@patrickdk77/office-defuse 0.1.1 → 0.2.0

package/dist/fields.js

@@ -10,68 +10,104 @@ const xml_1 = require("./xml");
 /** How much of a field code is kept, counted from its first word, which names the field. */
 const MAX_FIELD_CODE = 4096;
 /**
- * Reports a Word field by its code. A field whose name holds the content of an external entity has a type the file
- * does not say, as one whose name another field builds does.
+ * Reports a Word field by its code, and tells whether any of its findings strips it. A field whose name holds the
+ * content of an external entity has a type the file does not say, as one whose name another field builds does. A
+ * HYPERLINK field's result is the text the reader sees, and goes with its tooltip into the label check.
  */
-function evaluateField(ctx, location, code, computed) {
+function evaluateField(ctx, location, code, computed, result = '') {
     const data = { code: (0, context_1.clip)(code.trim()) };
     const words = (0, formulas_1.fieldWords)(code);
     const first = words[0]?.text ?? '';
     const entity = (0, xml_1.unknownEntity)(first);
+    const actions = [];
     if (computed || entity !== undefined)
-        ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, location, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) });
+        actions.push(ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Computed, location, entity === undefined ? data : { ...data, entity: (0, context_1.clip)(entity) }).action);
     const name = first.toUpperCase();
     // An argument comes before any switch, and a switch is an unquoted word starting with a backslash.
     const switchAt = words.findIndex(w => !w.quoted && w.text.startsWith('\\'));
     const arg = (n) => (words[n] !== undefined && (switchAt < 0 || n < switchAt) ? words[n].text : undefined);
     if (name === 'DDE' || name === 'DDEAUTO')
-        ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, location, data);
+        actions.push(ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, location, data).action);
     else if (name === 'MACROBUTTON')
-        ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') });
+        actions.push(ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') }).action);
     else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
         const target = arg(name === 'LINK' ? 2 : 1);
         if (target === undefined)
-            ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, location, data);
+            actions.push(ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, location, data).action);
         else
-            ctx.external(types_1.OfficeDetail.Include, target, location, data, 'field');
+            actions.push(ctx.external(types_1.OfficeDetail.Include, target, location, data, 'field').action);
     }
     else if (name === 'HYPERLINK') {
         const target = arg(1);
-        if (target !== undefined && !(0, links_1.isFragment)(target))
-            ctx.link(target, location, { ...data, source: 'HYPERLINK field' });
+        if (target !== undefined && !(0, links_1.isFragment)(target)) {
+            const r = ctx.link(target, location, { ...data, source: 'HYPERLINK field' });
+            actions.push(r.action);
+            // The \o switch gives the tooltip.
+            const tip = words.findIndex(w => !w.quoted && w.text.toLowerCase() === '\\o');
+            const labels = [result, tip >= 0 ? words[tip + 1]?.text : undefined];
+            if (r.action !== 'strip') {
+                const m = ctx.labelMismatch(target, labels, location, { ...data, source: 'HYPERLINK field' });
+                if (m)
+                    actions.push(m.action);
+            }
+        }
     }
+    return actions.includes('strip');
 }
 /**
  * Word field codes, followed through nested fields as the text of a document arrives: a field begins, its code
  * comes, a separator starts its result, and it ends. Each format says where those marks are.
  */
+/** The most of a field's result that is kept, for the label check. */
+const MAX_RESULT = 4096;
 class FieldStack {
     ctx;
     location;
+    onStrip;
     stack = [];
-    constructor(ctx, location) {
+    /**
+     * `onStrip` hears of each field a strip finding names, with the marks the format gave its begin, separator and end,
+     * so the rewrite can find the field again.
+     */
+    constructor(ctx, location, onStrip) {
         this.ctx = ctx;
         this.location = location;
+        this.onStrip = onStrip;
     }
     /** A field starts. One that starts before its parent's code has a word in it makes that code at run time. */
-    begin() {
+    begin(mark = -1) {
         this.nest();
-        this.stack.push({ code: '', inCode: true, computed: false });
+        this.stack.push({ code: '', inCode: true, computed: false, marks: { begin: mark, simple: false }, result: '' });
     }
-    /** A field that is all code, such as OOXML's fldSimple. */
-    simple(code) {
+    /** A field whose code is given whole, such as OOXML's fldSimple, whose result follows until simpleEnd(). */
+    simpleBegin(code, mark = -1) {
         this.nest();
-        evaluateField(this.ctx, this.location, code, false);
+        this.stack.push({ code, inCode: false, computed: false, marks: { begin: mark, simple: true }, result: '' });
     }
-    separate() {
+    simpleEnd() {
         const top = this.stack[this.stack.length - 1];
-        if (top)
-            top.inCode = false;
+        if (!top?.marks.simple)
+            return;
+        this.stack.pop();
+        this.decide(top);
     }
-    end() {
+    separate(mark = -1) {
+        const top = this.stack[this.stack.length - 1];
+        if (!top)
+            return;
+        top.inCode = false;
+        top.marks.separate ??= mark;
+    }
+    end(mark = -1) {
         const f = this.stack.pop();
-        if (f)
-            evaluateField(this.ctx, this.location, f.code, f.computed);
+        if (!f)
+            return;
+        f.marks.end = mark;
+        this.decide(f);
+    }
+    decide(f) {
+        if (evaluateField(this.ctx, this.location, f.code, f.computed, f.result))
+            this.onStrip?.(f.marks);
     }
     /** Whether a field's code is being read now. */
     get inCode() {
@@ -83,10 +119,16 @@ class FieldStack {
         if (top?.inCode && top.code.length < MAX_FIELD_CODE)
             top.code = top.code ? top.code + t : t.trimStart();
     }
+    /** Text of the innermost field's result, the text the reader sees. */
+    result(t) {
+        const top = this.stack[this.stack.length - 1];
+        if (top && !top.inCode && top.result.length < MAX_RESULT)
+            top.result += t;
+    }
     /** A document can end inside a field. Word still reads the code it has. */
     finish() {
         for (let f = this.stack.pop(); f; f = this.stack.pop())
-            evaluateField(this.ctx, this.location, f.code, f.computed);
+            this.decide(f);
     }
     nest() {
         const top = this.stack[this.stack.length - 1];

