@patrickdk77/office-defuse 0.1.1 → 0.2.1

package/dist/types.d.ts

@@ -13,7 +13,8 @@ export declare enum OfficeCategory {
     External = "EXTERNAL",
     Link = "LINK",
     Embedded = "EMBEDDED",
-    Control = "CONTROL"
+    Control = "CONTROL",
+    Processing = "PROCESSING"
 }
 /** Exact variant of a finding. Some details appear under more than one category. */
 export declare enum OfficeDetail {
@@ -34,6 +35,7 @@ export declare enum OfficeDetail {
     DataError = "DATA_ERROR",
     LeadingBytes = "LEADING_BYTES",
     HiddenData = "HIDDEN_DATA",
+    HiddenEntry = "HIDDEN_ENTRY",
     TrailingBytes = "TRAILING_BYTES",
     BadHeader = "BAD_HEADER",
     BrokenChain = "BROKEN_CHAIN",
@@ -55,10 +57,12 @@ export declare enum OfficeDetail {
     XmlEntityExpansions = "XML_ENTITY_EXPANSIONS",
     XmlEntitySize = "XML_ENTITY_SIZE",
     RtfDepth = "RTF_DEPTH",
+    NestingDepth = "NESTING_DEPTH",
     Time = "TIME",
     Unrecognized = "UNRECOGNIZED",
     AmbiguousFormat = "AMBIGUOUS_FORMAT",
     Unreadable = "UNREADABLE",
+    UnreadableBody = "UNREADABLE_BODY",
     DuplicateEntry = "DUPLICATE_ENTRY",
     UntypedPart = "UNTYPED_PART",
     UnreferencedPart = "UNREFERENCED_PART",
@@ -73,6 +77,7 @@ export declare enum OfficeDetail {
     Aes192 = "AES_192",
     Aes256 = "AES_256",
     UnsupportedAlgorithm = "UNSUPPORTED_ALGORITHM",
+    XorObfuscation = "XOR_OBFUSCATION",
     VbaProject = "VBA_PROJECT",
     XlmMacrosheet = "XLM_MACROSHEET",
     WordBasic = "WORDBASIC",
@@ -86,6 +91,7 @@ export declare enum OfficeDetail {
     Callback = "CALLBACK",
     OdfConfiguration = "ODF_CONFIGURATION",
     RunProgram = "RUN_PROGRAM",
+    SubmitForm = "SUBMIT_FORM",
     OleVerb = "OLE_VERB",
     ObjectUpdate = "OBJECT_UPDATE",
     Field = "FIELD",
@@ -100,6 +106,7 @@ export declare enum OfficeDetail {
     Workbook = "WORKBOOK",
     Reload = "RELOAD",
     Other = "OTHER",
+    DataConnection = "DATA_CONNECTION",
     LocalFile = "LOCAL_FILE",
     Safe = "SAFE",
     FileUrl = "FILE_URL",
@@ -112,6 +119,7 @@ export declare enum OfficeDetail {
     LookalikeHost = "LOOKALIKE_HOST",
     EncodedHost = "ENCODED_HOST",
     Relative = "RELATIVE",
+    TextMismatch = "TEXT_MISMATCH",
     OleObject = "OLE_OBJECT",
     Package = "PACKAGE",
     OleFile = "OLE_FILE",
@@ -119,7 +127,12 @@ export declare enum OfficeDetail {
     Plugin = "PLUGIN",
     Equation = "EQUATION",
     Attachment = "ATTACHMENT",
-    ActiveX = "ACTIVEX"
+    PluginPassed = "PLUGIN_PASSED",
+    PluginScrubbed = "PLUGIN_SCRUBBED",
+    PluginFailed = "PLUGIN_FAILED",
+    PluginRemoved = "PLUGIN_REMOVED",
+    ActiveX = "ACTIVEX",
+    VerificationFailed = "VERIFICATION_FAILED"
 }
 export type OfficeFindingAction = 'reject' | 'strip' | 'info';
 /**
@@ -170,6 +183,15 @@ export interface OfficeInspection {
     /** The MIME type of a file in that format. '' when not recognized. */
     mimeType: string;
 }
+export interface OfficeDisarmResult {
+    status: 'clean' | 'defused' | 'rejected';
+    /** The uploaded file and its score. */
+    before: OfficeInspection;
+    /** The output and its remaining score. Absent when rejected. */
+    after?: OfficeInspection;
+    /** Findings whose content was removed. */
+    removed: DefuseFinding[];
+}
 /** Random-access input. A buffer, a local file and an S3 ranged GetObject all fit. */
 export interface ByteSource {
     size(): Promise<number>;
