@patrickdk77/office-defuse 0.1.0 → 0.1.1

package/dist/ole.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.families = families;
+exports.inspectCompound = inspectCompound;
+const errors_1 = require("./errors");
+const msg_1 = require("./msg");
+const objects_1 = require("./objects");
+const offcrypto_1 = require("./offcrypto");
+const package_1 = require("./package");
+const ppt_1 = require("./ppt");
+const types_1 = require("./types");
+const word_1 = require("./word");
+const xls_1 = require("./xls");
+const zip_1 = require("./zip");
+const f = (format, mimeType) => ({ format, mimeType });
+const upper = (e) => e.name.toUpperCase();
+const PUBLISHER_CLSIDS = new Set(['00021200-0000-0000-00C0-000000000046', '00021201-0000-0000-00C0-000000000046']);
+/** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
+function families(cfb) {
+    const names = new Map(cfb.root.children.map(c => [upper(c), c]));
+    const stream = (n) => names.get(n)?.kind === 'stream';
+    const out = [];
+    if (stream('ENCRYPTIONINFO') && stream('ENCRYPTEDPACKAGE'))
+        out.push('encrypted');
+    if (stream('WORDDOCUMENT'))
+        out.push('word');
+    if (stream('WORKBOOK') || stream('BOOK'))
+        out.push('excel');
+    if (stream('POWERPOINT DOCUMENT'))
+        out.push('powerpoint');
+    if (stream('VISIODOCUMENT'))
+        out.push('visio');
+    if (stream('__PROPERTIES_VERSION1.0'))
+        out.push('outlook');
+    // Publisher 98 and later keep their content in a Quill storage. Publisher 95 has none, and names itself by class id.
+    if (names.get('QUILL')?.kind === 'storage' || (PUBLISHER_CLSIDS.has(cfb.root.clsid) && stream('CONTENTS')))
+        out.push('publisher');
+    // Project keeps its data in a storage named by three spaces and a number, beside a Props stream.
+    if ([...names.keys()].some(n => /^PROPS\d*$/.test(n)) && cfb.root.children.some(c => c.kind === 'storage' && /^ {3}\d+$/.test(c.name)))
+        out.push('project');
+    return out;
+}
+/**
+ * Inspects a compound file: the rules every compound file gets, over its whole tree, and then those of the format
+ * its root names.
+ */
+async function inspectCompound(ctx, cfb) {
+    const found = families(cfb);
+    // Word 2007 writes a Word document beside an encrypted package, for readers that cannot decrypt it.
+    const main = found.filter(x => !(x === 'word' && found.includes('encrypted')));
+    if (main.length > 1)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, `The compound file holds ${main.join(' and ')} streams`, { reason: `${main.join(' and ')} streams` });
+    if (main.length === 0)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The compound file holds no Office document stream', { reason: 'a compound file of another kind' });
+    const family = main[0];
+    ctx.format = formatOf(family, cfb);
+    await (0, objects_1.compoundRules)(ctx, cfb, '', false);
+    const stream = (name) => {
+        const e = cfb.child(cfb.root, name);
+        return e?.kind === 'stream' ? e : undefined;
+    };
+    // Beside an encrypted package, Word 2007 writes a WordDocument stream for older readers, of zeros in the files at
+    // hand. Those readers read it if it holds a document, so it gets the Word rules when it does.
+    const word = stream('WordDocument');
+    if (word) {
+        const r = await (0, word_1.wordRules)(ctx, cfb, word, family === 'encrypted');
+        if (r?.template && family === 'word')
+            ctx.format = f('dot', 'application/msword');
+    }
+    if (family === 'excel') {
+        // Excel 97 to 2003 reads Workbook, and Excel 5.0 and 95 read Book. A file can hold both.
+        let template = false;
+        let addIn = false;
+        for (const name of ['Workbook', 'Book']) {
+            const s = stream(name);
+            if (!s)
+                continue;
+            const r = await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook);
+            template ||= r.template;
+            addIn ||= r.addIn;
+        }
+        if (addIn)
+            ctx.format = f('xla', 'application/vnd.ms-excel');
+        else if (template)
+            ctx.format = f('xlt', 'application/vnd.ms-excel');
+        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream.
+        const controls = stream('Ctls');
+        if (controls && controls.size > 0)
+            ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name });
+    }
+    if (family === 'outlook')
+        await (0, msg_1.messageRules)(ctx, cfb, cfb.root);
+    const ppt = stream('PowerPoint Document');
+    if (family === 'powerpoint' && ppt)
+        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt);
+    const info = stream('EncryptionInfo');
+    const pkg = stream('EncryptedPackage');
+    if (family === 'encrypted' && info && pkg) {
+        // The package goes through the OOXML rules once a password opens it, and names the format.
+        const { source } = await (0, offcrypto_1.openPackage)(ctx, cfb, info, pkg);
+        const zip = await zip_1.ZipArchive.open(source, ctx.settings, ctx.settings.deadline);
+        for (const n of zip.notes)
+            ctx.report(types_1.OfficeCategory.Container, n.detail, pkg.name, { bytes: n.bytes });
+        await (0, package_1.inspectPackage)(ctx.withZip(zip));
+    }
+}
+function formatOf(family, cfb) {
+    switch (family) {
+        case 'word':
+            return f('doc', 'application/msword');
+        case 'excel':
+            return f('xls', 'application/vnd.ms-excel');
+        case 'powerpoint':
+            return f('ppt', 'application/vnd.ms-powerpoint');
+        case 'visio':
+            return f('vsd', 'application/vnd.visio');
+        case 'outlook':
+            return cfb.root.clsid === '0006F046-0000-0000-C000-000000000046' ? f('oft', 'application/vnd.ms-outlook') : f('msg', 'application/vnd.ms-outlook');
+        case 'publisher':
+            return f('pub', 'application/x-mspublisher');
+        case 'project':
+            return f('mpp', 'application/vnd.ms-project');
+        default:
+            // An encrypted package names its format only once it is decrypted.
+            return undefined;
+    }
+}

