@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/package.d.ts

@@ -0,0 +1,3 @@
+import type { ZipContext } from './context';
+/** Inspects an OOXML or OpenDocument package, which its markers name. */
+export declare function inspectPackage(ctx: ZipContext): Promise<void>;

package/dist/package.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inspectPackage = inspectPackage;
+const errors_1 = require("./errors");
+const odf_1 = require("./odf");
+const ooxml_1 = require("./ooxml");
+const types_1 = require("./types");
+/** Inspects an OOXML or OpenDocument package, which its markers name. */
+async function inspectPackage(ctx) {
+    const zip = ctx.zip;
+    const contentTypes = zip.get('[Content_Types].xml');
+    const odf = zip.entries.some(e => e.name === 'mimetype') || zip.get('META-INF/manifest.xml') !== undefined;
+    if (contentTypes && odf)
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'The file has both [Content_Types].xml and an OpenDocument mimetype or manifest', { reason: 'OOXML and OpenDocument markers' });
+    if (contentTypes)
+        await (0, ooxml_1.inspectOoxml)(ctx, contentTypes);
+    else if (odf)
+        await (0, odf_1.inspectOdf)(ctx);
+    else
+        throw new errors_1.StopError(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'The archive has neither [Content_Types].xml nor an OpenDocument mimetype or manifest', { reason: 'a plain ZIP archive' });
+}

package/dist/plan.d.ts

@@ -0,0 +1,104 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+import type { SpillSink } from './io';
+import type { OoxmlGraph } from './ooxml';
+import type { OfficeFinding } from './types';
+import type { ZipEntry } from './zip';
+/** What the rewrite does to one element of an XML part. */
+export interface ElementEdit {
+    /** The element goes, with everything inside it. */
+    remove?: boolean;
+    /** Its tags go and its content stays, as with a hyperlink around text. */
+    unwrap?: boolean;
+    /** Attributes left out, each as its namespace URI, a space and its local name. */
+    strip?: Set<string>;
+    /** Attribute values replaced, by qualified name. */
+    set?: Map<string, string>;
+    /** The element's content replaced with this text, as with base64 data a plugin rewrote. */
+    content?: string;
+}
+/** The key `ElementEdit.strip` takes for an attribute. */
+export declare const attributeKey: (ns: string, local: string) => string;
+/** A Word field the rewrite removes, by the element numbers of its marks. Its result stays. */
+export interface FieldMarks {
+    begin: number;
+    separate?: number;
+    end?: number;
+    /** A w:fldSimple, whose tags go and whose result runs stay. */
+    simple: boolean;
+}
+/** What the rewrite does inside one XML part. */
+export interface PartPlan {
+    elements: Map<number, ElementEdit>;
+    fields: FieldMarks[];
+    /** The part has an internal subset that goes. Its entity references are expanded and its defaults written out. */
+    subset: boolean;
+    /** References to external entities in the part go. */
+    external: boolean;
+    /** A document type declaration without an internal subset goes. */
+    doctype: boolean;
+    /** The part refers to an external entity. */
+    hasExternal: boolean;
+}
+/** An OpenDocument object element whose fate waits for the plugins' verdict on the entry it names. */
+export interface DeferredObject {
+    part: string;
+    index: number;
+    /** The key of the entry it refers to. */
+    target: string;
+    finding?: OfficeFinding;
+    strips: boolean;
+}
+/** Everything a strip finding names in a ZIP package, for the rewrite. */
+export declare class PackagePlan {
+    readonly parts: Map<string, PartPlan>;
+    /** Entries that go with every reference to them, by nameKey. */
+    readonly drop: Set<string>;
+    /** OpenDocument folders that go whole, as nameKey prefixes ending in "/". */
+    readonly folders: Set<string>;
+    /** Relationship Ids that go, by the name of their relationships part. */
+    readonly rels: Map<string, Set<string>>;
+    /** Excel 4.0 macro sheets that become empty worksheets, by nameKey. */
+    readonly sheets: Set<string>;
+    /** Entries whose bytes a plugin replaced, by nameKey. */
+    readonly replace: Map<string, SpillSink>;
+    /** OpenDocument object references, decided once the plugins have seen the entries they name. */
+    readonly objects: DeferredObject[];
+    /** What the OOXML rules read of the package's parts and relationships. */
+    graph?: OoxmlGraph;
+    /** What the OpenDocument rules read of the package's layout. */
+    odf?: OdfLayout;
+    part(name: string): PartPlan;
+    /** Adds an edit to an element. Removing it covers every other edit. */
+    element(part: string, index: number, edit: ElementEdit): void;
+    dropRelationship(relsPart: string, id: string): void;
+}
+/** The entries of a ZIP package the rewrite needs besides the plan: what the format rules found. */
+export interface OdfLayout {
+    mimetype?: ZipEntry;
+    manifest?: ZipEntry;
+    /** The media type the package declares, which the output's mimetype entry holds. */
+    mediaType: string;
+}
+/** Everything a strip finding names in a compound file, for the rewrite. */
+export declare class CompoundPlan {
+    /** Streams and storages that go, each with everything under it. */
+    readonly drop: Set<CfbEntry>;
+    /** Streams whose content a plugin replaced. */
+    readonly replace: Map<CfbEntry, SpillSink>;
+    /** Storages whose content a plugin replaced with a compound file of its own, read from what it wrote. */
+    readonly grafts: Map<CfbEntry, CompoundFile>;
+}
+/** A range of an RTF file the rewrite leaves out, or replaces with `text` and then the bytes of the file at `copy`. */
+export interface RtfCut {
+    start: number;
+    end: number;
+    text?: Uint8Array;
+    copy?: [number, number];
+}
+/** What the output of a Flat OPC package keeps of the file besides its parts. */
+export interface FlatOpcLayout {
+    /** The prolog's mso-application processing instructions, which name the application that opens the file. */
+    instructions: string[];
+    /** Each part's attributes besides its name and content type, such as pkg:compression, by key. */
+    extra: Map<string, Array<[string, string]>>;
+}

