@patrickdk77/office-defuse 0.1.0 → 0.1.1

package/dist/crc32.js

@@ -1,7 +1,41 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.crc32 = crc32;
-// zlib.crc32 arrived in Node 22.2, and the package supports every Node 22.
+exports.crc32 = void 0;
+exports.tableCrc32 = tableCrc32;
+const zlib = __importStar(require("node:zlib"));
 const TABLE = new Uint32Array(256);
 for (let n = 0; n < 256; n++) {
     let c = n;
@@ -9,10 +43,16 @@ for (let n = 0; n < 256; n++) {
         c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
     TABLE[n] = c >>> 0;
 }
-/** Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. */
-function crc32(bytes, crc = 0) {
+/** Continues a CRC-32, the one ZIP uses, over `bytes`, with a lookup table. Start from 0. */
+function tableCrc32(bytes, crc = 0) {
     let c = ~crc >>> 0;
     for (const b of bytes)
         c = TABLE[(c ^ b) & 0xff] ^ (c >>> 8);
     return ~c >>> 0;
 }
+/**
+ * Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. This is zlib.crc32 where Node has it, about 50
+ * times faster, and the table otherwise. Node 18 and early releases of Node 20 and 22 lack it. The choice is made
+ * once, when the module loads.
+ */
+exports.crc32 = zlib.crc32 ?? tableCrc32;