package/dist/oleobj.d.ts

@@ -0,0 +1,74 @@
+/** Thrown by ByteReader when a structure runs past the end of its bytes. Parsers catch it and keep what they read. */
+export declare class Truncated extends Error {
+}
+/** Runs `read`. A structure that runs past its data gives what `partial` returns instead, and any other error goes up. */
+export declare function bounded<T>(read: () => T, partial: () => T): T;
+/** Little-endian reads over bytes in memory, bounded by their end. */
+export declare class ByteReader {
+    readonly b: Uint8Array;
+    pos: number;
+    constructor(b: Uint8Array);
+    get left(): number;
+    private need;
+    u8(): number;
+    u16(): number;
+    u32(): number;
+    bytes(n: number): Uint8Array;
+    skip(n: number): void;
+    /** An ANSI string ended by a NUL within `max` bytes, read as Latin-1. */
+    ansiz(max?: number): string;
+    /** A 32-bit byte count, then that many bytes of ANSI text whose last is a NUL. */
+    lengthPrefixedAnsi(max?: number): string;
+    /** A 32-bit count of UTF-16 code units, then the units, the last of which may be a NUL. */
+    lengthPrefixedUnicode(max?: number): string;
+}
+export declare const latin1: (b: Uint8Array) => string;
+export declare const utf16: (b: Uint8Array) => string;
+/** The class an OLE object names in its CompObj stream (MS-OLEDS 2.3.8): the user type and the ProgID. */
+export interface CompObj {
+    userType?: string;
+    progId?: string;
+}
+export declare function parseCompObj(b: Uint8Array): CompObj;
+/** What a moniker names: a URL moniker's URL, or a file moniker's path. */
+export interface MonikerTarget {
+    target: string;
+    /** A URL moniker, whose target loads from wherever it names, however it is spelled. */
+    url: boolean;
+}
+/**
+ * The address a moniker names: a URL moniker's URL, a file moniker's path, or the first of a composite's that names
+ * one. Other monikers name nothing this reads, and give ''. The reader stops after the moniker it reads.
+ */
+export declare function readMoniker(r: ByteReader, depth?: number): MonikerTarget;
+/** What an OLE stream (MS-OLEDS 2.3.3) says: whether the object is a link, and what it links to. */
+export interface OleStreamInfo extends MonikerTarget {
+    linked: boolean;
+}
+export declare function parseOleStream(b: Uint8Array): OleStreamInfo;
+/** An embedded file in Packager's native data, which oleobj reads the same way. */
+export interface PackagedFile {
+    fileName: string;
+    sourcePath: string;
+    tempPath: string;
+    /** False when the data names a file it does not hold, a link. */
+    embedded: boolean;
+    size: number;
+}
+/**
+ * Packager's native data, as oleobj reads it: a 16-bit type, the label and source path ended by NULs, eight bytes,
+ * the temporary path ended by a NUL, and the size of the file's data. Without the size it is a link. Undefined when it
+ * does not read that far.
+ */
+export declare function parsePackage(b: Uint8Array): PackagedFile | undefined;
+/** An OLE 1.0 object (MS-OLEDS 2.2), as RTF's objdata holds one. */
+export interface Ole1Object {
+    /** 1 linked, 2 embedded, 5 a static picture. */
+    formatId: number;
+    className: string;
+    topicName: string;
+    itemName: string;
+    /** The native data of an embedded object. */
+    data?: Uint8Array;
+}
+export declare function parseOle1(b: Uint8Array): Ole1Object | undefined;

