@patrickdk77/office-defuse 0.1.1 → 0.2.0

package/dist/rtf.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inspectRtf = inspectRtf;
 const cfb_1 = require("./cfb");
+const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const fields_1 = require("./fields");
@@ -43,6 +44,8 @@ const MAX_WORD = 250;
 const CHUNK = 262144;
 /** Collected text other than an object's data is short: a class name, a template path, a link. */
 const MAX_TEXT = 4096;
+/** The pictures RTF holds as whole files of their own, by the control word that names their type. */
+const PICTURE_TYPES = { pngblip: 'image/png', jpegblip: 'image/jpeg', emfblip: 'image/emf' };
 /** An object's data as Word decodes its hex digits, with the quirks rtfobj documents. */
 class HexData {
     limit;
@@ -100,7 +103,9 @@ const isDigit = (c) => c >= 0x30 && c <= 0x39;
  */
 async function inspectRtf(ctx, source, size) {
     ctx.format = { format: 'rtf', mimeType: 'application/rtf' };
-    const reader = new RtfReader(ctx, size);
+    const cuts = [];
+    ctx.run.output = { kind: 'rtf', size, cuts };
+    const reader = new RtfReader(ctx, size, cuts);
     for (let pos = 0; pos < size; pos += CHUNK) {
         (0, errors_1.checkTime)(ctx.settings.deadline);
         const chunk = await source.read(pos, Math.min(CHUNK, size - pos));
@@ -111,6 +116,7 @@ async function inspectRtf(ctx, source, size) {
 class RtfReader {
     ctx;
     size;
+    cuts;
     frames;
     fields;
     depth = 0;
@@ -130,11 +136,30 @@ class RtfReader {
     decoded = 0;
     /** Objects whose groups closed, read in order once the chunk is done. */
     pending = [];
-    constructor(ctx, size) {
+    /** The offsets of the braces of the groups open now. */
+    groups = [];
+    /** Where the control word being read ends. */
+    wordEnd = 0;
+    fieldCount = 0;
+    /** The fldinst groups of each field, by the field's number, which go when a finding strips the field. */
+    codes = new Map();
+    /** Pictures go to the plugins only when there are any, or expected verdicts to check, so only then are they decoded. */
+    pictures;
+    pendingPictures = [];
+    constructor(ctx, size, 
+    /** Where the rewrite cuts, which the rules fill in as their findings strip. */
+    cuts) {
         this.ctx = ctx;
         this.size = size;
-        this.frames = [{ kind: 'document', depth: 0, uc: 1 }];
-        this.fields = new fields_1.FieldStack(ctx, 'document');
+        this.cuts = cuts;
+        this.frames = [{ kind: 'document', depth: 0, uc: 1, at: 0 }];
+        this.pictures = (ctx.run.options.filePlugins?.length ?? 0) > 0 || (ctx.run.verify?.size ?? 0) > 0;
+        // A field a strip finding names loses its instructions and keeps its result.
+        this.fields = new fields_1.FieldStack(ctx, 'document', marks => {
+            for (const [start, end] of this.codes.get(marks.begin) ?? [])
+                if (end >= 0)
+                    cuts.push({ start, end });
+        });
     }
     get top() {
         return this.frames[this.frames.length - 1];
@@ -152,6 +177,11 @@ class RtfReader {
                 }
                 else if (top.kind === 'objskip')
                     top.data.hex.binary(b.subarray(i, i + n));
+                else if (top.kind === 'pict') {
+                    if (top.picture.dataAt < 0)
+                        top.picture.dataAt = this.base + i;
+                    top.hex.binary(b.subarray(i, i + n));
+                }
                 this.note(b, i, i + n);
                 this.binLeft -= n;
                 i += n;
@@ -160,12 +190,12 @@ class RtfReader {
             const c = b[i];
             if (c === 0x7b) {
                 this.note(b, i, i + 1);
-                this.open();
+                this.open(this.base + i);
                 i++;
             }
             else if (c === 0x7d) {
                 this.note(b, i, i + 1);
-                this.close(this.base + i);
+                this.close(this.base + i + 1);
                 i++;
             }
             else if (c === 0x5c) {
@@ -190,7 +220,9 @@ class RtfReader {
     }
     async objects() {
         for (const o of this.pending.splice(0))
-            await objectRules(this.ctx, o);
+            await objectRules(this.ctx, o, this.cuts);
+        for (const p of this.pendingPictures.splice(0))
+            await pictureRules(this.ctx, p, this.cuts);
     }
     async end() {
         // A file can end inside groups. Word reads what it has, and so does this.
