@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/ole.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.families = families;
+exports.inspectCompound = inspectCompound;
+const errors_1 = require("./errors");
+const msg_1 = require("./msg");
+const objects_1 = require("./objects");
+const offcrypto_1 = require("./offcrypto");
+const package_1 = require("./package");
+const plan_1 = require("./plan");
+const ppt_1 = require("./ppt");
+const types_1 = require("./types");
+const vsd_1 = require("./vsd");
+const word_1 = require("./word");
+const xls_1 = require("./xls");
+const zip_1 = require("./zip");
+const f = (format, mimeType) => ({ format, mimeType });
+const upper = (e) => e.name.toUpperCase();
+const PUBLISHER_CLSIDS = new Set(['00021200-0000-0000-00C0-000000000046', '00021201-0000-0000-00C0-000000000046']);
+/** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
+function families(cfb) {
+    const names = new Map(cfb.root.children.map(c => [upper(c), c]));
+    const stream = (n) => names.get(n)?.kind === 'stream';
+    const out = [];
+    if (stream('ENCRYPTIONINFO') && stream('ENCRYPTEDPACKAGE'))
+        out.push('encrypted');
+    if (stream('WORDDOCUMENT'))
+        out.push('word');
+    if (stream('WORKBOOK') || stream('BOOK'))
+        out.push('excel');
+    if (stream('POWERPOINT DOCUMENT'))
+        out.push('powerpoint');
+    if (stream('VISIODOCUMENT'))
+        out.push('visio');
+    if (stream('__PROPERTIES_VERSION1.0'))
+        out.push('outlook');
+    // Publisher 98 and later keep their content in a Quill storage. Publisher 95 has none, and names itself by class id.
+    if (names.get('QUILL')?.kind === 'storage' || (PUBLISHER_CLSIDS.has(cfb.root.clsid) && stream('CONTENTS')))
+        out.push('publisher');
+    // Project keeps its data in a storage named by three spaces and a number, beside a Props stream.
+    if ([...names.keys()].some(n => /^PROPS\d*$/.test(n)) && cfb.root.children.some(c => c.kind === 'storage' && /^ {3}\d+$/.test(c.name)))
+        out.push('project');
+    return out;
+}
+/**
+ * Inspects a compound file: the rules every compound file gets, over its whole tree, and then those of the format
+ * its root names.
+ */
+async function inspectCompound(ctx, cfb) {
+    const found = families(cfb);
+    // Word 2007 writes a Word document beside an encrypted package, for readers that cannot decrypt it.
+    const main = found.filter(x => !(x === 'word' && found.includes('encrypted')));
+    if (main.length > 1)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, `The compound file holds ${main.join(' and ')} streams`, { reason: `${main.join(' and ')} streams` });
+    if (main.length === 0)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The compound file holds no Office document stream', { reason: 'a compound file of another kind' });
+    const family = main[0];
+    ctx.format = formatOf(family, cfb);
+    const plan = new plan_1.CompoundPlan();
+    if (family !== 'encrypted')
+        ctx.run.output = { kind: 'cfb', cfb, plan };
+    await (0, objects_1.compoundRules)(ctx, cfb, '', false, plan);
+    const stream = (name) => {
+        const e = cfb.child(cfb.root, name);
+        return e?.kind === 'stream' ? e : undefined;
+    };
+    // Beside an encrypted package, Word 2007 writes a WordDocument stream for older readers, of zeros in the files at
+    // hand. Those readers read it if it holds a document, so it gets the Word rules when it does.
+    const word = stream('WordDocument');
+    if (word) {
+        const r = await (0, word_1.wordRules)(ctx, cfb, word, family === 'encrypted');
+        if (r?.template && family === 'word')
+            ctx.format = f('dot', 'application/msword');
+    }
+    if (family === 'excel') {
+        // Excel 97 to 2003 reads Workbook, and Excel 5.0 and 95 read Book. A file can hold both.
