@patrickdk77/office-defuse 0.2.1 → 0.2.4

package/dist/ole.js

@@ -5,7 +5,10 @@ exports.mainFamily = mainFamily;
 exports.compoundFormat = compoundFormat;
 exports.openEncryptedPackage = openEncryptedPackage;
 exports.inspectCompound = inspectCompound;
+const cfb_1 = require("./cfb");
+const context_1 = require("./context");
 const errors_1 = require("./errors");
+const forms_1 = require("./forms");
 const msg_1 = require("./msg");
 const objects_1 = require("./objects");
 const offcrypto_1 = require("./offcrypto");
@@ -20,6 +23,11 @@ const zip_1 = require("./zip");
 const f = (format, mimeType) => ({ format, mimeType });
 const upper = (e) => e.name.toUpperCase();
 const PUBLISHER_CLSIDS = new Set(['00021200-0000-0000-00C0-000000000046', '00021201-0000-0000-00C0-000000000046']);
+/**
+ * The class id PowerPoint 97 to 2003 writes at the root of an add-in, a .ppa, whose root is its VBA project. An add-in
+ * whose project was removed keeps it, and is still an add-in.
+ */
+const PPA_CLSID = '817246F0-720A-11CF-8718-00AA0060263B';
 /** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
 function families(cfb) {
     const names = new Map(cfb.root.children.map(c => [upper(c), c]));
@@ -33,6 +41,8 @@ function families(cfb) {
         out.push('excel');
     if (stream('POWERPOINT DOCUMENT'))
         out.push('powerpoint');
+    if (cfb.root.clsid === PPA_CLSID)
+        out.push('powerpoint-addin');
     if (stream('VISIODOCUMENT'))
         out.push('visio');
     if (stream('__PROPERTIES_VERSION1.0'))
@@ -91,6 +101,8 @@ async function compoundFormat(cfb, family, deadline) {
         }
         case 'powerpoint':
             return f('ppt', 'application/vnd.ms-powerpoint');
+        case 'powerpoint-addin':
+            return f('ppa', 'application/vnd.ms-powerpoint');
         case 'visio':
             return f('vsd', 'application/vnd.visio');
         case 'outlook':
@@ -134,21 +146,29 @@ async function inspectCompound(ctx, cfb) {
     if (word)
         await (0, word_1.wordRules)(ctx, cfb, word, family === 'encrypted');
     if (family === 'excel') {
+        const found = [];
         for (const name of ['Workbook', 'Book']) {
             const s = stream(name);
             if (s)
-                await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook);
+                await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook, plan, found);
         }
-        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream.
+        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream. It stays when every control in it is a
+        // Forms 2.0 control as Office persists one, and the Obj records account for all of it.
         const controls = stream('Ctls');
-        if (controls && controls.size > 0 && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name }).action === 'strip')
-            plan.drop.add(controls);
+        if (controls && controls.size > 0) {
+            const problem = await ctlsProblem(cfb, controls, found);
+            const reported = problem
+                ? [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name, reason: (0, context_1.clip)(problem) })]
+                : found.map(c => ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, `${controls.name}, offset ${c.position}`, { stream: controls.name, sheet: (0, context_1.clip)(c.sheet), progId: (0, context_1.clip)(c.progId) }));
+            if (reported.some(r => r.action === 'strip'))
+                plan.drop.add(controls);
+        }
     }
     if (family === 'outlook')
         await (0, msg_1.messageRules)(ctx, cfb, cfb.root, 0, plan);
     const ppt = stream('PowerPoint Document');
     if (family === 'powerpoint' && ppt)
-        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt);
+        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt, plan);
     const visio = stream('VisioDocument');
     if (family === 'visio' && visio)
         await (0, vsd_1.visioRules)(ctx, cfb, visio);
@@ -165,3 +185,33 @@ async function inspectCompound(ctx, cfb) {
             ctx.run.output = { kind: 'zip', zip, plan: zctx.plan, format: ctx.format };
     }
 }
+/**
+ * Why the Ctls stream may hold more than Forms 2.0 controls as Office persists them, or undefined when it does not.