@@ -198,8 +230,8 @@ class RtfReader {
             this.close(this.size);
         this.fields.finish();
         await this.objects();
-        if (this.trailing > 0)
-            this.ctx.report(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, undefined, { bytes: this.trailing });
+        if (this.trailing > 0 && this.ctx.report(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, undefined, { bytes: this.trailing }).action === 'strip')
+            this.cuts.push({ start: this.closedAt, end: this.size });
     }
     /** Counts bytes past the document's outermost group that are not white space or NUL. */
     note(b, from, to) {
@@ -209,23 +241,26 @@ class RtfReader {
             if (b[k] > 0x20)
                 this.trailing++;
     }
-    open() {
+    open(offset) {
+        this.groups.push(offset);
         this.depth++;
         this.skipChars = 0;
         const limit = this.ctx.settings.rtfDepth;
         if (this.depth > limit)
             throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, `Groups nest deeper than ${limit}`, { limit });
     }
-    close(offset) {
+    /** Closes the group open now. `end` is the offset after its brace, or the end of the file. */
+    close(end) {
         this.skipChars = 0;
         this.starred = false;
         while (this.frames.length > 1 && this.top.depth >= this.depth)
-            this.finishFrame(this.frames.pop());
+            this.finishFrame(this.frames.pop(), end);
         if (this.depth === 0)
             return;
         this.depth--;
+        this.groups.pop();
         if (this.depth === 0 && this.closedAt < 0)
-            this.closedAt = offset;
+            this.closedAt = end;
     }
     /**
      * Opens a destination for the rest of the group. One opened in the same group as the last ends that one, as in
@@ -234,11 +269,11 @@ class RtfReader {
     push(body) {
         const top = this.top;
         if (this.frames.length > 1 && top.depth === this.depth && top.kind !== 'field' && top.kind !== 'object')
-            this.finishFrame(this.frames.pop());
+            this.finishFrame(this.frames.pop(), -1);
         const limit = this.ctx.settings.rtfDepth;
         if (this.frames.length > limit)
             throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, `More than ${limit} destinations are open at once`, { limit });
-        this.frames.push({ ...body, depth: this.depth, uc: this.top.uc });
+        this.frames.push({ ...body, depth: this.depth, uc: this.top.uc, at: this.groups[this.depth - 1] ?? 0 });
     }
     /** Reads a control word or symbol at `i`. Returns the bytes it takes, or 0 when the buffer ends inside it. */
     control(b, i, last) {
@@ -277,6 +312,7 @@ class RtfReader {
         const param = digits === '' ? undefined : Number(digits);
         // A space ends the control word and belongs to it.
         const used = k - i + (k < b.length && b[k] === 0x20 ? 1 : 0);
+        this.wordEnd = this.base + i + used;
         this.word(name, param, this.base + i);
         return used;
     }
@@ -287,6 +323,10 @@ class RtfReader {
         if (name === 'bin') {
             // Word reads a negative or missing length as none.
             this.binLeft = param !== undefined && param > 0 ? Math.min(param, Number.MAX_SAFE_INTEGER) : 0;
+            // A picture's data that starts with \bin is replaced from the control word on, so no length is left behind.
