */
+const TYPE = {
+    vba: new Set(['application/vnd.ms-office.vbaproject']),
+    macrosheet: new Set(['application/vnd.ms-excel.macrosheet+xml', 'application/vnd.ms-excel.intlmacrosheet+xml', 'application/vnd.ms-excel.macrosheet', 'application/vnd.ms-excel.intlmacrosheet']),
+    ole: new Set(['application/vnd.openxmlformats-officedocument.oleobject']),
+    control: new Set(['application/vnd.ms-office.activex+xml']),
+    controlBinary: new Set(['application/vnd.ms-office.activex']),
+    vml: 'application/vnd.openxmlformats-officedocument.vmldrawing',
+    xlsbExternalLink: 'application/vnd.ms-excel.externallink',
+};
+/** Relationship types that leave the package, by the finding they make. Any other is EXTERNAL/OTHER. */
+const EXTERNAL_KINDS = [
+    [REL.template, types_1.OfficeDetail.Template],
+    [new Set([...both('oleobject'), ...both('package')]), types_1.OfficeDetail.Object],
+    [REL.image, types_1.OfficeDetail.Image],
+    [REL.frame, types_1.OfficeDetail.Frame],
+    [REL.subDocument, types_1.OfficeDetail.Include],
+    [REL.workbook, types_1.OfficeDetail.Workbook],
+];
+const WORD_NS = new Set(['http://schemas.openxmlformats.org/wordprocessingml/2006/main', 'http://purl.oclc.org/ooxml/wordprocessingml/main']);
+const SHEET_NS = new Set(['http://schemas.openxmlformats.org/spreadsheetml/2006/main', 'http://purl.oclc.org/ooxml/spreadsheetml/main']);
+const XDR_NS = new Set(['http://schemas.openxmlformats.org/drawingml/2006/spreadsheetdrawing', 'http://purl.oclc.org/ooxml/drawingml/spreadsheetdrawing']);
+const R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/relationships', 'http://purl.oclc.org/ooxml/officedocument/relationships']);
+const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/customui', 'http://schemas.microsoft.com/office/2009/07/customui']);
+const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
+const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
+const VISIO_CODE = /\b(RUNADDON|RUNADDONWARGS|CALLTHIS|RUNMACRO|OPENFILE|DOOLEVERB)\s*\(/i;
+/** A Word attribute, qualified as Word writes it or unqualified. */
+const wordAttr = (el, local) => el.attributes.find(a => a.local === local && (a.ns === '' || WORD_NS.has(a.ns.toLowerCase())))?.value;
+/** The key of the part a relationships part belongs to, '' for the package, or undefined for any other part. */
+const relsSource = (relsName) => {
+    const m = /^(.*?)_rels\/([^/]*)\.rels$/i.exec(relsName);
+    return m ? (0, zip_1.nameKey)(m[1] + m[2]) : undefined;
+};
+/**
+ * Resolves an internal target against the folder of the part it belongs to, as RFC 3986 resolves a relative
+ * reference: a ".." at the root of the package stays at the root. LibreOffice writes "../customXml/item1.xml" in the
+ * package relationships of workbooks it saves.
+ */
+function resolveTarget(relsName, target) {
+    const folder = relsName.slice(0, relsName.toLowerCase().indexOf('_rels/'));
+    const path = (target.startsWith('/') ? target.slice(1) : folder + target).split('#')[0];
+    const out = [];
+    for (const seg of path.split('/')) {
+        if (seg === '..')
+            out.pop();
+        else if (seg !== '.' && seg !== '')
+            out.push(seg);
+    }
+    return (0, zip_1.nameKey)(out.join('/'));
+}
+const duplicate = (ctx, location, kind, name) => ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, location, { kind, name: (0, context_1.clip)(name) });
+/**
+ * The defaults and overrides of [Content_Types].xml. Only those that type an entry of the archive are kept, so a
+ * part full of declarations costs no memory. Two that type the same entry make PACKAGE/DUPLICATE_ENTRY.
