@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/links.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAbsoluteTarget = exports.isInsidePackage = exports.isLocalTarget = exports.isFragment = void 0;
+exports.LabelSites = exports.isAbsoluteTarget = exports.isInsidePackage = exports.isLocalTarget = exports.isFragment = void 0;
 exports.checkLink = checkLink;
+exports.labelSite = labelSite;
+exports.mismatchedLabel = mismatchedLabel;
 const types_1 = require("./types");
 const xml_1 = require("./xml");
 const IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
@@ -143,3 +145,106 @@ exports.isInsidePackage = isInsidePackage;
 /** Whether an OOXML relationship target is not a part name, whatever TargetMode says: a scheme, a drive or a network path. */
 const isAbsoluteTarget = (rawTarget) => [rawTarget, decoded(rawTarget)].some(t => SCHEME.test(clean(t)) || t.startsWith('\\') || t.startsWith('//'));
 exports.isAbsoluteTarget = isAbsoluteTarget;
+/** A host as LabelSites compares it. */
+const siteName = (h) => h
+    .toLowerCase()
+    .replace(/^www\./, '')
+    .replace(/\.$/, '');
+/**
+ * The hosts a label names, as a lookup: has() answers whether a host is one of them or a subdomain of one, or one of
+ * them is a subdomain of the host. No public-suffix list is needed: evil.co.uk is not under mybank.co.uk. The same
+ * comparison as pdf-defuse's.
+ */
+class LabelSites {
+    hosts = new Set();
+    /** Every domain some label host is a subdomain of. */
+    parents = new Set();
+    constructor(names) {
+        for (const n of names) {
+            const x = siteName(n);
+            this.hosts.add(x);
+            for (let i = x.indexOf('.'); i >= 0; i = x.indexOf('.', i + 1))
+                this.parents.add(x.slice(i + 1));
+        }
+    }
+    get size() {
+        return this.hosts.size;
+    }
+    has(host) {
+        const y = siteName(host);
+        if (this.hosts.has(y) || this.parents.has(y))
+            return true;
+        for (let i = y.indexOf('.'); i >= 0; i = y.indexOf('.', i + 1))
+            if (this.hosts.has(y.slice(i + 1)))
+                return true;
+        return false;
+    }
+}
+exports.LabelSites = LabelSites;
+/**
+ * Top-level domains a bare host in a label may end in: the common generic ones and the country codes. A name that
+ * ends in anything else, such as an Excel function (BETA.DIST) or a file (moon.htm), is not read as an address.
+ */
+const TLDS = new Set(('com net org edu gov mil int info biz name pro mobi asia tel travel jobs museum aero coop app dev io ai co me tv cc ly ' +
+    'xyz online site top shop club store tech live page blog cloud email link news ' +
+    'ac ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bm bn bo br bs bt bw by bz ca cd cf cg ' +
+    'ch ci ck cl cm cn cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg er es et eu fi fj fk fm fo fr ga gd ge gf gg gh gi ' +
+    'gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ' +
+    'ky kz la lb lc li lk lr ls lt lu lv ma mc md mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni ' +
+    'nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sk sl sm sn ' +
+    'so sr ss st su sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tw tz ua ug uk us uy uz va vc ve vg vi vn vu wf ws ' +
+    'ye yt za zm zw').split(' '));
+/** The most of a label that is read. */
+const MAX_LABEL = 4096;
+/**
+ * The site a label names when the label is itself an address: a web URL, a mail address, or a host with or without a
+ * path that starts with www. or ends in a known top-level domain. Text that only mentions an address, an Excel
+ * function name and a file name name no site. Excel's function names are all capitals, as typed hosts never are, so
+ * a bare host in capitals counts only after WWW.