+            const pict = this.top;
+            if (pict.kind === 'pict' && pict.picture.dataAt < 0)
+                pict.picture.dataAt = offset;
             return;
         }
         const top = this.top;
@@ -304,23 +344,44 @@ class RtfReader {
             return;
         }
         const object = this.object();
-        if (INERT.has(name))
+        if (name === 'pict' && this.pictures) {
+            const limit = this.ctx.settings.decompressedBytes;
+            this.push({ kind: 'pict', picture: { offset, dataAt: -1, group: [0, -1] }, hex: new HexData(offset, limit) });
+            const opened = this.top;
+            if (opened.kind === 'pict')
+                opened.picture.group[0] = opened.at;
+        }
+        else if (top.kind === 'pict' && Object.hasOwn(PICTURE_TYPES, name))
+            top.picture.type = PICTURE_TYPES[name];
+        else if (INERT.has(name))
             this.push({ kind: 'skip' });
         else if (name === 'field') {
-            this.fields.begin();
-            this.push({ kind: 'field' });
+            const field = this.fieldCount++;
+            this.fields.begin(field);
+            this.push({ kind: 'field', field });
         }
         else if (name === 'fldinst')
-            this.push({ kind: 'fldinst' });
+            this.push({ kind: 'fldinst', field: this.field() });
         else if (name === 'fldrslt') {
             this.fields.separate();
             this.push({ kind: 'fldrslt' });
         }
-        else if (name === 'object')
+        else if (name === 'object') {
             this.push({ kind: 'object', object: { offset, kinds: new Set(), update: false, className: '' } });
+            const opened = this.top;
+            if (opened.kind === 'object')
+                opened.object.group = [opened.at, -1];
+        }
         else if (name === 'objupdate') {
-            if (object)
+            if (object) {
                 object.update = true;
+                object.updateAt ??= [offset, this.wordEnd];
+            }
+        }
+        else if (name === 'result' && object && !object.result) {
+            // What Word shows in place of the object, which stays when the object goes.
+            object.result = [this.wordEnd, -1];
+            this.push({ kind: 'result', object });
         }
         else if (OBJECT_KINDS.has(name))
             object?.kinds.add(name);
@@ -350,6 +411,15 @@ class RtfReader {
         else if (starred)
             this.push({ kind: 'skip' });
     }
+    /** The number of the innermost field the reader is in, or -1. */
+    field() {
+        for (let k = this.frames.length - 1; k > 0; k--) {
+            const f = this.frames[k];
+            if (f.kind === 'field')
+                return f.field;
+        }
+        return -1;
+    }
     /** The object of the innermost object group the reader is in. */
     object() {
         for (let k = this.frames.length - 1; k > 0; k--) {
@@ -373,6 +443,10 @@ class RtfReader {
             top.data.hex.quote();
             return;
         }
+        if (top.kind === 'pict') {
+            top.hex.quote();
+            return;
+        }
         // A file can end before the two characters of a \'hh.
         const hi = hexValue(b[at] ?? -1);
         const lo = hexValue(b[at + 1] ?? -1);
@@ -384,6 +458,17 @@ class RtfReader {
         if (top.kind === 'skip')
             return;
         this.starred = false;
+        if (top.kind === 'pict') {
+            for (let k = from; k < to; k++) {
+                const v = hexValue(b[k]);
+                if (v < 0)
+                    continue;
+                if (top.picture.dataAt < 0)
+                    top.picture.dataAt = this.base + k;
+                top.hex.digit(v);
+            }
+            return;
+        }
         if (top.kind === 'objdata' || top.kind === 'objskip') {
             const both = top.kind === 'objdata';
             const hex = both ? top.hex : top.data.hex;
@@ -421,12 +506,41 @@ class RtfReader {
         const top = this.top;
         if (top.kind === 'fldinst')
             this.fields.text(s);
+        else if (top.kind === 'fldrslt')
+            this.fields.result(s);
         else if ((top.kind === 'objclass' || top.kind === 'template' || top.kind === 'hlsrc') && top.text.length < MAX_TEXT)
             top.text += s;
     }
-    finishFrame(f) {
+    /** Ends a destination. `end` is where its group ends, or -1 when another destination in its group ended it. */
+    finishFrame(f, end) {
+        // A cut takes a whole group, which only a group that closed has.