+ * Each control is its class id and then its properties, at the place its Obj record gives, and the places cover the
+ * stream with nothing between or after them.
+ */
+async function ctlsProblem(cfb, ctls, controls) {
+    if (!controls.length)
+        return 'no Obj record names a control in it';
+    if (ctls.size > 16 * 1024 * 1024)
+        return 'it is larger than Forms 2.0 controls without pictures';
+    const bytes = await cfb.bytes(ctls);
+    let covered = 0;
+    for (const c of [...controls].sort((a, b) => a.position - b.position)) {
+        if (c.position !== covered)
+            return `bytes at offset ${covered} that no control's place covers`;
+        if (c.position + c.size > bytes.length || c.size < 16)
+            return `a control's place runs past the stream`;
+        const classId = forms_1.FORMS_PROGIDS.get(c.progId.trim().toLowerCase());
+        if (!classId)
+            return `a control of class ${c.progId || 'not named'}`;
+        const data = bytes.subarray(c.position, c.position + c.size);
+        if ((0, cfb_1.guid)(data, 0) !== classId)
+            return `a control whose data names another class than ${c.progId}`;
+        const problem = (0, forms_1.controlProblem)(classId, data.subarray(16));
+        if (problem)
+            return problem;
+        covered = c.position + c.size;
+    }
+    return covered === bytes.length ? undefined : `${bytes.length - covered} bytes after the last control`;
+}

package/dist/ooxml.d.ts

@@ -1,3 +1,4 @@
+import { type ContainedDecision } from './contained';
 import { type ZipContext } from './context';
 import { type Format } from './formats';
 import { type XmlElement } from './xml';
@@ -52,6 +53,30 @@ export interface Part {
     /** The parts its own relationships reach. */
     targets: Set<Part>;
     ole: boolean;
+    /** For a VBA project part read before the XML parts, what became of it. */
+    vba?: ContainedDecision;
+    /** For an activeX part, the control its ax:ocx element describes. */
+    activeX?: ActiveXInfo;
+    /** For an activeX part, what the check of its control found. */
+    forms?: FormsVerdict;
+    /** A binary part that holds the data of a Forms 2.0 control that stays. */
+    formsData?: boolean;
+}
+/** What an activeX part's ax:ocx element says: the class, how the control persists itself, and a property bag. */
+export interface ActiveXInfo {
+    classId: string;
+    persistence?: string;
+    props: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** An element below ax:ocxPr, such as a font or picture, or one ax:ocx does not hold. */
+    nested: boolean;
+}
+/** An activeX part's control as checked: its class, and why it may not be a Forms 2.0 control as Office writes one. */
+interface FormsVerdict {
+    classId?: string;
+    problem?: string;
 }
 /** What the rewrite needs of an OOXML package: its parts, which part each relationships part belongs to, and the roots. */
 export interface OoxmlGraph {
@@ -112,3 +137,4 @@ export declare function nameOoxml(ctx: ZipContext, contentTypes: ZipEntry): Prom
  * OPC package unpacked into a ZIP archive, and the package's own format is returned.
  */
 export declare function inspectOoxml(ctx: ZipContext, contentTypes: ZipEntry, outer?: Format): Promise<Format>;
+export {};

package/dist/ooxml.js

@@ -10,14 +10,19 @@ exports.readMain = readMain;
 exports.nameOoxml = nameOoxml;
 exports.inspectOoxml = inspectOoxml;
 const biff_1 = require("./biff");
+const cfb_1 = require("./cfb");
 const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const fields_1 = require("./fields");
 const formats_1 = require("./formats");
+const forms_1 = require("./forms");
 const formulas_1 = require("./formulas");
+const io_1 = require("./io");
 const links_1 = require("./links");
+const objects_1 = require("./objects");
 const plan_1 = require("./plan");
+const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
 const xlsb_1 = require("./xlsb");
 const xml_1 = require("./xml");
@@ -98,6 +103,7 @@ exports.R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/r
 const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/customui', 'http://schemas.microsoft.com/office/2009/07/customui']);
 const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
 const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
+const ACTIVEX_NS = 'http://schemas.microsoft.com/office/2006/activex';
 const EXTENDED_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/extended-properties', 'http://purl.oclc.org/ooxml/officedocument/extendedproperties']);
 /**
  * The attributes of a SpreadsheetML data connection that name where it loads from (ECMA-376 18.13): an ODC file or an
@@ -310,6 +316,8 @@ class PartRules {
     hyperlinkBase;
     /** The parts this XPS part names in its markup, by key, which count as reached from it. */
     refs = new Set();
+    /** The control an activeX part describes in its ax:ocx element. */
+    activeX;
     /**
      * The labels of the hyperlinks the part names by relationship Id: their text, tooltips and display text. The
      * relationships part comes after the part, so the targets are compared with these as it is read.