package/dist/plan.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompoundPlan = exports.PackagePlan = exports.attributeKey = void 0;
+/** The key `ElementEdit.strip` takes for an attribute. */
+const attributeKey = (ns, local) => `${ns} ${local}`;
+exports.attributeKey = attributeKey;
+/** Everything a strip finding names in a ZIP package, for the rewrite. */
+class PackagePlan {
+    parts = new Map();
+    /** Entries that go with every reference to them, by nameKey. */
+    drop = new Set();
+    /** OpenDocument folders that go whole, as nameKey prefixes ending in "/". */
+    folders = new Set();
+    /** Relationship Ids that go, by the name of their relationships part. */
+    rels = new Map();
+    /** Excel 4.0 macro sheets that become empty worksheets, by nameKey. */
+    sheets = new Set();
+    /** Entries whose bytes a plugin replaced, by nameKey. */
+    replace = new Map();
+    /** OpenDocument object references, decided once the plugins have seen the entries they name. */
+    objects = [];
+    /** What the OOXML rules read of the package's parts and relationships. */
+    graph;
+    /** What the OpenDocument rules read of the package's layout. */
+    odf;
+    part(name) {
+        let p = this.parts.get(name);
+        if (!p) {
+            p = { elements: new Map(), fields: [], subset: false, external: false, doctype: false, hasExternal: false };
+            this.parts.set(name, p);
+        }
+        return p;
+    }
+    /** Adds an edit to an element. Removing it covers every other edit. */
+    element(part, index, edit) {
+        const elements = this.part(part).elements;
+        const had = elements.get(index);
+        if (!had) {
+            elements.set(index, edit);
+            return;
+        }
+        if (had.remove || edit.remove) {
+            elements.set(index, { remove: true });
+            return;
+        }
+        had.unwrap ||= edit.unwrap;
+        if (edit.strip)
+            had.strip = new Set([...(had.strip ?? []), ...edit.strip]);
+        if (edit.set)
+            had.set = new Map([...(had.set ?? []), ...edit.set]);
+        if (edit.content !== undefined)
+            had.content = edit.content;
+    }
+    dropRelationship(relsPart, id) {
+        let ids = this.rels.get(relsPart);
+        if (!ids) {
+            ids = new Set();
+            this.rels.set(relsPart, ids);
+        }
+        ids.add(id);
+    }
+}
+exports.PackagePlan = PackagePlan;
+/** Everything a strip finding names in a compound file, for the rewrite. */
+class CompoundPlan {
+    /** Streams and storages that go, each with everything under it. */
+    drop = new Set();
+    /** Streams whose content a plugin replaced. */
+    replace = new Map();
+    /** Storages whose content a plugin replaced with a compound file of its own, read from what it wrote. */
+    grafts = new Map();
+}
+exports.CompoundPlan = CompoundPlan;