+        let template = false;
+        let addIn = false;
+        for (const name of ['Workbook', 'Book']) {
+            const s = stream(name);
+            if (!s)
+                continue;
+            const r = await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook);
+            template ||= r.template;
+            addIn ||= r.addIn;
+        }
+        if (addIn)
+            ctx.format = f('xla', 'application/vnd.ms-excel');
+        else if (template)
+            ctx.format = f('xlt', 'application/vnd.ms-excel');
+        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream.
+        const controls = stream('Ctls');
+        if (controls && controls.size > 0 && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name }).action === 'strip')
+            plan.drop.add(controls);
+    }
+    if (family === 'outlook')
+        await (0, msg_1.messageRules)(ctx, cfb, cfb.root, 0, plan);
+    const ppt = stream('PowerPoint Document');
+    if (family === 'powerpoint' && ppt)
+        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt);
+    const visio = stream('VisioDocument');
+    if (family === 'visio' && visio)
+        await (0, vsd_1.visioRules)(ctx, cfb, visio);
+    const info = stream('EncryptionInfo');
+    const pkg = stream('EncryptedPackage');
+    if (family === 'encrypted' && info && pkg) {
+        // The package goes through the OOXML rules once a password opens it, and names the format.
+        const { source } = await (0, offcrypto_1.openPackage)(ctx, cfb, info, pkg);
+        const zip = await zip_1.ZipArchive.open(source, ctx.settings, ctx.settings.deadline);
+        for (const n of zip.notes)
+            ctx.report(types_1.OfficeCategory.Container, n.detail, pkg.name, { bytes: n.bytes });
+        // The rewrite writes the package decrypted, since office-defuse does not encrypt.
+        const zctx = ctx.withZip(zip);
+        await (0, package_1.inspectPackage)(zctx);
+        if (ctx.format)
+            ctx.run.output = { kind: 'zip', zip, plan: zctx.plan, format: ctx.format };
+    }
+}
+function formatOf(family, cfb) {
+    switch (family) {
+        case 'word':
+            return f('doc', 'application/msword');
+        case 'excel':
+            return f('xls', 'application/vnd.ms-excel');
+        case 'powerpoint':
+            return f('ppt', 'application/vnd.ms-powerpoint');
+        case 'visio':
+            return f('vsd', 'application/vnd.visio');
+        case 'outlook':
+            return cfb.root.clsid === '0006F046-0000-0000-C000-000000000046' ? f('oft', 'application/vnd.ms-outlook') : f('msg', 'application/vnd.ms-outlook');
+        case 'publisher':
+            return f('pub', 'application/x-mspublisher');
+        case 'project':
+            return f('mpp', 'application/vnd.ms-project');
+        default:
+            // An encrypted package names its format only once it is decrypted.
+            return undefined;
+    }
+}

package/dist/oleobj.d.ts

@@ -0,0 +1,85 @@
+/** Thrown by ByteReader when a structure runs past the end of its bytes. Parsers catch it and keep what they read. */
+export declare class Truncated extends Error {
+}
+/** Runs `read`. A structure that runs past its data gives what `partial` returns instead, and any other error goes up. */
+export declare function bounded<T>(read: () => T, partial: () => T): T;
+/** Little-endian reads over bytes in memory, bounded by their end. */
+export declare class ByteReader {
+    readonly b: Uint8Array;
+    pos: number;
+    constructor(b: Uint8Array);
+    get left(): number;
+    private need;
+    u8(): number;
+    u16(): number;
+    u32(): number;
+    bytes(n: number): Uint8Array;
+    skip(n: number): void;
+    /** An ANSI string ended by a NUL within `max` bytes, read as Latin-1. */
+    ansiz(max?: number): string;
+    /** A 32-bit byte count, then that many bytes of ANSI text whose last is a NUL. */
+    lengthPrefixedAnsi(max?: number): string;
+    /** A 32-bit count of UTF-16 code units, then the units, the last of which may be a NUL. */
+    lengthPrefixedUnicode(max?: number): string;
+}
+export declare const latin1: (b: Uint8Array) => string;
+export declare const utf16: (b: Uint8Array) => string;
+/** The class an OLE object names in its CompObj stream (MS-OLEDS 2.3.8): the user type and the ProgID. */
+export interface CompObj {
+    userType?: string;
+    progId?: string;
+}
+export declare function parseCompObj(b: Uint8Array): CompObj;
+/** What a moniker names: a URL moniker's URL, or a file moniker's path. */
+export interface MonikerTarget {
+    target: string;
+    /** A URL moniker, whose target loads from wherever it names, however it is spelled. */
+    url: boolean;
+}
+/**
+ * The address a moniker names: a URL moniker's URL, a file moniker's path, or the first of a composite's that names
+ * one. Other monikers name nothing this reads, and give ''. The reader stops after the moniker it reads.
