@patrickdk77/office-defuse 0.1.1 → 0.2.1

package/dist/links.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAbsoluteTarget = exports.isInsidePackage = exports.isLocalTarget = exports.isFragment = void 0;
+exports.LabelSites = exports.isAbsoluteTarget = exports.isInsidePackage = exports.isLocalTarget = exports.isFragment = void 0;
 exports.checkLink = checkLink;
+exports.labelSite = labelSite;
+exports.mismatchedLabel = mismatchedLabel;
 const types_1 = require("./types");
 const xml_1 = require("./xml");
 const IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/;
@@ -143,3 +145,106 @@ exports.isInsidePackage = isInsidePackage;
 /** Whether an OOXML relationship target is not a part name, whatever TargetMode says: a scheme, a drive or a network path. */
 const isAbsoluteTarget = (rawTarget) => [rawTarget, decoded(rawTarget)].some(t => SCHEME.test(clean(t)) || t.startsWith('\\') || t.startsWith('//'));
 exports.isAbsoluteTarget = isAbsoluteTarget;
+/** A host as LabelSites compares it. */
+const siteName = (h) => h
+    .toLowerCase()
+    .replace(/^www\./, '')
+    .replace(/\.$/, '');
+/**
+ * The hosts a label names, as a lookup: has() answers whether a host is one of them or a subdomain of one, or one of
+ * them is a subdomain of the host. No public-suffix list is needed: evil.co.uk is not under mybank.co.uk. The same
+ * comparison as pdf-defuse's.
+ */
+class LabelSites {
+    hosts = new Set();
+    /** Every domain some label host is a subdomain of. */
+    parents = new Set();
+    constructor(names) {
+        for (const n of names) {
+            const x = siteName(n);
+            this.hosts.add(x);
+            for (let i = x.indexOf('.'); i >= 0; i = x.indexOf('.', i + 1))
+                this.parents.add(x.slice(i + 1));
+        }
+    }
+    get size() {
+        return this.hosts.size;
+    }
+    has(host) {
+        const y = siteName(host);
+        if (this.hosts.has(y) || this.parents.has(y))
+            return true;
+        for (let i = y.indexOf('.'); i >= 0; i = y.indexOf('.', i + 1))
+            if (this.hosts.has(y.slice(i + 1)))
+                return true;
+        return false;
+    }
+}
+exports.LabelSites = LabelSites;
+/**
+ * Top-level domains a bare host in a label may end in: the common generic ones and the country codes. A name that
+ * ends in anything else, such as an Excel function (BETA.DIST) or a file (moon.htm), is not read as an address.
+ */
+const TLDS = new Set(('com net org edu gov mil int info biz name pro mobi asia tel travel jobs museum aero coop app dev io ai co me tv cc ly ' +
+    'xyz online site top shop club store tech live page blog cloud email link news ' +
+    'ac ad ae af ag ai al am ao aq ar as at au aw ax az ba bb bd be bf bg bh bi bj bm bn bo br bs bt bw by bz ca cd cf cg ' +
+    'ch ci ck cl cm cn cr cu cv cw cx cy cz de dj dk dm do dz ec ee eg er es et eu fi fj fk fm fo fr ga gd ge gf gg gh gi ' +
+    'gl gm gn gp gq gr gs gt gu gw gy hk hm hn hr ht hu id ie il im in iq ir is it je jm jo jp ke kg kh ki km kn kp kr kw ' +
+    'ky kz la lb lc li lk lr ls lt lu lv ma mc md mg mh mk ml mm mn mo mp mq mr ms mt mu mv mw mx my mz na nc ne nf ng ni ' +
+    'nl no np nr nu nz om pa pe pf pg ph pk pl pm pn pr ps pt pw py qa re ro rs ru rw sa sb sc sd se sg sh si sk sl sm sn ' +
+    'so sr ss st su sv sx sy sz tc td tf tg th tj tk tl tm tn to tr tt tw tz ua ug uk us uy uz va vc ve vg vi vn vu wf ws ' +
+    'ye yt za zm zw').split(' '));
+/** The most of a label that is read. */
+const MAX_LABEL = 4096;
+/**
+ * The site a label names when the label is itself an address: a web URL, a mail address, or a host with or without a
+ * path that starts with www. or ends in a known top-level domain. Text that only mentions an address, an Excel
+ * function name and a file name name no site. Excel's function names are all capitals, as typed hosts never are, so
+ * a bare host in capitals counts only after WWW.