@@ -358,14 +366,27 @@ class PartRules {
     }
     start(el) {
         const ns = this.lowerNs(el);
+        // Below ax:ocx only ax:ocxPr may stand, and nothing below it: anything else marks the bag as more than plain values.
+        if (this.activeX && (el.depth > 2 || (el.depth === 2 && !(ns === ACTIVEX_NS && el.local === 'ocxPr'))))
+            this.activeX.nested = true;
+        if (ns === ACTIVEX_NS) {
+            const value = (local) => el.attributes.find(a => a.ns.toLowerCase() === ACTIVEX_NS && a.local === local)?.value;
+            if (el.depth === 1 && el.local === 'ocx')
+                this.activeX = { classId: value('classid') ?? '', persistence: value('persistence'), props: [], nested: false };
+            else if (this.activeX && el.depth === 2 && el.local === 'ocxPr')
+                this.activeX.props.push({ name: value('name') ?? '', value: value('value') ?? '' });
+            else if (this.activeX)
+                this.activeX.nested = true;
+            return;
+        }
         if (CUSTOM_UI_NS.has(ns)) {
             if (el.depth === 1)
                 this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Ribbon, this.part);
             for (const a of el.attributes) {
                 if (a.ns !== '' || !a.value.trim() || !/^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
                     continue;
-                // The callback goes and the control stays, doing nothing.
-                if (this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }).action === 'strip') {
+                // The callback goes and the control stays, doing nothing, unless it calls a macro of a project that stays.
+                if (this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }, (0, context_1.ownMacro)(this.ctx.run, a.value)).action === 'strip') {
                     this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', a.local)]) });
                 }
             }
@@ -398,7 +419,7 @@ class PartRules {
         else if (XDR_NS.has(ns)) {
             const macro = (0, xml_1.attr)(el, '', 'macro');
             // The shape stays, and clicking it runs nothing.
-            if (macro?.trim() && this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }).action === 'strip') {
+            if (macro?.trim() && this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, (0, context_1.ownMacro)(this.ctx.run, macro)).action === 'strip') {
                 this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', 'macro')]) });
             }
         }
@@ -455,8 +476,9 @@ class PartRules {
             this.formula = undefined;
         }
         if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
+            const macro = this.macroText.shown.text.trim();
             if (this.macroText.shown.content)
-                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.shown.text.trim()) }), this.macroText);
+                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, (0, context_1.ownMacro)(this.ctx.run, macro)), this.macroText);
             this.macroText = undefined;
         }
         if (this.hyperlinkBase && EXTENDED_NS.has(ns) && el.local === 'HyperlinkBase') {
@@ -495,8 +517,10 @@ class PartRules {
         const data = { trigger: el.local, action: (0, context_1.clip)(written), ...(id === undefined ? {} : { relationship: (0, context_1.clip)(id) }) };
         if (action.startsWith('ppaction://program'))
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data), el);
-        else if (action.startsWith('ppaction://macro'))
-            this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data), el);
+        else if (action.startsWith('ppaction://macro')) {
+            const name = /[?&]name=([^&]*)/i.exec(written)?.[1] ?? '';
+            this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data, (0, context_1.ownMacro)(this.ctx.run, safeDecode(name))), el);
+        }
         else if (action.startsWith('ppaction://ole'))
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data), el);
     }
@@ -597,6 +621,8 @@ async function readMain(ctx, { parts, relsOf }, each) {
 async function nameOoxml(ctx, contentTypes) {
     return (await readMain(ctx, await readParts(ctx, contentTypes))).format;
 }
+/** The content type of an add-in's presentation part, which PowerPoint writes empty. */
+const PPAM_MAIN = 'application/vnd.ms-powerpoint.addin.macroenabled.main+xml';
 /**
  * Inspects an OOXML package. The package relationships come first, since they name the main part and so the format.
