@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/zip-writer.js

@@ -76,6 +76,10 @@ class ZipWriter {
         this.sink = sink;
         this.options = options;
     }
+    /** Bytes written so far: where the next entry's local header goes. */
+    get position() {
+        return this.offset;
+    }
     async put(b) {
         await this.sink.write(b);
         this.offset += b.length;
@@ -89,15 +93,11 @@ class ZipWriter {
             yield body;
         })());
     }
-    /** Adds an entry whose compressed bytes come from `chunks` unchanged, such as an entry of the archive being rewritten. */
-    async copy(info, chunks) {
-        if (this.names.has(info.name))
-            throw new Error(`Entry ${info.name} is already in the archive`);
-        this.names.add(info.name);
+    /** The local header `copy` writes for an entry. */
+    localHeader(info) {
         const name = Buffer.from(info.name, 'utf8');
         const flags = /^[\x20-\x7e]*$/.test(info.name) ? 0 : 0x0800;
         const big = this.options.forceZip64 === true || info.size >= MAX32 || info.compressedSize >= MAX32;
-        const localOffset = this.offset;
         const time = info.dosTime ?? 0;
         const date = info.dosDate ?? DOS_DATE;
         const local = new Builder()
@@ -115,7 +115,20 @@ class ZipWriter {
             .bytes(name);
         if (big)
             local.u16(0x0001).u16(16).u64(info.size).u64(info.compressedSize);
-        await this.put(local.build());
+        return local.build();
+    }
+    /** Adds an entry whose compressed bytes come from `chunks` unchanged, such as an entry of the archive being rewritten. */
+    async copy(info, chunks) {
+        if (this.names.has(info.name))
+            throw new Error(`Entry ${info.name} is already in the archive`);
+        this.names.add(info.name);
+        const name = Buffer.from(info.name, 'utf8');
+        const flags = /^[\x20-\x7e]*$/.test(info.name) ? 0 : 0x0800;
+        const big = this.options.forceZip64 === true || info.size >= MAX32 || info.compressedSize >= MAX32;
+        const localOffset = this.offset;
+        const time = info.dosTime ?? 0;
+        const date = info.dosDate ?? DOS_DATE;
+        await this.put(this.localHeader(info));
         let written = 0;
         for await (const c of chunks) {
             written += c.length;

package/dist/zip.d.ts

@@ -27,10 +27,17 @@ export interface ZipEntry {
 }
 /** Something the reader saw that it does not refuse. Each is a strip finding, since the rewrite drops the bytes. */
 export interface ZipNote {
-    detail: D.LeadingBytes | D.HiddenData | D.TrailingBytes;
+    detail: D.LeadingBytes | D.HiddenData | D.HiddenEntry | D.TrailingBytes;
     bytes: number;
+    /** For a hidden entry, where its local header sits. */
+    offset?: number;
 }
-/** The key two names collide on: percent-decoded, NFC and lowercase, without a directory's slash. */
+/**
+ * The key two names collide on: percent-decoded, NFKC and case-folded, without a directory's slash, and without the
+ * dots and spaces Windows drops from the end of each segment. Upper then lower case is the full folding, which takes a
+ * sharp s to ss as macOS's case-insensitive file system does. NFKC also joins compatibility forms such as ligatures
+ * and full-width letters.
+ */
 export declare function nameKey(name: string): string;
 /**
  * A ZIP archive read from its central directory, after every local header was checked against it. Reading an entry