+ */
+function labelSite(raw) {
+    const t = raw
+        .slice(0, MAX_LABEL)
+        .replace(/\p{Cc}/gu, '')
+        .trim();
+    if (/^https?:\/\//i.test(t)) {
+        try {
+            return new URL(t).hostname.toLowerCase() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    const mail = /^(?:mailto:)?[^\s@/]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)$/i.exec(t);
+    const host = mail?.[1] ?? /^([a-z0-9-]+(?:\.[a-z0-9-]+)+)(?::\d+)?(?:[/?#]\S*)?$/i.exec(t)?.[1];
+    if (!host)
+        return undefined;
+    const h = host.toLowerCase();
+    if (h.startsWith('www.'))
+        return h;
+    if (!mail && host === host.toUpperCase() && /[A-Z]/.test(host))
+        return undefined;
+    return TLDS.has(h.slice(h.lastIndexOf('.') + 1)) ? h : undefined;
+}
+/**
+ * The first label of a safe link that is an address, and an address of another site than the one the link opens, or
+ * undefined. A label is text the reader sees for the link: its text, its tooltip, a display name. A subdomain or a
+ * parent of the label's site counts as the same site, as in pdf-defuse. A target that fails on its own gets its own
+ * finding instead.
+ */
+function mismatchedLabel(target, labels) {
+    if (!labels.some(Boolean))
+        return undefined;
+    const v = checkLink(target);
+    if (v.category !== types_1.OfficeCategory.Link || v.detail !== types_1.OfficeDetail.Safe || !v.host)
+        return undefined;
+    for (const label of labels) {
+        const site = label ? labelSite(label) : undefined;
+        // A site without a dot, where the target has one, is a label cut short or a local alias, and names no site.
+        if (!site || (!site.includes('.') && v.host.includes('.')))
+            continue;
+        if (!new LabelSites([site]).has(v.host))
+            return label;
+    }
+    return undefined;
+}

package/dist/msg.d.ts

@@ -1,7 +1,8 @@
 import { type CfbEntry, type CompoundFile } from './cfb';
-import { type RunContext } from './context';
+import { RunContext } from './context';
+import type { CompoundPlan } from './plan';
 /**
  * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
  * reference with what it points to. An embedded message's own attachments are read as well.
  */
-export declare function messageRules(ctx: RunContext, cfb: CompoundFile, message: CfbEntry, depth?: number): Promise<void>;
+export declare function messageRules(ctx: RunContext, cfb: CompoundFile, message: CfbEntry, depth?: number, plan?: CompoundPlan): Promise<void>;

package/dist/msg.js

@@ -2,8 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.messageRules = messageRules;
 const cfb_1 = require("./cfb");
+const contained_1 = require("./contained");
 const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
 const oleobj_1 = require("./oleobj");
+const rewrite_rtf_1 = require("./rewrite-rtf");
+const rtf_1 = require("./rtf");
+const rtfcomp_1 = require("./rtfcomp");
 const types_1 = require("./types");
 /** Property ids of an attachment (MS-OXPROPS). */
 const P = { method: 0x3705, longName: 0x3707, name: 0x3704, display: 0x3001, mime: 0x370e, data: 0x3701, longPath: 0x370d, path: 0x3708 };
@@ -11,18 +17,165 @@ const P = { method: 0x3705, longName: 0x3707, name: 0x3704, display: 0x3001, mim
 const METHODS = { 1: 'by value', 2: 'by reference', 3: 'by reference, resolved', 4: 'by reference only', 5: 'embedded message', 6: 'OLE object', 7: 'by web reference' };
 /** Embedded messages can hold messages in turn. Past this depth they are still reported, and not read further. */
 const MAX_DEPTH = 16;
+/** A message's body properties (MS-OXPROPS): PidTagRtfCompressed, and PidTagHtml as binary, Unicode or 8-bit text. */
+const RTF_BODY = 0x10090102;
+const HTML_BODIES = [0x10130102, 0x1013001f, 0x1013001e];
+/** The stream that holds a variable-size property (MS-OXMSG 2.1.4.1). */
+const streamName = (tag) => `__SUBSTG1.0_${tag.toString(16).toUpperCase().padStart(8, '0')}`;
 /**
  * Inspects an Outlook message (MS-OXMSG): each attachment is reported with its name and type, and an attachment by
  * reference with what it points to. An embedded message's own attachments are read as well.