+ */
+function labelSite(raw) {
+    const t = raw
+        .slice(0, MAX_LABEL)
+        .replace(/\p{Cc}/gu, '')
+        .trim();
+    if (/^https?:\/\//i.test(t)) {
+        try {
+            return new URL(t).hostname.toLowerCase() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const mail = /^(?:mailto:)?[^\s@/]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)$/i.exec(t);
+    const host = mail?.[1] ?? /^([a-z0-9-]+(?:\.[a-z0-9-]+)+)(?::\d+)?(?:[/?#]\S*)?$/i.exec(t)?.[1];
+    if (!host)
+        return undefined;
+    const h = host.toLowerCase();
+    if (h.startsWith('www.'))
+        return h;
+    if (!mail && host === host.toUpperCase() && /[A-Z]/.test(host))
+        return undefined;
+    return TLDS.has(h.slice(h.lastIndexOf('.') + 1)) ? h : undefined;
+}
+/**
+ * The first label of a safe link that is an address, and an address of another site than the one the link opens, or
+ * undefined. A label is text the reader sees for the link: its text, its tooltip, a display name. A subdomain or a
+ * parent of the label's site counts as the same site, as in pdf-defuse. A target that fails on its own gets its own
+ * finding instead.
+ */
+function mismatchedLabel(target, labels) {
+    if (!labels.some(Boolean))
+        return undefined;
+    const v = checkLink(target);
+    if (v.category !== types_1.OfficeCategory.Link || v.detail !== types_1.OfficeDetail.Safe || !v.host)
+        return undefined;
+    for (const label of labels) {
+        const site = label ? labelSite(label) : undefined;
+        // A site without a dot, where the target has one, is a label cut short or a local alias, and names no site.
+        if (!site || (!site.includes('.') && v.host.includes('.')))
+            continue;
+        if (!new LabelSites([site]).has(v.host))
+            return label;
+    }
+    return undefined;
+}

package/dist/msg.d.ts

@@ -0,0 +1,8 @@
+import { type CfbEntry, type CompoundFile } from './cfb';
+import { RunContext } from './context';
+import type { CompoundPlan } from './plan';
+/**
+ * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
+ * reference with what it points to. An embedded message's own attachments are read as well.
+ */
+export declare function messageRules(ctx: RunContext, cfb: CompoundFile, message: CfbEntry, depth?: number, plan?: CompoundPlan): Promise<void>;

package/dist/msg.js

@@ -0,0 +1,251 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.messageRules = messageRules;
+const cfb_1 = require("./cfb");
+const contained_1 = require("./contained");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const oleobj_1 = require("./oleobj");
+const rewrite_rtf_1 = require("./rewrite-rtf");
+const rtf_1 = require("./rtf");
+const rtfcomp_1 = require("./rtfcomp");
+const types_1 = require("./types");
+/** Property ids of an attachment (MS-OXPROPS). */
+const P = { method: 0x3705, longName: 0x3707, name: 0x3704, display: 0x3001, mime: 0x370e, data: 0x3701, longPath: 0x370d, path: 0x3708 };
+/** How an attachment holds its file (MS-OXCMSG 2.2.2.9): by value, by reference, embedded message, OLE object, web reference. */
+const METHODS = { 1: 'by value', 2: 'by reference', 3: 'by reference, resolved', 4: 'by reference only', 5: 'embedded message', 6: 'OLE object', 7: 'by web reference' };
+/** Embedded messages can hold messages in turn. Past this depth they are still reported, and not read further. */
+const MAX_DEPTH = 16;
+/** A message's body properties (MS-OXPROPS): PidTagRtfCompressed, and PidTagHtml as binary, Unicode or 8-bit text. */
+const RTF_BODY = 0x10090102;
+const HTML_BODIES = [0x10130102, 0x1013001f, 0x1013001e];
+/** The stream that holds a variable-size property (MS-OXMSG 2.1.4.1). */
+const streamName = (tag) => `__SUBSTG1.0_${tag.toString(16).toUpperCase().padStart(8, '0')}`;
+/**
+ * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
+ * reference with what it points to. An embedded message's own attachments are read as well.
+ */
+async function messageRules(ctx, cfb, message, depth = 0, plan) {
+    const edit = { attachmentsDropped: 0, drop: new Set(), sizes: new Map() };
+    await bodyRules(ctx, cfb, message, edit, plan);
+    for (const a of message.children) {
+        if (a.kind !== 'storage' || !/^__attach_version1\.0_#[0-9A-F]{8}$/i.test(a.name))
+            continue;
+        // An attachment a strip finding names goes with its whole storage.
