@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/odf.d.ts

@@ -1,3 +1,67 @@
-import { type RunContext } from './context';
+import { type PlanContext, type ZipContext } from './context';
+import { OfficeCategory as C, OfficeDetail as D } from './types';
+import type { XmlElement, XmlHandler } from './xml';
+export declare const NS: {
+    manifest: string;
+    office: string;
+    script: string;
+    presentation: string;
+    text: string;
+    draw: string;
+    table: string;
+    form: string;
+    meta: string;
+    style: string;
+    database: string;
+    chart: string;
+    xlink: string;
+};
+/** An attribute by normalized namespace and local name. */
+export declare function oattr(el: XmlElement, ns: string, local: string): string | undefined;
+/** The ODF_NS-normalized namespace of `ns`, exported for the rewrite. */
+export declare const odfNamespace: (ns: string) => string;
+/** The xlink:href of an element, for the rewrite. */
+export declare const hrefOf: (el: XmlElement) => string | undefined;
+/** A path inside the package as the manifest and the zip name it: without "./" and leading slashes. */
+export declare const packagePath: (href: string) => string;
+/**
+ * The rules that read inside one XML entry of an ODF package, or inside a flat OpenDocument file. A flat file has no
+ * entries, so in one every relative reference names a file beside the document, which loads from outside it.
+ */
+export declare class EntryRules implements XmlHandler {
+    private readonly ctx;
+    private readonly entry;
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    private readonly oleRefs;
+    private readonly flat;
+    /** Depth of the office:scripts element being read, 0 outside one. */
+    private scriptsDepth;
+    /** An office:script element being read, with whether it holds anything. */
+    private script?;
+    /** A link element being read, whose text and title go into the label check at its end. */
+    private label?;
+    constructor(ctx: PlanContext, entry: string, 
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    oleRefs: Map<string, boolean>, flat?: boolean);
+    /**
+     * Whether a reference names an entry of the package. LibreOffice's vnd.sun.star.Package: URLs name one too. In a
+     * flat file no entry exists, so only such a URL stays inside, naming nothing.
+     */
+    private inside;
+    private report;
+    /** Records the edit for the element when the finding strips. */
+    private edit;
+    start(raw: XmlElement): void;
+    text(t: string): void;
+    end(el: XmlElement): void;
+    private scriptEvent;
+    private presentationEvent;
+}
+/** The code folder an entry sits in, as the folder's path and its finding. */
+export declare function folderOf(name: string): {
+    prefix: string;
+    detail: D;
+    category: C;
+} | undefined;
 /** Inspects an OpenDocument package. */
-export declare function inspectOdf(ctx: RunContext): Promise<void>;
+export declare function inspectOdf(ctx: ZipContext): Promise<void>;

package/dist/odf.js

@@ -1,14 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntryRules = exports.packagePath = exports.hrefOf = exports.odfNamespace = exports.NS = void 0;
+exports.oattr = oattr;
+exports.folderOf = folderOf;
 exports.inspectOdf = inspectOdf;
+const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const formats_1 = require("./formats");
 const formulas_1 = require("./formulas");
 const links_1 = require("./links");
+const plan_1 = require("./plan");
 const types_1 = require("./types");
 const zip_1 = require("./zip");
-const NS = {
+exports.NS = {
     manifest: 'urn:oasis:names:tc:opendocument:xmlns:manifest:1.0',
     office: 'urn:oasis:names:tc:opendocument:xmlns:office:1.0',
     script: 'urn:oasis:names:tc:opendocument:xmlns:script:1.0',
@@ -20,6 +25,7 @@ const NS = {
     meta: 'urn:oasis:names:tc:opendocument:xmlns:meta:1.0',
     style: 'urn:oasis:names:tc:opendocument:xmlns:style:1.0',