  */
-async function messageRules(ctx, cfb, message, depth = 0) {
+async function messageRules(ctx, cfb, message, depth = 0, plan) {
+    const edit = { attachmentsDropped: 0, drop: new Set(), sizes: new Map() };
+    await bodyRules(ctx, cfb, message, edit, plan);
     for (const a of message.children) {
         if (a.kind !== 'storage' || !/^__attach_version1\.0_#[0-9A-F]{8}$/i.test(a.name))
             continue;
-        await attachmentRules(ctx, cfb, a, depth);
+        // An attachment a strip finding names goes with its whole storage.
+        if ((await attachmentRules(ctx, cfb, a, depth, plan)).some(r => r.action === 'strip') && plan) {
+            plan.drop.add(a);
+            edit.attachmentsDropped++;
+        }
+    }
+    if (plan && (edit.attachmentsDropped || edit.drop.size || edit.sizes.size))
+        await editProperties(ctx, cfb, message, edit, plan);
+}
+/**
+ * The property stream of a message after the rewrite (MS-OXMSG 2.4). Its header counts the attachments, at the same
+ * place in a message and in an embedded one, and the count drops by the attachments that went. Each property held in
+ * a stream has an entry giving that stream's size: the entry goes with a body that went, and takes the new size of a
+ * body that was rewritten.
+ */
+async function editProperties(ctx, cfb, message, edit, plan) {
+    const s = message.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === '__PROPERTIES_VERSION1.0');
+    if (!s || s.size < 24 || s.size > ctx.settings.decompressedBytes)
+        return;
+    const b = Buffer.from(await cfb.bytes(s));
+    const headerSize = message === cfb.root ? 32 : 24;
+    if (edit.attachmentsDropped)
+        b.writeUInt32LE(Math.max(0, b.readUInt32LE(20) - edit.attachmentsDropped), 20);
+    const kept = [b.subarray(0, headerSize)];
+    for (let at = headerSize; at + 16 <= b.length; at += 16) {
+        const entry = Buffer.from(b.subarray(at, at + 16));
+        const tag = entry.readUInt32LE(0);
+        if (edit.drop.has(tag))
+            continue;
+        const size = edit.sizes.get(tag);
+        if (size !== undefined)
+            entry.writeUInt32LE(size, 8);
+        kept.push(entry);
+    }
+    plan.replace.set(s, await (0, contained_1.spillOf)(ctx.run, Buffer.concat(kept)));
+}
+/** A stream of the message storage by property tag. */
+const bodyStream = (message, tag) => message.children.find(c => c.kind === 'stream' && c.name.toUpperCase() === streamName(tag));
+/** Every byte a sink holds. */
+async function bytesOf(sink) {
+    const chunks = [];
+    for await (const c of sink.read())
+        chunks.push(Buffer.from(c));
+    return Buffer.concat(chunks);
+}
+async function* once(b) {
+    yield b;
+}
+/**
+ * A message's bodies. The RTF body goes to the plugins as the RTF it decompresses to, and a plugin's copy is stored
+ * back uncompressed. When no plugin takes it, the RTF rules read it: a strip finding inside rewrites it, and a finding
+ * that rejects it, or a body that does not decompress, makes it go, leaving the plain text body. The HTML body goes
+ * to the plugins, and when none takes it, it stays, as no rule names it.