package/dist/engine.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspectOfficeSource = inspectOfficeSource;
 exports.inspectOffice = inspectOffice;
+const cfb_1 = require("./cfb");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const findings_1 = require("./findings");
 const io_1 = require("./io");
-const odf_1 = require("./odf");
-const ooxml_1 = require("./ooxml");
+const ole_1 = require("./ole");
+const package_1 = require("./package");
+const rtf_1 = require("./rtf");
 const score_1 = require("./score");
 const types_1 = require("./types");
 const zip_1 = require("./zip");
@@ -20,6 +22,7 @@ const DEFAULT_LIMITS = {
     xmlEntityDepth: 16,
     xmlEntityExpansions: 100_000,
     xmlEntitySize: 16 * 1024 * 1024,
+    rtfDepth: 256,
 };
 function resolveLimits(given = {}) {
     return {
@@ -31,6 +34,7 @@ function resolveLimits(given = {}) {
         xmlEntityDepth: given.xmlEntityDepth ?? DEFAULT_LIMITS.xmlEntityDepth,
         xmlEntityExpansions: given.xmlEntityExpansions ?? DEFAULT_LIMITS.xmlEntityExpansions,
         xmlEntitySize: given.xmlEntitySize ?? DEFAULT_LIMITS.xmlEntitySize,
+        rtfDepth: given.rtfDepth ?? DEFAULT_LIMITS.rtfDepth,
         fileSize: given.fileSize,
         timeMs: given.timeMs,
     };
@@ -82,6 +86,44 @@ function guarded(source) {
     };
     return g;
 }
+const ambiguous = (reason) => new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, `The file is ${reason}`, { reason });
+/**
+ * Reads the file's container. A file that starts with the compound file signature is read as one, and one that
+ * starts with {\rt is RTF, which is how Word tells them. The ZIP reader runs too, from the end: a file both read is
+ * ambiguous, since Office goes by the first bytes and a ZIP reader by the last. A compound file that does not read is
+ * a ZIP archive with data in front, if the ZIP reader read one. Word reads any file that starts with {\rt as RTF, so
+ * that does not fail.
+ */
+async function openContainer(src, size, limits, settings) {
+    const head = await src.read(0, Math.min(8, size));
+    const cfbSignature = head.length === 8 && head.every((b, i) => b === cfb_1.CFB_SIGNATURE[i]);
+    const rtfSignature = Buffer.from(head.subarray(0, 4)).toString('latin1') === '{\\rt';
+    const probe = cfbSignature || rtfSignature
+        ? await zip_1.ZipArchive.open(src, limits, settings.deadline).catch((e) => {
+            if (e instanceof errors_1.StopError)
+                return undefined;
+            throw e;
+        })
+        : undefined;
+    if (rtfSignature) {
+        if (probe)
+            throw ambiguous('both RTF and a ZIP archive');
+        return { kind: 'rtf' };
+    }
+    if (cfbSignature) {
+        try {
+            const cfb = await cfb_1.CompoundFile.open(src, settings, settings.deadline);
+            if (probe)
+                throw ambiguous('both a compound file and a ZIP archive');
+            return { kind: 'cfb', cfb };
+        }
+        catch (e) {
+            if (!probe || !(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+                throw e;
+        }
+    }
+    return { kind: 'zip', zip: probe ?? (await zip_1.ZipArchive.open(src, limits, settings.deadline)) };
+}
 /** Inspects an Office or OpenDocument file without changing it. The source is closed when the run ends. */
 async function inspectOfficeSource(source, options = {}) {
     const limits = resolveLimits(options.limits);
@@ -89,40 +131,47 @@ async function inspectOfficeSource(source, options = {}) {
     const factory = new findings_1.FindingFactory(options.actionOverrides);
     const findings = [];
     const src = guarded(source);
-    let ctx;
+    const settings = {
+        entries: limits.entries,
+        decompressedBytes: limits.decompressedBytes,
+        totalDecompressedBytes: limits.totalDecompressedBytes,