+ */
+export declare function readMoniker(r: ByteReader, depth?: number): MonikerTarget;
+/** What an OLE stream (MS-OLEDS 2.3.3) says: whether the object is a link, and what it links to. */
+export interface OleStreamInfo extends MonikerTarget {
+    linked: boolean;
+}
+export declare function parseOleStream(b: Uint8Array): OleStreamInfo;
+/** An embedded file in Packager's native data, which oleobj reads the same way. */
+export interface PackagedFile {
+    fileName: string;
+    sourcePath: string;
+    tempPath: string;
+    /** False when the data names a file it does not hold, a link. */
+    embedded: boolean;
+    size: number;
+    /** Where the file's bytes start in the native data. */
+    dataAt: number;
+}
+/**
+ * Packager's native data, as oleobj reads it: a 16-bit type, the label and source path ended by NULs, eight bytes,
+ * the temporary path ended by a NUL, and the size of the file's data. Without the size it is a link. Undefined when it
+ * does not read that far.
+ */
+export declare function parsePackage(b: Uint8Array): PackagedFile | undefined;
+/** An OLE 1.0 object (MS-OLEDS 2.2), as RTF's objdata holds one. */
+export interface Ole1Object {
+    /** 1 linked, 2 embedded, 5 a static picture. */
+    formatId: number;
+    className: string;
+    topicName: string;
+    itemName: string;
+    /** The native data of an embedded object. */
+    data?: Uint8Array;
+    /** Where the native data starts in the object's bytes, after the size before it. */
+    dataAt?: number;
+}
+export declare function parseOle1(b: Uint8Array): Ole1Object | undefined;
+/**
+ * Data that holds a 32-bit size at `dataAt - 4` and that many bytes at `dataAt`, with `data` in their place and the
+ * size set to match. What came before and after stays. Packager's native data and an OLE 1.0 object have this layout.
+ */
+export declare function replaceSized(bytes: Uint8Array, dataAt: number, oldSize: number, data: Uint8Array): Uint8Array;
+/** A stream that starts with the size of what follows, such as Ole10Native, around `data`. */
+export declare const sizedStream: (data: Uint8Array) => Buffer<ArrayBuffer>;

package/dist/oleobj.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sizedStream = exports.utf16 = exports.latin1 = exports.ByteReader = exports.Truncated = void 0;
+exports.bounded = bounded;
+exports.parseCompObj = parseCompObj;
+exports.readMoniker = readMoniker;
+exports.parseOleStream = parseOleStream;
+exports.parsePackage = parsePackage;
+exports.parseOle1 = parseOle1;
+exports.replaceSized = replaceSized;
+const cfb_1 = require("./cfb");
+/** Thrown by ByteReader when a structure runs past the end of its bytes. Parsers catch it and keep what they read. */
+class Truncated extends Error {
+}
+exports.Truncated = Truncated;
+/** Runs `read`. A structure that runs past its data gives what `partial` returns instead, and any other error goes up. */
+function bounded(read, partial) {
+    try {
+        return read();
+    }
+    catch (e) {
+        if (e instanceof Truncated)
+            return partial();
+        throw e;
+    }
+}
+/** Little-endian reads over bytes in memory, bounded by their end. */
+class ByteReader {
+    b;
+    pos = 0;