+        const cut = (r) => {
+            if (r.action === 'strip' && end >= 0)
+                this.cuts.push({ start: f.at, end });
+        };
         if (f.kind === 'field')
             this.fields.end();
+        else if (f.kind === 'fldinst') {
+            const list = this.codes.get(f.field) ?? [];
+            list.push([f.at, end]);
+            this.codes.set(f.field, list);
+        }
+        else if (f.kind === 'result') {
+            if (f.object.result)
+                f.object.result[1] = end;
+        }
+        else if (f.kind === 'pict') {
+            const data = f.hex.result();
+            this.decoded += data.length;
+            const total = this.ctx.settings.totalDecompressedBytes;
+            if (this.decoded > total)
+                throw new errors_1.StopError(types_1.OfficeCategory.Limit, types_1.OfficeDetail.TotalDecompressedSize, `The objects and pictures decode past ${total} bytes`, { limit: total });
+            f.picture.group[1] = end;
+            if (f.picture.type && data.length) {
+                f.picture.data = data;
+                this.pendingPictures.push(f.picture);
+            }
+        }
         else if (f.kind === 'objclass') {
             if (f.object)
                 f.object.className = f.text.trim();
@@ -434,14 +548,15 @@ class RtfReader {
         else if (f.kind === 'template') {
             const path = f.text.trim();
             if (path)
-                this.ctx.external(types_1.OfficeDetail.Template, path, 'template', { source: 'RTF template' }, 'template');
+                cut(this.ctx.external(types_1.OfficeDetail.Template, path, 'template', { source: 'RTF template' }, 'template'));
         }
         else if (f.kind === 'hlsrc') {
             const target = f.text.trim();
             if (target && !(0, links_1.isFragment)(target))
-                this.ctx.link(target, 'hyperlink', { source: 'RTF shape hyperlink' });
+                cut(this.ctx.link(target, 'hyperlink', { source: 'RTF shape hyperlink' }));
         }
         else if (f.kind === 'objdata') {
+            f.object.objdata = [f.at, end];
             f.object.data = f.hex.result();
             const alt = f.alt.result();
             if (!Buffer.from(alt).equals(Buffer.from(f.object.data)))
@@ -454,28 +569,77 @@ class RtfReader {
             if (f.standalone)
                 this.pending.push(f.object);
         }
-        else if (f.kind === 'object')
+        else if (f.kind === 'object') {
+            if (f.object.group)
+                f.object.group[1] = end;
             this.pending.push(f.object);
+        }
     }
 }
-/** One embedded or linked object: what its OLE 1.0 header names, and what its data holds. */
-async function objectRules(ctx, o) {
+/**
+ * One embedded or linked object: what its OLE 1.0 header names, and what its data holds. When anything read inside it
+ * makes a strip finding, the object's group goes and its result group, the picture Word shows, takes its place.
+ * \objupdate, which ACTION/OBJECT_UPDATE names, goes on its own.
+ */
+async function objectRules(ctx, o, cuts) {
     const location = `object at offset ${o.offset}`;
     const kinds = [...o.kinds];
     const base = { object: location, ...(kinds.length ? { kind: kinds.join(' ') } : {}) };
-    if (o.update)
-        ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, location, base);
-    if (o.kinds.has('objocx')) {
+    if (o.update && ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, location, base).action === 'strip' && o.updateAt)
+        cuts.push({ start: o.updateAt[0], end: o.updateAt[1] });
+    const before = ctx.strips;
+    if (o.kinds.has('objocx'))
         ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...base, ...(o.className ? { className: (0, context_1.clip)(o.className) } : {}) });
+    else {
+        await objectData(ctx, o, o.data, location, base, cuts);
+        // The data read without the groups \* marks, where that reads differently, is the object a reader that skips them sees.