+ */
+async function readContentTypes(ctx, entry) {
+    const keys = new Set(ctx.zip.entries.map(e => (0, zip_1.nameKey)(e.name)));
+    const extensions = new Set(ctx.zip.entries.map(e => /\.([^./]*)$/.exec(e.name)?.[1]?.toLowerCase() ?? ''));
+    const defaults = new Map();
+    const overrides = new Map();
+    await ctx.parse(entry, {
+        start(el) {
+            if (el.ns.toLowerCase() !== CONTENT_TYPES_NS)
+                return;
+            const type = (0, xml_1.attr)(el, '', 'ContentType')?.trim().toLowerCase();
+            if (type === undefined)
+                return;
+            if (el.local === 'Default') {
+                const ext = (0, xml_1.attr)(el, '', 'Extension')?.toLowerCase();
+                if (ext === undefined || !extensions.has(ext))
+                    return;
+                if (defaults.has(ext))
+                    duplicate(ctx, entry.name, 'content type default', ext);
+                defaults.set(ext, type);
+            }
+            else if (el.local === 'Override') {
+                const name = (0, xml_1.attr)(el, '', 'PartName');
+                if (name === undefined)
+                    return;
+                const key = (0, zip_1.nameKey)(name.replace(/^\//, ''));
+                if (!keys.has(key))
+                    return;
+                if (overrides.has(key))
+                    duplicate(ctx, entry.name, 'content type override', name);
+                overrides.set(key, type);
+            }
+        },
+    });
+    return { defaults, overrides };
+}
+/** Reads a relationships part and hands each relationship to `each` as it is read. Ids given twice are reported. */
+async function readRelationships(ctx, entry, each) {
+    const ids = new Set();
+    await ctx.parse(entry, {
+        start(el) {
+            if (el.ns.toLowerCase() !== RELS_NS || el.local !== 'Relationship')
+                return;
+            const id = (0, xml_1.attr)(el, '', 'Id') ?? '';
+            if (ids.has(id))
+                duplicate(ctx, entry.name, 'relationship Id', id);
+            ids.add(id);
+            const target = (0, xml_1.attr)(el, '', 'Target');
+            if (target === undefined)
+                return;
+            const mode = ((0, xml_1.attr)(el, '', 'TargetMode') ?? 'Internal').trim().toLowerCase();
+            each({ id, type: ((0, xml_1.attr)(el, '', 'Type') ?? '').trim().toLowerCase(), target, external: mode !== 'internal' || (0, links_1.isAbsoluteTarget)(target) });
+        },
+    });
+}
+/** Word field codes in WordprocessingML: fldSimple, and fldChar marks around instrText. */
+class Fields {
+    stack;
+    capture = false;
+    constructor(ctx, part) {
+        this.stack = new fields_1.FieldStack(ctx, part);
+    }
+    start(el) {
+        if (el.local === 'fldSimple')
+            this.stack.simple(wordAttr(el, 'instr') ?? '');
+        else if (el.local === 'fldChar') {
+            const kind = wordAttr(el, 'fldCharType');
+            if (kind === 'begin')
+                this.stack.begin();
+            else if (kind === 'separate')
+                this.stack.separate();
+            else if (kind === 'end')
+                this.stack.end();
+        }
+        else if (el.local === 'instrText' || el.local === 'delInstrText')
+            this.capture = true;
+    }
+    end(el) {
+        if (el.local === 'instrText' || el.local === 'delInstrText')
+            this.capture = false;
+    }
+    text(t) {
+        if (this.capture)
+            this.stack.text(t);
+    }
+    finish() {
+        this.stack.finish();
+    }
+}
+/** Text that may run long. Detection needs only whether it holds more than white space; the report shows its start. */
+class Shown {
+    text = '';
+    content = false;
+    add(t) {
+        if (/\S/.test(t))
+            this.content = true;
+        if (this.text.length < 200)
+            this.text = this.text ? this.text + t : t.trimStart();
+    }
+}
+/** The rules that read inside one XML part of an OOXML package. */
+class PartRules {
+    ctx;
+    part;
+    fields;
+    /**
+     * The formula being read, with a check for DDE that sees all of it however long it is, and the first external
+     * entity whose content stands in it, which could hold the DDE reference or move the quotes around one.
