@patrickdk77/office-defuse 0.1.0 → 0.2.0

package/dist/context.d.ts

@@ -1,38 +1,161 @@
+import type { CompoundFile } from './cfb';
 import type { FindingFactory } from './findings';
 import type { Format } from './formats';
-import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding } from './types';
-import { type XmlHandler, type XmlLimits } from './xml';
+import type { SpillSink, TempDir } from './io';
+import { type CompoundPlan, type FlatOpcLayout, PackagePlan, type RtfCut } from './plan';
+import { type ByteSource, OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeFinding, type OfficeFindingAction, type OfficeOptions } from './types';
+import { type EntityBudget, type XmlHandler, type XmlLimits } from './xml';
 import type { ZipArchive, ZipEntry } from './zip';
 /** Cuts text from the file to a length that fits a finding's data. A reference to an external entity shows as `&name;`. */
 export declare const clip: (raw: string, n?: number) => string;
+/** The limits that bound a container and what is decoded from it, and the caller's password. */
+export interface RunSettings {
+    entries: number;
+    decompressedBytes: number;
+    totalDecompressedBytes: number;
+    /** Group nesting in an RTF file, and destinations open at once. */
+    rtfDepth: number;
+    deadline?: number;
+    /** Tried in order on an encrypted file, before the password the format opens with by default. */
+    passwords: readonly string[];
+}
+/** What a plugin returned for a file, which the output check expects to find again by the MD5 of its bytes. */
+export interface Expected {
+    result: 'passed' | 'scrubbed';
+    plugin: string;
+    findings?: DefuseFinding[];
+}
+/** What the rewrite starts from: the container the run read, and what its findings remove. */
+export type Output = {
+    kind: 'zip';
+    zip: ZipArchive;
+    plan: PackagePlan;
+    format: Format;
+} | {
+    kind: 'cfb';
+    cfb: CompoundFile;
+    plan: CompoundPlan;
+} | {
+    kind: 'rtf';
+    size: number;
+    cuts: RtfCut[];
+} | {
+    kind: 'flatodf';
+    plan: PackagePlan;
+}
+/** A Flat OPC package, unpacked into `zip`, whose OOXML format is `format`. */
+ | {
+    kind: 'flatopc';
+    zip: ZipArchive;
+    plan: PackagePlan;
+    format: Format;
+    layout: FlatOpcLayout;
+};
+/** What one run of the engine holds besides its findings: the caller's options, temporary files and plugin results. */
+export interface RunState {
+    options: OfficeOptions;
+    /** The depth of the file in the upload: 0 for the upload itself. */
+    depth: number;
+    deadline?: number;
+    temp: TempDir;
+    /** memoryThreshold, in bytes. */
+    threshold: number;
+    /** Bytes of plugin output held in memory until the rewrite. */
+    retained: number;
+    /** Set when the run checks an output: what the plugins returned for the upload's files. */
+    verify?: Map<string, Expected>;
+    /** What the plugins returned in this run, by the MD5 of the bytes kept. */
+    kept: Map<string, Expected>;
+    /** Plugin output that waits for the rewrite. The run disposes of it when it ends. */
+    held: SpillSink[];
+    /**
+     * Findings whose content a plugin kept, such as EMBEDDED/PACKAGE for a package a plugin passed. They stay in the
+     * report as info and leave the score to what the plugin found, as pdf-defuse leaves out a kept attached file.