     database: 'urn:oasis:names:tc:opendocument:xmlns:database:1.0',
+    chart: 'urn:oasis:names:tc:opendocument:xmlns:chart:1.0',
     xlink: 'http://www.w3.org/1999/xlink',
 };
 /**
@@ -35,21 +41,21 @@ const FOLDERS = [
 /** Event names that fire as the document opens. Focus and activation count only for the document's own events. */
 const ON_OPEN = new Set(['load', 'new', 'create', 'loadfinished', 'viewcreated']);
 const ON_OPEN_DOCUMENT = new Set(['focus', 'activate']);
-const LINK_ELEMENTS = new Set([`${NS.text} a`, `${NS.draw} a`, `${NS.draw} area-rectangle`, `${NS.draw} area-circle`, `${NS.draw} area-polygon`]);
+const LINK_ELEMENTS = new Set([`${exports.NS.text} a`, `${exports.NS.draw} a`, `${exports.NS.draw} area-rectangle`, `${exports.NS.draw} area-circle`, `${exports.NS.draw} area-polygon`]);
 const EXTERNAL_KIND = new Map([
-    [`${NS.meta} template`, types_1.OfficeDetail.Template],
-    [`${NS.meta} auto-reload`, types_1.OfficeDetail.Reload],
-    [`${NS.draw} image`, types_1.OfficeDetail.Image],
-    [`${NS.draw} fill-image`, types_1.OfficeDetail.Image],
-    [`${NS.style} background-image`, types_1.OfficeDetail.Image],
-    [`${NS.text} section-source`, types_1.OfficeDetail.Include],
-    [`${NS.table} table-source`, types_1.OfficeDetail.Include],
-    [`${NS.draw} object`, types_1.OfficeDetail.Object],
-    [`${NS.draw} object-ole`, types_1.OfficeDetail.Object],
-    [`${NS.draw} floating-frame`, types_1.OfficeDetail.Frame],
+    [`${exports.NS.meta} template`, types_1.OfficeDetail.Template],
+    [`${exports.NS.meta} auto-reload`, types_1.OfficeDetail.Reload],
+    [`${exports.NS.draw} image`, types_1.OfficeDetail.Image],
+    [`${exports.NS.draw} fill-image`, types_1.OfficeDetail.Image],
+    [`${exports.NS.style} background-image`, types_1.OfficeDetail.Image],
+    [`${exports.NS.text} section-source`, types_1.OfficeDetail.Include],
+    [`${exports.NS.table} table-source`, types_1.OfficeDetail.Include],
+    [`${exports.NS.draw} object`, types_1.OfficeDetail.Object],
+    [`${exports.NS.draw} object-ole`, types_1.OfficeDetail.Object],
+    [`${exports.NS.draw} floating-frame`, types_1.OfficeDetail.Frame],
 ]);
 /** Elements whose reference always leaves the package: it resolves against the document's own location. */
-const ALWAYS_OUTSIDE = new Set([`${NS.meta} template`, `${NS.meta} auto-reload`, `${NS.text} section-source`, `${NS.table} table-source`]);
+const ALWAYS_OUTSIDE = new Set([`${exports.NS.meta} template`, `${exports.NS.meta} auto-reload`, `${exports.NS.text} section-source`, `${exports.NS.table} table-source`]);
 /**
  * LibreOffice reads urn:oasis:names:tc:<any>:xmlns:<name>:1.<any> as the OpenDocument namespace <name> 1.0, so this
  * does too. The comparison ignores case, which can only find more.
@@ -65,90 +71,155 @@ function oattr(el, ns, local) {
             return a.value;
     return undefined;
 }
+/** The ODF_NS-normalized namespace of `ns`, exported for the rewrite. */
+const odfNamespace = (ns) => odfNs(ns);
+exports.odfNamespace = odfNamespace;
+/** The edit that takes an element's xlink:href away, under whatever namespace URI the attribute has. */
+function stripHref(el) {
+    return { strip: new Set(el.attributes.filter(a => a.local === 'href' && odfNs(a.ns) === exports.NS.xlink).map(a => (0, plan_1.attributeKey)(a.ns, a.local))) };
+}
+/** The xlink:href of an element, for the rewrite. */
+const hrefOf = (el) => oattr(el, exports.NS.xlink, 'href');
+exports.hrefOf = hrefOf;
 /** A path inside the package as the manifest and the zip name it: without "./" and leading slashes. */
 const packagePath = (href) => (0, zip_1.nameKey)(href.trim().replace(/^(\.\/)+/, ''));
-/** The rules that read inside one XML entry of an ODF package. */
+exports.packagePath = packagePath;
+/**
+ * The rules that read inside one XML entry of an ODF package, or inside a flat OpenDocument file. A flat file has no
+ * entries, so in one every relative reference names a file beside the document, which loads from outside it.