+        if ((await attachmentRules(ctx, cfb, a, depth, plan)).some(r => r.action === 'strip') && plan) {
+            plan.drop.add(a);
+            edit.attachmentsDropped++;
+        }
+    }
+    if (plan && (edit.attachmentsDropped || edit.drop.size || edit.sizes.size))
+        await editProperties(ctx, cfb, message, edit, plan);
+}
+/**
+ * The property stream of a message after the rewrite (MS-OXMSG 2.4). Its header counts the attachments, at the same
+ * place in a message and in an embedded one, and the count drops by the attachments that went. Each property held in
+ * a stream has an entry giving that stream's size: the entry goes with a body that went, and takes the new size of a
+ * body that was rewritten.
+ */
+async function editProperties(ctx, cfb, message, edit, plan) {
+    const s = message.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === '__PROPERTIES_VERSION1.0');
+    if (!s || s.size < 24 || s.size > ctx.settings.decompressedBytes)
+        return;
+    const b = Buffer.from(await cfb.bytes(s));
+    const headerSize = message === cfb.root ? 32 : 24;
+    if (edit.attachmentsDropped)
+        b.writeUInt32LE(Math.max(0, b.readUInt32LE(20) - edit.attachmentsDropped), 20);
+    const kept = [b.subarray(0, headerSize)];
+    for (let at = headerSize; at + 16 <= b.length; at += 16) {
+        const entry = Buffer.from(b.subarray(at, at + 16));
+        const tag = entry.readUInt32LE(0);
+        if (edit.drop.has(tag))
+            continue;
+        const size = edit.sizes.get(tag);
+        if (size !== undefined)
+            entry.writeUInt32LE(size, 8);
+        kept.push(entry);
+    }
+    plan.replace.set(s, await (0, contained_1.spillOf)(ctx.run, Buffer.concat(kept)));
+}
+/** A stream of the message storage by property tag. */
+const bodyStream = (message, tag) => message.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === streamName(tag));
+/** Every byte a sink holds. */
+async function bytesOf(sink) {
+    const chunks = [];
+    for await (const c of sink.read())
+        chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks);
+}
+async function* once(b) {
+    yield b;
+}
+/**
+ * A message's bodies. The RTF body goes to the plugins as the RTF it decompresses to, and a plugin's copy is stored
+ * back uncompressed. When no plugin takes it, the RTF rules read it: a strip finding inside rewrites it, and a finding
+ * that rejects it, or a body that does not decompress, makes it go, leaving the plain text body. The HTML body goes
+ * to the plugins, and when none takes it, it stays, as no rule names it.
+ */
+async function bodyRules(ctx, cfb, message, edit, plan) {
+    const replace = async (stream, tag, bytes) => {
+        plan?.replace.set(stream, await (0, contained_1.spillOf)(ctx.run, bytes));
+        edit.sizes.set(tag, bytes.length);
+    };
+    const drop = (stream, tag) => {
+        plan?.drop.add(stream);
+        edit.drop.add(tag);
+    };
+    const rtf = bodyStream(message, RTF_BODY);
+    if (rtf) {
+        const location = (0, cfb_1.entryPath)(rtf);
+        const body = rtf.size <= ctx.settings.decompressedBytes ? (0, rtfcomp_1.decompressRtf)(await cfb.bytes(rtf), ctx.settings.decompressedBytes) : undefined;
+        if (!body) {
+            if (ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreadableBody, location, { stream: location }).action === 'strip')
+                drop(rtf, RTF_BODY);
+        }
+        else {
+            const decision = await (0, contained_1.decideContained)(ctx, { name: 'RTF body', declaredType: 'application/rtf', location, chunks: () => once(body) });
+            if (decision) {
+                if (!decision.keep)
+                    drop(rtf, RTF_BODY);
+                else if (decision.replacement)
+                    await replace(rtf, RTF_BODY, (0, rtfcomp_1.storeRtf)(await bytesOf(decision.replacement)));
+            }
+            else
+                await rtfRules(ctx, body, location, rtf, edit, plan);
+        }
+    }
+    for (const tag of HTML_BODIES) {
+        const html = bodyStream(message, tag);
+        if (!html || html.size > ctx.settings.decompressedBytes)
+            continue;
+        const raw = await cfb.bytes(html);
+        const unicode = (tag & 0xffff) === 0x001f;
+        const text = unicode ? Buffer.from((0, oleobj_1.utf16)(raw).replace(/\0+$/, ''), 'utf8') : raw;