+     */
+    superseded: WeakSet<DefuseFinding>;
+    /** Sources the rewrite reads from, such as a compound file a plugin returned, which the run closes when it ends. */
+    sources: ByteSource[];
+    /** The container, once the format rules have read it. */
+    output?: Output;
+}
+/** A finding the rules made, with its action, which the rewrite reads. Past 200 of one kind, `finding` is absent. */
+export interface Reported {
+    action: OfficeFindingAction;
+    finding?: OfficeFinding;
+}
+/** What every context of one inspection shares, so a package inside the file reports into the same list. */
+interface Shared {
+    findings: DefuseFinding[];
+    perKind: Map<string, number>;
+    overflow: Map<string, Record<string, string | number>>;
+    /** Entity expansion in every part, which the entity limits bound. */
+    budget: EntityBudget;
+    format?: Format;
+    run: RunState;
+    /** Strip findings made so far, counted past the 200 kept of each kind too. */
+    strips: number;
+}
 /** What one inspection holds while the format rules run. */
 export declare class RunContext {
-    readonly zip: ZipArchive;
     readonly factory: FindingFactory;
     readonly xmlLimits: XmlLimits;
-    readonly findings: DefuseFinding[];
+    readonly settings: RunSettings;
+    protected readonly shared: Shared;
+    constructor(factory: FindingFactory, xmlLimits: XmlLimits, settings: RunSettings, shared: Shared | RunState);
+    get findings(): DefuseFinding[];
+    get run(): RunState;
+    /** How many strip findings the run has made, so a rule can tell whether anything it read made one. */
+    get strips(): number;
     /** Set as soon as the rules know it, so a run that stops later still names the format. */
-    format?: Format;
-    private readonly perKind;
-    private readonly overflow;
-    /** Entity expansion in every part, which the entity limits bound. */
-    private readonly budget;
-    constructor(zip: ZipArchive, factory: FindingFactory, xmlLimits: XmlLimits);
-    /** Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. */
-    report(category: C, detail: D, location?: string, data?: Record<string, string | number>): void;
+    get format(): Format | undefined;
+    set format(f: Format | undefined);
+    /** A context for a ZIP archive the rules read, reporting into the same findings, with a plan of its own. */
+    withZip(zip: ZipArchive): ZipContext;
+    /** A context for rules that fill in a plan of their own without an archive, as for a flat XML file. */
+    withPlan(): PlanContext;
+    /**
+     * Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. `action` replaces the
+     * action the overrides give, for content whose fate a plugin decided.
+     */
+    report(category: C, detail: D, location?: string, data?: Record<string, string | number>, action?: OfficeFindingAction): Reported;
+    /** Reports content that goes whatever the overrides say: its action is strip, or reject when the caller asked for that. */
+    removal(category: C, detail: D, location?: string, data?: Record<string, string | number>): Reported;
+    /** Adds findings from another package as they are, such as those a plugin made inside a file. */
+    push(findings: DefuseFinding[]): void;
     /** Reports a link, classified by pdf-defuse's checks of its target. */
-    link(target: string, location: string, data?: Record<string, string>): void;
+    link(target: string, location: string, data?: Record<string, string>): Reported;
+    /**
+     * Reports a safe link whose text or tooltip names another site than the one it opens, as LINK/TEXT_MISMATCH. Returns
+     * undefined when no label names a site, or every site a label names is the target's.
+     */
+    labelMismatch(target: string, labels: ReadonlyArray<string | undefined>, location: string, data?: Record<string, string>): Reported | undefined;
     /**
      * Reports a reference that loads from outside the file on its own. It is EXTERNAL/LOCAL_FILE, with `kind` saying
      * what refers, when the target is on this machine, and `detail` otherwise.
      */
-    external(detail: D, target: string, location: string, data: Record<string, string>, kind: string): void;
+    external(detail: D, target: string, location: string, data: Record<string, string>, kind: string): Reported;
     /**
-     * Inflates an entry and tokenizes it as XML, or as Office's VML dialect, handing the events to `handler`. A document
-     * type declaration is XML/DOCTYPE without an internal subset and XML/INTERNAL_SUBSET with one. A reference to an
-     * external entity in content is XML/EXTERNAL_ENTITY.
+     * Tokenizes XML text, or Office's VML dialect, handing the events to `handler`. A document type declaration is
+     * XML/DOCTYPE without an internal subset and XML/INTERNAL_SUBSET with one. A reference to an external entity in
+     * content is XML/EXTERNAL_ENTITY.