+        rtfDepth: limits.rtfDepth,
+        deadline,
+        password: options.password,
+    };
+    const ctx = new context_1.RunContext(factory, {
+        depth: limits.xmlDepth,
+        tokenSize: limits.xmlTokenSize,
+        entityDepth: limits.xmlEntityDepth,
+        entityExpansions: limits.xmlEntityExpansions,
+        entitySize: limits.xmlEntitySize,
+    }, settings);
     try {
         const size = await src.size();
         if (limits.fileSize !== undefined && size > limits.fileSize)
             throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.FileSize, `${size} bytes`, { size, limit: limits.fileSize });
         (0, errors_1.checkTime)(deadline);
-        const zip = await zip_1.ZipArchive.open(src, limits, deadline);
-        for (const n of zip.notes)
-            findings.push(factory.make(types_1.OfficeCategory.Container, n.detail, undefined, { bytes: n.bytes }));
-        ctx = new context_1.RunContext(zip, factory, {
-            depth: limits.xmlDepth,
-            tokenSize: limits.xmlTokenSize,
-            entityDepth: limits.xmlEntityDepth,
-            entityExpansions: limits.xmlEntityExpansions,
-            entitySize: limits.xmlEntitySize,
-        });
-        const contentTypes = zip.get('[Content_Types].xml');
-        const odf = zip.entries.some(e => e.name === 'mimetype') || zip.get('META-INF/manifest.xml') !== undefined;
-        if (contentTypes && odf)
-            throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The file has both [Content_Types].xml and an OpenDocument mimetype or manifest', { reason: 'OOXML and OpenDocument markers' });
-        if (contentTypes)
-            await (0, ooxml_1.inspectOoxml)(ctx, contentTypes);
-        else if (odf)
-            await (0, odf_1.inspectOdf)(ctx);
-        else
-            throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The archive has neither [Content_Types].xml nor an OpenDocument mimetype or manifest', { reason: 'a plain ZIP archive' });
+        const container = await openContainer(src, size, limits, settings);
+        if (container.kind === 'rtf')
+            await (0, rtf_1.inspectRtf)(ctx, src, size);
+        else if (container.kind === 'cfb') {
+            for (const n of container.cfb.notes)
+                findings.push(factory.make(types_1.OfficeCategory.Container, n.detail, undefined, { bytes: n.bytes }));
+            await (0, ole_1.inspectCompound)(ctx, container.cfb);
+        }
+        else {
+            const zip = container.zip;
+            for (const n of zip.notes)
+                findings.push(factory.make(types_1.OfficeCategory.Container, n.detail, undefined, { bytes: n.bytes }));
+            await (0, package_1.inspectPackage)(ctx.withZip(zip));
+        }
         findings.push(...ctx.findings);
         return finish(findings, options, false, ctx.format);
     }
     catch (e) {
         if (src.failure !== undefined)
             throw src.failure;
-        if (ctx)
-            findings.push(...ctx.findings);
+        findings.push(...ctx.findings);
         if (e instanceof errors_1.StopError) {
             findings.push(factory.make(e.category, e.detail, e.location ?? (typeof e.data?.name === 'string' ? e.data.name : undefined), { ...e.data, reason: e.data?.reason ?? e.message }));
         }
@@ -134,7 +183,7 @@ async function inspectOfficeSource(source, options = {}) {
             // Anything unexpected rejects the file rather than escaping as an exception.
             findings.push(factory.make(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unreadable, undefined, { reason: String(e?.message ?? e).slice(0, 200) }));
         }
-        return finish(findings, options, true, ctx?.format);
+        return finish(findings, options, true, ctx.format);
     }
     finally {
         try {