+        const decision = await (0, contained_1.decideContained)(ctx, { name: 'HTML body', declaredType: 'text/html', location: (0, cfb_1.entryPath)(html), chunks: () => once(text) });
+        if (decision && !decision.keep)
+            drop(html, tag);
+        else if (decision?.replacement) {
+            const out = await bytesOf(decision.replacement);
+            await replace(html, tag, unicode ? Buffer.from(`${out.toString('utf8')}\0`, 'utf16le') : out);
+        }
+        break;
+    }
+}
+/**
+ * The RTF rules over a message's RTF body, reporting into this run with the body's place. A strip finding rewrites the
+ * body, and a reject drops it.
+ */
+async function rtfRules(ctx, body, location, stream, edit, plan) {
+    const sub = new context_1.RunContext(ctx.factory, ctx.xmlLimits, ctx.settings, ctx.run);
+    // The RTF reader leaves its cuts where a whole file's rewrite finds them, which is the message's own.
+    const saved = ctx.run.output;
+    let cuts;
+    try {
+        await (0, rtf_1.inspectRtf)(sub, (0, io_1.bufferSource)(body), body.length);
+        const out = ctx.run.output;
+        if (out?.kind === 'rtf')
+            cuts = out;
+    }
+    catch (e) {
+        if ((0, errors_1.stopsTree)(e) || !(e instanceof errors_1.StopError))
+            throw e;
+        sub.report(e.category, e.detail, undefined, { ...e.data, reason: e.data?.reason ?? e.message });
+        cuts = undefined;
+    }
+    finally {
+        ctx.run.output = saved;
+    }
+    const found = sub.findings;
+    (0, contained_1.pushContained)(ctx, found, location, 'RTF body');
+    if (found.some(f => f.action === 'reject') || !cuts) {
+        if (found.some(f => f.action !== 'info')) {
+            plan?.drop.add(stream);
+            edit.drop.add(RTF_BODY);
+        }
+        return;
+    }
+    if (!found.some(f => f.action === 'strip') || !plan)
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    await (0, rewrite_rtf_1.writeRtf)(ctx.run, (0, io_1.bufferSource)(body), body.length, cuts.cuts, sink);
+    await sink.close();
+    const stored = (0, rtfcomp_1.storeRtf)(await bytesOf(sink));
+    plan.replace.set(stream, await (0, contained_1.spillOf)(ctx.run, stored));
+    edit.sizes.set(RTF_BODY, stored.length);
+}
+async function attachmentRules(ctx, cfb, a, depth, plan) {
+    const location = (0, cfb_1.entryPath)(a);
+    const props = await properties(cfb, a);
+    const text = async (id) => {
+        for (const [type, decode] of [
+            ['001F', oleobj_1.utf16],
+            ['001E', oleobj_1.latin1],
+        ]) {
+            const s = a.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === `__SUBSTG1.0_${id.toString(16).toUpperCase().padStart(4, '0')}${type}`);
+            if (s && s.size <= 65536)
+                return decode(await cfb.bytes(s)).replace(/\0+$/, '');
+        }
+        return '';
+    };
+    const method = props.get(P.method) ?? 0;
+    const name = (await text(P.longName)) || (await text(P.name)) || (await text(P.display));
+    const declaredType = await text(P.mime);
+    const dataId = `__SUBSTG1.0_${P.data.toString(16).toUpperCase()}`;
+    const data = a.children.find(c => c.name.toUpperCase().startsWith(dataId));
+    const info = { attachment: location, method: METHODS[method] ?? String(method) };
+    if (name)
+        info.name = (0, context_1.clip)(name);
+    if (declaredType)
+        info.type = (0, context_1.clip)(declaredType);
+    if (method >= 2 && method <= 4) {
+        const path = (await text(P.longPath)) || (await text(P.path));
+        return path ? [ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment')] : [];
+    }
+    if (method === 7) {
+        const path = (await text(P.longPath)) || (await text(P.path));
+        return path ? [ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by web reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment')] : [];
+    }
+    if (!data)
+        return [];
+    if (data.kind === 'stream') {
+        return [await attachment(ctx, cfb, data, { name: name || undefined, declaredType: declaredType || undefined, location }, info, plan)];
+    }
+    // An embedded message or an OLE object is a storage of this file. The object rules read an object's storage, and
+    // an embedded message's attachments are read here.