package/dist/plugins.d.ts

@@ -0,0 +1,8 @@
+import type { ContainedFilePlugin, OfficeOptions } from './types';
+/**
+ * Defuses Office and OpenDocument files inside other files, with `options` when given. Without them, it takes the
+ * options of the office-defuse run that found the file, or none when another package found it. `limits.nestingDepth`
+ * applies to the depth in the context. The file's findings go into the containing file's report, and its output's
+ * findings into the output's report, each with its `weight`.
+ */
+export declare function officePlugin(options?: OfficeOptions): ContainedFilePlugin;

package/dist/plugins.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.officePlugin = officePlugin;
+const contained_1 = require("./contained");
+const engine_1 = require("./engine");
+const flat_1 = require("./flat");
+const score_1 = require("./score");
+const zip_1 = require("./zip");
+/** What the ZIP reader needs to look for the markers of an Office package, with the default limits. */
+const PROBE = { entries: 10_000, decompressedBytes: 512 * 1024 * 1024, totalDecompressedBytes: 2 * 1024 * 1024 * 1024 };
+/**
+ * Whether the content is a file office-defuse reads: a compound file, RTF, a ZIP archive with the marker of an Office
+ * Open XML or OpenDocument package, or XML whose root is a flat OpenDocument document or a Flat OPC package. A ZIP
+ * archive without a marker, or one the ZIP reader refuses, is not.
+ */
+async function isOffice(source, sniffed) {
+    if (sniffed === 'application/x-ole-storage' || sniffed === 'application/rtf')
+        return true;
+    if (sniffed === 'application/xml') {
+        const head = await source.read(0, Math.min(16384, await source.size()));
+        return (0, flat_1.isFlatHead)(Buffer.from(head).toString('utf8'));
+    }
+    if (sniffed !== 'application/zip')
+        return false;
+    try {
+        const zip = await zip_1.ZipArchive.open(source, PROBE);
+        return zip.get('[Content_Types].xml') !== undefined || zip.entries.some(e => e.name === 'mimetype') || zip.get('META-INF/manifest.xml') !== undefined;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Defuses Office and OpenDocument files inside other files, with `options` when given. Without them, it takes the
+ * options of the office-defuse run that found the file, or none when another package found it. `limits.nestingDepth`
+ * applies to the depth in the context. The file's findings go into the containing file's report, and its output's
+ * findings into the output's report, each with its `weight`.
+ */
+function officePlugin(options) {
+    return {
+        kind: 'file',
+        name: 'office',
+        // It can only read what it can parse, so the content decides, whatever the name says.
+        accepts: f => isOffice(f.source, f.sniffedType),
+        async process(file, sink, context) {
+            const run = options ?? context[contained_1.RUN_OPTIONS] ?? {};
+            const r = await (0, engine_1.disarmAtDepth)(file.source, sink, run, context.depth, context.deadline);
+            // A container in another package scores these by the weights this run used.
+            for (const f of [...r.before.findings, ...(r.after?.findings ?? [])])
+                f.weight = (0, score_1.weightOf)(f, run);
+            const findings = r.before.findings;
+            // The sink holds the rewritten file, also when nothing was removed.
+            if (r.status === 'clean')
+                return { result: 'passed', findings, outputFindings: r.after?.findings };
+            if (r.status === 'defused')
+                return { result: 'scrubbed', findings, outputFindings: r.after?.findings };
+            return { result: 'removed', findings };
+        },
+    };
+}