+ */
+async function bodyRules(ctx, cfb, message, edit, plan) {
+    const replace = async (stream, tag, bytes) => {
+        plan?.replace.set(stream, await (0, contained_1.spillOf)(ctx.run, bytes));
+        edit.sizes.set(tag, bytes.length);
+    };
+    const drop = (stream, tag) => {
+        plan?.drop.add(stream);
+        edit.drop.add(tag);
+    };
+    const rtf = bodyStream(message, RTF_BODY);
+    if (rtf) {
+        const location = (0, cfb_1.entryPath)(rtf);
+        const body = rtf.size <= ctx.settings.decompressedBytes ? (0, rtfcomp_1.decompressRtf)(await cfb.bytes(rtf), ctx.settings.decompressedBytes) : undefined;
+        if (!body) {
+            if (ctx.report(types_1.OfficeCategory.Package, types_1.OfficeDetail.UnreadableBody, location, { stream: location }).action === 'strip')
+                drop(rtf, RTF_BODY);
+        }
+        else {
+            const decision = await (0, contained_1.decideContained)(ctx, { name: 'RTF body', declaredType: 'application/rtf', location, chunks: () => once(body) });
+            if (decision) {
+                if (!decision.keep)
+                    drop(rtf, RTF_BODY);
+                else if (decision.replacement)
+                    await replace(rtf, RTF_BODY, (0, rtfcomp_1.storeRtf)(await bytesOf(decision.replacement)));
+            }
+            else
+                await rtfRules(ctx, body, location, rtf, edit, plan);
+        }
+    }
+    for (const tag of HTML_BODIES) {
+        const html = bodyStream(message, tag);
+        if (!html || html.size > ctx.settings.decompressedBytes)
+            continue;
+        const raw = await cfb.bytes(html);
+        const unicode = (tag & 0xffff) === 0x001f;
+        const text = unicode ? Buffer.from((0, oleobj_1.utf16)(raw).replace(/\0+$/, ''), 'utf8') : raw;
+        const decision = await (0, contained_1.decideContained)(ctx, { name: 'HTML body', declaredType: 'text/html', location: (0, cfb_1.entryPath)(html), chunks: () => once(text) });
+        if (decision && !decision.keep)
+            drop(html, tag);
+        else if (decision?.replacement) {
+            const out = await bytesOf(decision.replacement);
+            await replace(html, tag, unicode ? Buffer.from(`${out.toString('utf8')}\0`, 'utf16le') : out);
+        }
+        break;
     }
 }
-async function attachmentRules(ctx, cfb, a, depth) {
+/**
+ * The RTF rules over a message's RTF body, reporting into this run with the body's place. A strip finding rewrites the
+ * body, and a reject drops it.
+ */
+async function rtfRules(ctx, body, location, stream, edit, plan) {
+    const sub = new context_1.RunContext(ctx.factory, ctx.xmlLimits, ctx.settings, ctx.run);
+    // The RTF reader leaves its cuts where a whole file's rewrite finds them, which is the message's own.
+    const saved = ctx.run.output;
+    let cuts;
+    try {
+        await (0, rtf_1.inspectRtf)(sub, (0, io_1.bufferSource)(body), body.length);
+        const out = ctx.run.output;
+        if (out?.kind === 'rtf')
+            cuts = out;
+    }
+    catch (e) {
+        if ((0, errors_1.stopsTree)(e) || !(e instanceof errors_1.StopError))
+            throw e;
+        sub.report(e.category, e.detail, undefined, { ...e.data, reason: e.data?.reason ?? e.message });
+        cuts = undefined;
+    }
+    finally {
+        ctx.run.output = saved;
+    }
+    const found = sub.findings;
+    (0, contained_1.pushContained)(ctx, found, location, 'RTF body');
+    if (found.some(f => f.action === 'reject') || !cuts) {
+        if (found.some(f => f.action !== 'info')) {
+            plan?.drop.add(stream);
+            edit.drop.add(RTF_BODY);
+        }
+        return;
+    }
+    if (!found.some(f => f.action === 'strip') || !plan)
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    await (0, rewrite_rtf_1.writeRtf)(ctx.run, (0, io_1.bufferSource)(body), body.length, cuts.cuts, sink);
+    await sink.close();
+    const stored = (0, rtfcomp_1.storeRtf)(await bytesOf(sink));
+    plan.replace.set(stream, await (0, contained_1.spillOf)(ctx.run, stored));
+    edit.sizes.set(RTF_BODY, stored.length);
+}
+async function attachmentRules(ctx, cfb, a, depth, plan) {
     const location = (0, cfb_1.entryPath)(a);
     const props = await properties(cfb, a);
     const text = async (id) => {
@@ -48,37 +201,38 @@ async function attachmentRules(ctx, cfb, a, depth) {
         info.type = (0, context_1.clip)(declaredType);
     if (method >= 2 && method <= 4) {
         const path = (await text(P.longPath)) || (await text(P.path));
-        if (path)
-            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment');
-        return;
+        return path ? [ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment')] : [];
     }
     if (method === 7) {
         const path = (await text(P.longPath)) || (await text(P.path));
-        if (path)
-            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by web reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment');
-        return;
+        return path ? [ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'attachment by web reference', ...(name ? { name: (0, context_1.clip)(name) } : {}) }, 'attachment')] : [];
     }
     if (!data)
-        return;
+        return [];
     if (data.kind === 'stream') {
-        attachment(ctx, { name: name || undefined, declaredType: declaredType || undefined, size: data.size, location, depth: 1, source: cfb.source(data) }, info);
-        return;
+        return [await attachment(ctx, cfb, data, { name: name || undefined, declaredType: declaredType || undefined, location }, info, plan)];
     }
     // An embedded message or an OLE object is a storage of this file. The object rules read an object's storage, and
     // an embedded message's attachments are read here.