  * Then each part is read in archive order, followed by its relationships, which are reported as they are read and
@@ -639,6 +665,12 @@ async function inspectOoxml(ctx, contentTypes, outer) {
     };
     const { format, strict, xps } = await readMain(ctx, typed, (rels, r) => relate(rels, undefined, r));
     ctx.format = outer ?? format;
+    // A VBA project goes to the script plugins before the XML parts are read, whose buttons and callbacks keep running
+    // its macros only when it stays.
+    if (ctx.run.options.scriptPlugins !== undefined)
+        for (const p of parts.values())
+            if (exports.TYPE.vba.has(p.contentType ?? ''))
+                p.vba = await vbaPart(ctx, p.entry, p.entry.name);
     // OPC has no folders. A directory entry is still inflated once, so its bytes are checked like any other.
     for (const entry of ctx.zip.entries)
         if (entry.directory)
@@ -650,11 +682,17 @@ async function inspectOoxml(ctx, contentTypes, outer) {
                 plan.drop.add(key);
             p.ole = await ctx.drain(p.entry);
         }
+        else if (format.format === 'ppam' && p.entry.size === 0 && ct.toLowerCase() === PPAM_MAIN) {
+            // PowerPoint writes an add-in's presentation part empty, since an add-in has no slides.
+            await ctx.drain(p.entry);
+        }
         else if ((0, exports.isXmlType)(ct)) {
             const rules = new PartRules(ctx, p.entry.name);
             await ctx.parse(p.entry, rules, ct === exports.TYPE.vml);
             if (rules.labels.size)
                 labelsOf.set(key, rules.labels);
+            if (rules.activeX)
+                p.activeX = rules.activeX;
             for (const k of rules.refs) {
                 const t = parts.get(k);
                 if (t && t !== p)
@@ -680,6 +718,10 @@ async function inspectOoxml(ctx, contentTypes, outer) {
     for (const [source, rels] of relsOf)
         if (source !== '' && !parts.has(source))
             await readRelationships(ctx, rels, r => relate(rels, undefined, r));
+    // Controls are checked before any part's own rules, since a Forms 2.0 control that stays keeps its binary part.
+    for (const p of parts.values())
+        if (exports.TYPE.control.has(p.contentType ?? '') || (p.reachedAs & AS.control) !== 0)
+            p.forms = await formsControl(ctx, p);
     for (const p of parts.values())
         await partRules(ctx, p);
     unreferenced(ctx, parts, relsOf, roots);
@@ -705,11 +747,16 @@ async function partRules(ctx, p) {
     // Besides OLE parts and packages, every part that is a whole file in a format of its own, such as an image, goes
     // to the plugins. Such a part has no rule of its own, so one no plugin takes stays.
     const wholeFile = !(0, exports.isXmlType)(p.contentType) && !formatBinary(ct);
+    // The data of a Forms 2.0 control that stays was read with the control, and stays with it.
+    if (p.formsData)
+        return;
     const contained = vba || ole || pkg || controlBinary || p.ole || wholeFile;
-    const decision = contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined;
+    // With script plugins, a VBA project part is read here, so its modules go to them, rather than to the file plugins.