package/dist/oleobj.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.utf16 = exports.latin1 = exports.ByteReader = exports.Truncated = void 0;
+exports.bounded = bounded;
+exports.parseCompObj = parseCompObj;
+exports.readMoniker = readMoniker;
+exports.parseOleStream = parseOleStream;
+exports.parsePackage = parsePackage;
+exports.parseOle1 = parseOle1;
+const cfb_1 = require("./cfb");
+/** Thrown by ByteReader when a structure runs past the end of its bytes. Parsers catch it and keep what they read. */
+class Truncated extends Error {
+}
+exports.Truncated = Truncated;
+/** Runs `read`. A structure that runs past its data gives what `partial` returns instead, and any other error goes up. */
+function bounded(read, partial) {
+    try {
+        return read();
+    }
+    catch (e) {
+        if (e instanceof Truncated)
+            return partial();
+        throw e;
+    }
+}
+/** Little-endian reads over bytes in memory, bounded by their end. */
+class ByteReader {
+    b;
+    pos = 0;
+    constructor(b) {
+        this.b = b;
+    }
+    get left() {
+        return this.b.length - this.pos;
+    }
+    need(n) {
+        if (n < 0 || this.pos + n > this.b.length)
+            throw new Truncated('The structure runs past its data');
+        const at = this.pos;
+        this.pos += n;
+        return at;
+    }
+    u8() {
+        return this.b[this.need(1)];
+    }
+    u16() {
+        const at = this.need(2);
+        return this.b[at] | (this.b[at + 1] << 8);
+    }
+    u32() {
+        const at = this.need(4);
+        return (this.b[at] | (this.b[at + 1] << 8) | (this.b[at + 2] << 16) | (this.b[at + 3] << 24)) >>> 0;
+    }
+    bytes(n) {
+        const at = this.need(n);
+        return this.b.subarray(at, at + n);
+    }
+    skip(n) {
+        this.need(n);
+    }
+    /** An ANSI string ended by a NUL within `max` bytes, read as Latin-1. */
+    ansiz(max = 1024) {
+        const end = this.b.indexOf(0, this.pos);
+        if (end < 0 || end - this.pos >= max)
+            throw new Truncated('No NUL ends the string');
+        const s = (0, exports.latin1)(this.b.subarray(this.pos, end));
+        this.pos = end + 1;
+        return s;
+    }
+    /** A 32-bit byte count, then that many bytes of ANSI text whose last is a NUL. */
+    lengthPrefixedAnsi(max = 65536) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        if (n === 0)
+            return '';
+        const s = this.bytes(n);
+        return (0, exports.latin1)(s[n - 1] === 0 ? s.subarray(0, n - 1) : s);
+    }
+    /** A 32-bit count of UTF-16 code units, then the units, the last of which may be a NUL. */
+    lengthPrefixedUnicode(max = 32768) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        return (0, exports.utf16)(this.bytes(n * 2)).replace(/\0+$/, '');
+    }
+}
+exports.ByteReader = ByteReader;
+const latin1 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString('latin1');
+exports.latin1 = latin1;
+const utf16 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength - (b.byteLength % 2)).toString('utf16le');
+exports.utf16 = utf16;
+function parseCompObj(b) {
+    const r = new ByteReader(b);
+    const out = {};
+    return bounded(() => {
+        r.skip(28);
+        out.userType = r.lengthPrefixedAnsi();
+        const marker = r.u32();
+        if (marker === 0xffffffff || marker === 0xfffffffe)
+            r.skip(4);
+        else if (marker !== 0)
+            r.skip(marker);
+        // MS-OLEDS calls it Reserved1. Windows writes the ProgID there.
+        out.progId = r.lengthPrefixedAnsi();
+        return out;
+    }, () => out);
+}