+    constructor(b) {
+        this.b = b;
+    }
+    get left() {
+        return this.b.length - this.pos;
+    }
+    need(n) {
+        if (n < 0 || this.pos + n > this.b.length)
+            throw new Truncated('The structure runs past its data');
+        const at = this.pos;
+        this.pos += n;
+        return at;
+    }
+    u8() {
+        return this.b[this.need(1)];
+    }
+    u16() {
+        const at = this.need(2);
+        return this.b[at] | (this.b[at + 1] << 8);
+    }
+    u32() {
+        const at = this.need(4);
+        return (this.b[at] | (this.b[at + 1] << 8) | (this.b[at + 2] << 16) | (this.b[at + 3] << 24)) >>> 0;
+    }
+    bytes(n) {
+        const at = this.need(n);
+        return this.b.subarray(at, at + n);
+    }
+    skip(n) {
+        this.need(n);
+    }
+    /** An ANSI string ended by a NUL within `max` bytes, read as Latin-1. */
+    ansiz(max = 1024) {
+        const end = this.b.indexOf(0, this.pos);
+        if (end < 0 || end - this.pos >= max)
+            throw new Truncated('No NUL ends the string');
+        const s = (0, exports.latin1)(this.b.subarray(this.pos, end));
+        this.pos = end + 1;
+        return s;
+    }
+    /** A 32-bit byte count, then that many bytes of ANSI text whose last is a NUL. */
+    lengthPrefixedAnsi(max = 65536) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        if (n === 0)
+            return '';
+        const s = this.bytes(n);
+        return (0, exports.latin1)(s[n - 1] === 0 ? s.subarray(0, n - 1) : s);
+    }
+    /** A 32-bit count of UTF-16 code units, then the units, the last of which may be a NUL. */
+    lengthPrefixedUnicode(max = 32768) {
+        const n = this.u32();
+        if (n > max)
+            throw new Truncated('A string length past any real string');
+        return (0, exports.utf16)(this.bytes(n * 2)).replace(/\0+$/, '');
+    }
+}
+exports.ByteReader = ByteReader;
+const latin1 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength).toString('latin1');
+exports.latin1 = latin1;
+const utf16 = (b) => Buffer.from(b.buffer, b.byteOffset, b.byteLength - (b.byteLength % 2)).toString('utf16le');
+exports.utf16 = utf16;
+function parseCompObj(b) {
+    const r = new ByteReader(b);
+    const out = {};
+    return bounded(() => {
+        r.skip(28);
+        out.userType = r.lengthPrefixedAnsi();
+        const marker = r.u32();
+        if (marker === 0xffffffff || marker === 0xfffffffe)
+            r.skip(4);
+        else if (marker !== 0)
+            r.skip(marker);
+        // MS-OLEDS calls it Reserved1. Windows writes the ProgID there.
+        out.progId = r.lengthPrefixedAnsi();
+        return out;
+    }, () => out);
+}
+/** URL moniker, file moniker and composite moniker class ids (MS-OSHARED 2.3.7). */
+const URL_MONIKER = '79EAC9E0-BAF9-11CE-8C82-00AA004BA90B';
+const FILE_MONIKER = '00000303-0000-0000-C000-000000000046';
+const COMPOSITE_MONIKER = '00000309-0000-0000-C000-000000000046';
+/**
+ * The address a moniker names: a URL moniker's URL, a file moniker's path, or the first of a composite's that names
+ * one. Other monikers name nothing this reads, and give ''. The reader stops after the moniker it reads.