@@ -204,9 +226,37 @@ export interface OfficeLimits {
     xmlEntitySize?: number;
     /** Group nesting in an RTF file, and destinations open at once. Default 256. */
     rtfDepth?: number;
+    /**
+     * The deepest a file may sit in the upload. The upload is at depth 0 and a file inside it at 1, and files of every
+     * format in between count. Not enforced unless set.
+     */
+    nestingDepth?: number;
     /** Milliseconds for the whole run. Not enforced unless set. */
     timeMs?: number;
 }
+export interface FormatDetection {
+    /** The format's MIME type, such as application/vnd.openxmlformats-officedocument.wordprocessingml.document. */
+    mimeType: string;
+    /** The format's usual extension, lowercase and without the dot. */
+    extension: string;
+    /** Where the format starts in the file: 0, or the offset of its data when other data comes first. */
+    offset: number;
+    /** Set when the match rests on more than the content, and says what it rests on. */
+    heuristic?: string;
+}
+/** What a detect function may know of a file besides its content. */
+export interface DetectOptions {
+    /** The file's name, as the upload or the container that holds it gives it. */
+    name?: string;
+    /** The MIME type the upload or the container declares. */
+    declaredType?: string;
+    /** The Date.now() value detection must finish by, as `PluginContext.deadline`. */
+    deadline?: number;
+    /** Folder for temporary files. Defaults to `os.tmpdir()`. */
+    tempDir?: string;
+    /** Bytes held in memory before a temporary file takes over. */
+    memoryThreshold?: number;
+}
 /** What a contained file plugin learns of the run, with nothing format-specific, so any package of the family can make one. */
 export interface PluginContext {
     /** The depth of the file itself: 0 for the upload, 1 for a file inside it, and so on, whatever the formats. */
@@ -262,13 +312,23 @@ export interface OfficeScoreBands {
 }
 export interface OfficeOptions {
     /**
-     * Tried first on an encrypted file: an encrypted OOXML package, or an .xls workbook. If it does not open the file,
-     * the password Excel opens it with by default, VelvetSweatshop, is tried. Pass it in code, never on a command line,
-     * where other users can read it.
+     * One password or a list, tried in order on an encrypted file: an encrypted OOXML package, or an .xls workbook.
+     * VelvetSweatshop, the password Excel opens a workbook with by default, comes after them. Pass passwords in code,
+     * never on a command line, where other users can read them.
      */
-    password?: string;
+    password?: string | string[];
     limits?: OfficeLimits;
     actionOverrides?: OfficeActionOverride[];
     scoreWeights?: OfficeScoreWeight[];
     scoreBands?: OfficeScoreBands;
+    /** Plugins that decide about the files inside the file: embedded objects and packages, OLE parts and attachments. */
+    filePlugins?: ContainedFilePlugin[];
+    /** Directory for temporary files. Defaults to os.tmpdir(). */
+    tempDir?: string;
+    /**
+     * Default 8 MiB. disarmOfficeSource keeps its copy of the upload and its output in memory up to this size and in a
+     * temporary file above it. Each file inside that goes to a plugin does the same, and the copies plugins return,
+     * which wait for the output to be written, share this much memory.
+     */
+    memoryThreshold?: number;
 }