+    info.size = 0;
+    if (method === 5)
+        info.type ??= 'application/vnd.ms-outlook';
+    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, location, info);
+    if (method === 5 && depth < MAX_DEPTH)
+        await messageRules(ctx, cfb, data, depth + 1, plan);
+    return [r];
+}
+/**
+ * An attached file held in a stream. It goes to the plugins, whose verdict decides whether it stays. When no plugin
+ * takes it, EMBEDDED/ATTACHMENT does.
+ */
+async function attachment(ctx, cfb, data, file, info, plan) {
+    const source = cfb.source(data);
+    const decision = await (0, contained_1.decideContained)(ctx, { ...file, chunks: () => (0, io_1.chunksOf)(source, data.size) });
+    if (decision?.replacement)
+        plan?.replace.set(data, decision.replacement);
+    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size }, (0, contained_1.presence)(decision));
+    return decision && !decision.keep ? { ...r, action: 'strip' } : r;
+}
+/** The fixed-size values of a property stream (MS-OXMSG 2.4.2), by property id. An attachment's has an 8-byte header. */
+async function properties(cfb, storage) {
+    const out = new Map();
+    const s = storage.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === '__PROPERTIES_VERSION1.0');
+    if (!s || s.size > 65536)
+        return out;
+    const b = await cfb.bytes(s);
+    for (let at = 8; at + 16 <= b.length; at += 16) {
+        const tag = (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+        // PT_LONG values sit in the first four bytes of the value.
+        if ((tag & 0xffff) === 0x0003)
+            out.set(tag >>> 16, (b[at + 8] | (b[at + 9] << 8) | (b[at + 10] << 16) | (b[at + 11] << 24)) >>> 0);
+    }
+    return out;
+}

package/dist/objects.d.ts

@@ -0,0 +1,45 @@
+import { type CfbEntry, CompoundFile } from './cfb';
+import { type ContainedDecision } from './contained';
+import { type Reported, type RunContext } from './context';
+import { type PackagedFile } from './oleobj';
+import type { CompoundPlan } from './plan';
+/** Equation Editor 3.0's ProgID, which rtfobj matches as a prefix. */
+export declare const isEquationClass: (name: string) => boolean;
+/** Reports what the reader of a compound file inside this one noted, at the place it sits. */
+export declare function nestedNotes(ctx: RunContext, cfb: CompoundFile, location: string): void;
+/**
+ * The rules every compound file gets: VBA projects, embedded objects and controls, wherever they sit in the tree.
+ * `prefix` names where the file sits when it is inside another, and `rootIsObject` says that its root is itself an
+ * OLE object's storage, as an object in a presentation or an RTF file is. `plan`, given for the file the rewrite
+ * writes, collects the storages a strip finding names.