      */
+    parseXml(part: string, chunks: AsyncIterable<Uint8Array> | Iterable<Uint8Array>, handler: XmlHandler, vml?: boolean, plan?: PackagePlan, after?: () => Promise<void>): Promise<void>;
+}
+/** The context of rules that fill in a rewrite plan: a ZIP package's, or a flat XML file's. */
+export declare class PlanContext extends RunContext {
+    /** What the rewrite removes, which the rules fill in as they report. */
+    readonly plan: PackagePlan;
+    constructor(
+    /** What the rewrite removes, which the rules fill in as they report. */
+    plan: PackagePlan, factory: FindingFactory, xmlLimits: XmlLimits, settings: RunSettings, shared: Shared);
+}
+/** The context of the rules that read a ZIP archive. */
+export declare class ZipContext extends PlanContext {
+    readonly zip: ZipArchive;
+    constructor(zip: ZipArchive, plan: PackagePlan, factory: FindingFactory, xmlLimits: XmlLimits, settings: RunSettings, shared: Shared);
+    /** Inflates an entry and tokenizes it as XML, or as Office's VML dialect, handing the events to `handler`. */
     parse(entry: ZipEntry, handler: XmlHandler, vml?: boolean): Promise<void>;
     /** Inflates an entry, which checks it, hands each chunk to `visit`, and tells whether its bytes are an OLE file. */
     drain(entry: ZipEntry, visit?: (chunk: Uint8Array) => void): Promise<boolean>;
 }
+export {};

package/dist/context.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RunContext = exports.clip = void 0;
+exports.ZipContext = exports.PlanContext = exports.RunContext = exports.clip = void 0;
 const links_1 = require("./links");
+const plan_1 = require("./plan");
 const types_1 = require("./types");
 const xml_1 = require("./xml");
 const OLE_SIGNATURE = [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1];
@@ -13,43 +14,98 @@ const clip = (raw, n = 200) => {
 exports.clip = clip;
 /** What one inspection holds while the format rules run. */
 class RunContext {
-    zip;
     factory;
     xmlLimits;
-    findings = [];
-    /** Set as soon as the rules know it, so a run that stops later still names the format. */
-    format;
-    perKind = new Map();
-    overflow = new Map();
-    /** Entity expansion in every part, which the entity limits bound. */
-    budget = { expansions: 0, size: 0 };
-    constructor(zip, factory, xmlLimits) {
-        this.zip = zip;
+    settings;
+    shared;
+    constructor(factory, xmlLimits, settings, shared) {
         this.factory = factory;
         this.xmlLimits = xmlLimits;
+        this.settings = settings;
+        this.shared = 'run' in shared ? shared : { findings: [], perKind: new Map(), overflow: new Map(), budget: { expansions: 0, size: 0 }, run: shared, strips: 0 };
+    }
+    get findings() {
+        return this.shared.findings;
+    }
+    get run() {
+        return this.shared.run;
+    }
+    /** How many strip findings the run has made, so a rule can tell whether anything it read made one. */
+    get strips() {
+        return this.shared.strips;
+    }
+    /** Set as soon as the rules know it, so a run that stops later still names the format. */
+    get format() {
+        return this.shared.format;
     }
-    /** Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. */
-    report(category, detail, location, data) {
-        const k = `${category}/${detail}`;
-        const n = (this.perKind.get(k) ?? 0) + 1;
-        this.perKind.set(k, n);
+    set format(f) {
+        this.shared.format = f;
+    }
+    /** A context for a ZIP archive the rules read, reporting into the same findings, with a plan of its own. */
+    withZip(zip) {
+        return new ZipContext(zip, new plan_1.PackagePlan(), this.factory, this.xmlLimits, this.settings, this.shared);
+    }
+    /** A context for rules that fill in a plan of their own without an archive, as for a flat XML file. */
+    withPlan() {
+        return new PlanContext(new plan_1.PackagePlan(), this.factory, this.xmlLimits, this.settings, this.shared);
+    }
+    /**
+     * Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. `action` replaces the
+     * action the overrides give, for content whose fate a plugin decided.