+     */
+    formula;
+    macroText;
+    /** The last namespace seen and its lowercase form. Neighboring elements share one, and this spares a copy each. */
+    ns = '';
+    lower = '';
+    constructor(ctx, part) {
+        this.ctx = ctx;
+        this.part = part;
+        this.fields = new Fields(ctx, part);
+    }
+    lowerNs(el) {
+        if (el.ns !== this.ns) {
+            this.ns = el.ns;
+            this.lower = el.ns.toLowerCase();
+        }
+        return this.lower;
+    }
+    start(el) {
+        const ns = this.lowerNs(el);
+        if (CUSTOM_UI_NS.has(ns)) {
+            if (el.depth === 1)
+                this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Ribbon, this.part);
+            for (const a of el.attributes) {
+                if (a.ns === '' && a.value.trim() && /^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
+                    this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` });
+            }
+            return;
+        }
+        if (WORD_NS.has(ns))
+            this.fields.start(el);
+        else if (SHEET_NS.has(ns)) {
+            if (el.local === 'f' || el.local === 'definedName')
+                this.formula = { shown: new Shown(), quotes: new formulas_1.Quotes(), ddeBar: false };
+            if (el.local === 'definedName') {
+                // Excel runs the macro a name like _xlnm.Auto_Open refers to, as it does in a binary workbook.
+                const name = (0, xml_1.attr)(el, '', 'name') ?? '';
+                const auto = (0, biff_1.autoName)(name);
+                if (auto)
+                    this.ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, this.part, { event: auto.event, name: (0, context_1.clip)(name) });
+            }
+            else if (el.local === 'ddeLink')
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, this.part, { application: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeService') ?? ''), topic: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeTopic') ?? '') });
+        }
+        else if (XDR_NS.has(ns)) {
+            const macro = (0, xml_1.attr)(el, '', 'macro');
+            if (macro?.trim())
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) });
+        }
+        else if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro')
+            this.macroText = new Shown();
+        else if (ns === VISIO_NS && el.local === 'Cell')
+            this.visioCell(el);
+        if (el.local === 'hlinkClick' || el.local === 'hlinkHover' || el.local === 'hlinkMouseOver')
+            this.drawingAction(el);
+    }
+    text(t) {
+        this.fields.text(t);
+        const f = this.formula;
+        if (f) {
+            f.shown.add(t);
+            // Excel writes a DDE reference as application|topic!item, and "|" means nothing else outside quotes.