+    const vbaDecision = p.vba ?? (vba && ctx.run.options.scriptPlugins !== undefined ? await vbaPart(ctx, p.entry, loc) : undefined);
+    const decision = vbaDecision ?? (contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined);
     const act = (0, contained_1.presence)(decision);
     const found = [];
-    if (vba)
+    if (vba && !vbaDecision)
         found.push(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data, act));
     // A macro sheet becomes an empty worksheet, so the indexes of the sheets after it stay right.
     if ((exports.TYPE.macrosheet.has(ct) || as(AS.macrosheet)) && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data).action === 'strip')
@@ -718,8 +765,12 @@ async function partRules(ctx, p) {
         found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data, act));
     if (pkg)
         found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data, act));
-    if (control || (controlBinary && !p.claimed))
-        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data, control ? undefined : act));
+    if (control && p.forms && !p.forms.problem)
+        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, loc, { ...data, clsid: p.forms.classId ?? '' }));
+    else if (control || (controlBinary && !p.claimed)) {
+        const why = control && p.forms ? { ...(p.forms.classId ? { clsid: p.forms.classId } : {}), ...(p.forms.problem ? { reason: (0, context_1.clip)(p.forms.problem) } : {}) } : {};
+        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }, control ? undefined : act));
+    }
     if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
         found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data, act));
     if (decision ? !decision.keep : found.some(f => f.action === 'strip'))
@@ -727,6 +778,109 @@ async function partRules(ctx, p) {
     else if (decision?.replacement)
         ctx.plan.replace.set(key, decision.replacement);
 }
+/** Bytes a Forms 2.0 control's binary part holds at most, pictures left out. */
+const MAX_CONTROL_DATA = 65536;
+/**
+ * Checks the control an activeX part describes as a Forms 2.0 control that Office persisted: by its class, and by
+ * its properties, read from the property bag in the part or from the binary part its relationship names. A control
+ * persisted as a stream starts with its class id; one persisted as a storage holds its CompObj and contents. A
+ * control that passes marks its binary part, which then stays with it.
+ */
+async function formsControl(ctx, p) {
+    const ax = p.activeX;
+    if (!ax)
+        return { problem: 'its part has no ax:ocx element' };
+    const classId = ax.classId.replace(/[{}]/g, '').trim().toUpperCase();
+    if (!forms_1.FORMS_CONTROLS.has(classId))
+        return { classId, problem: 'its class is not a Forms 2.0 control office-defuse reads' };
+    const binaries = [...p.targets].filter(t => t.claimed);
+    const persistence = ax.persistence ?? 'persistStreamInit';
+    if (persistence === 'persistPropertyBag') {
+        if (binaries.length)
+            return { classId, problem: 'a property bag with a binary part' };
+        return { classId, problem: (0, forms_1.bagProblem)(classId, ax.props, ax.nested) };
+    }
+    if (ax.props.length || ax.nested)
+        return { classId, problem: `properties in its part beside ${persistence}` };
+    if (binaries.length !== 1)
+        return { classId, problem: 'it has no binary part, or more than one' };
+    const bin = binaries[0];
+    if (bin.entry.size > MAX_CONTROL_DATA)
+        return { classId, problem: 'its binary part is larger than a Forms 2.0 control without pictures' };
+    const chunks = [];
+    for await (const c of ctx.zip.read(bin.entry))
+        chunks.push(c);
+    const bytes = Buffer.concat(chunks);
+    let problem;
+    if (persistence === 'persistStreamInit' || persistence === 'persistStream') {
+        problem = bytes.length < 16 || (0, cfb_1.guid)(bytes, 0) !== classId ? 'its binary part names another class' : (0, forms_1.controlProblem)(classId, bytes.subarray(16));
+    }
+    else if (persistence === 'persistStorage') {
+        let cfb;
+        try {
+            cfb = await cfb_1.CompoundFile.open((0, io_1.bufferSource)(bytes), ctx.settings, ctx.run.deadline);
+        }
+        catch (e) {
+            if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+                throw e;
+            problem = `its binary part is not a compound file: ${e.message}`;
+        }
+        if (cfb)
+            problem = await (0, forms_1.controlStorageProblem)(cfb, cfb.root, forms_1.OOXML_CONTROL_STREAMS, classId);
+    }
+    else
+        problem = `its persistence is ${persistence}`;
+    if (!problem)
+        bin.formsData = true;
+    return { classId, problem };
+}
+/**
+ * A VBA project part, read as the compound file it is: the rules every compound file gets, which show the project to
+ * the script plugins and the storages of its forms to the file plugins. The part stays, as the rewrite writes it, when
+ * the project does.
