@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/rtfcomp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Decompresses an Outlook message's PidTagRtfCompressed (MS-OXRTFCP 2.1.3.1). Returns undefined for input the
+ * specification calls corrupt: cut short, of an unknown type, with a CRC that does not match, or longer than `limit`.
+ */
+export declare function decompressRtf(b: Uint8Array, limit: number): Uint8Array | undefined;
+/** RTF stored as a PidTagRtfCompressed value of type UNCOMPRESSED, whose CRC is 0 (MS-OXRTFCP 2.1.3.1.1). */
+export declare function storeRtf(rtf: Uint8Array): Uint8Array;

package/dist/rtfcomp.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decompressRtf = decompressRtf;
+exports.storeRtf = storeRtf;
+const crc32_1 = require("./crc32");
+/** The dictionary MS-OXRTFCP 2.1.3.1.2 starts from: 207 bytes of RTF that most bodies begin with. */
+const PRESET = Buffer.from('{\\rtf1\\ansi\\mac\\deff0\\deftab720{\\fonttbl;}{\\f0\\fnil \\froman \\fswiss \\fmodern \\fscript \\fdecor MS Sans SerifSymbolArialTimes New RomanCourier{\\colortbl\\red0\\green0\\blue0\r\n\\par \\pard\\plain\\f0\\fs20\\b\\i\\u\\tab\\tx', 'latin1');
+/** COMPTYPE: LZFu for compressed, MELA for stored. */
+const COMPRESSED = 0x75465a4c;
+const UNCOMPRESSED = 0x414c454d;
+/**
+ * The CRC of MS-OXRTFCP 2.1.3.2: CRC-32's table, started at 0 and never inverted. zlib's CRC-32 inverts the value it
+ * starts from and the value it ends with, so starting it from all ones and inverting its result gives this one.
+ */
+const rtfCrc = (b) => ~(0, crc32_1.crc32)(b, 0xffffffff) >>> 0;
+/**
+ * Decompresses an Outlook message's PidTagRtfCompressed (MS-OXRTFCP 2.1.3.1). Returns undefined for input the
+ * specification calls corrupt: cut short, of an unknown type, with a CRC that does not match, or longer than `limit`.
+ */
+function decompressRtf(b, limit) {
+    if (b.length < 16)
+        return undefined;
+    const view = Buffer.from(b.buffer, b.byteOffset, b.byteLength);
+    const compSize = view.readUInt32LE(0);
+    const rawSize = view.readUInt32LE(4);
+    const type = view.readUInt32LE(8);
+    const crc = view.readUInt32LE(12);
+    if (compSize < 12 || compSize + 4 > b.length || rawSize > limit)
+        return undefined;
+    const contents = view.subarray(16, 4 + compSize);
+    if (type === UNCOMPRESSED)
+        return contents.subarray(0, rawSize);
+    if (type !== COMPRESSED || rtfCrc(contents) !== crc)
+        return undefined;
+    const dict = Buffer.alloc(4096);
+    PRESET.copy(dict);
+    let write = PRESET.length;
+    const out = Buffer.alloc(rawSize);
+    let n = 0;
+    let at = 0;
+    while (at < contents.length) {
+        const control = contents[at++];
+        for (let bit = 0; bit < 8; bit++) {
+            if ((control & (1 << bit)) === 0) {
+                if (at >= contents.length)
+                    return undefined;
+                const c = contents[at++];
+                if (n < rawSize)
+                    out[n++] = c;
+                dict[write] = c;
+                write = (write + 1) & 4095;
+                continue;
+            }
+            if (at + 2 > contents.length)
+                return undefined;
+            const ref = (contents[at] << 8) | contents[at + 1];
+            at += 2;
+            let read = ref >> 4;
+            if (read === write)
+                return out.subarray(0, n);
+            for (let k = (ref & 0x0f) + 2; k > 0; k--) {
+                const c = dict[read];
+                read = (read + 1) & 4095;
+                if (n < rawSize)
+                    out[n++] = c;
+                dict[write] = c;
+                write = (write + 1) & 4095;
+            }
+        }
+    }
+    return undefined;
+}
+/** RTF stored as a PidTagRtfCompressed value of type UNCOMPRESSED, whose CRC is 0 (MS-OXRTFCP 2.1.3.1.1). */
+function storeRtf(rtf) {
+    const head = Buffer.alloc(16);
+    head.writeUInt32LE(rtf.length + 12, 0);
+    head.writeUInt32LE(rtf.length, 4);
+    head.writeUInt32LE(UNCOMPRESSED, 8);
+    return Buffer.concat([head, rtf]);
+}