+ */
 class EntryRules {
     ctx;
     entry;
     oleRefs;
+    flat;
     /** Depth of the office:scripts element being read, 0 outside one. */
     scriptsDepth = 0;
     /** An office:script element being read, with whether it holds anything. */
     script;
+    /** A link element being read, whose text and title go into the label check at its end. */
+    label;
     constructor(ctx, entry, 
     /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
-    oleRefs) {
+    oleRefs, flat = false) {
         this.ctx = ctx;
         this.entry = entry;
         this.oleRefs = oleRefs;
+        this.flat = flat;
+    }
+    /**
+     * Whether a reference names an entry of the package. LibreOffice's vnd.sun.star.Package: URLs name one too. In a
+     * flat file no entry exists, so only such a URL stays inside, naming nothing.
+     */
+    inside(href) {
+        const own = /^\s*vnd\.sun\.star\.package:(.*)$/is.exec(href);
+        if (own)
+            return this.flat || (0, links_1.isInsidePackage)(own[1]);
+        return !this.flat && (0, links_1.isInsidePackage)(href);
     }
     report(category, detail, data) {
-        this.ctx.report(category, detail, this.entry, data);
+        return this.ctx.report(category, detail, this.entry, data);
+    }
+    /** Records the edit for the element when the finding strips. */
+    edit(r, el, edit = { remove: true }) {
+        if (r.action === 'strip')
+            this.ctx.plan.element(this.entry, el.index, edit);
     }
     start(raw) {
         if (this.script)
             this.script.content = true;
         const el = { ...raw, ns: odfNs(raw.ns) };
         const key = `${el.ns} ${el.local}`;
-        const href = oattr(el, NS.xlink, 'href');
-        if (el.ns === NS.office && el.local === 'scripts' && !this.scriptsDepth)
+        const href = oattr(el, exports.NS.xlink, 'href');
+        if (el.ns === exports.NS.office && el.local === 'scripts' && !this.scriptsDepth)
             this.scriptsDepth = el.depth;
-        else if (el.ns === NS.office && el.local === 'script')
-            this.script = { depth: el.depth, language: oattr(el, NS.script, 'language') ?? '', content: false };
-        else if (el.ns === NS.script && el.local === 'event-listener')
+        else if (el.ns === exports.NS.office && el.local === 'script')
+            this.script = { depth: el.depth, language: oattr(el, exports.NS.script, 'language') ?? '', content: false, index: el.index };
+        else if (el.ns === exports.NS.script && el.local === 'event-listener')
             this.scriptEvent(el, href);
-        else if (el.ns === NS.presentation && el.local === 'event-listener')
+        else if (el.ns === exports.NS.presentation && el.local === 'event-listener')
             this.presentationEvent(el, href);
-        else if ((el.ns === NS.text && el.local === 'dde-connection-decl') || (el.ns === NS.office && el.local === 'dde-source')) {
-            this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, { application: (0, context_1.clip)(oattr(el, NS.office, 'dde-application') ?? ''), topic: (0, context_1.clip)(oattr(el, NS.office, 'dde-topic') ?? '') });
+        else if ((el.ns === exports.NS.text && el.local === 'dde-connection-decl') || (el.ns === exports.NS.office && el.local === 'dde-source')) {
+            this.edit(this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, { application: (0, context_1.clip)(oattr(el, exports.NS.office, 'dde-application') ?? ''), topic: (0, context_1.clip)(oattr(el, exports.NS.office, 'dde-topic') ?? '') }), raw);
         }
-        else if (el.ns === NS.draw && el.local === 'applet') {
-            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, { code: (0, context_1.clip)(oattr(el, NS.draw, 'code') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+        else if (el.ns === exports.NS.draw && el.local === 'applet') {
+            this.edit(this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, { code: (0, context_1.clip)(oattr(el, exports.NS.draw, 'code') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) }), raw);
             return;
         }
-        else if (el.ns === NS.draw && el.local === 'plugin') {
-            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, { mimeType: (0, context_1.clip)(oattr(el, NS.draw, 'mime-type') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) });
+        else if (el.ns === exports.NS.draw && el.local === 'plugin') {
+            this.edit(this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, { mimeType: (0, context_1.clip)(oattr(el, exports.NS.draw, 'mime-type') ?? ''), ...(href ? { target: (0, context_1.clip)(href) } : {}) }), raw);
             return;
         }
-        else if (el.ns === NS.draw && el.local === 'object-ole' && (href === undefined || (0, links_1.isInsidePackage)(href))) {
-            this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, href ? { target: (0, context_1.clip)(href) } : undefined);
-            if (href && this.oleRefs.has(packagePath(href)))
-                this.oleRefs.set(packagePath(href), true);
+        else if (el.ns === exports.NS.draw && el.local === 'object-ole' && (href === undefined || this.inside(href))) {
+            // The object's entry may still be ahead in the archive, so its plugin verdict decides this element later. The
+            // preview image beside the element stays either way.