+ */
+function readMoniker(r, depth = 0) {
+    const clsid = (0, cfb_1.guid)(r.bytes(16));
+    if (clsid === URL_MONIKER) {
+        const n = r.u32();
+        const raw = r.bytes(Math.min(n, r.left));
+        return { target: (0, exports.utf16)(raw).split('\0')[0], url: true };
+    }
+    if (clsid === FILE_MONIKER) {
+        const anti = r.u16();
+        const ansi = r.lengthPrefixedAnsi();
+        r.skip(2 + 2 + 16);
+        const unicodeSize = r.u32();
+        let path = ansi;
+        if (unicodeSize > 0) {
+            const bytes = r.u32();
+            r.skip(2);
+            path = (0, exports.utf16)(r.bytes(bytes));
+        }
+        return { target: '..\\'.repeat(Math.min(anti, 64)) + path, url: false };
+    }
+    if (clsid === COMPOSITE_MONIKER && depth < 8) {
+        const count = r.u32();
+        for (let i = 0; i < Math.min(count, 64); i++) {
+            const found = readMoniker(r, depth + 1);
+            if (found.target)
+                return found;
+        }
+    }
+    return { target: '', url: false };
+}
+function parseOleStream(b) {
+    const r = new ByteReader(b);
+    const out = { linked: false, target: '', url: false };
+    return bounded(() => {
+        r.skip(4);
+        out.linked = (r.u32() & 1) === 1;
+        if (!out.linked)
+            return out;
+        r.skip(8);
+        r.skip(r.u32());
+        // The relative moniker comes first, then the absolute one, which Office prefers when both resolve.
+        const monikers = [];
+        for (let i = 0; i < 2; i++) {
+            const size = r.u32();
+            if (size > 0)
+                monikers.push(readMoniker(new ByteReader(r.bytes(size))));
+        }
+        return Object.assign(out, monikers.reverse().find(m => m.target));
+    }, () => out);
+}
+/**
+ * Packager's native data, as oleobj reads it: a 16-bit type, the label and source path ended by NULs, eight bytes,
+ * the temporary path ended by a NUL, and the size of the file's data. Without the size it is a link. Undefined when it
+ * does not read that far.
+ */
+function parsePackage(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(2);
+        const fileName = r.ansiz();
+        const sourcePath = r.ansiz();
+        r.skip(8);
+        const tempPath = r.ansiz();
+        return bounded(() => ({ fileName, sourcePath, tempPath, embedded: true, size: r.u32(), dataAt: r.pos }), () => ({ fileName, sourcePath, tempPath, embedded: false, size: 0, dataAt: r.pos }));
+    }, () => undefined);
+}
+function parseOle1(b) {
+    const r = new ByteReader(b);
+    return bounded(() => {
+        r.skip(4);
+        const formatId = r.u32();
+        if (formatId !== 1 && formatId !== 2)
+            return { formatId, className: '', topicName: '', itemName: '' };
+        const className = r.lengthPrefixedAnsi();
+        const topicName = r.lengthPrefixedAnsi();
+        const itemName = r.lengthPrefixedAnsi();
+        if (formatId === 1)
+            return { formatId, className, topicName, itemName };
+        const size = r.u32();
+        const dataAt = r.pos;
+        return { formatId, className, topicName, itemName, data: r.bytes(Math.min(size, r.left)), dataAt };
+    }, () => undefined);
+}
+const le32 = (n) => {
+    const b = Buffer.alloc(4);
+    b.writeUInt32LE(n >>> 0);
+    return b;
+};
+/**
+ * Data that holds a 32-bit size at `dataAt - 4` and that many bytes at `dataAt`, with `data` in their place and the
+ * size set to match. What came before and after stays. Packager's native data and an OLE 1.0 object have this layout.