package/dist/fields.d.ts

@@ -0,0 +1,29 @@
+import { type RunContext } from './context';
+/**
+ * Reports a Word field by its code. A field whose name holds the content of an external entity has a type the file
+ * does not say, as one whose name another field builds does.
+ */
+export declare function evaluateField(ctx: RunContext, location: string, code: string, computed: boolean): void;
+/**
+ * Word field codes, followed through nested fields as the text of a document arrives: a field begins, its code
+ * comes, a separator starts its result, and it ends. Each format says where those marks are.
+ */
+export declare class FieldStack {
+    private readonly ctx;
+    private readonly location;
+    private readonly stack;
+    constructor(ctx: RunContext, location: string);
+    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
+    begin(): void;
+    /** A field that is all code, such as OOXML's fldSimple. */
+    simple(code: string): void;
+    separate(): void;
+    end(): void;
+    /** Whether a field's code is being read now. */
+    get inCode(): boolean;
+    /** Text of the innermost field's code. White space before the first word counts for nothing, so no amount of it can push the field's name out. */
+    text(t: string): void;
+    /** A document can end inside a field. Word still reads the code it has. */
+    finish(): void;
+    private nest;
+}

package/dist/fields.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldStack = void 0;
+exports.evaluateField = evaluateField;
+const context_1 = require("./context");
+const formulas_1 = require("./formulas");
+const links_1 = require("./links");
+const types_1 = require("./types");
+const xml_1 = require("./xml");
+/** How much of a field code is kept, counted from its first word, which names the field. */
+const MAX_FIELD_CODE = 4096;
+/**
+ * Reports a Word field by its code. A field whose name holds the content of an external entity has a type the file
+ * does not say, as one whose name another field builds does.
+ */
+function evaluateField(ctx, location, code, computed) {
+    const data = { code: (0, context_1.clip)(code.trim()) };
+    const words = (0, formulas_1.fieldWords)(code);
+    const first = words[0]?.text ?? '';
+    const entity = (0, xml_1.unknownEntity)(first);
+    if (computed || entity !== undefined)
+        ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, location, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) });
+    const name = first.toUpperCase();
+    // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
+    const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
+    const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
+    if (name === 'DDE' || name === 'DDEAUTO')
+        ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, location, data);
+    else if (name === 'MACROBUTTON')
+        ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') });
+    else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
+        const target = arg(name === 'LINK' ? 2 : 1);
+        if (target === undefined)
+            ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, location, data);
+        else
+            ctx.external(types_1.OfficeDetail.Include, target, location, data, 'field');
+    }
+    else if (name === 'HYPERLINK') {
+        const target = arg(1);
+        if (target !== undefined && !(0, links_1.isFragment)(target))
+            ctx.link(target, location, { ...data, source: 'HYPERLINK field' });
+    }
+}
+/**
+ * Word field codes, followed through nested fields as the text of a document arrives: a field begins, its code
+ * comes, a separator starts its result, and it ends. Each format says where those marks are.
+ */
+class FieldStack {
+    ctx;
+    location;
+    stack = [];
+    constructor(ctx, location) {
+        this.ctx = ctx;
+        this.location = location;
+    }
+    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
+    begin() {
+        this.nest();
+        this.stack.push({ code: '', inCode: true, computed: false });
+    }
+    /** A field that is all code, such as OOXML's fldSimple. */
+    simple(code) {
+        this.nest();
+        evaluateField(this.ctx, this.location, code, false);
+    }
+    separate() {
+        const top = this.stack[this.stack.length - 1];
+        if (top)
+            top.inCode = false;
+    }
+    end() {
+        const f = this.stack.pop();
+        if (f)
+            evaluateField(this.ctx, this.location, f.code, f.computed);
+    }
+    /** Whether a field's code is being read now. */
+    get inCode() {
+        return this.stack[this.stack.length - 1]?.inCode === true;
+    }
+    /** Text of the innermost field's code. White space before the first word counts for nothing, so no amount of it can push the field's name out. */
+    text(t) {
+        const top = this.stack[this.stack.length - 1];
+        if (top?.inCode && top.code.length < MAX_FIELD_CODE)
+            top.code = top.code ? top.code + t : t.trimStart();
+    }
+    /** A document can end inside a field. Word still reads the code it has. */
+    finish() {
+        for (let f = this.stack.pop(); f; f = this.stack.pop())
+            evaluateField(this.ctx, this.location, f.code, f.computed);
+    }
+    nest() {
+        const top = this.stack[this.stack.length - 1];
+        if (top?.inCode && top.code === '')
+            top.computed = true;
+    }
+}
+exports.FieldStack = FieldStack;