package/dist/ppt.d.ts

@@ -0,0 +1,8 @@
+import { type CfbEntry, CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/**
+ * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
+ * current edit names. This reads every record at the top level of the stream as well as every object the persist
+ * directories name, so an object that one route hides is still read.
+ */
+export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;

package/dist/ppt.js

@@ -0,0 +1,281 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.powerPointRules = powerPointRules;
+const zlib = __importStar(require("node:zlib"));
+const cfb_1 = require("./cfb");
+const contained_1 = require("./contained");
+const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
+const links_1 = require("./links");
+const objects_1 = require("./objects");
+const offcrypto_1 = require("./offcrypto");
+const oleobj_1 = require("./oleobj");
+const types_1 = require("./types");
+/** Record types of the PowerPoint binary format (MS-PPT 2.13.24). */
+const T = {
+    currentUserAtom: 0x0ff6,
+    userEditAtom: 0x0ff5,
+    persistDirectoryAtom: 0x1772,
+    exOleObjStg: 0x1011,
+    exOleObjAtom: 0x0fc3,
+    vbaInfoAtom: 0x0400,
+    interactiveInfo: 0x0ff2,
+    interactiveInfoAtom: 0x0ff3,
+    cString: 0x0fba,
+    exHyperlink: 0x0fd7,
+    exHyperlinkAtom: 0x0fd3,
+    cryptSession: 0x2f14,
+};
+/** ExVideoContainer, ExMIDIAudioContainer and ExWAVAudioLinkContainer, whose path names a file outside the presentation. */
+const MEDIA_LINKS = new Set([0x1005, 0x100d, 0x1010]);
+/** The CurrentUserAtom's header token of an encrypted presentation. */
+const ENCRYPTED_TOKEN = 0xf3d1c4df;
+const MAX_DEPTH = 64;
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const header = (b) => ({ version: b[0] & 0x0f, instance: (b[0] | (b[1] << 8)) >> 4, type: b[2] | (b[3] << 8), length: u32(b, 4) });
+/**
+ * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
+ * current edit names. This reads every record at the top level of the stream as well as every object the persist
+ * directories name, so an object that one route hides is still read.
+ */
+async function powerPointRules(ctx, cfb, stream) {
+    const location = stream.name;
+    let source = cfb.source(stream);
+    let reader = new io_1.Reader(source, stream.size, 16384, 8);
+    const persist = new Map();
+    const current = cfb.child(cfb.root, 'Current User');
+    if (current?.kind === 'stream') {
+        const cu = await cfb.source(current).read(0, 24);
+        if (cu.length >= 20 && header(cu).type === T.currentUserAtom) {
+            await readPersist(reader, stream.size, u32(cu, 16), persist, ctx.settings.deadline);
+            if (u32(cu, 12) === ENCRYPTED_TOKEN) {
+                source = await decryptPresentation(ctx, reader, stream, u32(cu, 16), persist);
+                reader = new io_1.Reader(source, stream.size, 16384, 8);
+            }
+        }
+    }
+    const storages = new Map();
+    /** ExOleObjAtom types by the persist id of the storage they name: 0 embedded, 1 linked, 2 a control. */
+    const roles = new Map();
+    const vba = new Set();
+    const visited = new Set();
+    const walk = async (start, end, depth, siblings) => {
+        for (let pos = start; pos + 8 <= end;) {
+            (0, errors_1.checkTime)(ctx.settings.deadline);
+            const h = header(await reader.read(pos, 8));
+            const bodyEnd = pos + 8 + h.length;
+            if (bodyEnd > end || visited.has(pos))
+                return;
+            visited.add(pos);
+            siblings.push({ h, offset: pos });
+            if (h.type === T.exOleObjStg)
+                storages.set(pos, { offset: pos, header: h });
+            else if (h.type === T.exOleObjAtom && h.length >= 20) {
+                const b = await reader.read(pos + 8, 20);
+                roles.set(u32(b, 16), u32(b, 4));
+            }
+            else if (h.type === T.vbaInfoAtom && h.length >= 4)
+                vba.add(u32(await reader.read(pos + 8, 4), 0));
+            if (h.version === 0x0f && depth < MAX_DEPTH) {
+                const kids = [];
+                await walk(pos + 8, bodyEnd, depth + 1, kids);
+                await containerRules(ctx, reader, h, pos, kids, location);
+            }