package/dist/zip.js

@@ -56,6 +56,22 @@ const END_SEARCH = 22 + MAX16;
 const FLAG_MASK = 0x0001 | 0x0008 | 0x0040 | 0x0800 | 0x2000;
 const ENCRYPTION_FLAGS = 0x0001 | 0x0040 | 0x2000;
 const MAX_NAME_BYTES = 1024;
+const LOCAL_SIGNATURE = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+/** The offset of the first local file header signature in [start, end) of the file, or undefined. */
+async function findLocalHeader(reader, start, end, deadline) {
+    let carry = Buffer.alloc(0);
+    let at = start;
+    for await (const c of reader.chunks(start, end - start)) {
+        (0, errors_1.checkTime)(deadline);
+        const b = Buffer.concat([carry, Buffer.from(c.buffer, c.byteOffset, c.byteLength)]);
+        const i = b.indexOf(LOCAL_SIGNATURE);
+        if (i >= 0)
+            return at - carry.length + i;
+        carry = b.subarray(Math.max(0, b.length - 3));
+        at += c.length;
+    }
+    return undefined;
+}
 const fail = (detail, message, data) => {
     throw new errors_1.StopError(types_1.OfficeCategory.Container, detail, message, data);
 };
@@ -137,6 +153,20 @@ function checkUnicodePath(extras, name) {
     if (other !== name)
         fail(types_1.OfficeDetail.NameEncoding, 'The Unicode path field names a different entry', { name });
 }
+/** True for a segment of nothing but dots and spaces, the empty one included. */
+function onlyDotsAndSpaces(seg) {
+    for (const c of seg)
+        if (c !== '.' && c !== ' ')
+            return false;
+    return true;
+}
+/** A segment without the dots and spaces Windows drops from its end. A loop, since /[. ]+$/ backtracks. */
+function trimSegment(seg) {
+    let end = seg.length;
+    while (end > 0 && (seg[end - 1] === '.' || seg[end - 1] === ' '))
+        end--;
+    return seg.slice(0, end);
+}
 function checkName(name, directory) {
     const why = (reason) => fail(types_1.OfficeDetail.UnsafeName, `Entry name ${reason}`, { name, reason });
     if (name === '')
@@ -150,11 +180,17 @@ function checkName(name, directory) {
     if (/^[A-Za-z]:/.test(name))
         why('starts with a drive letter');
     for (const seg of (directory ? name.slice(0, -1) : name).split('/')) {
-        if (seg === '' || seg === '.' || seg === '..')
-            why('has an empty, "." or ".." segment');
+        // Windows drops trailing dots and spaces from each segment, so ".. " and "..." climb out as ".." does.
+        if (onlyDotsAndSpaces(seg))
+            why('has an empty segment, or one of only dots and spaces');
     }
 }
-/** The key two names collide on: percent-decoded, NFC and lowercase, without a directory's slash. */
+/**
+ * The key two names collide on: percent-decoded, NFKC and case-folded, without a directory's slash, and without the
+ * dots and spaces Windows drops from the end of each segment. Upper then lower case is the full folding, which takes a
+ * sharp s to ss as macOS's case-insensitive file system does. NFKC also joins compatibility forms such as ligatures
+ * and full-width letters.
+ */
 function nameKey(name) {
     let n = name;
     try {
@@ -163,7 +199,7 @@ function nameKey(name) {
     catch {
         // Not valid percent-encoding, so it stays as written.
     }
-    return n.normalize('NFC').toLowerCase().replace(/\/$/, '');
+    return n.normalize('NFKC').toUpperCase().toLowerCase().replace(/\/$/, '').split('/').map(trimSegment).join('/');
 }
 /** ZIP64 values the central directory defers to its extra field, in the order the format fixes. */
 function zip64Central(extras, fields, name) {
@@ -371,25 +407,46 @@ class ZipArchive {
                 (0, errors_1.checkTime)(deadline);
             await ZipArchive.checkLocal(reader, e, raws[i], dirOffset);
         }
+        // A reader that walks the file cannot know where a stored entry with a data descriptor ends. It looks for the
+        // next signature, so a local header inside the data is an entry to it, and part of this entry here.
+        for (const e of entries) {
+            if (e.method !== 0 || !(e.flags & 0x0008) || e.compressedSize === 0)
+                continue;
+            const at = await findLocalHeader(reader, e.dataOffset, e.dataOffset + e.compressedSize, deadline);
+            if (at !== undefined)
+                notes.push({ detail: types_1.OfficeDetail.HiddenEntry, bytes: e.dataOffset + e.compressedSize - at, offset: at });
+        }
         // Entries and the central directory must tile the file. Bytes no entry covers are reported, overlaps refused.
         const sorted = [...entries].sort((a, b) => a.localOffset - b.localOffset);
+        const gaps = [];
         let covered = 0;
         let hidden = 0;
         for (const e of sorted) {
             if (e.localOffset < covered)
                 fail(types_1.OfficeDetail.Overlap, 'Two entries share bytes', { name: e.name });
+            if (e.localOffset > covered)
+                gaps.push([covered, e.localOffset]);
             if (covered === 0 && e.localOffset > 0)
                 notes.push({ detail: types_1.OfficeDetail.LeadingBytes, bytes: e.localOffset });
             else
                 hidden += e.localOffset - covered;
             covered = e.end;
         }
+        if (dirOffset > covered)
+            gaps.push([covered, dirOffset]);
         if (sorted.length === 0 && dirOffset > 0)
             notes.push({ detail: types_1.OfficeDetail.LeadingBytes, bytes: dirOffset });
         else
             hidden += dirOffset - covered;
         if (hidden > 0)
             notes.push({ detail: types_1.OfficeDetail.HiddenData, bytes: hidden });
+        // A local header in a gap is an entry the central directory does not list. A reader that walks the file from the
+        // start, as streaming unzippers do, extracts it; a reader of the central directory never sees it.
+        for (const [from, to] of gaps) {
+            const at = await findLocalHeader(reader, from, to, deadline);
+            if (at !== undefined)
+                notes.push({ detail: types_1.OfficeDetail.HiddenEntry, bytes: to - from, offset: at });
+        }
         return new ZipArchive(reader, entries, notes, deadline);
     }
     /** Checks a local header and any data descriptor against the central directory, and fills in where the entry's data and the entry end. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",
@@ -16,13 +16,16 @@
     },
     "./package.json": "./package.json"
   },
+  "bin": {
+    "office-defuse": "dist/cli.js"
+  },
   "files": [
     "dist",
     "README.md",
     "LICENSE"
   ],
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=18.0.0"
   },
   "scripts": {
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true});require('fs').rmSync('build-test',{recursive:true,force:true})\"",
@@ -84,7 +87,7 @@
     "@biomejs/biome": "^2.5.15",
     "@types/chai": "^5.2.3",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^22.20.5",
+    "@types/node": "^18.19.130",
     "c8": "^12.0.0",
     "chai": "^6.3.0",
     "husky": "^9.1.7",