+     */
+    report(category, detail, location, data, action) {
+        const act = action ?? this.factory.actionFor(category, detail);
+        if (act === 'strip')
+            this.shared.strips++;
+        const k = `${category}/${detail}/${act}`;
+        const n = (this.shared.perKind.get(k) ?? 0) + 1;
+        this.shared.perKind.set(k, n);
         if (n <= 200) {
-            this.findings.push(this.factory.make(category, detail, location, data));
-            return;
+            const finding = this.factory.make(category, detail, location, data);
+            finding.action = act;
+            if (action === 'info')
+                this.run.superseded.add(finding);
+            this.shared.findings.push(finding);
+            return { action: act, finding };
         }
-        let counted = this.overflow.get(k);
+        let counted = this.shared.overflow.get(k);
         if (!counted) {
             // The first overflow fills the description's placeholders.
             counted = { ...data, count: 0 };
-            this.overflow.set(k, counted);
-            this.findings.push(this.factory.make(category, detail, 'additional occurrences', counted));
+            this.shared.overflow.set(k, counted);
+            const finding = this.factory.make(category, detail, 'additional occurrences', counted);
+            finding.action = act;
+            if (action === 'info')
+                this.run.superseded.add(finding);
+            this.shared.findings.push(finding);
         }
         counted.count = Number(counted.count) + 1;
+        return { action: act };
+    }
+    /** Reports content that goes whatever the overrides say: its action is strip, or reject when the caller asked for that. */
+    removal(category, detail, location, data) {
+        const act = this.factory.actionFor(category, detail);
+        return this.report(category, detail, location, data, act === 'info' ? 'strip' : act);
+    }
+    /** Adds findings from another package as they are, such as those a plugin made inside a file. */
+    push(findings) {
+        this.shared.findings.push(...findings);
+        this.shared.strips += findings.filter(f => f.action === 'strip').length;
     }
     /** Reports a link, classified by pdf-defuse's checks of its target. */
     link(target, location, data = {}) {
         const v = (0, links_1.checkLink)(target);
-        this.report(v.category, v.detail, location, { ...data, target: (0, exports.clip)(target, 2000), ...(v.host ? { host: (0, exports.clip)(v.host) } : {}) });
+        return this.report(v.category, v.detail, location, { ...data, target: (0, exports.clip)(target, 2000), ...(v.host ? { host: (0, exports.clip)(v.host) } : {}) });
+    }
+    /**
+     * Reports a safe link whose text or tooltip names another site than the one it opens, as LINK/TEXT_MISMATCH. Returns
+     * undefined when no label names a site, or every site a label names is the target's.
+     */
+    labelMismatch(target, labels, location, data = {}) {
+        const label = (0, links_1.mismatchedLabel)(target, labels);
+        if (label === undefined)
+            return undefined;
+        return this.report(types_1.OfficeCategory.Link, types_1.OfficeDetail.TextMismatch, location, { ...data, target: (0, exports.clip)(target, 2000), label: (0, exports.clip)(label) });
     }
     /**
      * Reports a reference that loads from outside the file on its own. It is EXTERNAL/LOCAL_FILE, with `kind` saying
@@ -58,33 +114,75 @@ class RunContext {
     external(detail, target, location, data, kind) {
         const d = { ...data, target: (0, exports.clip)(target, 2000) };
         if ((0, links_1.isLocalTarget)(target))
-            this.report(types_1.OfficeCategory.External, types_1.OfficeDetail.LocalFile, location, { ...d, kind });
-        else
-            this.report(types_1.OfficeCategory.External, detail, location, d);
+            return this.report(types_1.OfficeCategory.External, types_1.OfficeDetail.LocalFile, location, { ...d, kind });
+        return this.report(types_1.OfficeCategory.External, detail, location, d);
     }
     /**
-     * Inflates an entry and tokenizes it as XML, or as Office's VML dialect, handing the events to `handler`. A document
-     * type declaration is XML/DOCTYPE without an internal subset and XML/INTERNAL_SUBSET with one. A reference to an
-     * external entity in content is XML/EXTERNAL_ENTITY.