package/dist/findings.d.ts

@@ -19,7 +19,8 @@ export declare function allFindingSpecs(): Array<{
 export declare class FindingFactory {
     private readonly overrides;
     constructor(overrides?: OfficeActionOverride[]);
-    private actionFor;
+    /** The action of a kind of finding, after the caller's overrides. */
+    actionFor(category: C, detail: D): OfficeFindingAction;
     make(category: C, detail: D, location?: string, data?: Record<string, string | number>): OfficeFinding;
 }
 export {};

package/dist/findings.js

@@ -26,6 +26,7 @@ def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadExtraField, 'rejec
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.DataError, 'reject', 0, "An entry's data does not match its declared size or checksum<: {name}|>");
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.LeadingBytes, 'strip', 10, 'Data before the first entry of the archive');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenData, 'strip', 20, 'Data in the file that no entry or stream covers');
+def(types_1.OfficeCategory.Container, types_1.OfficeDetail.HiddenEntry, 'strip', 40, 'A local file header the central directory does not list, which a reader that walks the file in order extracts<: at offset {offset}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.TrailingBytes, 'strip', 10, 'Data after the end of the archive or compound file');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BadHeader, 'reject', 0, 'The compound file header is invalid<: {reason}|>');
 def(types_1.OfficeCategory.Container, types_1.OfficeDetail.BrokenChain, 'reject', 0, 'A sector chain of the compound file runs into a free or reserved sector');
@@ -49,18 +50,20 @@ def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityDepth, 'reject',
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntityExpansions, 'reject', 0, 'The file exceeds the entity expansion limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.XmlEntitySize, 'reject', 0, 'The file exceeds the expanded entity size limit');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.RtfDepth, 'reject', 0, 'The RTF file exceeds the group nesting limit');
+def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.NestingDepth, 'reject', 0, 'The file sits deeper in the upload than the nesting limit allows');
 def(types_1.OfficeCategory.Limit, types_1.OfficeDetail.Time, 'reject', 0, 'The file exceeds the time limit');
 // PACKAGE
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unrecognized, 'reject', 0, 'The file is not a recognized Office or OpenDocument file');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.AmbiguousFormat, 'reject', 0, 'The file can be read as more than one format');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.Unreadable, 'reject', 0, 'The file could not be read');
+def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreadableBody, 'strip', 10, "An Outlook message's RTF body does not decompress<: {stream}|>");
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.DuplicateEntry, 'reject', 0, 'The package names one thing twice, and readers may pick either');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UntypedPart, 'strip', 10, 'A part has no content type<: {part}|>');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreferencedPart, 'strip', 0, 'A part nothing in the package refers to<: {part}|>');
 def(types_1.OfficeCategory.Package, types_1.OfficeDetail.OdfLayout, 'strip', 10, 'The OpenDocument package layout is irregular<: {reason}|>');
 // ENCRYPTED
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, 'reject', 0, 'The document is encrypted with a password');
-def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.DefaultPassword, 'strip', 10, 'The file is encrypted with VelvetSweatshop, the password Excel opens it with without asking');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.DefaultPassword, 'strip', 10, 'The file is encrypted with <{password}|VelvetSweatshop>, the password <{application}|Excel> opens it with without asking');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UserPassword, 'strip', 0, 'The file was decrypted with the supplied password');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_40, 'info', 0, 'Encryption is RC4 with a 40-bit key');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4_128, 'info', 0, 'Encryption is RC4 with a 128-bit key');
@@ -68,6 +71,7 @@ def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Rc4Other, 'info', 0,
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes128, 'info', 0, 'Encryption is AES with a 128-bit key');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes192, 'info', 0, 'Encryption is AES with a 192-bit key');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.Aes256, 'info', 0, 'Encryption is AES with a 256-bit key');
+def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.XorObfuscation, 'info', 0, 'Encryption is XOR obfuscation');
 def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UnsupportedAlgorithm, 'reject', 0, 'The file is encrypted with an algorithm office-defuse does not decrypt<: {algorithm}|>');