package/dist/findings.js

@@ -13,8 +13,8 @@ def(types_1.OfficeCategory.Container, types_1.OfficeDetail.NotZip, 'reject', 0,
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.AmbiguousEnd, 'reject', 0, 'The archive has more than one end record a reader could pick');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.MultiDisk, 'reject', 0, 'The archive claims to span several disks');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DirectoryMismatch, 'reject', 0, "The archive's end record disagrees with its central directory");
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.OutOfRange, 'reject', 0, 'An entry or the central directory lies outside the file');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Overlap, 'reject', 0, 'Two entries in the archive share bytes');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.OutOfRange, 'reject', 0, 'An entry, a sector or a directory lies outside the file');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Overlap, 'reject', 0, 'Two entries or streams of the file share bytes');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HeaderMismatch, 'reject', 0, 'A local header contradicts the central directory<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DuplicateName, 'reject', 0, 'Two entries have the same name, ignoring case<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.UnsafeName, 'reject', 0, 'An entry name is unsafe to use as a path<: {name}|>');
@@ -23,10 +23,15 @@ def(types_1.OfficeCategory.Container, types_1.OfficeDetail.EncryptedEntry, 'reje
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.UnsupportedMethod, 'reject', 0, 'An entry uses a compression method other than stored or deflate<: {name}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.Zip64Mismatch, 'reject', 0, 'ZIP64 fields disagree with the fields they extend');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadExtraField, 'reject', 0, 'An extra field block does not parse<: {name}|>');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DataError, 'reject', 0, "An entry's data does not match its declared size and checksum<: {name}|>");
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DataError, 'reject', 0, "An entry's data does not match its declared size or checksum<: {name}|>");
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes, 'strip', 10, 'Data before the first entry of the archive');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData, 'strip', 20, 'Data between entries of the archive that no entry covers');
-def(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, 'strip', 10, 'Data after the end of the archive');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData, 'strip', 20, 'Data in the file that no entry or stream covers');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, 'strip', 10, 'Data after the end of the archive or compound file');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadHeader, 'reject', 0, 'The compound file header is invalid<: {reason}|>');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BrokenChain, 'reject', 0, 'A sector chain of the compound file runs into a free or reserved sector');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.ChainLoop, 'reject', 0, 'A sector chain of the compound file loops');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DirectoryLoop, 'reject', 0, 'The compound file directory reaches one entry twice');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadEntry, 'reject', 0, 'A compound file directory entry is invalid<: {reason}|>');
 // XML. MALFORMED and ENCODING stop the run.
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Doctype, 'info', 0, 'An XML part declares a document type<: {part}|>');
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.InternalSubset, 'strip', 20, 'An XML part declares entities or other markup in its document type<: {part}|>');
@@ -35,17 +40,18 @@ def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Malformed, 'reject', 0, 'An
 def(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Encoding, 'reject', 0, 'An XML part is not in valid UTF-8 or UTF-16<: {part}|>');
 // LIMIT
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.FileSize, 'reject', 0, 'The file exceeds the file size limit');
-def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.EntryCount, 'reject', 0, 'The archive exceeds the entry count limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.EntryCount, 'reject', 0, 'The file exceeds the entry count limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, 'reject', 0, 'An entry exceeds the decompressed size limit');
-def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, 'reject', 0, 'The archive exceeds the total decompressed size limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, 'reject', 0, 'The file exceeds the total decompressed size limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlDepth, 'reject', 0, 'An XML part exceeds the element depth limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlTokenSize, 'reject', 0, 'An XML part exceeds the token size limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityDepth, 'reject', 0, 'An XML part exceeds the entity nesting limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityExpansions, 'reject', 0, 'The file exceeds the entity expansion limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntitySize, 'reject', 0, 'The file exceeds the expanded entity size limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, 'reject', 0, 'The RTF file exceeds the group nesting limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.Time, 'reject', 0, 'The file exceeds the time limit');
 // PACKAGE
-def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'reject', 0, 'The file is not a recognized Office or OpenDocument package');
+def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'reject', 0, 'The file is not a recognized Office or OpenDocument file');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'reject', 0, 'The file can be read as more than one format');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unreadable, 'reject', 0, 'The file could not be read');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, 'reject', 0, 'The package names one thing twice, and readers may pick either');
@@ -54,9 +60,19 @@ def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, 'stri
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.OdfLayout, 'strip', 10, 'The OpenDocument package layout is irregular<: {reason}|>');
 // ENCRYPTED
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'reject', 0, 'The document is encrypted with a password');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.DefaultPassword, 'strip', 10, 'The file is encrypted with VelvetSweatshop, the password Excel opens it with without asking');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UserPassword, 'strip', 0, 'The file was decrypted with the supplied password');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_40, 'info', 0, 'Encryption is RC4 with a 40-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_128, 'info', 0, 'Encryption is RC4 with a 128-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4Other, 'info', 0, 'Encryption is RC4 with a <{bits}|longer>-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes128, 'info', 0, 'Encryption is AES with a 128-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes192, 'info', 0, 'Encryption is AES with a 192-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes256, 'info', 0, 'Encryption is AES with a 256-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UnsupportedAlgorithm, 'reject', 0, 'The file is encrypted with an algorithm office-defuse does not decrypt<: {algorithm}|>');
 // MACRO
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, 'strip', 70, 'The document holds VBA macros');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, 'strip', 70, 'The workbook holds an Excel 4.0 macro sheet');
+def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.WordBasic, 'strip', 70, 'The Word 6.0 or 95 document holds WordBasic macros, which Word runs as VBA');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfBasic, 'strip', 70, 'The document holds Basic macros');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfScripts, 'strip', 70, 'The document holds scripts');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.OdfDialogs, 'strip', 30, 'The document holds Basic dialogs, which call macros');
@@ -70,6 +86,7 @@ def(types_1.OfficeCategory.Ui, types_1.OfficeDetail.OdfConfiguration, 'strip', 1
 // ACTION
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, 'strip', 80, 'A click or hover runs a program or opens a file');
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, 'strip', 40, 'A click or hover activates an embedded object');
+def(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, 'strip', 50, 'An embedded object updates itself as the document opens, which starts the program it belongs to');
 // DDE
 def(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, 'strip', 70, 'A field runs a command through DDE');
 def(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, 'strip', 70, 'A DDE link asks another program for data<: {application}|>');
@@ -100,11 +117,13 @@ def(types_1.OfficeCategory.Link, types_1.OfficeDetail.LookalikeHost, 'strip', 40
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.EncodedHost, 'strip', 40, "A link's host is percent-encoded");
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.Relative, 'strip', 30, "A relative link, which resolves against the file's own location");
 // EMBEDDED
-def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, 'strip', 40, 'An embedded OLE object');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, 'strip', 40, 'An embedded OLE object<, which holds the file {fileName}|>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, 'strip', 30, 'An embedded document<: {contentType}|>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, 'strip', 40, 'A part holds an OLE file that nothing declares as an object');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, 'strip', 60, 'An embedded Java applet');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, 'strip', 50, 'An embedded browser plug-in object');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, 'strip', 70, 'An Equation Editor 3.0 object, which CVE-2017-11882 and CVE-2018-0802 exploit');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, 'strip', 30, '<An attached file "{name}"|An attached file> (<{type}|unknown type>)');
 // CONTROL
 def(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, 'strip', 50, 'An ActiveX control');
 /** The built-in spec for a kind of finding, or undefined for a kind office-defuse does not make, such as one from another package. */