     info.size = 0;
     if (method === 5)
         info.type ??= 'application/vnd.ms-outlook';
-    ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, location, info);
+    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, location, info);
     if (method === 5 && depth < MAX_DEPTH)
-        await messageRules(ctx, cfb, data, depth + 1);
+        await messageRules(ctx, cfb, data, depth + 1, plan);
+    return [r];
 }
 /**
- * The place every attached file passes, with what a contained file plugin needs to read it. office-defuse reports it;
- * the family's router, once office-defuse has a plugin for it, is where it would be handed on.
+ * An attached file held in a stream. It goes to the plugins, whose verdict decides whether it stays. When no plugin
+ * takes it, EMBEDDED/ATTACHMENT does.
  */
-function attachment(ctx, file, info) {
-    ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: file.size });
+async function attachment(ctx, cfb, data, file, info, plan) {
+    const source = cfb.source(data);
+    const decision = await (0, contained_1.decideContained)(ctx, { ...file, chunks: () => (0, io_1.chunksOf)(source, data.size) });
+    if (decision?.replacement)
+        plan?.replace.set(data, decision.replacement);
+    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size }, (0, contained_1.presence)(decision));
+    return decision && !decision.keep ? { ...r, action: 'strip' } : r;
 }
 /** The fixed-size values of a property stream (MS-OXMSG 2.4.2), by property id. An attachment's has an 8-byte header. */
 async function properties(cfb, storage) {

package/dist/objects.d.ts

@@ -1,6 +1,8 @@
-import { type CfbEntry, type CompoundFile } from './cfb';
-import { type RunContext } from './context';
+import { type CfbEntry, CompoundFile } from './cfb';
+import { type ContainedDecision } from './contained';
+import { type Reported, type RunContext } from './context';
 import { type PackagedFile } from './oleobj';
+import type { CompoundPlan } from './plan';
 /** Equation Editor 3.0's ProgID, which rtfobj matches as a prefix. */
 export declare const isEquationClass: (name: string) => boolean;
 /** Reports what the reader of a compound file inside this one noted, at the place it sits. */
@@ -8,9 +10,10 @@ export declare function nestedNotes(ctx: RunContext, cfb: CompoundFile, location
 /**
  * The rules every compound file gets: VBA projects, embedded objects and controls, wherever they sit in the tree.
  * `prefix` names where the file sits when it is inside another, and `rootIsObject` says that its root is itself an
- * OLE object's storage, as an object in a presentation or an RTF file is.
+ * OLE object's storage, as an object in a presentation or an RTF file is. `plan`, given for the file the rewrite
+ * writes, collects the storages a strip finding names.