+            const r = this.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, href ? { target: (0, context_1.clip)(href) } : undefined);
+            this.ctx.plan.objects.push({ part: this.entry, index: el.index, target: href ? (0, exports.packagePath)(href) : '', finding: r.finding, strips: r.action === 'strip' });
+            if (href && this.oleRefs.has((0, exports.packagePath)(href)))
+                this.oleRefs.set((0, exports.packagePath)(href), true);
         }
         for (const a of el.attributes) {
-            if (odfNs(a.ns) === NS.table && (a.local === 'formula' || a.local === 'expression') && (0, formulas_1.callsDde)(a.value))
-                this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, { formula: (0, context_1.clip)(a.value) });
+            // The cell keeps its value without the formula.
+            if (odfNs(a.ns) !== exports.NS.table || (a.local !== 'formula' && a.local !== 'expression'))
+                continue;
+            const strip = { strip: new Set([(0, plan_1.attributeKey)(a.ns, a.local)]) };
+            if ((0, formulas_1.callsDde)(a.value))
+                this.edit(this.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Formula, { formula: (0, context_1.clip)(a.value) }), raw, strip);
+            for (const [fn, kind] of (0, formulas_1.formulaCalls)(a.value))
+                this.edit(this.report(kind === 'fetch' ? types_1.OfficeCategory.External : types_1.OfficeCategory.Macro, types_1.OfficeDetail.Formula, { function: (0, context_1.clip)(fn), formula: (0, context_1.clip)(a.value) }), raw, strip);
         }
-        if (href === undefined || (0, links_1.isFragment)(href) || (el.ns === NS.script && el.local === 'event-listener') || (el.ns === NS.presentation && el.local === 'event-listener'))
+        if (href === undefined || (0, links_1.isFragment)(href) || (el.ns === exports.NS.script && el.local === 'event-listener') || (el.ns === exports.NS.presentation && el.local === 'event-listener'))
             return;
         // A database document names its own embedded database this way.
-        if (el.ns === NS.database && el.local === 'connection-resource' && /^sdbc:embedded:/i.test(href.trim()))
+        if (el.ns === exports.NS.database && el.local === 'connection-resource' && /^sdbc:embedded:/i.test(href.trim()))
+            return;
+        // A chart names the document that holds it, its data source, as "..".
+        if (el.ns === exports.NS.chart && el.local === 'chart' && /^\.\.\/?$/.test(href.trim()))
             return;
-        if (LINK_ELEMENTS.has(key) || (el.ns === NS.form && el.local !== 'form'))
-            this.ctx.link(href, this.entry, { element: (0, context_1.clip)(el.qname) });
-        else if ((ALWAYS_OUTSIDE.has(key) || !(0, links_1.isInsidePackage)(href)) && !(el.ns === NS.form && el.local === 'form')) {
-            this.ctx.external(EXTERNAL_KIND.get(key) ?? types_1.OfficeDetail.Other, href, this.entry, { element: (0, context_1.clip)(el.qname) }, (0, context_1.clip)(el.local));
+        if (LINK_ELEMENTS.has(key)) {
+            // The text of a link stays without it. An image map area is nothing but its link.
+            const r = this.ctx.link(href, this.entry, { element: (0, context_1.clip)(el.qname) });
+            this.edit(r, raw, el.local === 'a' ? { unwrap: true } : { remove: true });
+            if (r.action !== 'strip' && !this.label)
+                this.label = { index: el.index, href, text: '', title: oattr(el, exports.NS.office, 'title') ?? oattr(el, exports.NS.xlink, 'title'), unwrap: el.local === 'a' };
+        }
+        else if (el.ns === exports.NS.form && el.local === 'form') {
+            // A form's own href is where it sends its fields, which goes as pdf-defuse's form submit actions go.