+            pos = bodyEnd;
+        }
+    };
+    // Every record at the top level, then each persist object that does not start on a record already read.
+    await walk(0, stream.size, 0, []);
+    for (const offset of persist.values()) {
+        if (visited.has(offset) || offset + 8 > stream.size)
+            continue;
+        const h = header(await reader.read(offset, 8));
+        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, []);
+    }
+    const byOffset = new Map([...persist].map(([id, offset]) => [offset, id]));
+    for (const s of storages.values()) {
+        const id = byOffset.get(s.offset);
+        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id) === 2 ? 'control' : 'object';
+        await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`);
+    }
+}
+/**
+ * The PowerPoint Document stream of an encrypted presentation, decrypted (MS-PPT 2.3.7). The current edit names the
+ * persist object that holds the CryptSession10Container, whose data is an RC4 CryptoAPI EncryptionHeader. Each other
+ * persist object, its record header included, is RC4 with the key of block number its persist id. The edits and
+ * persist directories were never encrypted.
+ */
+async function decryptPresentation(ctx, reader, stream, edit, persist) {
+    const required = (reason) => new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, `The presentation is encrypted: ${reason}`, { stream: stream.name, reason });
+    const u = await reader.read(edit, 40);
+    const sessionAt = u.length >= 40 && header(u).type === T.userEditAtom ? persist.get(u32(u, 36)) : undefined;
+    if (sessionAt === undefined || sessionAt + 8 > stream.size)
+        throw required('the current edit names no CryptSession10Container');
+    const h = header(await reader.read(sessionAt, 8));
+    if (h.type !== T.cryptSession)
+        throw required('the current edit names no CryptSession10Container');
+    const keyOf = (0, offcrypto_1.unlockPresentation)(ctx, await reader.read(sessionAt + 8, Math.min(h.length, 65536)), stream.name);
+    if (stream.size > ctx.settings.decompressedBytes)
+        throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, `The encrypted stream ${stream.name} is ${stream.size} bytes`, { name: stream.name, size: stream.size, limit: ctx.settings.decompressedBytes });
+    const copy = Buffer.from(await reader.read(0, stream.size));
+    for (const [id, offset] of persist) {
+        (0, errors_1.checkTime)(ctx.settings.deadline);
+        if (offset === sessionAt || offset + 8 > copy.length)
+            continue;
+        const rc4 = keyOf(id);
+        const head = rc4.crypt(copy.subarray(offset, offset + 8));
+        const length = Math.min(copy.length - offset - 8, u32(head, 4));
+        copy.set(head, offset);
+        copy.set(rc4.crypt(copy.subarray(offset + 8, offset + 8 + length)), offset + 8);
+    }
+    return (0, io_1.bufferSource)(copy);
+}
+/** Reads the persist directories of the current edit and every edit before it. Newer entries win. */
+async function readPersist(reader, size, start, persist, deadline) {
+    const seen = new Set();
+    for (let edit = start; edit > 0 && edit + 36 <= size && !seen.has(edit);) {
+        (0, errors_1.checkTime)(deadline);
+        seen.add(edit);
+        const u = await reader.read(edit, 36);
+        if (header(u).type !== T.userEditAtom)
+            return;
+        const dirAt = u32(u, 20);
+        const d = await reader.read(dirAt, 8);
+        if (d.length === 8 && header(d).type === T.persistDirectoryAtom) {
+            const body = await reader.read(dirAt + 8, Math.min(header(d).length, size - dirAt - 8));
+            for (let p = 0; p + 4 <= body.length;) {
+                const entry = u32(body, p);
+                const first = entry & 0xfffff;
+                const count = entry >>> 20;
+                p += 4;
+                for (let i = 0; i < count && p + 4 <= body.length; i++, p += 4)
+                    if (!persist.has(first + i))
+                        persist.set(first + i, u32(body, p));
+            }
+        }
+        edit = u32(u, 16);
+    }
+}
+/** One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. */
+async function storageRules(ctx, source, s, role, location) {
+    let inner;