+        if (o.alt)
+            await objectData(ctx, o, o.alt, location, { ...base, reading: 'without the groups \\* marks' });
+    }
+    if (ctx.strips === before)
+        return;
+    const [start, end] = o.group ?? o.objdata ?? [-1, -1];
+    if (end < 0)
+        return;
+    const result = o.group && o.result && o.result[1] >= 0 ? o.result : undefined;
+    cuts.push(result ? { start, end, text: Buffer.from('{', 'latin1'), copy: result } : { start, end });
+}
+/** Bytes as the hex digits of an objdata group, in lines of 128 digits as Word writes them. */
+function objdataGroup(bytes) {
+    const hex = Buffer.from(bytes).toString('hex');
+    const lines = [];
+    for (let i = 0; i < hex.length; i += 128)
+        lines.push(hex.slice(i, i + 128));
+    return Buffer.from(`{\\*\\objdata\r\n${lines.join('\r\n')}}`, 'latin1');
+}
+/**
+ * A PNG, JPEG or EMF picture goes to the plugins, as the file it is. A plugin that removes it removes its \pict group,
+ * and bytes a plugin wrote take the place of its data. A picture no plugin takes stays, since no rule names it.
+ */
+async function pictureRules(ctx, p, cuts) {
+    const data = p.data ?? new Uint8Array(0);
+    const decision = await (0, contained_1.decideContained)(ctx, { declaredType: p.type, location: `picture at offset ${p.offset}`, chunks: () => (0, io_1.chunksOf)((0, io_1.bufferSource)(data), data.length) });
+    const [start, end] = p.group;
+    if (!decision || end < 0)
         return;
+    if (!decision.keep)
+        cuts.push({ start, end });
+    else if (decision.replacement && p.dataAt >= 0) {
+        const hex = Buffer.from(await (0, io_1.readAll)(decision.replacement)).toString('hex');
+        const lines = [];
+        for (let i = 0; i < hex.length; i += 128)
+            lines.push(hex.slice(i, i + 128));
+        // The data runs to the brace that closes the group, which stays.
+        cuts.push({ start: p.dataAt, end: end - 1, text: Buffer.from(lines.join('\r\n'), 'latin1') });
     }
-    await objectData(ctx, o, o.data, location, base);
-    // The data read without the groups \* marks, where that reads differently, is the object a reader that skips them sees.
-    if (o.alt)
-        await objectData(ctx, o, o.alt, location, { ...base, reading: 'without the groups \\* marks' });
 }
-/** An object's data: its OLE 1.0 header, and the Packager data or storage it holds. */
-async function objectData(ctx, o, bytes, location, base) {
+/**
+ * An object's data: its OLE 1.0 header, and the Packager data or storage it holds. With `cuts`, for the first reading
+ * of the data, the file it holds goes to the plugins first: the file a Packager object holds, or the native data of
+ * any other embedded object. A plugin's verdict decides whether the object stays, and the bytes a plugin wrote take
+ * the place of the file in the object's data.
+ */
+async function objectData(ctx, o, bytes, location, base, cuts) {
     const ole1 = bytes?.length ? (0, oleobj_1.parseOle1)(bytes) : undefined;
     const className = (ole1?.className || o.className).replace(/\0+$/, '');
     const data = { ...base, ...(className ? { className: (0, context_1.clip)(className) } : {}) };
@@ -494,11 +658,20 @@ async function objectData(ctx, o, bytes, location, base) {
     if (!ole1)
         data.reason = 'its data is not an OLE 1.0 object';
     const native = ole1?.data;
-    if (native && className.toLowerCase() === 'package') {
-        const pkg = (0, oleobj_1.parsePackage)(native);
-        if (pkg)