+ */
+export declare function compoundRules(ctx: RunContext, cfb: CompoundFile, prefix: string, rootIsObject: boolean, plan?: CompoundPlan, rootDecision?: ContainedDecision): Promise<void>;
+/** What an OLE object's storage says about the object. */
+export interface ObjectInfo {
+    clsid: string;
+    progId?: string;
+    userType?: string;
+    /** An ActiveX control's storage, with the control's name. */
+    control: boolean;
+    controlName?: string;
+    linked: boolean;
+    /** What a linked object loads, or ''. */
+    target: string;
+    /** The target is a URL moniker's, which loads from outside however it is spelled. */
+    url: boolean;
+    /** A Packager object's file, held or linked to. */
+    pkg?: PackagedFile;
+    equation: boolean;
+}
+/** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
+export declare function describeObject(cfb: CompoundFile, e: CfbEntry, _location: string): Promise<ObjectInfo>;
+/**
+ * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a
+ * CVE-2017-0199 sample puts a character with a stray high byte where the colon of https: goes.
+ */
+export declare function linkedObject(ctx: RunContext, d: {
+    target: string;
+    url: boolean;
+}, location: string, data: Record<string, string>): Reported;
+/** What a finding shows of a Packager object's file: its name and paths, and its size when the object holds it. */
+export declare function packageData(p: PackagedFile): Record<string, string | number>;

package/dist/objects.js

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isEquationClass = void 0;
+exports.nestedNotes = nestedNotes;
+exports.compoundRules = compoundRules;
+exports.describeObject = describeObject;
+exports.linkedObject = linkedObject;
+exports.packageData = packageData;
+const cfb_1 = require("./cfb");
+const cfb_writer_1 = require("./cfb-writer");
+const contained_1 = require("./contained");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const oleobj_1 = require("./oleobj");
+const rewrite_cfb_1 = require("./rewrite-cfb");
+const types_1 = require("./types");
+/** The class ids of Equation Editor 3.0 and its kin, which CVE-2017-11882 and CVE-2018-0802 exploit, as oletools lists them. */
+const EQUATION_CLSIDS = new Set(['0002CE02-0000-0000-C000-000000000046', '00021700-0000-0000-C000-000000000046', '0003000B-0000-0000-C000-000000000046', '0004A6B0-0000-0000-C000-000000000046']);
+/** Equation Editor 3.0's ProgID, which rtfobj matches as a prefix. */
+const isEquationClass = (name) => name.trim().toLowerCase().startsWith('equation.3');
+exports.isEquationClass = isEquationClass;
+/** Streams that only an OLE object's storage holds. */
+const OBJECT_STREAMS = new Set(['\x01OLE', '\x01COMPOBJ', '\x01OLE10NATIVE', '\x03OBJINFO']);
+/** Streams that only an ActiveX control's storage holds. */
+const CONTROL_STREAMS = new Set(['\x03OCXNAME', '\x03OCXDATA']);
+/** A CompObj, OLE or ObjInfo stream is small. More is not read. */
+const SMALL = 65536;
+/** Packager's header is short, and its names are at most 1,024 bytes each. */
+const PACKAGE_HEAD = 4096;
+const upper = (e) => e.name.toUpperCase();
+/** Reports what the reader of a compound file inside this one noted, at the place it sits. */
+function nestedNotes(ctx, cfb, location) {
+    for (const n of cfb.notes)
+        ctx.report(types_1.OfficeCategory.Container, n.detail, location, { bytes: n.bytes });
+}
+/** Where a finding about an entry points: `prefix`, then the entry's path. */
+const at = (prefix, e) => [prefix, (0, cfb_1.entryPath)(e)].filter(Boolean).join(' > ');
+/**
+ * The rules every compound file gets: VBA projects, embedded objects and controls, wherever they sit in the tree.
+ * `prefix` names where the file sits when it is inside another, and `rootIsObject` says that its root is itself an
+ * OLE object's storage, as an object in a presentation or an RTF file is. `plan`, given for the file the rewrite
+ * writes, collects the storages a strip finding names.
+ */
+async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision) {
+    const projects = new Set();
+    const drop = (r, e) => {
+        if (r.action === 'strip' && e.kind !== 'root')
+            plan?.drop.add(e);
+    };
+    for (const e of cfb.entries) {
+        if (e.kind === 'stream')
+            continue;
+        const child = (name) => e.children.find(c => upper(c) === name);
+        // A VBA project: a VBA storage with a dir stream, which names the modules (MS-OVBA 2.2). The storage that holds
+        // the project goes, or the VBA storage when that is the root.
