@patrickdk77/office-defuse 0.2.1 → 0.2.2

package/README.md

@@ -292,7 +292,7 @@ A writer that streams an entry sets the data descriptor flag and may leave the l
 
 The XML tokenizer reads each part in pieces. It refuses these, and stops the run:
 
-- XML/ENCODING: anything but UTF-8 or UTF-16, the two encodings OPC allows, an encoding declaration that disagrees with the bytes, and bytes that are not valid in their encoding.
+- XML/ENCODING: anything but UTF-8 or UTF-16, the two encodings OPC allows, an encoding declaration that disagrees with the bytes, and bytes that are not valid in their encoding. A declaration of us-ascii agrees with UTF-8 bytes as long as every byte is ASCII, since both read them the same. SharePoint writes such declarations into custom XML parts.
 - XML/MALFORMED: markup that breaks XML 1.0 or its namespaces. That covers an undeclared prefix, a duplicate attribute, a mismatched end tag, an element or text outside the root, a malformed name, reference or declaration, and characters XML 1.0 forbids. It also covers what XML 1.0 refuses about entities: a reference to an entity nothing declares, a reference to an external entity in an attribute value, entity text that refers to itself or leaves an element open, and a markup declaration outside the document type declaration.
 
 References get expanded and line ends normalized as the XML specification says, so `DDEAUTO` reads as `DDEAUTO`.

package/dist/ooxml.js

@@ -597,6 +597,8 @@ async function readMain(ctx, { parts, relsOf }, each) {
 async function nameOoxml(ctx, contentTypes) {
     return (await readMain(ctx, await readParts(ctx, contentTypes))).format;
 }
+/** The content type of an add-in's presentation part, which PowerPoint writes empty. */
+const PPAM_MAIN = 'application/vnd.ms-powerpoint.addin.macroenabled.main+xml';
 /**
  * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
  * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
@@ -650,6 +652,10 @@ async function inspectOoxml(ctx, contentTypes, outer) {
                 plan.drop.add(key);
             p.ole = await ctx.drain(p.entry);
         }
+        else if (format.format === 'ppam' && p.entry.size === 0 && ct.toLowerCase() === PPAM_MAIN) {
+            // PowerPoint writes an add-in's presentation part empty, since an add-in has no slides.
+            await ctx.drain(p.entry);
+        }
         else if ((0, exports.isXmlType)(ct)) {
             const rules = new PartRules(ctx, p.entry.name);
             await ctx.parse(p.entry, rules, ct === exports.TYPE.vml);

package/dist/rewrite-zip.js

@@ -281,7 +281,8 @@ async function writeOoxml(run, zip, plan, graph, format, limits, sink) {
         for (const [k, p] of graph.parts) {
             const removed = removedIds.get(k);
             const own = plan.parts.get(p.entry.name);
-            if (drops.has(k) || sheets.has(k) || plan.replace.has(k) || !(0, ooxml_1.isXmlType)(p.contentType) || (!removed && !own && !xpsDrops))
+            // An empty part, such as the presentation part PowerPoint writes into an add-in, refers to nothing.
+            if (drops.has(k) || sheets.has(k) || plan.replace.has(k) || !(0, ooxml_1.isXmlType)(p.contentType) || p.entry.size === 0 || (!removed && !own && !xpsDrops))
                 continue;
             const rules = {
                 element(el) {

package/dist/xml.d.ts

@@ -159,6 +159,9 @@ export declare class XmlTokenizer {
     /** The XML declaration says standalone="yes". */
     private standalone;
     private encoding;
+    /** Set by a declaration of US-ASCII, which agrees with UTF-8 only while every byte is ASCII. */
+    private asciiDeclared;
+    private nonAscii;
     /** Start tags read so far, which numbers the elements. */
     private elements;
     /** An attribute value of the tag being read referred to an entity of the internal subset. */

package/dist/xml.js

@@ -190,6 +190,9 @@ class XmlTokenizer {
     /** The XML declaration says standalone="yes". */
     standalone = false;
     encoding = 'utf-8';
+    /** Set by a declaration of US-ASCII, which agrees with UTF-8 only while every byte is ASCII. */
+    asciiDeclared = false;
+    nonAscii = false;
     /** Start tags read so far, which numbers the elements. */
     elements = 0;
     /** An attribute value of the tag being read referred to an entity of the internal subset. */
@@ -263,6 +266,14 @@ class XmlTokenizer {
         return decoder;
     }
     decode(decoder, bytes, more) {
+        if (!this.nonAscii)
+            for (const c of bytes)
+                if (c >= 0x80) {
+                    this.nonAscii = true;
+                    break;
+                }
+        if (this.asciiDeclared && this.nonAscii)
+            this.stop(types_1.OfficeDetail.Encoding, 'The declaration says us-ascii, the bytes are not all ASCII');
         try {
             return decoder.decode(bytes, { stream: more });
         }
@@ -279,9 +290,16 @@ class XmlTokenizer {
         const declared = /\bencoding\s*=\s*(["'])([^"']*)\1/.exec(body)?.[2]?.toLowerCase();
         if (declared === undefined)
             return;
-        const ok = this.encoding === 'utf-8' ? declared === 'utf-8' || declared === 'utf8' : declared === 'utf-16' || declared === this.encoding;
+        // SharePoint declares us-ascii on the custom XML it writes. ASCII bytes read the same in UTF-8.
+        const ascii = this.encoding === 'utf-8' && (declared === 'us-ascii' || declared === 'ascii');
+        const ok = this.encoding === 'utf-8' ? declared === 'utf-8' || declared === 'utf8' || ascii : declared === 'utf-16' || declared === this.encoding;
         if (!ok)
             this.stop(types_1.OfficeDetail.Encoding, `The declaration says ${declared}, the bytes are ${this.encoding.toUpperCase()}`);
+        if (ascii) {
+            this.asciiDeclared = true;
+            if (this.nonAscii)
+                this.stop(types_1.OfficeDetail.Encoding, 'The declaration says us-ascii, the bytes are not all ASCII');
+        }
     }
     feed(text, final) {
         this.buf = this.pos < this.buf.length ? this.buf.slice(this.pos) + text : text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",