+            this.edit(this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.SubmitForm, { element: (0, context_1.clip)(el.qname), target: (0, context_1.clip)(href, 2000) }), raw, stripHref(raw));
+        }
+        else if (el.ns === exports.NS.form)
+            this.edit(this.ctx.link(href, this.entry, { element: (0, context_1.clip)(el.qname) }), raw, stripHref(raw));
+        else if (ALWAYS_OUTSIDE.has(key) || !this.inside(href)) {
+            this.edit(this.ctx.external(EXTERNAL_KIND.get(key) ?? types_1.OfficeDetail.Other, href, this.entry, { element: (0, context_1.clip)(el.qname) }, (0, context_1.clip)(el.local)), raw);
         }
     }
     text(t) {
         if (this.script && t.trim())
             this.script.content = true;
+        if (this.label && this.label.text.length < 4096)
+            this.label.text += t;
     }
     end(el) {
-        if (this.scriptsDepth === el.depth && odfNs(el.ns) === NS.office && el.local === 'scripts')
+        const label = this.label;
+        if (label && label.index === el.index) {
+            this.label = undefined;
+            const r = this.ctx.labelMismatch(label.href, [label.text, label.title], this.entry, { element: (0, context_1.clip)(el.qname) });
+            if (r)
+                this.edit(r, el, label.unwrap ? { unwrap: true } : { remove: true });
+        }
+        if (this.scriptsDepth === el.depth && odfNs(el.ns) === exports.NS.office && el.local === 'scripts')
             this.scriptsDepth = 0;
         if (this.script && this.script.depth === el.depth) {
             if (this.script.content)
-                this.report(types_1.OfficeCategory.Macro, /basic/i.test(this.script.language) ? types_1.OfficeDetail.OdfBasic : types_1.OfficeDetail.OdfScripts, { language: (0, context_1.clip)(this.script.language) });
+                this.edit(this.report(types_1.OfficeCategory.Macro, /basic/i.test(this.script.language) ? types_1.OfficeDetail.OdfBasic : types_1.OfficeDetail.OdfScripts, { language: (0, context_1.clip)(this.script.language) }), el, { remove: true });
             this.script = undefined;
         }
     }
     scriptEvent(el, href) {
-        const event = oattr(el, NS.script, 'event-name') ?? '';
+        const event = oattr(el, exports.NS.script, 'event-name') ?? '';
         // LibreOffice runs nothing for a listener whose script URL and macro name are both empty. An empty href does not
         // hide a macro name.
-        const target = [href, oattr(el, NS.script, 'macro-name')].find(v => v !== undefined && v !== '');
+        const target = [href, oattr(el, exports.NS.script, 'macro-name')].find(v => v !== undefined && v !== '');
         if (target === undefined)
             return;
         const name = event
@@ -157,45 +228,43 @@ class EntryRules {
             .replace(/^on/, '')
             .replace(/-/g, '');
         const onOpen = ON_OPEN.has(name) || (this.scriptsDepth > 0 && ON_OPEN_DOCUMENT.has(name));
-        const data = { event: (0, context_1.clip)(event), target: (0, context_1.clip)(target), language: (0, context_1.clip)(oattr(el, NS.script, 'language') ?? '') };
-        if (onOpen)
-            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.EventOnOpen, data);
-        else
-            this.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Event, data);
+        const data = { event: (0, context_1.clip)(event), target: (0, context_1.clip)(target), language: (0, context_1.clip)(oattr(el, exports.NS.script, 'language') ?? '') };
+        this.edit(this.report(types_1.OfficeCategory.Macro, onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, data), el);
     }
     presentationEvent(el, href) {
-        const action = oattr(el, NS.presentation, 'action') ?? '';
-        const data = { event: (0, context_1.clip)(oattr(el, NS.script, 'event-name') ?? ''), action: (0, context_1.clip)(action), ...(href ? { target: (0, context_1.clip)(href) } : {}) };
+        const action = oattr(el, exports.NS.presentation, 'action') ?? '';
+        const data = { event: (0, context_1.clip)(oattr(el, exports.NS.script, 'event-name') ?? ''), action: (0, context_1.clip)(action), ...(href ? { target: (0, context_1.clip)(href) } : {}) };
         if (action === 'execute')
-            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, data);
+            this.edit(this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, data), el);
         else if (action === 'verb')
-            this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, data);
+            this.edit(this.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, data), el);