+        const vba = child('VBA');
+        if (vba?.kind === 'storage' && vba.children.some(c => c.kind === 'stream' && upper(c) === 'DIR')) {
+            projects.add(e);
+            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), { storage: at(prefix, vba) }), e.kind === 'root' ? vba : e);
+        }
+        if (e.kind === 'storage' && (upper(e) === '_VBA_PROJECT_CUR' || upper(e) === 'MACROS') && e.children.length && !projects.has(e)) {
+            // Excel's and Word's project storages, without the dir stream a whole project has.
+            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, e), { storage: at(prefix, e) }), e);
+        }
+        const names = new Set(e.children.map(upper));
+        const parent = e.parent ? upper(e.parent) : '';
+        const isObject = e.kind === 'root'
+            ? rootIsObject
+            : [...names].some(n => OBJECT_STREAMS.has(n) || CONTROL_STREAMS.has(n)) ||
+                (parent === 'OBJECTPOOL' && e.parent?.parent?.kind === 'root') ||
+                (e.parent?.kind === 'root' && /^MBD[0-9A-F]{8}$/i.test(e.name));
+        if (isObject)
+            for (const r of await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined))
+                drop(r, e);
+    }
+}
+/** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
+async function describeObject(cfb, e, _location) {
+    const child = (name) => e.children.find(c => c.kind === 'stream' && upper(c) === name);
+    const small = async (name) => {
+        const s = child(name);
+        return s && s.size <= SMALL ? cfb.bytes(s) : undefined;
+    };
+    const clsid = e.clsid === '00000000-0000-0000-0000-000000000000' ? '' : e.clsid;
+    const compObjBytes = await small('\x01COMPOBJ');
+    const comp = compObjBytes ? (0, oleobj_1.parseCompObj)(compObjBytes) : {};
+    const info = { clsid, progId: comp.progId, userType: comp.userType, control: false, linked: false, target: '', url: false, equation: false };
+    info.equation = EQUATION_CLSIDS.has(clsid) || (0, exports.isEquationClass)(comp.progId ?? '');
+    if ([...CONTROL_STREAMS].some(n => child(n))) {
+        const name = await small('\x03OCXNAME');
+        info.control = true;
+        if (name)
+            info.controlName = Buffer.from(name).toString('utf16le').replace(/\0+$/, '');
+        return info;
+    }
+    const oleBytes = await small('\x01OLE');
+    const ole = oleBytes ? (0, oleobj_1.parseOleStream)(oleBytes) : { linked: false, target: '', url: false };
+    Object.assign(info, ole);
+    const native = child('\x01OLE10NATIVE');
+    if (native) {
+        // The stream starts with the native data's size, then Packager's data.
+        info.pkg = (0, oleobj_1.parsePackage)(await cfb.source(native).read(4, PACKAGE_HEAD));
+    }
+    return info;
+}
+/**
+ * Shows an embedded object of the compound file the rewrite writes to the plugins: the file a Packager object holds,
+ * or the object's storage written out as a compound file of its own. Bytes a plugin wrote take the file's place in
+ * the Ole10Native stream, or the storage's place as the storages and streams of the compound file they hold.