-            Object.assign(data, (0, objects_1.packageData)(pkg));
+    const pkg = native && className.toLowerCase() === 'package' ? (0, oleobj_1.parsePackage)(native) : undefined;
+    let decision;
+    if (cuts && native && ole1?.dataAt !== undefined && className.toLowerCase() !== 'ole2link') {
+        const held = pkg?.embedded ? native.subarray(pkg.dataAt, pkg.dataAt + pkg.size) : native;
+        decision = await (0, contained_1.decideContained)(ctx, { name: (pkg?.embedded ? pkg.fileName : className) || undefined, location, chunks: () => (0, io_1.chunksOf)((0, io_1.bufferSource)(held), held.length) });
+        if (decision?.replacement && o.objdata && o.objdata[1] >= 0) {
+            const replaced = await (0, io_1.readAll)(decision.replacement);
+            const newNative = pkg?.embedded ? (0, oleobj_1.replaceSized)(native, pkg.dataAt, pkg.size, replaced) : replaced;
+            cuts.push({ start: o.objdata[0], end: o.objdata[1], text: objdataGroup((0, oleobj_1.replaceSized)(bytes, ole1.dataAt, native.length, newNative)) });
+        }
     }
+    const act = (0, contained_1.presence)(decision);
+    if (pkg)
+        Object.assign(data, (0, objects_1.packageData)(pkg));
     else if (native && native.length >= 8 && cfb_1.CFB_SIGNATURE.every((v, i) => native[i] === v)) {
         let cfb;
         try {
@@ -533,7 +706,7 @@ async function objectData(ctx, o, bytes, location, base) {
     if (className.toLowerCase() === 'ole2link')
         ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
     else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data);
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, act);
     if (equation)
         ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
 }

package/dist/rtfcomp.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Decompresses an Outlook message's PidTagRtfCompressed (MS-OXRTFCP 2.1.3.1). Returns undefined for input the
+ * specification calls corrupt: cut short, of an unknown type, with a CRC that does not match, or longer than `limit`.
+ */
+export declare function decompressRtf(b: Uint8Array, limit: number): Uint8Array | undefined;
+/** RTF stored as a PidTagRtfCompressed value of type UNCOMPRESSED, whose CRC is 0 (MS-OXRTFCP 2.1.3.1.1). */
+export declare function storeRtf(rtf: Uint8Array): Uint8Array;

package/dist/rtfcomp.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decompressRtf = decompressRtf;
+exports.storeRtf = storeRtf;
+const crc32_1 = require("./crc32");
+/** The dictionary MS-OXRTFCP 2.1.3.1.2 starts from: 207 bytes of RTF that most bodies begin with. */
+const PRESET = Buffer.from('{\\rtf1\\ansi\\mac\\deff0\\deftab720{\\fonttbl;}{\\f0\\fnil \\froman \\fswiss \\fmodern \\fscript \\fdecor MS Sans SerifSymbolArialTimes New RomanCourier{\\colortbl\\red0\\green0\\blue0\r\n\\par \\pard\\plain\\f0\\fs20\\b\\i\\u\\tab\\tx', 'latin1');
+/** COMPTYPE: LZFu for compressed, MELA for stored. */
+const COMPRESSED = 0x75465a4c;
+const UNCOMPRESSED = 0x414c454d;
+/**
+ * The CRC of MS-OXRTFCP 2.1.3.2: CRC-32's table, started at 0 and never inverted. zlib's CRC-32 inverts the value it
+ * starts from and the value it ends with, so starting it from all ones and inverting its result gives this one.
+ */
+const rtfCrc = (b) => ~(0, crc32_1.crc32)(b, 0xffffffff) >>> 0;
+/**
+ * Decompresses an Outlook message's PidTagRtfCompressed (MS-OXRTFCP 2.1.3.1). Returns undefined for input the
+ * specification calls corrupt: cut short, of an unknown type, with a CRC that does not match, or longer than `limit`.