package/dist/msg.d.ts

@@ -0,0 +1,7 @@
+import { type CfbEntry, type CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/**
+ * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
+ * reference with what it points to. An embedded message's own attachments are read as well.
+ */
+export declare function messageRules(ctx: RunContext, cfb: CompoundFile, message: CfbEntry, depth?: number): Promise<void>;

package/dist/msg.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.messageRules = messageRules;
+const cfb_1 = require("./cfb");
+const context_1 = require("./context");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+/** Property ids of an attachment (MS-OXPROPS). */
+const P = { method: 0x3705, longName: 0x3707, name: 0x3704, display: 0x3001, mime: 0x370e, data: 0x3701, longPath: 0x370d, path: 0x3708 };
+/** How an attachment holds its file (MS-OXCMSG 2.2.2.9): by value, by reference, embedded message, OLE object, web reference. */
+const METHODS = { 1: 'by value', 2: 'by reference', 3: 'by reference, resolved', 4: 'by reference only', 5: 'embedded message', 6: 'OLE object', 7: 'by web reference' };
+/** Embedded messages can hold messages in turn. Past this depth they are still reported, and not read further. */
+const MAX_DEPTH = 16;
+/**
+ * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
+ * reference with what it points to. An embedded message's own attachments are read as well.
+ */
+async function messageRules(ctx, cfb, message, depth = 0) {
+    for (const a of message.children) {
+        if (a.kind !== 'storage' || !/^__attach_version1\.0_#[0-9A-F]{8}$/i.test(a.name))
+            continue;
+        await attachmentRules(ctx, cfb, a, depth);
+    }
+}
+async function attachmentRules(ctx, cfb, a, depth) {
+    const location = (0, cfb_1.entryPath)(a);
+    const props = await properties(cfb, a);
+    const text = async (id) => {
+        for (const [type, decode] of [
+            ['001F', oleobj_1.utf16],
+            ['001E', oleobj_1.latin1],
+        ]) {
+            const s = a.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === `__SUBSTG1.0_${id.toString(16).toUpperCase().padStart(4, '0')}${type}`);
+            if (s && s.size <= 65536)
+                return decode(await cfb.bytes(s)).replace(/\0+$/, '');
+        }
+        return '';
+    };
+    const method = props.get(P.method) ?? 0;
+    const name = (await text(P.longName)) || (await text(P.name)) || (await text(P.display));
+    const declaredType = await text(P.mime);
+    const dataId = `__SUBSTG1.0_${P.data.toString(16).toUpperCase()}`;
+    const data = a.children.find(c => c.name.toUpperCase().startsWith(dataId));
+    const info = { attachment: location, method: METHODS[method] ?? String(method) };
+    if (name)
+        info.name = (0, context_1.clip)(name);
+    if (declaredType)
+        info.type = (0, context_1.clip)(declaredType);
+    if (method >= 2 && method <= 4) {
+        const path = (await text(P.longPath)) || (await text(P.path));
+        if (path)
+            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment');
+        return;
+    }
+    if (method === 7) {
+        const path = (await text(P.longPath)) || (await text(P.path));
+        if (path)
+            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by web reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment');
+        return;
+    }
+    if (!data)
+        return;
+    if (data.kind === 'stream') {
+        attachment(ctx, { name: name || undefined, declaredType: declaredType || undefined, size: data.size, location, depth: 1, source: cfb.source(data) }, info);
+        return;
+    }
+    // An embedded message or an OLE object is a storage of this file. The object rules read an object's storage, and
+    // an embedded message's attachments are read here.
+    info.size = 0;
+    if (method === 5)
+        info.type ??= 'application/vnd.ms-outlook';
+    ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, location, info);
+    if (method === 5 && depth < MAX_DEPTH)
+        await messageRules(ctx, cfb, data, depth + 1);
+}
+/**
+ * The place every attached file passes, with what a contained file plugin needs to read it. office-defuse reports it;
+ * the family's router, once office-defuse has a plugin for it, is where it would be handed on.
+ */
+function attachment(ctx, file, info) {
+    ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: file.size });
+}
+/** The fixed-size values of a property stream (MS-OXMSG 2.4.2), by property id. An attachment's has an 8-byte header. */
+async function properties(cfb, storage) {
+    const out = new Map();
+    const s = storage.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === '__PROPERTIES_VERSION1.0');
+    if (!s || s.size > 65536)
+        return out;
+    const b = await cfb.bytes(s);
+    for (let at = 8; at + 16 <= b.length; at += 16) {
+        const tag = (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+        // PT_LONG values sit in the first four bytes of the value.
+        if ((tag & 0xffff) === 0x0003)
+            out.set(tag >>> 16, (b[at + 8] | (b[at + 9] << 8) | (b[at + 10] << 16) | (b[at + 11] << 24)) >>> 0);
+    }
+    return out;
+}