+ */
+async function objectFile(ctx, cfb, e, d, location, plan) {
+    const run = ctx.run;
+    const native = e.children.find(c => c.kind === 'stream' && upper(c) === '\x01OLE10NATIVE');
+    if (d.pkg?.embedded && native) {
+        const pkg = d.pkg;
+        const source = cfb.source(native);
+        const start = 4 + pkg.dataAt;
+        const length = Math.max(0, Math.min(pkg.size, native.size - start));
+        const decision = await (0, contained_1.decideContained)(ctx, { name: pkg.fileName || undefined, location, chunks: () => (0, io_1.rangeChunks)(source, start, length) });
+        if (decision?.replacement) {
+            const all = await cfb.bytes(native);
+            plan.replace.set(native, await (0, contained_1.spillOf)(run, (0, oleobj_1.sizedStream)((0, oleobj_1.replaceSized)(all.subarray(4), pkg.dataAt, pkg.size, await (0, io_1.readAll)(decision.replacement)))));
+        }
+        return decision;
+    }
+    const written = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(written);
+    await (0, cfb_writer_1.writeCfb)((0, rewrite_cfb_1.subtree)(cfb, e), written, run.deadline);
+    await written.close();
+    const decision = await (0, contained_1.decideContained)(ctx, { name: d.userType || d.progId || undefined, location, chunks: () => written.read() });
+    const replacement = decision?.replacement;
+    if (!replacement)
+        return decision;
+    const source = replacement.source();
+    run.sources.push(source);
+    let graft;
+    try {
+        graft = await cfb_1.CompoundFile.open(source, ctx.settings, run.deadline);
+    }
+    catch (err) {
+        if (!(err instanceof errors_1.StopError))
+            throw err;
+        ctx.removal(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginFailed, location, { reason: 'its output is not a compound file' });
+        return { keep: false };
+    }
+    plan.grafts.set(e, graft);
+    // The output check writes the storage out again, so it expects the bytes this writer makes of the graft.
+    const again = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(again);
+    await (0, cfb_writer_1.writeCfb)((0, rewrite_cfb_1.subtree)(graft, graft.root), again, run.deadline);
+    await again.close();
+    const expected = run.kept.get(replacement.digest());
+    if (expected)
+        run.kept.set(again.digest(), expected);
+    return decision;
+}
+/**
+ * One OLE object's storage: a control, a linked object, or an embedded one, with what it holds. Returns its findings,
+ * and a strip when a plugin removed the object. In the file the rewrite writes, `plan` is set and an embedded object
+ * goes to the plugins first. `given` is the verdict on an object whose container showed it to the plugins already.
+ */
+async function objectRules(ctx, cfb, e, location, plan, given) {
+    const d = await describeObject(cfb, e, location);
+    const data = { storage: location };
+    if (d.clsid)
+        data.clsid = d.clsid;
+    if (d.progId)
+        data.progId = (0, context_1.clip)(d.progId);
+    if (d.userType)
+        data.className = (0, context_1.clip)(d.userType);
+    if (d.control)
+        return [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, d.controlName ? { ...data, name: (0, context_1.clip)(d.controlName) } : data)];
+    const found = [];
+    if (d.pkg) {
+        Object.assign(data, packageData(d.pkg));
+        if (!d.pkg.embedded && d.pkg.sourcePath)
+            found.push(ctx.external(types_1.OfficeDetail.Object, d.pkg.sourcePath, location, { storage: location }, 'package link'));
+    }
+    if (d.linked)
+        found.push(linkedObject(ctx, d, location, { storage: location, ...(d.clsid ? { clsid: d.clsid } : {}) }));
+    else {
+        const decision = given ?? (plan ? await objectFile(ctx, cfb, e, d, location, plan) : undefined);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, (0, contained_1.presence)(decision)));
+        if (decision && !decision.keep)
+            found.push({ action: 'strip' });
+    }
+    if (d.equation)
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data));
+    return found;
+}
+/**
+ * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a
+ * CVE-2017-0199 sample puts a character with a stray high byte where the colon of https: goes.
+ */
+function linkedObject(ctx, d, location, data) {
+    if (d.target && !d.url)
+        return ctx.external(types_1.OfficeDetail.Object, d.target, location, data, 'linked object');
+    return ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, d.target ? { ...data, target: (0, context_1.clip)(d.target, 2000) } : data);
+}
+/** What a finding shows of a Packager object's file: its name and paths, and its size when the object holds it. */
+function packageData(p) {
+    return { fileName: (0, context_1.clip)(p.fileName), sourcePath: (0, context_1.clip)(p.sourcePath, 2000), tempPath: (0, context_1.clip)(p.tempPath, 2000), ...(p.embedded ? { size: p.size } : {}) };
+}