package/dist/types.js

@@ -18,6 +18,7 @@ var OfficeCategory;
     OfficeCategory["Link"] = "LINK";
     OfficeCategory["Embedded"] = "EMBEDDED";
     OfficeCategory["Control"] = "CONTROL";
+    OfficeCategory["Processing"] = "PROCESSING";
 })(OfficeCategory || (exports.OfficeCategory = OfficeCategory = {}));
 /** Exact variant of a finding. Some details appear under more than one category. */
 var OfficeDetail;
@@ -40,6 +41,7 @@ var OfficeDetail;
     OfficeDetail["DataError"] = "DATA_ERROR";
     OfficeDetail["LeadingBytes"] = "LEADING_BYTES";
     OfficeDetail["HiddenData"] = "HIDDEN_DATA";
+    OfficeDetail["HiddenEntry"] = "HIDDEN_ENTRY";
     OfficeDetail["TrailingBytes"] = "TRAILING_BYTES";
     OfficeDetail["BadHeader"] = "BAD_HEADER";
     OfficeDetail["BrokenChain"] = "BROKEN_CHAIN";
@@ -63,11 +65,13 @@ var OfficeDetail;
     OfficeDetail["XmlEntityExpansions"] = "XML_ENTITY_EXPANSIONS";
     OfficeDetail["XmlEntitySize"] = "XML_ENTITY_SIZE";
     OfficeDetail["RtfDepth"] = "RTF_DEPTH";
+    OfficeDetail["NestingDepth"] = "NESTING_DEPTH";
     OfficeDetail["Time"] = "TIME";
     // PACKAGE
     OfficeDetail["Unrecognized"] = "UNRECOGNIZED";
     OfficeDetail["AmbiguousFormat"] = "AMBIGUOUS_FORMAT";
     OfficeDetail["Unreadable"] = "UNREADABLE";
+    OfficeDetail["UnreadableBody"] = "UNREADABLE_BODY";
     OfficeDetail["DuplicateEntry"] = "DUPLICATE_ENTRY";
     OfficeDetail["UntypedPart"] = "UNTYPED_PART";
     OfficeDetail["UnreferencedPart"] = "UNREFERENCED_PART";
@@ -83,6 +87,7 @@ var OfficeDetail;
     OfficeDetail["Aes192"] = "AES_192";
     OfficeDetail["Aes256"] = "AES_256";
     OfficeDetail["UnsupportedAlgorithm"] = "UNSUPPORTED_ALGORITHM";
+    OfficeDetail["XorObfuscation"] = "XOR_OBFUSCATION";
     // MACRO
     OfficeDetail["VbaProject"] = "VBA_PROJECT";
     OfficeDetail["XlmMacrosheet"] = "XLM_MACROSHEET";
@@ -99,6 +104,7 @@ var OfficeDetail;
     OfficeDetail["OdfConfiguration"] = "ODF_CONFIGURATION";
     // ACTION
     OfficeDetail["RunProgram"] = "RUN_PROGRAM";
+    OfficeDetail["SubmitForm"] = "SUBMIT_FORM";
     OfficeDetail["OleVerb"] = "OLE_VERB";
     OfficeDetail["ObjectUpdate"] = "OBJECT_UPDATE";
     // DDE
@@ -116,6 +122,7 @@ var OfficeDetail;
     OfficeDetail["Workbook"] = "WORKBOOK";
     OfficeDetail["Reload"] = "RELOAD";
     OfficeDetail["Other"] = "OTHER";
+    OfficeDetail["DataConnection"] = "DATA_CONNECTION";
     OfficeDetail["LocalFile"] = "LOCAL_FILE";
     // LINK
     OfficeDetail["Safe"] = "SAFE";
@@ -129,6 +136,7 @@ var OfficeDetail;
     OfficeDetail["LookalikeHost"] = "LOOKALIKE_HOST";
     OfficeDetail["EncodedHost"] = "ENCODED_HOST";
     OfficeDetail["Relative"] = "RELATIVE";
+    OfficeDetail["TextMismatch"] = "TEXT_MISMATCH";
     // EMBEDDED
     OfficeDetail["OleObject"] = "OLE_OBJECT";
     OfficeDetail["Package"] = "PACKAGE";
@@ -137,8 +145,14 @@ var OfficeDetail;
     OfficeDetail["Plugin"] = "PLUGIN";
     OfficeDetail["Equation"] = "EQUATION";
     OfficeDetail["Attachment"] = "ATTACHMENT";
+    OfficeDetail["PluginPassed"] = "PLUGIN_PASSED";
+    OfficeDetail["PluginScrubbed"] = "PLUGIN_SCRUBBED";
+    OfficeDetail["PluginFailed"] = "PLUGIN_FAILED";
+    OfficeDetail["PluginRemoved"] = "PLUGIN_REMOVED";
     // CONTROL
     OfficeDetail["ActiveX"] = "ACTIVEX";
+    // PROCESSING
+    OfficeDetail["VerificationFailed"] = "VERIFICATION_FAILED";
 })(OfficeDetail || (exports.OfficeDetail = OfficeDetail = {}));
 var OfficeRisk;
 (function (OfficeRisk) {

package/dist/vsd.d.ts

@@ -0,0 +1,13 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+import { type RunContext } from './context';
+/**
+ * Reads the ShapeSheet cells of a Visio 2000 to 2010 drawing for formulas that call RUNADDON, RUNADDONWARGS,
+ * CALLTHIS, RUNMACRO, OPENFILE or DOOLEVERB. Other versions of the stream go unread. A stream whose structure does
+ * not read stops the run as PACKAGE/UNREADABLE.
+ */
+export declare function visioRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;
+/**
+ * The LZ77 compression of Visio streams (VSDInternalStream.cpp): a flag byte for each eight items, a set bit for a
+ * literal byte and a clear one for a 2-byte back reference into a 4,096-byte window. Output past `limit` stops the run.
+ */
+export declare function inflate(src: Uint8Array, limit: number): Uint8Array;