@patrickdk77/office-defuse 0.1.1 → 0.2.1

package/dist/zip.js

@@ -56,6 +56,22 @@ const END_SEARCH = 22 + MAX16;
 const FLAG_MASK = 0x0001 | 0x0008 | 0x0040 | 0x0800 | 0x2000;
 const ENCRYPTION_FLAGS = 0x0001 | 0x0040 | 0x2000;
 const MAX_NAME_BYTES = 1024;
+const LOCAL_SIGNATURE = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
+/** The offset of the first local file header signature in [start, end) of the file, or undefined. */
+async function findLocalHeader(reader, start, end, deadline) {
+    let carry = Buffer.alloc(0);
+    let at = start;
+    for await (const c of reader.chunks(start, end - start)) {
+        (0, errors_1.checkTime)(deadline);
+        const b = Buffer.concat([carry, Buffer.from(c.buffer, c.byteOffset, c.byteLength)]);
+        const i = b.indexOf(LOCAL_SIGNATURE);
+        if (i >= 0)
+            return at - carry.length + i;
+        carry = b.subarray(Math.max(0, b.length - 3));
+        at += c.length;
+    }
+    return undefined;
+}
 const fail = (detail, message, data) => {
     throw new errors_1.StopError(types_1.OfficeCategory.Container, detail, message, data);
 };
@@ -137,6 +153,20 @@ function checkUnicodePath(extras, name) {
     if (other !== name)
         fail(types_1.OfficeDetail.NameEncoding, 'The Unicode path field names a different entry', { name });
 }
+/** True for a segment of nothing but dots and spaces, the empty one included. */
+function onlyDotsAndSpaces(seg) {
+    for (const c of seg)
+        if (c !== '.' && c !== ' ')
+            return false;
+    return true;
+}
+/** A segment without the dots and spaces Windows drops from its end. A loop, since /[. ]+$/ backtracks. */
+function trimSegment(seg) {
+    let end = seg.length;
+    while (end > 0 && (seg[end - 1] === '.' || seg[end - 1] === ' '))
+        end--;
+    return seg.slice(0, end);
+}
 function checkName(name, directory) {
     const why = (reason) => fail(types_1.OfficeDetail.UnsafeName, `Entry name ${reason}`, { name, reason });
     if (name === '')
@@ -150,11 +180,17 @@ function checkName(name, directory) {
     if (/^[A-Za-z]:/.test(name))
         why('starts with a drive letter');
     for (const seg of (directory ? name.slice(0, -1) : name).split('/')) {
-        if (seg === '' || seg === '.' || seg === '..')
-            why('has an empty, "." or ".." segment');
+        // Windows drops trailing dots and spaces from each segment, so ".. " and "..." climb out as ".." does.
+        if (onlyDotsAndSpaces(seg))
+            why('has an empty segment, or one of only dots and spaces');
     }
 }
-/** The key two names collide on: percent-decoded, NFC and lowercase, without a directory's slash. */
+/**
+ * The key two names collide on: percent-decoded, NFKC and case-folded, without a directory's slash, and without the
+ * dots and spaces Windows drops from the end of each segment. Upper then lower case is the full folding, which takes a
+ * sharp s to ss as macOS's case-insensitive file system does. NFKC also joins compatibility forms such as ligatures
+ * and full-width letters.
+ */
 function nameKey(name) {
     let n = name;
     try {
@@ -163,7 +199,7 @@ function nameKey(name) {
     catch {
         // Not valid percent-encoding, so it stays as written.
     }
-    return n.normalize('NFC').toLowerCase().replace(/\/$/, '');
+    return n.normalize('NFKC').toUpperCase().toLowerCase().replace(/\/$/, '').split('/').map(trimSegment).join('/');
 }
 /** ZIP64 values the central directory defers to its extra field, in the order the format fixes. */
 function zip64Central(extras, fields, name) {
@@ -205,12 +241,16 @@ class ZipArchive {
     entries;
     notes;
     deadline;
+    start;
     byKey = new Map();
-    constructor(reader, entries, notes, deadline) {
+    constructor(reader, entries, notes, deadline, 
+    /** Where the archive's data starts: the first local header, or the central directory of an archive without entries. */
+    start) {
         this.reader = reader;
         this.entries = entries;
         this.notes = notes;
         this.deadline = deadline;
+        this.start = start;
         for (const e of entries)
             this.byKey.set(nameKey(e.name), e);
     }
@@ -371,26 +411,47 @@ class ZipArchive {
                 (0, errors_1.checkTime)(deadline);
             await ZipArchive.checkLocal(reader, e, raws[i], dirOffset);
         }
+        // A reader that walks the file cannot know where a stored entry with a data descriptor ends. It looks for the
+        // next signature, so a local header inside the data is an entry to it, and part of this entry here.
+        for (const e of entries) {
+            if (e.method !== 0 || !(e.flags & 0x0008) || e.compressedSize === 0)
+                continue;
+            const at = await findLocalHeader(reader, e.dataOffset, e.dataOffset + e.compressedSize, deadline);
+            if (at !== undefined)
+                notes.push({ detail: types_1.OfficeDetail.HiddenEntry, bytes: e.dataOffset + e.compressedSize - at, offset: at });
+        }
         // Entries and the central directory must tile the file. Bytes no entry covers are reported, overlaps refused.
         const sorted = [...entries].sort((a, b) => a.localOffset - b.localOffset);
+        const gaps = [];
         let covered = 0;
         let hidden = 0;
         for (const e of sorted) {
             if (e.localOffset < covered)
                 fail(types_1.OfficeDetail.Overlap, 'Two entries share bytes', { name: e.name });
+            if (e.localOffset > covered)
+                gaps.push([covered, e.localOffset]);
             if (covered === 0 && e.localOffset > 0)
                 notes.push({ detail: types_1.OfficeDetail.LeadingBytes, bytes: e.localOffset });
             else
                 hidden += e.localOffset - covered;
             covered = e.end;
         }
+        if (dirOffset > covered)
+            gaps.push([covered, dirOffset]);
         if (sorted.length === 0 && dirOffset > 0)
             notes.push({ detail: types_1.OfficeDetail.LeadingBytes, bytes: dirOffset });
         else
             hidden += dirOffset - covered;
         if (hidden > 0)
             notes.push({ detail: types_1.OfficeDetail.HiddenData, bytes: hidden });
-        return new ZipArchive(reader, entries, notes, deadline);
+        // A local header in a gap is an entry the central directory does not list. A reader that walks the file from the
+        // start, as streaming unzippers do, extracts it; a reader of the central directory never sees it.
+        for (const [from, to] of gaps) {
+            const at = await findLocalHeader(reader, from, to, deadline);
+            if (at !== undefined)
+                notes.push({ detail: types_1.OfficeDetail.HiddenEntry, bytes: to - from, offset: at });
+        }
+        return new ZipArchive(reader, entries, notes, deadline, sorted.length ? sorted[0].localOffset : dirOffset);
     }
     /** Checks a local header and any data descriptor against the central directory, and fills in where the entry's data and the entry end. */
     static async checkLocal(reader, e, rawName, dirOffset) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",
@@ -16,6 +16,9 @@
     },
     "./package.json": "./package.json"
   },
+  "bin": {
+    "office-defuse": "dist/cli.js"
+  },
   "files": [
     "dist",
     "README.md",