+     * Tokenizes XML text, or Office's VML dialect, handing the events to `handler`. A document type declaration is
+     * XML/DOCTYPE without an internal subset and XML/INTERNAL_SUBSET with one. A reference to an external entity in
+     * content is XML/EXTERNAL_ENTITY.
      */
-    async parse(entry, handler, vml = false) {
-        const part = entry.name;
+    async parseXml(part, chunks, handler, vml = false, plan, after) {
         const notes = {
             doctype: d => {
                 const ids = { ...(d.publicId === undefined ? {} : { publicId: (0, exports.clip)(d.publicId) }), ...(d.systemId === undefined ? {} : { systemId: (0, exports.clip)(d.systemId) }) };
-                if (!d.internalSubset)
-                    this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Doctype, part, { part, name: (0, exports.clip)(d.name), ...ids });
+                if (!d.internalSubset) {
+                    if (this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.Doctype, part, { part, name: (0, exports.clip)(d.name), ...ids }).action === 'strip' && plan)
+                        plan.part(part).doctype = true;
+                }
                 else {
                     const counts = { entities: d.entities, externalEntities: d.externalEntities, attributeDefaults: d.attributeDefaults, skipped: d.skipped };
-                    this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.InternalSubset, part, { part, name: (0, exports.clip)(d.name), ...ids, ...counts });
+                    if (this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.InternalSubset, part, { part, name: (0, exports.clip)(d.name), ...ids, ...counts }).action === 'strip' && plan)
+                        plan.part(part).subset = true;
                 }
             },
-            externalEntity: r => this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.ExternalEntity, part, { part, entity: (0, exports.clip)(r.name), target: (0, exports.clip)(r.systemId, 2000), ...(r.publicId === undefined ? {} : { publicId: (0, exports.clip)(r.publicId) }) }),
+            externalEntity: r => {
+                const reported = this.report(types_1.OfficeCategory.Xml, types_1.OfficeDetail.ExternalEntity, part, {
+                    part,
+                    entity: (0, exports.clip)(r.name),
+                    target: (0, exports.clip)(r.systemId, 2000),
+                    ...(r.publicId === undefined ? {} : { publicId: (0, exports.clip)(r.publicId) }),
+                });
+                if (!plan)
+                    return;
+                const p = plan.part(part);
+                p.hasExternal = true;
+                if (reported.action === 'strip')
+                    p.external = true;
+            },
         };
-        const t = new xml_1.XmlTokenizer(handler, this.xmlLimits, part, { vml, notes, budget: this.budget });
-        for await (const chunk of this.zip.read(entry))
+        const t = new xml_1.XmlTokenizer(handler, this.xmlLimits, part, { vml, notes, budget: this.shared.budget });
+        // `after` runs between chunks, so a handler can hand what it gathered to something that waits.
+        for await (const chunk of chunks) {
             t.write(chunk);
+            await after?.();
+        }
         t.end();
+        await after?.();
+    }
+}
+exports.RunContext = RunContext;
+/** The context of rules that fill in a rewrite plan: a ZIP package's, or a flat XML file's. */
+class PlanContext extends RunContext {
+    plan;
+    constructor(
+    /** What the rewrite removes, which the rules fill in as they report. */
+    plan, factory, xmlLimits, settings, shared) {
+        super(factory, xmlLimits, settings, shared);
+        this.plan = plan;
+    }
+}
+exports.PlanContext = PlanContext;
+/** The context of the rules that read a ZIP archive. */
+class ZipContext extends PlanContext {
+    zip;
+    constructor(zip, plan, factory, xmlLimits, settings, shared) {
+        super(plan, factory, xmlLimits, settings, shared);
+        this.zip = zip;
+    }
+    /** Inflates an entry and tokenizes it as XML, or as Office's VML dialect, handing the events to `handler`. */
+    parse(entry, handler, vml = false) {
+        return this.parseXml(entry.name, this.zip.read(entry), handler, vml, this.plan);
     }
     /** Inflates an entry, which checks it, hands each chunk to `visit`, and tells whether its bytes are an OLE file. */
     async drain(entry, visit) {
@@ -97,4 +195,4 @@ class RunContext {
         return head.length === OLE_SIGNATURE.length && head.every((b, i) => b === OLE_SIGNATURE[i]);
     }
 }
-exports.RunContext = RunContext;
+exports.ZipContext = ZipContext;

package/dist/crc32.d.ts

@@ -1,2 +1,8 @@
-/** Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. */
-export declare function crc32(bytes: Uint8Array, crc?: number): number;
+/** Continues a CRC-32, the one ZIP uses, over `bytes`, with a lookup table. Start from 0. */
+export declare function tableCrc32(bytes: Uint8Array, crc?: number): number;
+/**
+ * Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. This is zlib.crc32 where Node has it, about 50
+ * times faster, and the table otherwise. Node 18 and early releases of Node 20 and 22 lack it. The choice is made
+ * once, when the module loads.