+/** URL moniker, file moniker and composite moniker class ids (MS-OSHARED 2.3.7). */
+const URL_MONIKER = '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B';
+const FILE_MONIKER = '00000303-0000-0000-C000-000000000046';
+const COMPOSITE_MONIKER = '00000309-0000-0000-C000-000000000046';
+/**
+ * The address a moniker names: a URL moniker's URL, a file moniker's path, or the first of a composite's that names
+ * one. Other monikers name nothing this reads, and give ''. The reader stops after the moniker it reads.
+ */
+function readMoniker(r, depth = 0) {
+    const clsid = (0, cfb_1.guid)(r.bytes(16));
+    if (clsid === URL_MONIKER) {
+        const n = r.u32();
+        const raw = r.bytes(Math.min(n, r.left));
+        return { target: (0, exports.utf16)(raw).split('\0')[0], url: true };
+    }
+    if (clsid === FILE_MONIKER) {
+        const anti = r.u16();
+        const ansi = r.lengthPrefixedAnsi();
+        r.skip(2 + 2 + 16);
+        const unicodeSize = r.u32();
+        let path = ansi;
+        if (unicodeSize > 0) {
+            const bytes = r.u32();
+            r.skip(2);
+            path = (0, exports.utf16)(r.bytes(bytes));
+        }
+        return { target: '..\\'.repeat(Math.min(anti, 64)) + path, url: false };
+    }
+    if (clsid === COMPOSITE_MONIKER && depth < 8) {
+        const count = r.u32();
+        for (let i = 0; i < Math.min(count, 64); i++) {
+            const found = readMoniker(r, depth + 1);
+            if (found.target)
+                return found;
+        }
+    }
+    return { target: '', url: false };
+}
+function parseOleStream(b) {
+    const r = new ByteReader(b);
+    const out = { linked: false, target: '', url: false };
+    return bounded(() => {
+        r.skip(4);
+        out.linked = (r.u32() & 1) === 1;
+        if (!out.linked)
+            return out;
+        r.skip(8);
+        r.skip(r.u32());
+        // The relative moniker comes first, then the absolute one, which Office prefers when both resolve.
+        const monikers = [];
+        for (let i = 0; i < 2; i++) {
+            const size = r.u32();
+            if (size > 0)
+                monikers.push(readMoniker(new ByteReader(r.bytes(size))));
+        }
+        return Object.assign(out, monikers.reverse().find(m => m.target));
+    }, () => out);
+}
+/**
+ * Packager's native data, as oleobj reads it: a 16-bit type, the label and source path ended by NULs, eight bytes,
+ * the temporary path ended by a NUL, and the size of the file's data. Without the size it is a link. Undefined when it
+ * does not read that far.
+ */
+function parsePackage(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(2);
+        const fileName = r.ansiz();
+        const sourcePath = r.ansiz();
+        r.skip(8);
+        const tempPath = r.ansiz();
+        return bounded(() => ({ fileName, sourcePath, tempPath, embedded: true, size: r.u32() }), () => ({ fileName, sourcePath, tempPath, embedded: false, size: 0 }));
+    }, () => undefined);
+}
+function parseOle1(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(4);
+        const formatId = r.u32();
+        if (formatId !== 1 && formatId !== 2)
+            return { formatId, className: '', topicName: '', itemName: '' };
+        const className = r.lengthPrefixedAnsi();
+        const topicName = r.lengthPrefixedAnsi();
+        const itemName = r.lengthPrefixedAnsi();
+        if (formatId === 1)
+            return { formatId, className, topicName, itemName };
+        const size = r.u32();
+        return { formatId, className, topicName, itemName, data: r.bytes(Math.min(size, r.left)) };
+    }, () => undefined);
+}