+            for (const c of t)
+                if (f.quotes.outside(c) && c === '|')
+                    f.ddeBar = true;
+            if (f.entity === undefined && t.includes(xml_1.UNKNOWN))
+                f.entity = (0, xml_1.unknownEntity)(t);
+        }
+        this.macroText?.add(t);
+    }
+    end(el) {
+        const ns = this.lowerNs(el);
+        if (WORD_NS.has(ns))
+            this.fields.end(el);
+        if (SHEET_NS.has(ns) && (el.local === 'f' || el.local === 'definedName') && this.formula) {
+            const { ddeBar, entity, shown } = this.formula;
+            if (ddeBar)
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text) });
+            else if (entity !== undefined)
+                this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, this.part, { formula: (0, context_1.clip)(shown.text), entity: (0, context_1.clip)(entity) });
+            this.formula = undefined;
+        }
+        if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
+            if (this.macroText.content)
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.text.trim()) });
+            this.macroText = undefined;
+        }
+        if (el.depth === 1)
+            this.fields.finish();
+    }
+    /** PowerPoint action settings, in a DrawingML hyperlink's action attribute. The relationship it names is reported on its own. */
+    drawingAction(el) {
+        const written = ((0, xml_1.attr)(el, '', 'action') ?? '').trim();
+        const action = written.toLowerCase();
+        if (!action)
+            return;
+        const id = el.attributes.find(a => a.local === 'id' && R_NS.has(a.ns.toLowerCase()))?.value;
+        const data = { trigger: el.local, action: (0, context_1.clip)(written), ...(id === undefined ? {} : { relationship: (0, context_1.clip)(id) }) };
+        if (action.startsWith('ppaction://program'))
+            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data);
+        else if (action.startsWith('ppaction://macro'))
+            this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data);
+        else if (action.startsWith('ppaction://ole'))
+            this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data);
+    }
+    visioCell(el) {
+        const n = (0, xml_1.attr)(el, '', 'N') ?? '';
+        const formula = (0, xml_1.attr)(el, '', 'F') ?? '';
+        if (VISIO_CODE.test(formula)) {
+            if (n.startsWith('Event'))
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, this.part, { event: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+            else
+                this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { cell: (0, context_1.clip)(n), formula: (0, context_1.clip)(formula) });
+        }
+        const v = (0, xml_1.attr)(el, '', 'V');
+        if (n === 'Address' && v?.trim() && !(0, links_1.isFragment)(v))
+            this.ctx.link(v, this.part, { source: 'Visio hyperlink' });
+    }
+}
+/**
+ * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
+ * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
+ * leave behind only which parts they reach and how.
+ */
+async function inspectOoxml(ctx, contentTypes) {
+    const { defaults, overrides } = await readContentTypes(ctx, contentTypes);
+    const parts = new Map();
+    const relsOf = new Map();
+    for (const entry of ctx.zip.entries) {
+        if (entry === contentTypes)
+            continue;
+        // OPC has no folders. A directory entry is still inflated once, so its bytes are checked like any other.
+        if (entry.directory) {
+            await ctx.drain(entry);
+            continue;
+        }
+        const source = relsSource(entry.name);
+        if (source !== undefined) {
+            relsOf.set(source, entry);
+            continue;
+        }
+        const key = (0, zip_1.nameKey)(entry.name);
+        const ext = /\.([^./]*)$/.exec(entry.name)?.[1]?.toLowerCase();
+        parts.set(key, { entry, contentType: overrides.get(key) ?? (ext === undefined ? undefined : defaults.get(ext)), reachedAs: 0, claimed: false, targets: new Set(), ole: false });
+    }
+    const roots = new Set();
+    const mains = [];
+    const relate = (rels, from, r) => {
+        const location = `${rels.name}, ${(0, context_1.clip)(r.id)}`;
+        const part = r.external ? undefined : parts.get(resolveTarget(rels.name, r.target));
+        if (part) {
+            part.reachedAs |= REACHED_AS.get(r.type) ?? 0;
+            if (TYPE.control.has(from?.contentType ?? ''))
+                part.claimed = true;
+            (from?.targets ?? roots).add(part);
+        }
+        // A hyperlink to a part of the package, or to a place in the document, goes nowhere else.