 // MACRO
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, 'strip', 70, 'The document holds VBA macros');
@@ -85,6 +89,7 @@ def(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, 'strip', 30, 'The
 def(types_1.OfficeCategory.Ui, types_1.OfficeDetail.OdfConfiguration, 'strip', 10, 'The document carries its own menu, toolbar or key settings, which can call macros');
 // ACTION
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, 'strip', 80, 'A click or hover runs a program or opens a file');
+def(types_1.OfficeCategory.Action, types_1.OfficeDetail.SubmitForm, 'strip', 40, 'A form sends its data to a URL<: {target}|>');
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, 'strip', 40, 'A click or hover activates an embedded object');
 def(types_1.OfficeCategory.Action, types_1.OfficeDetail.ObjectUpdate, 'strip', 50, 'An embedded object updates itself as the document opens, which starts the program it belongs to');
 // DDE
@@ -103,6 +108,7 @@ def(types_1.OfficeCategory.External, types_1.OfficeDetail.Include, 'strip', 40,
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Workbook, 'strip', 30, 'Formulas read another workbook at <{target}|another location>');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Reload, 'strip', 40, 'The document loads <{target}|another address> on its own after a delay');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.Other, 'strip', 30, 'The document refers to <{target}|something outside the file>');
+def(types_1.OfficeCategory.External, types_1.OfficeDetail.DataConnection, 'strip', 40, 'A data connection loads from outside the file<: {target}|>');
 def(types_1.OfficeCategory.External, types_1.OfficeDetail.LocalFile, 'strip', 5, 'The document refers to a local file<: {target}|>');
 // LINK
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.Safe, 'info', 0, 'Web or email link');
@@ -116,6 +122,9 @@ def(types_1.OfficeCategory.Link, types_1.OfficeDetail.IpHost, 'strip', 40, 'A li
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.LookalikeHost, 'strip', 40, "A link's host uses punycode or mixed scripts");
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.EncodedHost, 'strip', 40, "A link's host is percent-encoded");
 def(types_1.OfficeCategory.Link, types_1.OfficeDetail.Relative, 'strip', 30, "A relative link, which resolves against the file's own location");
+def(types_1.OfficeCategory.Link, types_1.OfficeDetail.TextMismatch, 'strip', 40, "A link's text or tooltip names a different site than it opens");
+def(types_1.OfficeCategory.External, types_1.OfficeDetail.Formula, 'strip', 40, 'A formula fetches from outside the file when it is calculated<: {function}|>');
+def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Formula, 'strip', 60, 'A formula runs code outside the file when it is calculated<: {function}|>');
 // EMBEDDED
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, 'strip', 40, 'An embedded OLE object<, which holds the file {fileName}|>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, 'strip', 30, 'An embedded document<: {contentType}|>');
@@ -124,8 +133,14 @@ def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, 'strip', 60, '
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, 'strip', 50, 'An embedded browser plug-in object');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, 'strip', 70, 'An Equation Editor 3.0 object, which CVE-2017-11882 and CVE-2018-0802 exploit');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, 'strip', 30, '<An attached file "{name}"|An attached file> (<{type}|unknown type>)');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginPassed, 'info', 20, 'An embedded file was kept by <plugin {plugin}|a plugin> with nothing removed');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginScrubbed, 'info', 10, 'An embedded file was cleaned and kept by <plugin {plugin}|a plugin>');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginFailed, 'strip', 0, '<Plugin {plugin}|A plugin> failed, so the embedded file was removed');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginRemoved, 'strip', 0, 'An embedded file was removed by <plugin {plugin}|a plugin>');
 // CONTROL
 def(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, 'strip', 50, 'An ActiveX control');
+// PROCESSING
+def(types_1.OfficeCategory.Processing, types_1.OfficeDetail.VerificationFailed, 'reject', 0, 'The defused output did not pass its own inspection, so nothing was written');
 /** The built-in spec for a kind of finding, or undefined for a kind office-defuse does not make, such as one from another package. */
 function findingSpec(category, detail) {
     return specs.get(`${category}/${detail}`);
@@ -151,6 +166,7 @@ class FindingFactory {
     constructor(overrides = []) {
         this.overrides = overrides;
     }
+    /** The action of a kind of finding, after the caller's overrides. */
     actionFor(category, detail) {
         const exact = this.overrides.find(o => o.category === category && o.detail === detail);
         if (exact)