package/dist/ooxml.d.ts

@@ -1,8 +1,8 @@
-import { type RunContext } from './context';
+import { type ZipContext } from './context';
 import { type ZipEntry } from './zip';
 /**
  * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
  * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
  * leave behind only which parts they reach and how.
  */
-export declare function inspectOoxml(ctx: RunContext, contentTypes: ZipEntry): Promise<void>;
+export declare function inspectOoxml(ctx: ZipContext, contentTypes: ZipEntry): Promise<void>;

package/dist/ooxml.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspectOoxml = inspectOoxml;
+const biff_1 = require("./biff");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
+const fields_1 = require("./fields");
 const formats_1 = require("./formats");
 const formulas_1 = require("./formulas");
 const links_1 = require("./links");
@@ -70,8 +72,6 @@ const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/custo
 const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
 const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
 const VISIO_CODE = /\b(RUNADDON|RUNADDONWARGS|CALLTHIS|RUNMACRO|OPENFILE|DOOLEVERB)\s*\(/i;
-/** How much of a field code is kept, counted from its first word, which names the field. */
-const MAX_FIELD_CODE = 4096;
 /** A Word attribute, qualified as Word writes it or unqualified. */
 const wordAttr = (el, local) => el.attributes.find(a => a.local === local && (a.ns === '' || WORD_NS.has(a.ns.toLowerCase())))?.value;
 /** The key of the part a relationships part belongs to, '' for the package, or undefined for any other part. */
@@ -155,43 +155,24 @@ async function readRelationships(ctx, entry, each) {
         },
     });
 }
-/** Word field codes, followed through nested fields, as one part's fields run. */
+/** Word field codes in WordprocessingML: fldSimple, and fldChar marks around instrText. */
 class Fields {
-    ctx;
-    part;
-    stack = [];
+    stack;
     capture = false;
     constructor(ctx, part) {
-        this.ctx = ctx;
-        this.part = part;
-    }
-    /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
-    nest() {
-        const top = this.stack[this.stack.length - 1];
-        if (top?.inCode && top.code === '')
-            top.computed = true;
+        this.stack = new fields_1.FieldStack(ctx, part);
     }
     start(el) {
-        if (el.local === 'fldSimple') {
-            this.nest();
-            this.evaluate(wordAttr(el, 'instr') ?? '', false);
-        }
+        if (el.local === 'fldSimple')
+            this.stack.simple(wordAttr(el, 'instr') ?? '');
         else if (el.local === 'fldChar') {
             const kind = wordAttr(el, 'fldCharType');
-            if (kind === 'begin') {
-                this.nest();
-                this.stack.push({ code: '', inCode: true, computed: false });
-            }
-            else if (kind === 'separate') {
-                const top = this.stack[this.stack.length - 1];
-                if (top)
-                    top.inCode = false;
-            }
-            else if (kind === 'end') {
-                const f = this.stack.pop();
-                if (f)
-                    this.evaluate(f.code, f.computed);
-            }
+            if (kind === 'begin')
+                this.stack.begin();
+            else if (kind === 'separate')
+                this.stack.separate();
+            else if (kind === 'end')
+                this.stack.end();
         }
         else if (el.local === 'instrText' || el.local === 'delInstrText')
             this.capture = true;
@@ -200,48 +181,12 @@ class Fields {
         if (el.local === 'instrText' || el.local === 'delInstrText')
             this.capture = false;
     }
-    /** White space before the first word counts for nothing, so no amount of it can push the field's name out. */
     text(t) {
-        const top = this.stack[this.stack.length - 1];
-        if (this.capture && top?.inCode && top.code.length < MAX_FIELD_CODE)
-            top.code = top.code ? top.code + t : t.trimStart();
+        if (this.capture)
+            this.stack.text(t);
     }
-    /** A part can end inside a field. Word still reads the code it has. */
     finish() {
-        for (let f = this.stack.pop(); f; f = this.stack.pop())
-            this.evaluate(f.code, f.computed);
-    }
-    /**
-     * Reports a field by its code. A field whose name holds the content of an external entity has a type the file does
-     * not say, as one whose name another field builds does.
-     */
-    evaluate(code, computed) {
-        const data = { code: (0, context_1.clip)(code.trim()) };
-        const words = (0, formulas_1.fieldWords)(code);
-        const first = words[0]?.text ?? '';
-        const entity = (0, xml_1.unknownEntity)(first);
-        if (computed || entity !== undefined)
-            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, this.part, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) });
-        const name = first.toUpperCase();
-        // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
-        const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
-        const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
-        if (name === 'DDE' || name === 'DDEAUTO')
-            this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, this.part, data);
-        else if (name === 'MACROBUTTON')
-            this.ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, this.part, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') });
-        else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
-            const target = arg(name === 'LINK' ? 2 : 1);
-            if (target === undefined)
-                this.ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, this.part, data);
-            else
-                this.ctx.external(types_1.OfficeDetail.Include, target, this.part, data, 'field');
-        }
-        else if (name === 'HYPERLINK') {
-            const target = arg(1);
-            if (target !== undefined && !(0, links_1.isFragment)(target))
-                this.ctx.link(target, this.part, { ...data, source: 'HYPERLINK field' });
-        }
+        this.stack.finish();
     }
 }
 /** Text that may run long. Detection needs only whether it holds more than white space; the report shows its start. */
@@ -297,6 +242,13 @@ class PartRules {
         else if (SHEET_NS.has(ns)) {
             if (el.local === 'f' || el.local === 'definedName')
                 this.formula = { shown: new Shown(), quotes: new formulas_1.Quotes(), ddeBar: false };
+            if (el.local === 'definedName') {
+                // Excel runs the macro a name like _xlnm.Auto_Open refers to, as it does in a binary workbook.
+                const name = (0, xml_1.attr)(el, '', 'name') ?? '';
+                const auto = (0, biff_1.autoName)(name);
+                if (auto)
+                    this.ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, this.part, { event: auto.event, name: (0, context_1.clip)(name) });
+            }
             else if (el.local === 'ddeLink')
                 this.ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, this.part, { application: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeService') ?? ''), topic: (0, context_1.clip)((0, xml_1.attr)(el, '', 'ddeTopic') ?? '') });
         }