+    if (s.header.instance === 1) {
+        const raw = await source.read(s.offset + 8, s.header.length);
+        const declared = raw.length >= 4 ? u32(raw, 0) : 0;
+        if (declared > ctx.settings.decompressedBytes)
+            throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.DecompressedSize, `An object at ${location} declares ${declared} bytes`, { name: location, size: declared, limit: ctx.settings.decompressedBytes });
+        let bytes;
+        try {
+            bytes = zlib.inflateSync(raw.subarray(4), { maxOutputLength: Math.max(1, declared) });
+        }
+        catch {
+            unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
+            return;
+        }
+        inner = { size: async () => bytes.length, read: async (offset, length) => bytes.subarray(offset, offset + length) };
+    }
+    else {
+        const start = s.offset + 8;
+        const length = s.header.length;
+        inner = { size: async () => length, read: (offset, n) => source.read(start + offset, Math.max(0, Math.min(n, length - offset))) };
+    }
+    const head = await inner.read(0, 8);
+    let cfb;
+    try {
+        if (head.length < 8 || head[0] !== 0xd0 || head[1] !== 0xcf)
+            throw new errors_1.StopError(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadHeader, 'not a compound file');
+        cfb = await cfb_1.CompoundFile.open(inner, ctx.settings, ctx.settings.deadline);
+    }
+    catch (e) {
+        if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+            throw e;
+        unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
+        return;
+    }
+    (0, objects_1.nestedNotes)(ctx, cfb, location);
+    if (role === 'control')
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) });
+    // An object's storage goes to the plugins as the compound file it is. The rewrite cannot change the presentation's
+    // records, so only a plugin that passes the object keeps it in the output.
+    const size = await inner.size();
+    const decision = role === 'object' ? await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) }) : undefined;
+    await (0, objects_1.compoundRules)(ctx, cfb, location, role === 'object', undefined, decision);
+}
+function unreadable(ctx, role, location, reason) {
+    if (role === 'vba')
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason });
+    else if (role === 'control')
+        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason });
+    else
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+}
+/** The rules of one container record, from its children: actions, hyperlinks and linked media. */
+async function containerRules(ctx, reader, h, offset, kids, stream) {
+    const location = `${stream}, offset ${offset}`;
+    const strings = async () => {
+        const out = new Map();
+        for (const k of kids)
+            if (k.h.type === T.cString && !out.has(k.h.instance))
+                out.set(k.h.instance, (0, oleobj_1.utf16)(await reader.read(k.offset + 8, Math.min(k.h.length, 65536))));
+        return out;
+    };
+    if (h.type === T.interactiveInfo) {
+        const atom = kids.find(k => k.h.type === T.interactiveInfoAtom && k.h.length >= 16);
+        if (!atom)
+            return;
+        const action = (await reader.read(atom.offset + 8 + 8, 1))[0];
+        const name = (await strings()).get(2) ?? '';
+        const data = { trigger: h.instance === 1 ? 'mouse over' : 'click', ...(name ? { action: (0, context_1.clip)(name) } : {}) };
+        if (action === 2)
+            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+        else if (action === 1)
+            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data);
+        else if (action === 5)
+            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+    }
+    else if (h.type === T.exHyperlink) {
+        const s = await strings();
+        const target = s.get(1) ?? '';
+        if (target.trim() && !(0, links_1.isFragment)(target))
+            ctx.link(target, location, { source: 'PowerPoint hyperlink' });
+    }
+    else if (MEDIA_LINKS.has(h.type)) {
+        const path = (await strings()).get(0) ?? '';
+        if (path.trim())
+            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media');
+    }
+}