  */
-export declare function compoundRules(ctx: RunContext, cfb: CompoundFile, prefix: string, rootIsObject: boolean): Promise<void>;
+export declare function compoundRules(ctx: RunContext, cfb: CompoundFile, prefix: string, rootIsObject: boolean, plan?: CompoundPlan, rootDecision?: ContainedDecision): Promise<void>;
 /** What an OLE object's storage says about the object. */
 export interface ObjectInfo {
     clsid: string;
@@ -37,6 +40,6 @@ export declare function describeObject(cfb: CompoundFile, e: CfbEntry, _location
 export declare function linkedObject(ctx: RunContext, d: {
     target: string;
     url: boolean;
-}, location: string, data: Record<string, string>): void;
+}, location: string, data: Record<string, string>): Reported;
 /** What a finding shows of a Packager object's file: its name and paths, and its size when the object holds it. */
 export declare function packageData(p: PackagedFile): Record<string, string | number>;

package/dist/objects.js

@@ -7,8 +7,13 @@ exports.describeObject = describeObject;
 exports.linkedObject = linkedObject;
 exports.packageData = packageData;
 const cfb_1 = require("./cfb");
+const cfb_writer_1 = require("./cfb-writer");
+const contained_1 = require("./contained");
 const context_1 = require("./context");
+const errors_1 = require("./errors");
+const io_1 = require("./io");
 const oleobj_1 = require("./oleobj");
+const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
 /** The class ids of Equation Editor 3.0 and its kin, which CVE-2017-11882 and CVE-2018-0802 exploit, as oletools lists them. */
 const EQUATION_CLSIDS = new Set(['0002CE02-0000-0000-C000-000000000046', '00021700-0000-0000-C000-000000000046', '0003000B-0000-0000-C000-000000000046', '0004A6B0-0000-0000-C000-000000000046']);
@@ -34,23 +39,29 @@ const at = (prefix, e) => [prefix, (0, cfb_1.entryPath)(e)].filter(Boolean).join
 /**
  * The rules every compound file gets: VBA projects, embedded objects and controls, wherever they sit in the tree.
  * `prefix` names where the file sits when it is inside another, and `rootIsObject` says that its root is itself an
- * OLE object's storage, as an object in a presentation or an RTF file is.
+ * OLE object's storage, as an object in a presentation or an RTF file is. `plan`, given for the file the rewrite
+ * writes, collects the storages a strip finding names.
  */
-async function compoundRules(ctx, cfb, prefix, rootIsObject) {
+async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision) {
     const projects = new Set();
+    const drop = (r, e) => {
+        if (r.action === 'strip' && e.kind !== 'root')
+            plan?.drop.add(e);
+    };
     for (const e of cfb.entries) {
         if (e.kind === 'stream')
             continue;
         const child = (name) => e.children.find(c => upper(c) === name);
-        // A VBA project: a VBA storage with a dir stream, which names the modules (MS-OVBA 2.2).
+        // A VBA project: a VBA storage with a dir stream, which names the modules (MS-OVBA 2.2). The storage that holds
+        // the project goes, or the VBA storage when that is the root.
         const vba = child('VBA');
         if (vba?.kind === 'storage' && vba.children.some(c => c.kind === 'stream' && upper(c) === 'DIR')) {
             projects.add(e);
-            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), { storage: at(prefix, vba) });
+            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), { storage: at(prefix, vba) }), e.kind === 'root' ? vba : e);
         }
         if (e.kind === 'storage' && (upper(e) === '_VBA_PROJECT_CUR' || upper(e) === 'MACROS') && e.children.length && !projects.has(e)) {
             // Excel's and Word's project storages, without the dir stream a whole project has.
-            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, e), { storage: at(prefix, e) });
+            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, e), { storage: at(prefix, e) }), e);
         }
         const names = new Set(e.children.map(upper));
         const parent = e.parent ? upper(e.parent) : '';
@@ -60,7 +71,8 @@ async function compoundRules(ctx, cfb, prefix, rootIsObject) {
                 (parent === 'OBJECTPOOL' && e.parent?.parent?.kind === 'root') ||
                 (e.parent?.kind === 'root' && /^MBD[0-9A-F]{8}$/i.test(e.name));
         if (isObject)
-            await objectRules(ctx, cfb, e, at(prefix, e));
+            for (const r of await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined))
+                drop(r, e);
     }
 }
 /** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
@@ -92,8 +104,63 @@ async function describeObject(cfb, e, _location) {
     }
     return info;
 }
-/** One OLE object's storage: a control, a linked object, or an embedded one, with what it holds. */
-async function objectRules(ctx, cfb, e, location) {
+/**
+ * Shows an embedded object of the compound file the rewrite writes to the plugins: the file a Packager object holds,
+ * or the object's storage written out as a compound file of its own. Bytes a plugin wrote take the file's place in
+ * the Ole10Native stream, or the storage's place as the storages and streams of the compound file they hold.