package/dist/package.d.ts

@@ -0,0 +1,3 @@
+import type { ZipContext } from './context';
+/** Inspects an OOXML or OpenDocument package, which its markers name. */
+export declare function inspectPackage(ctx: ZipContext): Promise<void>;

package/dist/package.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectPackage = inspectPackage;
+const errors_1 = require("./errors");
+const odf_1 = require("./odf");
+const ooxml_1 = require("./ooxml");
+const types_1 = require("./types");
+/** Inspects an OOXML or OpenDocument package, which its markers name. */
+async function inspectPackage(ctx) {
+    const zip = ctx.zip;
+    const contentTypes = zip.get('[Content_Types].xml');
+    const odf = zip.entries.some(e => e.name === 'mimetype') || zip.get('META-INF/manifest.xml') !== undefined;
+    if (contentTypes && odf)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The file has both [Content_Types].xml and an OpenDocument mimetype or manifest', { reason: 'OOXML and OpenDocument markers' });
+    if (contentTypes)
+        await (0, ooxml_1.inspectOoxml)(ctx, contentTypes);
+    else if (odf)
+        await (0, odf_1.inspectOdf)(ctx);
+    else
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The archive has neither [Content_Types].xml nor an OpenDocument mimetype or manifest', { reason: 'a plain ZIP archive' });
+}

package/dist/ppt.d.ts

@@ -0,0 +1,8 @@
+import { type CfbEntry, CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/**
+ * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
+ * current edit names. This reads every record at the top level of the stream as well as every object the persist
+ * directories name, so an object that one route hides is still read.
+ */
+export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;