package/dist/objects.d.ts

@@ -0,0 +1,42 @@
+import { type CfbEntry, type CompoundFile } from './cfb';
+import { type RunContext } from './context';
+import { type PackagedFile } from './oleobj';
+/** Equation Editor 3.0's ProgID, which rtfobj matches as a prefix. */
+export declare const isEquationClass: (name: string) => boolean;
+/** Reports what the reader of a compound file inside this one noted, at the place it sits. */
+export declare function nestedNotes(ctx: RunContext, cfb: CompoundFile, location: string): void;
+/**
+ * The rules every compound file gets: VBA projects, embedded objects and controls, wherever they sit in the tree.
+ * `prefix` names where the file sits when it is inside another, and `rootIsObject` says that its root is itself an
+ * OLE object's storage, as an object in a presentation or an RTF file is.
+ */
+export declare function compoundRules(ctx: RunContext, cfb: CompoundFile, prefix: string, rootIsObject: boolean): Promise<void>;
+/** What an OLE object's storage says about the object. */
+export interface ObjectInfo {
+    clsid: string;
+    progId?: string;
+    userType?: string;
+    /** An ActiveX control's storage, with the control's name. */
+    control: boolean;
+    controlName?: string;
+    linked: boolean;
+    /** What a linked object loads, or ''. */
+    target: string;
+    /** The target is a URL moniker's, which loads from outside however it is spelled. */
+    url: boolean;
+    /** A Packager object's file, held or linked to. */
+    pkg?: PackagedFile;
+    equation: boolean;
+}
+/** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
+export declare function describeObject(cfb: CompoundFile, e: CfbEntry, _location: string): Promise<ObjectInfo>;
+/**
+ * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a
+ * CVE-2017-0199 sample puts a character with a stray high byte where the colon of https: goes.
+ */
+export declare function linkedObject(ctx: RunContext, d: {
+    target: string;
+    url: boolean;
+}, location: string, data: Record<string, string>): void;
+/** What a finding shows of a Packager object's file: its name and paths, and its size when the object holds it. */
+export declare function packageData(p: PackagedFile): Record<string, string | number>;