+ */
+async function objectFile(ctx, cfb, e, d, location, plan) {
+    const run = ctx.run;
+    const native = e.children.find(c => c.kind === 'stream' && upper(c) === '\x01OLE10NATIVE');
+    if (d.pkg?.embedded && native) {
+        const pkg = d.pkg;
+        const source = cfb.source(native);
+        const start = 4 + pkg.dataAt;
+        const length = Math.max(0, Math.min(pkg.size, native.size - start));
+        const decision = await (0, contained_1.decideContained)(ctx, { name: pkg.fileName || undefined, location, chunks: () => (0, io_1.rangeChunks)(source, start, length) });
+        if (decision?.replacement) {
+            const all = await cfb.bytes(native);
+            plan.replace.set(native, await (0, contained_1.spillOf)(run, (0, oleobj_1.sizedStream)((0, oleobj_1.replaceSized)(all.subarray(4), pkg.dataAt, pkg.size, await (0, io_1.readAll)(decision.replacement)))));
+        }
+        return decision;
+    }
+    const written = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(written);
+    await (0, cfb_writer_1.writeCfb)((0, rewrite_cfb_1.subtree)(cfb, e), written, run.deadline);
+    await written.close();
+    const decision = await (0, contained_1.decideContained)(ctx, { name: d.userType || d.progId || undefined, location, chunks: () => written.read() });
+    const replacement = decision?.replacement;
+    if (!replacement)
+        return decision;
+    const source = replacement.source();
+    run.sources.push(source);
+    let graft;
+    try {
+        graft = await cfb_1.CompoundFile.open(source, ctx.settings, run.deadline);
+    }
+    catch (err) {
+        if (!(err instanceof errors_1.StopError))
+            throw err;
+        ctx.removal(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginFailed, location, { reason: 'its output is not a compound file' });
+        return { keep: false };
+    }
+    plan.grafts.set(e, graft);
+    // The output check writes the storage out again, so it expects the bytes this writer makes of the graft.
+    const again = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(again);
+    await (0, cfb_writer_1.writeCfb)((0, rewrite_cfb_1.subtree)(graft, graft.root), again, run.deadline);
+    await again.close();
+    const expected = run.kept.get(replacement.digest());
+    if (expected)
+        run.kept.set(again.digest(), expected);
+    return decision;
+}
+/**
+ * One OLE object's storage: a control, a linked object, or an embedded one, with what it holds. Returns its findings,
+ * and a strip when a plugin removed the object. In the file the rewrite writes, `plan` is set and an embedded object
+ * goes to the plugins first. `given` is the verdict on an object whose container showed it to the plugins already.
+ */
+async function objectRules(ctx, cfb, e, location, plan, given) {
     const d = await describeObject(cfb, e, location);
     const data = { storage: location };
     if (d.clsid)
@@ -102,21 +169,25 @@ async function objectRules(ctx, cfb, e, location) {
         data.progId = (0, context_1.clip)(d.progId);
     if (d.userType)
         data.className = (0, context_1.clip)(d.userType);
-    if (d.control) {
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, d.controlName ? { ...data, name: (0, context_1.clip)(d.controlName) } : data);
-        return;
-    }
+    if (d.control)
+        return [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, d.controlName ? { ...data, name: (0, context_1.clip)(d.controlName) } : data)];
+    const found = [];
     if (d.pkg) {
         Object.assign(data, packageData(d.pkg));
         if (!d.pkg.embedded && d.pkg.sourcePath)
-            ctx.external(types_1.OfficeDetail.Object, d.pkg.sourcePath, location, { storage: location }, 'package link');
+            found.push(ctx.external(types_1.OfficeDetail.Object, d.pkg.sourcePath, location, { storage: location }, 'package link'));
     }
     if (d.linked)
-        linkedObject(ctx, d, location, { storage: location, ...(d.clsid ? { clsid: d.clsid } : {}) });
-    else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data);
+        found.push(linkedObject(ctx, d, location, { storage: location, ...(d.clsid ? { clsid: d.clsid } : {}) }));
+    else {
+        const decision = given ?? (plan ? await objectFile(ctx, cfb, e, d, location, plan) : undefined);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, (0, contained_1.presence)(decision)));
+        if (decision && !decision.keep)
+            found.push({ action: 'strip' });
+    }
     if (d.equation)
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data));
+    return found;
 }
 /**
  * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a
@@ -124,9 +195,8 @@ async function objectRules(ctx, cfb, e, location) {