package/dist/flat.d.ts

@@ -0,0 +1,33 @@
+import { type Output, type RunContext, type RunState } from './context';
+import type { Format } from './formats';
+import type { PackagePlan } from './plan';
+import { type ByteSink, type ByteSource } from './types';
+import { type XmlLimits } from './xml';
+import { type ZipLimits } from './zip';
+/** The namespace of a Flat OPC package, the single-file form of OOXML that Word, Excel and PowerPoint save as XML. */
+export declare const PKG_NS = "http://schemas.microsoft.com/office/2006/xmlPackage";
+/** The name findings give the one part of a flat OpenDocument file. */
+export declare const FLAT_ODF_PART = "office:document";
+/** Flat OPC has no media type of its own, and Office saves it with the .xml extension. */
+export declare const FLAT_OPC_FORMAT: Format;
+/** Whether the first bytes of a file read as XML: a byte order mark, white space and then "<". */
+export declare function startsAsXml(head: Uint8Array): boolean;
+/**
+ * Whether the start of an XML file names a flat OpenDocument document or a Flat OPC package as its root element. The
+ * reading of the whole file decides; this tells a router which package to try.
+ */
+export declare function isFlatHead(text: string): boolean;
+/**
+ * Inspects a flat XML file: flat OpenDocument, read with the OpenDocument rules over its one part, or Flat OPC,
+ * which is unpacked into a package of its parts and read with the OOXML rules. Returns what the rewrite needs.
+ */
+export declare function inspectFlat(ctx: RunContext, src: ByteSource, size: number, zipLimits: ZipLimits): Promise<Output | undefined>;
+/** Writes a flat OpenDocument file without what the plan removes. */
+export declare function writeFlatOdf(run: RunState, src: ByteSource, plan: PackagePlan, limits: XmlLimits, sink: ByteSink): Promise<void>;
+/**
+ * Writes a Flat OPC package without what the plan removes: the package is rewritten as any OOXML package is, and its
+ * parts are written back into one XML file, each with its name, content type and attributes.
+ */
+export declare function writeFlatOpc(run: RunState, output: Extract<Output, {
+    kind: 'flatopc';
+}>, limits: XmlLimits, zipLimits: ZipLimits, sink: ByteSink): Promise<void>;