package/dist/score.js

@@ -19,7 +19,7 @@ exports.COMBINATIONS = [
     {
         name: 'code with data hidden in the archive',
         weight: 10,
-        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
+        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenEntry) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
     },
 ];
 /** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */

package/dist/sniff.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Identifies a file type from its first bytes, with the MIME types pdf-defuse gives, so plugins of the family see one
+ * name for each type. Returns a MIME type or undefined.
+ */
+export declare function sniffType(head: Uint8Array): string | undefined;

package/dist/sniff.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sniffType = sniffType;
+/**
+ * Identifies a file type from its first bytes, with the MIME types pdf-defuse gives, so plugins of the family see one
+ * name for each type. Returns a MIME type or undefined.
+ */
+function sniffType(head) {
+    const b = Buffer.from(head.buffer, head.byteOffset, head.byteLength);
+    // PDF readers accept the header anywhere in the first 1024 bytes.
+    const s = b.subarray(0, 1024).toString('latin1');
+    if (s.includes('%PDF-'))
+        return 'application/pdf';
+    if (b[0] === 0x50 && b[1] === 0x4b && (b[2] === 0x03 || b[2] === 0x05 || b[2] === 0x07))
+        return 'application/zip';
+    if (b[0] === 0x89 && s.startsWith('\x89PNG'))
+        return 'image/png';
+    if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'image/jpeg';
+    if (s.startsWith('GIF87a') || s.startsWith('GIF89a'))
+        return 'image/gif';
+    if (b[0] === 0xd0 && b[1] === 0xcf && b[2] === 0x11 && b[3] === 0xe0)
+        return 'application/x-ole-storage';
+    if (s.startsWith('{\\rt'))
+        return 'application/rtf';
+    if (s.startsWith('MZ'))
+        return 'application/x-msdownload';
+    if (s.startsWith('\x7fELF'))
+        return 'application/x-executable';
+    const text = s.replace(/^\xef\xbb\xbf/, '').trimStart();
+    if (/^<svg[\s>/]/i.test(text) || (/^<\?xml/i.test(text) && /<svg[\s>/]/i.test(s)))
+        return 'image/svg+xml';
+    if (/^<\?xml/i.test(text))
+        return 'application/xml';
+    if (/^<!doctype html|^<html[\s>]/i.test(text))
+        return 'text/html';
+    return undefined;
+}