+ */
+function decompressRtf(b, limit) {
+    if (b.length < 16)
+        return undefined;
+    const view = Buffer.from(b.buffer, b.byteOffset, b.byteLength);
+    const compSize = view.readUInt32LE(0);
+    const rawSize = view.readUInt32LE(4);
+    const type = view.readUInt32LE(8);
+    const crc = view.readUInt32LE(12);
+    if (compSize < 12 || compSize + 4 > b.length || rawSize > limit)
+        return undefined;
+    const contents = view.subarray(16, 4 + compSize);
+    if (type === UNCOMPRESSED)
+        return contents.subarray(0, rawSize);
+    if (type !== COMPRESSED || rtfCrc(contents) !== crc)
+        return undefined;
+    const dict = Buffer.alloc(4096);
+    PRESET.copy(dict);
+    let write = PRESET.length;
+    const out = Buffer.alloc(rawSize);
+    let n = 0;
+    let at = 0;
+    while (at < contents.length) {
+        const control = contents[at++];
+        for (let bit = 0; bit < 8; bit++) {
+            if ((control & (1 << bit)) === 0) {
+                if (at >= contents.length)
+                    return undefined;
+                const c = contents[at++];
+                if (n < rawSize)
+                    out[n++] = c;
+                dict[write] = c;
+                write = (write + 1) & 4095;
+                continue;
+            }
+            if (at + 2 > contents.length)
+                return undefined;
+            const ref = (contents[at] << 8) | contents[at + 1];
+            at += 2;
+            let read = ref >> 4;
+            if (read === write)
+                return out.subarray(0, n);
+            for (let k = (ref & 0x0f) + 2; k > 0; k--) {
+                const c = dict[read];
+                read = (read + 1) & 4095;
+                if (n < rawSize)
+                    out[n++] = c;
+                dict[write] = c;
+                write = (write + 1) & 4095;
+            }
+        }
+    }
+    return undefined;
+}
+/** RTF stored as a PidTagRtfCompressed value of type UNCOMPRESSED, whose CRC is 0 (MS-OXRTFCP 2.1.3.1.1). */
+function storeRtf(rtf) {
+    const head = Buffer.alloc(16);
+    head.writeUInt32LE(rtf.length + 12, 0);
+    head.writeUInt32LE(rtf.length, 4);
+    head.writeUInt32LE(UNCOMPRESSED, 8);
+    return Buffer.concat([head, rtf]);
+}

package/dist/score.js

@@ -19,7 +19,7 @@ exports.COMBINATIONS = [
     {
         name: 'code with data hidden in the archive',
         weight: 10,
-        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
+        test: has => runsCode(has) && (has(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenEntry) || has(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes)),
     },
 ];
 /** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */

package/dist/sniff.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Identifies a file type from its first bytes, with the MIME types pdf-defuse gives, so plugins of the family see one
+ * name for each type. Returns a MIME type or undefined.
+ */
+export declare function sniffType(head: Uint8Array): string | undefined;

package/dist/sniff.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sniffType = sniffType;
+/**
+ * Identifies a file type from its first bytes, with the MIME types pdf-defuse gives, so plugins of the family see one
+ * name for each type. Returns a MIME type or undefined.
+ */
+function sniffType(head) {
+    const b = Buffer.from(head.buffer, head.byteOffset, head.byteLength);
+    // PDF readers accept the header anywhere in the first 1024 bytes.
+    const s = b.subarray(0, 1024).toString('latin1');
+    if (s.includes('%PDF-'))
+        return 'application/pdf';
+    if (b[0] === 0x50 && b[1] === 0x4b && (b[2] === 0x03 || b[2] === 0x05 || b[2] === 0x07))
+        return 'application/zip';
+    if (b[0] === 0x89 && s.startsWith('\x89PNG'))
+        return 'image/png';
+    if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'image/jpeg';
+    if (s.startsWith('GIF87a') || s.startsWith('GIF89a'))
+        return 'image/gif';
+    if (b[0] === 0xd0 && b[1] === 0xcf && b[2] === 0x11 && b[3] === 0xe0)
+        return 'application/x-ole-storage';
+    if (s.startsWith('{\\rt'))
+        return 'application/rtf';
+    if (s.startsWith('MZ'))
+        return 'application/x-msdownload';
+    if (s.startsWith('\x7fELF'))
+        return 'application/x-executable';
+    const text = s.replace(/^\xef\xbb\xbf/, '').trimStart();
+    if (/^<svg[\s>/]/i.test(text) || (/^<\?xml/i.test(text) && /<svg[\s>/]/i.test(s)))
+        return 'image/svg+xml';
+    if (/^<\?xml/i.test(text))
+        return 'application/xml';
+    if (/^<!doctype html|^<html[\s>]/i.test(text))
+        return 'text/html';
+    return undefined;
+}