package/dist/rewrite-cfb.d.ts

@@ -0,0 +1,14 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+import { type CfbTree } from './cfb-writer';
+import type { RunState } from './context';
+import { CompoundPlan } from './plan';
+import type { ByteSink } from './types';
+/**
+ * Writes a compound file without the streams and storages the plan drops. A stream a plugin replaced takes the bytes
+ * the plugin wrote, and an object's storage a plugin replaced takes the storages and streams of the compound file the
+ * plugin wrote. Every other stream is copied as it is. Sectors no stream holds, the rest of each stream's last sector
+ * and anything after the last sector are not written.
+ */
+export declare function writeCompound(run: RunState, cfb: CompoundFile, plan: CompoundPlan, sink: ByteSink): Promise<void>;
+/** A storage and everything under it, as the root of a compound file of its own. */
+export declare function subtree(cfb: CompoundFile, storage: CfbEntry): CfbTree;

package/dist/rewrite-cfb.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeCompound = writeCompound;
+exports.subtree = subtree;
+const cfb_writer_1 = require("./cfb-writer");
+const plan_1 = require("./plan");
+/** The nodes of a storage's subtree, without what the plan drops, with what plugins returned in place of the rest. */
+function nodes(cfb, storage, plan, opened) {
+    const out = [];
+    for (const c of storage.children) {
+        if (plan.drop.has(c))
+            continue;
+        const replaced = plan.replace.get(c);
+        if (c.kind === 'stream') {
+            if (!replaced) {
+                out.push({ kind: 'stream', name: c.name, size: c.size, source: cfb.source(c) });
+                continue;
+            }
+            const source = replaced.source();
+            opened.push(source);
+            out.push({ kind: 'stream', name: c.name, size: replaced.length, source });
+            continue;
+        }
+        const graft = plan.grafts.get(c);
+        if (graft)
+            out.push({ kind: 'storage', name: c.name, clsid: graft.root.clsid === '00000000-0000-0000-0000-000000000000' ? '' : graft.root.clsid, children: nodes(graft, graft.root, plan, opened) });
+        else
+            out.push({ kind: 'storage', name: c.name, clsid: c.clsid === '00000000-0000-0000-0000-000000000000' ? '' : c.clsid, children: nodes(cfb, c, plan, opened) });
+    }
+    return out;
+}
+/**
+ * Writes a compound file without the streams and storages the plan drops. A stream a plugin replaced takes the bytes
+ * the plugin wrote, and an object's storage a plugin replaced takes the storages and streams of the compound file the
+ * plugin wrote. Every other stream is copied as it is. Sectors no stream holds, the rest of each stream's last sector
+ * and anything after the last sector are not written.
+ */
+async function writeCompound(run, cfb, plan, sink) {
+    const clsid = cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? '' : cfb.root.clsid;
+    const opened = [];
+    try {
+        await (0, cfb_writer_1.writeCfb)({ clsid, children: nodes(cfb, cfb.root, plan, opened) }, sink, run.deadline);
+    }
+    finally {
+        for (const s of opened)
+            await s.close?.();
+    }
+}
+/** A storage and everything under it, as the root of a compound file of its own. */
+function subtree(cfb, storage) {
+    return { clsid: storage.clsid === '00000000-0000-0000-0000-000000000000' ? '' : storage.clsid, children: nodes(cfb, storage, new plan_1.CompoundPlan(), []) };
+}

package/dist/rewrite-rtf.d.ts

@@ -0,0 +1,9 @@
+import type { RunState } from './context';
+import type { RtfCut } from './plan';
+import type { ByteSink, ByteSource } from './types';
+/**
+ * Writes an RTF file without the ranges the cuts name: the groups of the destinations a strip finding names, and any
+ * bytes after the group that closes the document. A cut can put text in place of what it removes, such as an object's
+ * result group in place of the object. Everything else keeps its bytes.
+ */
+export declare function writeRtf(run: RunState, source: ByteSource, size: number, cuts: RtfCut[], sink: ByteSink): Promise<void>;