package/dist/types.d.ts

@@ -13,7 +13,8 @@ export declare enum OfficeCategory {
     External = "EXTERNAL",
     Link = "LINK",
     Embedded = "EMBEDDED",
-    Control = "CONTROL"
+    Control = "CONTROL",
+    Processing = "PROCESSING"
 }
 /** Exact variant of a finding. Some details appear under more than one category. */
 export declare enum OfficeDetail {
@@ -34,7 +35,13 @@ export declare enum OfficeDetail {
     DataError = "DATA_ERROR",
     LeadingBytes = "LEADING_BYTES",
     HiddenData = "HIDDEN_DATA",
+    HiddenEntry = "HIDDEN_ENTRY",
     TrailingBytes = "TRAILING_BYTES",
+    BadHeader = "BAD_HEADER",
+    BrokenChain = "BROKEN_CHAIN",
+    ChainLoop = "CHAIN_LOOP",
+    DirectoryLoop = "DIRECTORY_LOOP",
+    BadEntry = "BAD_ENTRY",
     Doctype = "DOCTYPE",
     InternalSubset = "INTERNAL_SUBSET",
     ExternalEntity = "EXTERNAL_ENTITY",
@@ -49,17 +56,31 @@ export declare enum OfficeDetail {
     XmlEntityDepth = "XML_ENTITY_DEPTH",
     XmlEntityExpansions = "XML_ENTITY_EXPANSIONS",
     XmlEntitySize = "XML_ENTITY_SIZE",
+    RtfDepth = "RTF_DEPTH",
+    NestingDepth = "NESTING_DEPTH",
     Time = "TIME",
     Unrecognized = "UNRECOGNIZED",
     AmbiguousFormat = "AMBIGUOUS_FORMAT",
     Unreadable = "UNREADABLE",
+    UnreadableBody = "UNREADABLE_BODY",
     DuplicateEntry = "DUPLICATE_ENTRY",
     UntypedPart = "UNTYPED_PART",
     UnreferencedPart = "UNREFERENCED_PART",
     OdfLayout = "ODF_LAYOUT",
     PasswordRequired = "PASSWORD_REQUIRED",
+    DefaultPassword = "DEFAULT_PASSWORD",
+    UserPassword = "USER_PASSWORD",
+    Rc4_40 = "RC4_40",
+    Rc4_128 = "RC4_128",
+    Rc4Other = "RC4_OTHER",
+    Aes128 = "AES_128",
+    Aes192 = "AES_192",
+    Aes256 = "AES_256",
+    UnsupportedAlgorithm = "UNSUPPORTED_ALGORITHM",
+    XorObfuscation = "XOR_OBFUSCATION",
     VbaProject = "VBA_PROJECT",
     XlmMacrosheet = "XLM_MACROSHEET",
+    WordBasic = "WORDBASIC",
     OdfBasic = "ODF_BASIC",
     OdfScripts = "ODF_SCRIPTS",
     OdfDialogs = "ODF_DIALOGS",
@@ -70,7 +91,9 @@ export declare enum OfficeDetail {
     Callback = "CALLBACK",
     OdfConfiguration = "ODF_CONFIGURATION",
     RunProgram = "RUN_PROGRAM",
+    SubmitForm = "SUBMIT_FORM",
     OleVerb = "OLE_VERB",
+    ObjectUpdate = "OBJECT_UPDATE",
     Field = "FIELD",
     Formula = "FORMULA",
     Macrobutton = "MACROBUTTON",
@@ -83,6 +106,7 @@ export declare enum OfficeDetail {
     Workbook = "WORKBOOK",
     Reload = "RELOAD",
     Other = "OTHER",
+    DataConnection = "DATA_CONNECTION",
     LocalFile = "LOCAL_FILE",
     Safe = "SAFE",
     FileUrl = "FILE_URL",
@@ -95,12 +119,20 @@ export declare enum OfficeDetail {
     LookalikeHost = "LOOKALIKE_HOST",
     EncodedHost = "ENCODED_HOST",
     Relative = "RELATIVE",
+    TextMismatch = "TEXT_MISMATCH",
     OleObject = "OLE_OBJECT",
     Package = "PACKAGE",
     OleFile = "OLE_FILE",
     Applet = "APPLET",
     Plugin = "PLUGIN",
-    ActiveX = "ACTIVEX"
+    Equation = "EQUATION",
+    Attachment = "ATTACHMENT",
+    PluginPassed = "PLUGIN_PASSED",
+    PluginScrubbed = "PLUGIN_SCRUBBED",
+    PluginFailed = "PLUGIN_FAILED",
+    PluginRemoved = "PLUGIN_REMOVED",
+    ActiveX = "ACTIVEX",
+    VerificationFailed = "VERIFICATION_FAILED"
 }
 export type OfficeFindingAction = 'reject' | 'strip' | 'info';
 /**
@@ -151,6 +183,15 @@ export interface OfficeInspection {
     /** The MIME type of a file in that format. '' when not recognized. */
     mimeType: string;
 }
+export interface OfficeDisarmResult {
+    status: 'clean' | 'defused' | 'rejected';
+    /** The uploaded file and its score. */
+    before: OfficeInspection;
+    /** The output and its remaining score. Absent when rejected. */
+    after?: OfficeInspection;
+    /** Findings whose content was removed. */
+    removed: DefuseFinding[];
+}
 /** Random-access input. A buffer, a local file and an S3 ranged GetObject all fit. */
 export interface ByteSource {
     size(): Promise<number>;
@@ -183,6 +224,13 @@ export interface OfficeLimits {
     xmlEntityExpansions?: number;
     /** Characters of entity text expanded in the whole run. Default 16 Mi. */
     xmlEntitySize?: number;
+    /** Group nesting in an RTF file, and destinations open at once. Default 256. */
+    rtfDepth?: number;
+    /**
+     * The deepest a file may sit in the upload. The upload is at depth 0 and a file inside it at 1, and files of every
+     * format in between count. Not enforced unless set.
+     */
+    nestingDepth?: number;
     /** Milliseconds for the whole run. Not enforced unless set. */
     timeMs?: number;
 }
@@ -240,8 +288,24 @@ export interface OfficeScoreBands {
     critical: number;
 }
 export interface OfficeOptions {
+    /**
+     * One password or a list, tried in order on an encrypted file: an encrypted OOXML package, or an .xls workbook.
+     * VelvetSweatshop, the password Excel opens a workbook with by default, comes after them. Pass passwords in code,
+     * never on a command line, where other users can read them.
+     */
+    password?: string | string[];
     limits?: OfficeLimits;
     actionOverrides?: OfficeActionOverride[];
     scoreWeights?: OfficeScoreWeight[];
     scoreBands?: OfficeScoreBands;
+    /** Plugins that decide about the files inside the file: embedded objects and packages, OLE parts and attachments. */
+    filePlugins?: ContainedFilePlugin[];
+    /** Directory for temporary files. Defaults to os.tmpdir(). */
+    tempDir?: string;
+    /**
+     * Default 8 MiB. disarmOfficeSource keeps its copy of the upload and its output in memory up to this size and in a
+     * temporary file above it. Each file inside that goes to a plugin does the same, and the copies plugins return,
+     * which wait for the output to be written, share this much memory.
+     */
+    memoryThreshold?: number;
 }

