@patrickdk77/office-defuse 0.1.0 → 0.1.1

package/dist/ppt.js

@@ -0,0 +1,241 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.powerPointRules = powerPointRules;
+const zlib = __importStar(require("node:zlib"));
+const cfb_1 = require("./cfb");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const links_1 = require("./links");
+const objects_1 = require("./objects");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+/** Record types of the PowerPoint binary format (MS-PPT 2.13.24). */
+const T = {
+    currentUserAtom: 0x0ff6,
+    userEditAtom: 0x0ff5,
+    persistDirectoryAtom: 0x1772,
+    exOleObjStg: 0x1011,
+    exOleObjAtom: 0x0fc3,
+    vbaInfoAtom: 0x0400,
+    interactiveInfo: 0x0ff2,
+    interactiveInfoAtom: 0x0ff3,
+    cString: 0x0fba,
+    exHyperlink: 0x0fd7,
+    exHyperlinkAtom: 0x0fd3,
+};
+/** ExVideoContainer, ExMIDIAudioContainer and ExWAVAudioLinkContainer, whose path names a file outside the presentation. */
+const MEDIA_LINKS = new Set([0x1005, 0x100d, 0x1010]);
+/** The CurrentUserAtom's header token of an encrypted presentation. */
+const ENCRYPTED_TOKEN = 0xf3d1c4df;
+const MAX_DEPTH = 64;
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const header = (b) => ({ version: b[0] & 0x0f, instance: (b[0] | (b[1] << 8)) >> 4, type: b[2] | (b[3] << 8), length: u32(b, 4) });
+/**
+ * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
+ * current edit names. This reads every record at the top level of the stream as well as every object the persist
+ * directories name, so an object that one route hides is still read.
+ */
+async function powerPointRules(ctx, cfb, stream) {
+    const location = stream.name;
+    const source = cfb.source(stream);
+    const reader = new io_1.Reader(source, stream.size, 16384, 8);
+    const persist = new Map();
+    const current = cfb.child(cfb.root, 'Current User');
+    if (current?.kind === 'stream') {
+        const cu = await cfb.source(current).read(0, 24);
+        if (cu.length >= 20 && header(cu).type === T.currentUserAtom) {
+            if (u32(cu, 12) === ENCRYPTED_TOKEN)
+                throw new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'The presentation is encrypted', { stream: location });
+            await readPersist(reader, stream.size, u32(cu, 16), persist, ctx.settings.deadline);
+        }
+    }
+    const storages = new Map();
+    /** ExOleObjAtom types by the persist id of the storage they name: 0 embedded, 1 linked, 2 a control. */
+    const roles = new Map();
+    const vba = new Set();
+    const visited = new Set();
+    const walk = async (start, end, depth, siblings) => {
+        for (let pos = start; pos + 8 <= end;) {
+            (0, errors_1.checkTime)(ctx.settings.deadline);
+            const h = header(await reader.read(pos, 8));
+            const bodyEnd = pos + 8 + h.length;
+            if (bodyEnd > end || visited.has(pos))
+                return;
+            visited.add(pos);
+            siblings.push({ h, offset: pos });
+            if (h.type === T.exOleObjStg)
+                storages.set(pos, { offset: pos, header: h });
+            else if (h.type === T.exOleObjAtom && h.length >= 20) {
+                const b = await reader.read(pos + 8, 20);
+                roles.set(u32(b, 16), u32(b, 4));
+            }
+            else if (h.type === T.vbaInfoAtom && h.length >= 4)
+                vba.add(u32(await reader.read(pos + 8, 4), 0));
+            if (h.version === 0x0f && depth < MAX_DEPTH) {
+                const kids = [];
+                await walk(pos + 8, bodyEnd, depth + 1, kids);
+                await containerRules(ctx, reader, h, pos, kids, location);
+            }
+            pos = bodyEnd;
+        }
+    };
+    // Every record at the top level, then each persist object that does not start on a record already read.
+    await walk(0, stream.size, 0, []);
+    for (const offset of persist.values()) {
+        if (visited.has(offset) || offset + 8 > stream.size)
+            continue;
+        const h = header(await reader.read(offset, 8));
+        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, []);
+    }
+    const byOffset = new Map([...persist].map(([id, offset]) => [offset, id]));
+    for (const s of storages.values()) {
+        const id = byOffset.get(s.offset);
+        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id) === 2 ? 'control' : 'object';
+        await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`);
+    }
+}
+/** Reads the persist directories of the current edit and every edit before it. Newer entries win. */
+async function readPersist(reader, size, start, persist, deadline) {
+    const seen = new Set();
+    for (let edit = start; edit > 0 && edit + 36 <= size && !seen.has(edit);) {
+        (0, errors_1.checkTime)(deadline);
+        seen.add(edit);
+        const u = await reader.read(edit, 36);
+        if (header(u).type !== T.userEditAtom)
+            return;
+        const dirAt = u32(u, 20);
+        const d = await reader.read(dirAt, 8);
+        if (d.length === 8 && header(d).type === T.persistDirectoryAtom) {