         else if (href !== undefined && !(0, links_1.isFragment)(href))
-            this.ctx.link(href, this.entry, data);
+            this.edit(this.ctx.link(href, this.entry, data), el);
     }
 }
+exports.EntryRules = EntryRules;
 /** The manifest. Only paths that name an entry of the archive are kept, so a manifest of millions costs no memory. */
 async function readManifest(ctx, entry) {
     const keys = new Set(ctx.zip.entries.map(e => (0, zip_1.nameKey)(e.name)));
     const m = { paths: new Set(), encrypted: false };
     await ctx.parse(entry, {
         start(el) {
-            if (odfNs(el.ns) !== NS.manifest)
+            if (odfNs(el.ns) !== exports.NS.manifest)
                 return;
             if (el.local === 'encryption-data')
                 m.encrypted = true;
             if (el.local !== 'file-entry')
                 return;
-            const path = oattr(el, NS.manifest, 'full-path');
+            const path = oattr(el, exports.NS.manifest, 'full-path');
             if (path === undefined)
                 return;
             if (path === '/') {
                 if (m.root !== undefined)
                     ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, entry.name, { kind: 'manifest path', name: '/' });
-                m.root = oattr(el, NS.manifest, 'media-type') ?? '';
+                m.root = oattr(el, exports.NS.manifest, 'media-type') ?? '';
                 return;
             }
-            const key = packagePath(path);
+            const key = (0, exports.packagePath)(path);
             if (!keys.has(key))
                 return;
             if (m.paths.has(key))
@@ -262,6 +331,8 @@ async function inspectOdf(ctx) {
     const folders = new Map();
     const oleRefs = new Map(zip.entries.map(e => [(0, zip_1.nameKey)(e.name), false]));
     const oleEntries = [];
+    /** Entries that are whole files in formats of their own, such as pictures, which go to the plugins. */
+    const wholeFiles = [];
     for (const entry of zip.entries) {
         if (entry === mimetype || entry === manifestEntry)
             continue;
@@ -280,18 +351,64 @@ async function inspectOdf(ctx) {
             await ctx.parse(entry, new EntryRules(ctx, entry.name, oleRefs));
         else if (await ctx.drain(entry))
             oleEntries.push(entry);
+        else if (!entry.directory && !/^meta-inf\//i.test(entry.name))
+            wholeFiles.push(entry);
     }
+    const plan = ctx.plan;
+    // A folder goes whole, its empty files with it.
     for (const [prefix, f] of folders)
-        ctx.report(f.category, f.detail, prefix, { entries: f.entries });
-    for (const e of oleEntries)
-        if (!oleRefs.get((0, zip_1.nameKey)(e.name)))
-            ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name });
+        if (ctx.report(f.category, f.detail, prefix, { entries: f.entries }).action === 'strip')
+            plan.folders.add(`${(0, zip_1.nameKey)(prefix)}/`);
+    // OLE entries go to the plugins. When none takes one, the elements that refer to it decide, or EMBEDDED/OLE_FILE.
+    const decided = new Map();
+    for (const e of oleEntries) {
+        const key = (0, zip_1.nameKey)(e.name);
+        const decision = await (0, contained_1.decideContained)(ctx, { name: e.name, location: e.name, chunks: () => zip.read(e) });
+        if (decision) {
+            decided.set(key, decision.keep);
+            if (!decision.keep)
+                plan.drop.add(key);
+            else if (decision.replacement)
+                plan.replace.set(key, decision.replacement);
+        }
+        if (!oleRefs.get(key)) {
+            const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name }, (0, contained_1.presence)(decision));
+            if (!decision && r.action === 'strip')
+                plan.drop.add(key);
+        }
+    }
+    // A whole file no plugin takes stays, since no rule names it.
+    for (const e of wholeFiles) {
+        const decision = await (0, contained_1.decideContained)(ctx, { name: e.name, location: e.name, chunks: () => zip.read(e) });
+        if (decision && !decision.keep)
+            plan.drop.add((0, zip_1.nameKey)(e.name));
+        else if (decision?.replacement)
+            plan.replace.set((0, zip_1.nameKey)(e.name), decision.replacement);
+    }
+    const files = new Set(zip.entries.filter(e => !e.directory).map(e => (0, zip_1.nameKey)(e.name)));
+    for (const o of plan.objects) {
+        const kept = decided.get(o.target);
+        if (kept === true) {
+            // A plugin kept the object's file, so the object stays.