+ */
+async function vbaPart(ctx, entry, loc) {
+    const run = ctx.run;
+    const copy = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(copy);
+    for await (const c of ctx.zip.read(entry))
+        await copy.write(c);
+    await copy.close();
+    const source = copy.source();
+    run.sources.push(source);
+    let cfb;
+    try {
+        cfb = await cfb_1.CompoundFile.open(source, ctx.settings, run.deadline);
+    }
+    catch (e) {
+        if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+            throw e;
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, { part: loc, reason: (0, context_1.clip)(`its compound file does not read: ${e.message}`) });
+        return { keep: false };
+    }
+    (0, objects_1.nestedNotes)(ctx, cfb, loc);
+    const plan = new plan_1.CompoundPlan();
+    await (0, objects_1.compoundRules)(ctx, cfb, loc, false, plan);
+    const vba = cfb.child(cfb.root, 'VBA');
+    if (!vba)
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, { part: loc, reason: 'it holds no VBA storage' });
+    if (!vba || plan.drop.has(vba))
+        return { keep: false };
+    const out = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(out);
+    await (0, rewrite_cfb_1.writeCompound)(run, cfb, plan, out);
+    await out.close();
+    return { keep: true, replacement: out };
+}
+/** A percent-encoded value, or the value as written when it does not decode. */
+function safeDecode(v) {
+    try {
+        return decodeURIComponent(v);
+    }
+    catch {
+        return v;
+    }
+}
 /** Parts that no chain of internal relationships reaches from the package. */
 function unreferenced(ctx, parts, relsOf, roots) {
     const reached = new Set(roots);

package/dist/ppt-writer.d.ts

@@ -0,0 +1,27 @@
+import type { SpillSink } from './io';
+import type { ByteSource } from './types';
+/** What the rewrite of a PowerPoint Document stream changes, each record by its offset in the stream as read. */
+export interface PresentationEdits {
+    /** Records that go, with everything inside them. */
+    remove: Set<number>;
+    /** Records whose body is replaced, the header written for the new length. */
+    replace: Map<number, Uint8Array>;
+    /** Persist objects, by persist id, that the new persist directory leaves out. */
+    dropPersist: Set<number>;
+    /** The presentation is rewritten only to decrypt it. A rewrite of an encrypted presentation always decrypts it. */
+    decrypt: boolean;
+}
+export declare const noPresentationEdits: () => PresentationEdits;
+export declare const hasPresentationEdits: (e: PresentationEdits) => boolean;
+/** The current edit as its UserEditAtom (MS-PPT 2.3.3) gives it. */
+export interface CurrentEdit {
+    /** The atom's body, kept but for the offsets the rewrite writes anew. */
+    body: Uint8Array;
+}
+/**
+ * Writes a PowerPoint Document stream again as a full save (MS-PPT 2.1.2): each persist object the current edit
+ * reaches, in persist id order, then one persist directory for them and one UserEditAtom with no edit before it.
+ * `source` is the stream as read, decrypted when it was encrypted, and `persist` maps each persist id to the offset of
+ * its object. Returns the offset of the new UserEditAtom, which the Current User stream points at.
+ */
+export declare function rewritePresentation(source: ByteSource, size: number, persist: ReadonlyMap<number, number>, current: CurrentEdit, edits: PresentationEdits, sink: SpillSink, deadline?: number): Promise<number>;

package/dist/ppt-writer.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasPresentationEdits = exports.noPresentationEdits = void 0;
+exports.rewritePresentation = rewritePresentation;
+const errors_1 = require("./errors");
+const noPresentationEdits = () => ({ remove: new Set(), replace: new Map(), dropPersist: new Set(), decrypt: false });
+exports.noPresentationEdits = noPresentationEdits;
+const hasPresentationEdits = (e) => e.decrypt || e.remove.size > 0 || e.replace.size > 0 || e.dropPersist.size > 0;
+exports.hasPresentationEdits = hasPresentationEdits;
+const USER_EDIT = 0x0ff5;
+const PERSIST_DIRECTORY = 0x1772;
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const le32 = (n) => Uint8Array.of(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+function head(verInst, type, length) {
+    return Uint8Array.of(verInst & 0xff, verInst >> 8, type & 0xff, type >> 8, ...le32(length));
+}
+/**
+ * The bytes of one record, from `offset` in `source`, with the edits inside it made. A container is written from its
+ * children, so its length follows what they become; a record without edits inside is copied as it is.