  */
 function linkedObject(ctx, d, location, data) {
     if (d.target && !d.url)
-        ctx.external(types_1.OfficeDetail.Object, d.target, location, data, 'linked object');
-    else
-        ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, d.target ? { ...data, target: (0, context_1.clip)(d.target, 2000) } : data);
+        return ctx.external(types_1.OfficeDetail.Object, d.target, location, data, 'linked object');
+    return ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, d.target ? { ...data, target: (0, context_1.clip)(d.target, 2000) } : data);
 }
 /** What a finding shows of a Packager object's file: its name and paths, and its size when the object holds it. */
 function packageData(p) {

package/dist/odf.d.ts

@@ -1,3 +1,89 @@
-import { type ZipContext } from './context';
+import { type PlanContext, type ZipContext } from './context';
+import { type Format } from './formats';
+import { OfficeCategory as C, OfficeDetail as D } from './types';
+import type { XmlElement, XmlHandler } from './xml';
+import { type ZipEntry } from './zip';
+export declare const NS: {
+    manifest: string;
+    office: string;
+    script: string;
+    presentation: string;
+    text: string;
+    draw: string;
+    table: string;
+    form: string;
+    meta: string;
+    style: string;
+    database: string;
+    chart: string;
+    xlink: string;
+};
+/** An attribute by normalized namespace and local name. */
+export declare function oattr(el: XmlElement, ns: string, local: string): string | undefined;
+/** The ODF_NS-normalized namespace of `ns`, exported for the rewrite. */
+export declare const odfNamespace: (ns: string) => string;
+/** The xlink:href of an element, for the rewrite. */
+export declare const hrefOf: (el: XmlElement) => string | undefined;
+/** A path inside the package as the manifest and the zip name it: without "./" and leading slashes. */
+export declare const packagePath: (href: string) => string;
+/**
+ * The rules that read inside one XML entry of an ODF package, or inside a flat OpenDocument file. A flat file has no
+ * entries, so in one every relative reference names a file beside the document, which loads from outside it.
+ */
+export declare class EntryRules implements XmlHandler {
+    private readonly ctx;
+    private readonly entry;
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    private readonly oleRefs;
+    private readonly flat;
+    /** Depth of the office:scripts element being read, 0 outside one. */
+    private scriptsDepth;
+    /** An office:script element being read, with whether it holds anything. */
+    private script?;
+    /** A link element being read, whose text and title go into the label check at its end. */
+    private label?;
+    constructor(ctx: PlanContext, entry: string, 
+    /** Whether an object refers to each entry, by key. Only entries are kept, so a part full of references costs no memory. */
+    oleRefs: Map<string, boolean>, flat?: boolean);
+    /**
+     * Whether a reference names an entry of the package. LibreOffice's vnd.sun.star.Package: URLs name one too. In a
+     * flat file no entry exists, so only such a URL stays inside, naming nothing.
+     */
+    private inside;
+    private report;
+    /** Records the edit for the element when the finding strips. */
+    private edit;
+    start(raw: XmlElement): void;
+    text(t: string): void;
+    end(el: XmlElement): void;
+    private scriptEvent;
+    private presentationEvent;
+}
+export interface Manifest {
+    paths: Set<string>;
+    root?: string;
+    encrypted: boolean;
+}
+/** The code folder an entry sits in, as the folder's path and its finding. */
+export declare function folderOf(name: string): {
+    prefix: string;
+    detail: D;
+    category: C;
+} | undefined;
+/** What names an OpenDocument package: the media type its format comes from, and the entries that give it. */
+export interface OdfNaming {
+    format: Format;
+    /** The media type the format was named by. */
+    mediaType: string;
+    mimetype?: ZipEntry;
+    manifestEntry?: ZipEntry;
+    manifest?: Manifest;
+}
+/**
+ * Names an OpenDocument package's format by the media type in its mimetype entry or, without one, its manifest's root
+ * entry. Throws when the two name different formats, or the media type is not one this package reads. `layout` hears,
+ * with the entry it concerns, of each way the mimetype entry and the manifest leave the layout OpenDocument asks for.
+ */
+export declare function nameOdf(ctx: ZipContext, layout?: (location: string, reason: string) => void): Promise<OdfNaming>;
 /** Inspects an OpenDocument package. */
 export declare function inspectOdf(ctx: ZipContext): Promise<void>;