+            if (o.finding) {
+                o.finding.action = 'info';
+                ctx.run.superseded.add(o.finding);
+            }
+            continue;
+        }
+        if (kept === false || o.strips) {
+            plan.element(o.part, o.index, { remove: true });
+            if (files.has(o.target))
+                plan.drop.add(o.target);
+        }
+    }
     if (manifest) {
         for (const e of zip.entries) {
             if (e.directory || e === mimetype || e === manifestEntry || /^meta-inf\//i.test(e.name))
                 continue;
-            if (!manifest.paths.has((0, zip_1.nameKey)(e.name)))
-                ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, e.name, { part: e.name });
+            if (!manifest.paths.has((0, zip_1.nameKey)(e.name)) && ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, e.name, { part: e.name }).action === 'strip')
+                plan.drop.add((0, zip_1.nameKey)(e.name));
         }
     }
+    plan.odf = { mimetype, manifest: manifestEntry, mediaType: type };
 }

package/dist/offcrypto.d.ts

@@ -0,0 +1,54 @@
+import type { BiffRecord } from './biff';
+import type { CfbEntry, CompoundFile } from './cfb';
+import type { RunContext } from './context';
+import { type ByteSource } from './types';
+import type { Decrypt } from './xls';
+/** The password Excel opens a workbook with when nobody set one to open it (MS-OFFCRYPTO 2.4.3). */
+export declare const DEFAULT_PASSWORD = "VelvetSweatshop";
+/** The password PowerPoint 97 to 2003 opens a presentation with when nobody set one to open it. */
+export declare const POWERPOINT_PASSWORD = "/01Hannes Ruescher/01";
+/** RC4, which OpenSSL 3 leaves out of its default provider. */
+export declare class Rc4 {
+    private readonly s;
+    private i;
+    private j;
+    constructor(key: Uint8Array);
+    /** XORs the next keystream bytes into a copy of `data`. */
+    crypt(data: Uint8Array): Uint8Array;
+}
+/**
+ * Opens a workbook that its FILEPASS record (MS-XLS 2.4.117) encrypts with RC4 or RC4 CryptoAPI, with the caller's
+ * password or VelvetSweatshop. The records after FILEPASS are encrypted in 1024-byte blocks of the stream, each with its
+ * own key. Their headers are not, but take keystream bytes, and some records are never encrypted. XOR obfuscation,
+ * the only kind an Excel 5.0 or 95 workbook has, is undone the same way record by record.
+ */
+export declare function unlockWorkbook(ctx: RunContext, filePass: BiffRecord, stream: string): Decrypt;
+/** A stream decrypted where it is read. */
+export type StreamDecrypt = (offset: number, bytes: Uint8Array) => Uint8Array;
+/** What opens an encrypted Word 97 to 2003 document: a decryption for each of its three encrypted streams. */
+export interface WordKey {
+    word: StreamDecrypt;
+    table: StreamDecrypt;
+    data: StreamDecrypt;
+}
+/**
+ * Opens an encrypted Word 97 to 2003 document (MS-DOC 2.2.6) with the caller's passwords. XOR obfuscation keeps its
+ * verifier in FibBase.lKey. RC4 and RC4 CryptoAPI keep their EncryptionHeader in the table stream's first lKey bytes.
+ * The WordDocument stream stays plain for its first 68 bytes, and Word has no default password.
+ */
+export declare function unlockDocument(ctx: RunContext, fib: Uint8Array, table: ByteSource, stream: string): Promise<WordKey>;
+/**
+ * Opens an encrypted PowerPoint 97 to 2003 presentation (MS-PPT 2.3.7): `session` is the CryptSession10Container's
+ * data, an RC4 CryptoAPI EncryptionHeader. Returns the key of each persist object, whose block number is its persist
+ * id, after the caller's passwords and PowerPoint's own default have been tried.
+ */
+export declare function unlockPresentation(ctx: RunContext, session: Uint8Array, stream: string): (id: number) => Rc4;
+/**
+ * Inspects an encrypted OOXML package: EncryptionInfo (MS-OFFCRYPTO 2.3.4) names the cipher, and the caller's password
+ * or VelvetSweatshop gives the key. The package it decrypts goes through the OOXML rules, read in place: Agile
+ * encryption works in 4,096-byte segments and Standard in 16-byte blocks, so nothing is decrypted that is not read.
+ */
+export declare function openPackage(ctx: RunContext, cfb: CompoundFile, info: CfbEntry, pkg: CfbEntry): Promise<{
+    source: ByteSource;
+    size: number;
+}>;