package/dist/types.js

@@ -18,6 +18,7 @@ var OfficeCategory;
     OfficeCategory["Link"] = "LINK";
     OfficeCategory["Embedded"] = "EMBEDDED";
     OfficeCategory["Control"] = "CONTROL";
+    OfficeCategory["Processing"] = "PROCESSING";
 })(OfficeCategory || (exports.OfficeCategory = OfficeCategory = {}));
 /** Exact variant of a finding. Some details appear under more than one category. */
 var OfficeDetail;
@@ -40,7 +41,13 @@ var OfficeDetail;
     OfficeDetail["DataError"] = "DATA_ERROR";
     OfficeDetail["LeadingBytes"] = "LEADING_BYTES";
     OfficeDetail["HiddenData"] = "HIDDEN_DATA";
+    OfficeDetail["HiddenEntry"] = "HIDDEN_ENTRY";
     OfficeDetail["TrailingBytes"] = "TRAILING_BYTES";
+    OfficeDetail["BadHeader"] = "BAD_HEADER";
+    OfficeDetail["BrokenChain"] = "BROKEN_CHAIN";
+    OfficeDetail["ChainLoop"] = "CHAIN_LOOP";
+    OfficeDetail["DirectoryLoop"] = "DIRECTORY_LOOP";
+    OfficeDetail["BadEntry"] = "BAD_ENTRY";
     // XML
     OfficeDetail["Doctype"] = "DOCTYPE";
     OfficeDetail["InternalSubset"] = "INTERNAL_SUBSET";
@@ -57,20 +64,34 @@ var OfficeDetail;
     OfficeDetail["XmlEntityDepth"] = "XML_ENTITY_DEPTH";
     OfficeDetail["XmlEntityExpansions"] = "XML_ENTITY_EXPANSIONS";
     OfficeDetail["XmlEntitySize"] = "XML_ENTITY_SIZE";
+    OfficeDetail["RtfDepth"] = "RTF_DEPTH";
+    OfficeDetail["NestingDepth"] = "NESTING_DEPTH";
     OfficeDetail["Time"] = "TIME";
     // PACKAGE
     OfficeDetail["Unrecognized"] = "UNRECOGNIZED";
     OfficeDetail["AmbiguousFormat"] = "AMBIGUOUS_FORMAT";
     OfficeDetail["Unreadable"] = "UNREADABLE";
+    OfficeDetail["UnreadableBody"] = "UNREADABLE_BODY";
     OfficeDetail["DuplicateEntry"] = "DUPLICATE_ENTRY";
     OfficeDetail["UntypedPart"] = "UNTYPED_PART";
     OfficeDetail["UnreferencedPart"] = "UNREFERENCED_PART";
     OfficeDetail["OdfLayout"] = "ODF_LAYOUT";
     // ENCRYPTED
     OfficeDetail["PasswordRequired"] = "PASSWORD_REQUIRED";
+    OfficeDetail["DefaultPassword"] = "DEFAULT_PASSWORD";
+    OfficeDetail["UserPassword"] = "USER_PASSWORD";
+    OfficeDetail["Rc4_40"] = "RC4_40";
+    OfficeDetail["Rc4_128"] = "RC4_128";
+    OfficeDetail["Rc4Other"] = "RC4_OTHER";
+    OfficeDetail["Aes128"] = "AES_128";
+    OfficeDetail["Aes192"] = "AES_192";
+    OfficeDetail["Aes256"] = "AES_256";
+    OfficeDetail["UnsupportedAlgorithm"] = "UNSUPPORTED_ALGORITHM";
+    OfficeDetail["XorObfuscation"] = "XOR_OBFUSCATION";
     // MACRO
     OfficeDetail["VbaProject"] = "VBA_PROJECT";
     OfficeDetail["XlmMacrosheet"] = "XLM_MACROSHEET";
+    OfficeDetail["WordBasic"] = "WORDBASIC";
     OfficeDetail["OdfBasic"] = "ODF_BASIC";