+        if (REL.hyperlink.has(r.type)) {
+            if (!part && !(0, links_1.isFragment)(r.target))
+                ctx.link(r.target, location);
+        }
+        else if (r.external) {
+            const kind = EXTERNAL_KINDS.find(([types]) => types.has(r.type))?.[1] ?? types_1.OfficeDetail.Other;
+            ctx.external(kind, r.target, location, { type: (0, context_1.clip)(r.type) }, (0, context_1.clip)(r.type.slice(r.type.lastIndexOf('/') + 1)));
+        }
+    };
+    const packageRels = relsOf.get('');
+    if (packageRels) {
+        await readRelationships(ctx, packageRels, r => {
+            if (REL.main.has(r.type))
+                mains.push(r.external ? undefined : parts.get(resolveTarget(packageRels.name, r.target)));
+            relate(packageRels, undefined, r);
+        });
+    }
+    if (mains.length > 1)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The package names more than one main part', { reason: 'more than one main part' });
+    const main = mains[0];
+    if (!main)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The package has no main part', { reason: 'no main document part' });
+    const format = formats_1.OOXML_FORMATS.get(main.contentType ?? '');
+    if (!format)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The main part has an unknown content type', { contentType: (0, context_1.clip)(main.contentType ?? '') });
+    ctx.format = format;
+    for (const [key, p] of parts) {
+        const ct = p.contentType;
+        if (ct === undefined) {
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, p.entry.name, { part: p.entry.name });
+            p.ole = await ctx.drain(p.entry);
+        }
+        else if (ct.endsWith('+xml') || ct === 'application/xml' || ct === 'text/xml' || ct === TYPE.vml) {
+            await ctx.parse(p.entry, new PartRules(ctx, p.entry.name), ct === TYPE.vml);
+        }
+        else if (ct === TYPE.xlsbExternalLink) {
+            // The binary form of an Excel ddeLink.
+            const links = new xlsb_1.XlsbLinks();
+            p.ole = await ctx.drain(p.entry, c => links.write(c));
+            for (const l of links.dde)
+                ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, p.entry.name, { application: (0, context_1.clip)(l.application), topic: (0, context_1.clip)(l.topic) });
+        }
+        else
+            p.ole = await ctx.drain(p.entry);
+        const rels = relsOf.get(key);
+        if (rels)
+            await readRelationships(ctx, rels, r => relate(rels, p, r));
+    }
+    // Relationships of parts that are not there still say what the parts they reach are.
+    for (const [source, rels] of relsOf)
+        if (source !== '' && !parts.has(source))
+            await readRelationships(ctx, rels, r => relate(rels, undefined, r));
+    for (const p of parts.values())
+        partRules(ctx, p);
+    unreferenced(ctx, parts, relsOf, roots);
+}
+/** Findings about a whole part, from its content type and the relationships that reach it. */
+function partRules(ctx, p) {
+    const ct = p.contentType ?? '';
+    const loc = p.entry.name;
+    const data = { part: loc, contentType: (0, context_1.clip)(ct) };
+    const as = (bit) => (p.reachedAs & bit) !== 0;
+    const vba = TYPE.vba.has(ct) || as(AS.vba);
+    const ole = TYPE.ole.has(ct) || as(AS.ole);
+    const control = TYPE.control.has(ct) || as(AS.control);
+    const controlBinary = TYPE.controlBinary.has(ct) || as(AS.controlBinary);
+    const pkg = as(AS.package);
+    if (vba)
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data);
+    if (TYPE.macrosheet.has(ct) || as(AS.macrosheet))
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data);
+    if (ole)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data);
+    if (pkg)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data);
+    if (control || (controlBinary && !p.claimed))
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data);
+    if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data);
+}
+/** Parts that no chain of internal relationships reaches from the package. */
+function unreferenced(ctx, parts, relsOf, roots) {
+    const reached = new Set(roots);
+    const queue = [...roots];
+    for (let p = queue.pop(); p; p = queue.pop()) {
+        for (const t of p.targets) {
+            if (reached.has(t))
+                continue;
+            reached.add(t);
+            queue.push(t);
+        }
+    }
+    for (const p of parts.values())
+        if (!reached.has(p))
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, p.entry.name, { part: p.entry.name });
+    for (const [source, rels] of relsOf) {
+        const owner = parts.get(source);
+        if (source !== '' && !(owner && reached.has(owner)))
+            ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, rels.name, { part: rels.name });
+    }
+}

package/dist/package.d.ts

@@ -0,0 +1,3 @@
+import type { ZipContext } from './context';
+/** Inspects an OOXML or OpenDocument package, which its markers name. */
+export declare function inspectPackage(ctx: ZipContext): Promise<void>;