+ */
+function replaceSized(bytes, dataAt, oldSize, data) {
+    return Buffer.concat([bytes.subarray(0, dataAt - 4), le32(data.length), data, bytes.subarray(Math.min(bytes.length, dataAt + oldSize))]);
+}
+/** A stream that starts with the size of what follows, such as Ole10Native, around `data`. */
+const sizedStream = (data) => Buffer.concat([le32(data.length), data]);
+exports.sizedStream = sizedStream;

package/dist/ooxml.d.ts

@@ -1,8 +1,89 @@
-import { type RunContext } from './context';
+import { type ZipContext } from './context';
+import { type XmlElement } from './xml';
 import { type ZipEntry } from './zip';
+export declare const CONTENT_TYPES_NS = "http://schemas.openxmlformats.org/package/2006/content-types";
+export declare const RELS_NS = "http://schemas.openxmlformats.org/package/2006/relationships";
+/** The relationship types that name an XPS package's FixedDocumentSequence, lowercased. */
+export declare const XPS_MAIN: {
+    xps: string;
+    oxps: string;
+};
+/** The XPS and OpenXPS markup namespaces, lowercased. */
+export declare const XPS_NS: Set<string>;
+/** Relationship types, lowercased, as OPC compares them without regard to case. */
+export declare const REL: {
+    main: Set<string>;
+    hyperlink: Set<string>;
+    template: Set<string>;
+    image: Set<string>;
+    frame: Set<string>;
+    subDocument: Set<string>;
+    workbook: Set<string>;
+};
+/** Content types, lowercased. */
+export declare const TYPE: {
+    vba: Set<string>;
+    macrosheet: Set<string>;
+    ole: Set<string>;
+    control: Set<string>;
+    controlBinary: Set<string>;
+    vml: string;
+    xlsbExternalLink: string;
+};
+/** Whether the rules read a part of this content type as XML. */
+export declare const isXmlType: (ct: string | undefined) => boolean;
+export declare const WORD_NS: Set<string>;
+export declare const SHEET_NS: Set<string>;
+export declare const R_NS: Set<string>;
+export interface Relationship {
+    id: string;
+    type: string;
+    target: string;
+    external: boolean;
+}
+export interface Part {
+    entry: ZipEntry;
+    contentType?: string;
+    /** The AS bits of the relationship types that reach the part. */
+    reachedAs: number;
+    /** A relationship of an ActiveX control part reaches it, so it is that control's binary. */
+    claimed: boolean;
+    /** The parts its own relationships reach. */
+    targets: Set<Part>;
+    ole: boolean;
+}
+/** What the rewrite needs of an OOXML package: its parts, which part each relationships part belongs to, and the roots. */
+export interface OoxmlGraph {
+    contentTypes: ZipEntry;
+    parts: Map<string, Part>;
+    relsOf: Map<string, ZipEntry>;
+    /** The parts the package relationships reach. */
+    roots: Set<Part>;
+    /** The package uses the relationship types of Strict OOXML. */
+    strict: boolean;
+    /** The package is XPS or OpenXPS, whose parts name the parts they use in attributes. */
+    xps: boolean;
+}
+/** The key of the part a relationships part belongs to, '' for the package, or undefined for any other part. */
+export declare const relsSource: (relsName: string) => string | undefined;
+/**
+ * Resolves an internal target against the folder of the part it belongs to, as RFC 3986 resolves a relative
+ * reference: a ".." at the root of the package stays at the root. LibreOffice writes "../customXml/item1.xml" in the
+ * package relationships of workbooks it saves.
+ */
+export declare function resolveTarget(relsName: string, target: string): string;
+/** A reference in an XPS part to another part: an absolute part name, or a path relative to the part's folder. */
+export declare function resolvePartRef(part: string, ref: string): string;
+/**
+ * The resources an XPS element names in its attributes, as the attribute and the URI: a document, page or resource
+ * dictionary's Source, a font's FontUri, an image brush's image and profile, and a ContextColor's profile.
+ */
+export declare function xpsResources(el: XmlElement): Array<[string, string]>;
+/** Reads a relationships part and hands each relationship to `each` as it is read. Ids given twice are reported. */
+export declare function readRelationships(ctx: ZipContext, entry: ZipEntry, each: (r: Relationship) => void): Promise<void>;
 /**
  * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
  * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
  * leave behind only which parts they reach and how.
  */
-export declare function inspectOoxml(ctx: RunContext, contentTypes: ZipEntry): Promise<void>;
+export declare function inspectOoxml(ctx: ZipContext, contentTypes: ZipEntry): Promise<void>;