     OfficeDetail["OdfScripts"] = "ODF_SCRIPTS";
     OfficeDetail["OdfDialogs"] = "ODF_DIALOGS";
@@ -83,7 +104,9 @@ var OfficeDetail;
     OfficeDetail["OdfConfiguration"] = "ODF_CONFIGURATION";
     // ACTION
     OfficeDetail["RunProgram"] = "RUN_PROGRAM";
+    OfficeDetail["SubmitForm"] = "SUBMIT_FORM";
     OfficeDetail["OleVerb"] = "OLE_VERB";
+    OfficeDetail["ObjectUpdate"] = "OBJECT_UPDATE";
     // DDE
     OfficeDetail["Field"] = "FIELD";
     OfficeDetail["Formula"] = "FORMULA";
@@ -99,6 +122,7 @@ var OfficeDetail;
     OfficeDetail["Workbook"] = "WORKBOOK";
     OfficeDetail["Reload"] = "RELOAD";
     OfficeDetail["Other"] = "OTHER";
+    OfficeDetail["DataConnection"] = "DATA_CONNECTION";
     OfficeDetail["LocalFile"] = "LOCAL_FILE";
     // LINK
     OfficeDetail["Safe"] = "SAFE";
@@ -112,14 +136,23 @@ var OfficeDetail;
     OfficeDetail["LookalikeHost"] = "LOOKALIKE_HOST";
     OfficeDetail["EncodedHost"] = "ENCODED_HOST";
     OfficeDetail["Relative"] = "RELATIVE";
+    OfficeDetail["TextMismatch"] = "TEXT_MISMATCH";
     // EMBEDDED
     OfficeDetail["OleObject"] = "OLE_OBJECT";
     OfficeDetail["Package"] = "PACKAGE";
     OfficeDetail["OleFile"] = "OLE_FILE";
     OfficeDetail["Applet"] = "APPLET";
     OfficeDetail["Plugin"] = "PLUGIN";
+    OfficeDetail["Equation"] = "EQUATION";
+    OfficeDetail["Attachment"] = "ATTACHMENT";
+    OfficeDetail["PluginPassed"] = "PLUGIN_PASSED";
+    OfficeDetail["PluginScrubbed"] = "PLUGIN_SCRUBBED";
+    OfficeDetail["PluginFailed"] = "PLUGIN_FAILED";
+    OfficeDetail["PluginRemoved"] = "PLUGIN_REMOVED";
     // CONTROL
     OfficeDetail["ActiveX"] = "ACTIVEX";
+    // PROCESSING
+    OfficeDetail["VerificationFailed"] = "VERIFICATION_FAILED";
 })(OfficeDetail || (exports.OfficeDetail = OfficeDetail = {}));
 var OfficeRisk;
 (function (OfficeRisk) {

package/dist/vsd.d.ts

@@ -0,0 +1,13 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/**
+ * Reads the ShapeSheet cells of a Visio 2000 to 2010 drawing for formulas that call RUNADDON, RUNADDONWARGS,
+ * CALLTHIS, RUNMACRO, OPENFILE or DOOLEVERB. Other versions of the stream go unread. A stream whose structure does
+ * not read stops the run as PACKAGE/UNREADABLE.
+ */
+export declare function visioRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;
+/**
+ * The LZ77 compression of Visio streams (VSDInternalStream.cpp): a flag byte for each eight items, a set bit for a
+ * literal byte and a clear one for a 2-byte back reference into a 4,096-byte window. Output past `limit` stops the run.
+ */
+export declare function inflate(src: Uint8Array, limit: number): Uint8Array;