+ */
+export declare const crc32: (bytes: Uint8Array, crc?: number) => number;

package/dist/crc32.js

@@ -1,7 +1,41 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.crc32 = crc32;
-// zlib.crc32 arrived in Node 22.2, and the package supports every Node 22.
+exports.crc32 = void 0;
+exports.tableCrc32 = tableCrc32;
+const zlib = __importStar(require("node:zlib"));
 const TABLE = new Uint32Array(256);
 for (let n = 0; n < 256; n++) {
     let c = n;
@@ -9,10 +43,16 @@ for (let n = 0; n < 256; n++) {
         c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
     TABLE[n] = c >>> 0;
 }
-/** Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. */
-function crc32(bytes, crc = 0) {
+/** Continues a CRC-32, the one ZIP uses, over `bytes`, with a lookup table. Start from 0. */
+function tableCrc32(bytes, crc = 0) {
     let c = ~crc >>> 0;
     for (const b of bytes)
         c = TABLE[(c ^ b) & 0xff] ^ (c >>> 8);
     return ~c >>> 0;
 }
+/**
+ * Continues a CRC-32, the one ZIP uses, over `bytes`. Start from 0. This is zlib.crc32 where Node has it, about 50
+ * times faster, and the table otherwise. Node 18 and early releases of Node 20 and 22 lack it. The choice is made
+ * once, when the module loads.
+ */
+exports.crc32 = zlib.crc32 ?? tableCrc32;

package/dist/engine.d.ts

@@ -1,5 +1,16 @@
-import { type ByteSource, type OfficeInspection, type OfficeOptions } from './types';
+import { type ByteSink, type ByteSource, type OfficeDisarmResult, type OfficeInspection, type OfficeOptions } from './types';
 /** Inspects an Office or OpenDocument file without changing it. The source is closed when the run ends. */
 export declare function inspectOfficeSource(source: ByteSource, options?: OfficeOptions): Promise<OfficeInspection>;
 /** Inspects Office or OpenDocument bytes. */
 export declare function inspectOffice(bytes: Uint8Array, options?: OfficeOptions): Promise<OfficeInspection>;
+/**
+ * Writes a defused copy of `source` to `sink`. Nothing reaches the sink unless the output passes inspection. The
+ * source is closed when the run ends.
+ */
+export declare function disarmOfficeSource(source: ByteSource, sink: ByteSink, options?: OfficeOptions): Promise<OfficeDisarmResult>;
+/** Internal entry that carries the depth of a file inside another, and the deadline it shares with the upload. */
+export declare function disarmAtDepth(source: ByteSource, sink: ByteSink, options: OfficeOptions, depth: number, deadline?: number | undefined): Promise<OfficeDisarmResult>;
+/** Defuses Office or OpenDocument bytes. `bytes` holds the output unless the file was rejected. */
+export declare function disarmOffice(bytes: Uint8Array, options?: OfficeOptions): Promise<OfficeDisarmResult & {
+    bytes?: Uint8Array;
+}>;