+            const body = await reader.read(dirAt + 8, Math.min(header(d).length, size - dirAt - 8));
+            for (let p = 0; p + 4 <= body.length;) {
+                const entry = u32(body, p);
+                const first = entry & 0xfffff;
+                const count = entry >>> 20;
+                p += 4;
+                for (let i = 0; i < count && p + 4 <= body.length; i++, p += 4)
+                    if (!persist.has(first + i))
+                        persist.set(first + i, u32(body, p));
+            }
+        }
+        edit = u32(u, 16);
+    }
+}
+/** One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. */
+async function storageRules(ctx, source, s, role, location) {
+    let inner;
+    if (s.header.instance === 1) {
+        const raw = await source.read(s.offset + 8, s.header.length);
+        const declared = raw.length >= 4 ? u32(raw, 0) : 0;
+        if (declared > ctx.settings.decompressedBytes)
+            throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, `An object at ${location} declares ${declared} bytes`, { name: location, size: declared, limit: ctx.settings.decompressedBytes });
+        let bytes;
+        try {
+            bytes = zlib.inflateSync(raw.subarray(4), { maxOutputLength: Math.max(1, declared) });
+        }
+        catch {
+            unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
+            return;
+        }
+        inner = { size: async () => bytes.length, read: async (offset, length) => bytes.subarray(offset, offset + length) };
+    }
+    else {
+        const start = s.offset + 8;
+        const length = s.header.length;
+        inner = { size: async () => length, read: (offset, n) => source.read(start + offset, Math.max(0, Math.min(n, length - offset))) };
+    }
+    const head = await inner.read(0, 8);
+    let cfb;
+    try {
+        if (head.length < 8 || head[0] !== 0xd0 || head[1] !== 0xcf)
+            throw new errors_1.StopError(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadHeader, 'not a compound file');
+        cfb = await cfb_1.CompoundFile.open(inner, ctx.settings, ctx.settings.deadline);
+    }
+    catch (e) {
+        if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+            throw e;
+        unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
+        return;
+    }
+    (0, objects_1.nestedNotes)(ctx, cfb, location);
+    if (role === 'control')
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) });
+    await (0, objects_1.compoundRules)(ctx, cfb, location, role === 'object');
+}
+function unreadable(ctx, role, location, reason) {
+    if (role === 'vba')
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason });
+    else if (role === 'control')
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason });
+    else
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+}
+/** The rules of one container record, from its children: actions, hyperlinks and linked media. */
+async function containerRules(ctx, reader, h, offset, kids, stream) {
+    const location = `${stream}, offset ${offset}`;
+    const strings = async () => {
+        const out = new Map();
+        for (const k of kids)
+            if (k.h.type === T.cString && !out.has(k.h.instance))
+                out.set(k.h.instance, (0, oleobj_1.utf16)(await reader.read(k.offset + 8, Math.min(k.h.length, 65536))));
+        return out;
+    };
+    if (h.type === T.interactiveInfo) {
+        const atom = kids.find(k => k.h.type === T.interactiveInfoAtom && k.h.length >= 16);
+        if (!atom)
+            return;
+        const action = (await reader.read(atom.offset + 8 + 8, 1))[0];
+        const name = (await strings()).get(2) ?? '';
+        const data = { trigger: h.instance === 1 ? 'mouse over' : 'click', ...(name ? { action: (0, context_1.clip)(name) } : {}) };
+        if (action === 2)
+            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+        else if (action === 1)
+            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data);
+        else if (action === 5)
+            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+    }
+    else if (h.type === T.exHyperlink) {
+        const s = await strings();
+        const target = s.get(1) ?? '';
+        if (target.trim() && !(0, links_1.isFragment)(target))
+            ctx.link(target, location, { source: 'PowerPoint hyperlink' });
+    }
+    else if (MEDIA_LINKS.has(h.type)) {
+        const path = (await strings()).get(0) ?? '';
+        if (path.trim())
+            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media');
+    }
+}

package/dist/rtf.d.ts

@@ -0,0 +1,8 @@
+import { type RunContext } from './context';
+import { type ByteSource } from './types';
+/**
+ * Inspects an RTF file the way Word reads one. Objects with their data, fields, the attached template and shape
+ * hyperlinks are reported. Unknown destinations marked with \* are skipped, unknown control words are ignored, and
+ * text after the document's last brace is still read, as rtfobj reads it, and reported as trailing data.
+ */
+export declare function inspectRtf(ctx: RunContext, source: ByteSource, size: number): Promise<void>;