+ */
+async function recordBytes(source, offset, end, edits, touched, deadline) {
+    (0, errors_1.checkTime)(deadline);
+    const h = await source.read(offset, 8);
+    const verInst = h[0] | (h[1] << 8);
+    const type = h[2] | (h[3] << 8);
+    const length = Math.min(u32(h, 4), end - offset - 8);
+    if (edits.remove.has(offset))
+        return [];
+    const replaced = edits.replace.get(offset);
+    if (replaced)
+        return [head(verInst, type, replaced.length), replaced];
+    const bodyEnd = offset + 8 + length;
+    if ((verInst & 0x0f) !== 0x0f || !touched(offset + 8, bodyEnd))
+        return [head(verInst, type, length), await source.read(offset + 8, length)];
+    const parts = [];
+    let total = 0;
+    for (let pos = offset + 8; pos + 8 <= bodyEnd;) {
+        const kh = await source.read(pos, 8);
+        const kidEnd = Math.min(bodyEnd, pos + 8 + u32(kh, 4));
+        for (const p of await recordBytes(source, pos, kidEnd, edits, touched, deadline)) {
+            parts.push(p);
+            total += p.length;
+        }
+        pos = kidEnd;
+    }
+    return [head(verInst, type, total), ...parts];
+}
+/**
+ * Writes a PowerPoint Document stream again as a full save (MS-PPT 2.1.2): each persist object the current edit
+ * reaches, in persist id order, then one persist directory for them and one UserEditAtom with no edit before it.
+ * `source` is the stream as read, decrypted when it was encrypted, and `persist` maps each persist id to the offset of
+ * its object. Returns the offset of the new UserEditAtom, which the Current User stream points at.
+ */
+async function rewritePresentation(source, size, persist, current, edits, sink, deadline) {
+    const marks = [...edits.remove, ...edits.replace.keys()].sort((a, b) => a - b);
+    const touched = (from, to) => {
+        let lo = 0;
+        let hi = marks.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (marks[mid] < from)
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        return lo < marks.length && marks[lo] < to;
+    };
+    const written = new Map();
+    let pos = 0;
+    for (const [id, offset] of [...persist].sort((a, b) => a[0] - b[0])) {
+        if (edits.dropPersist.has(id) || offset + 8 > size)
+            continue;
+        const parts = await recordBytes(source, offset, size, edits, touched, deadline);
+        if (!parts.length)
+            continue;
+        written.set(id, pos);
+        for (const p of parts) {
+            await sink.write(p);
+            pos += p.length;
+        }
+    }
+    // The directory: runs of consecutive ids, each a 20-bit first id and a 12-bit count, then their offsets.
+    const ids = [...written.keys()].sort((a, b) => a - b);
+    const dir = [];
+    for (let i = 0; i < ids.length;) {
+        let n = 1;
+        while (i + n < ids.length && ids[i + n] === ids[i] + n && n < 0xfff)
+            n++;
+        dir.push(...le32((ids[i] & 0xfffff) | (n << 20)));
+        for (let k = 0; k < n; k++)
+            dir.push(...le32(written.get(ids[i + k]) ?? 0));
+        i += n;
+    }
+    const dirAt = pos;
+    const dirRecord = Uint8Array.from([...head(0, PERSIST_DIRECTORY, dir.length), ...dir]);
+    await sink.write(dirRecord);
+    pos += dirRecord.length;
+    // The UserEditAtom: no edit before it, the new directory, and no encryption session once decrypted.
+    const body = Uint8Array.from(current.body.subarray(0, edits.decrypt ? 28 : current.body.length));
+    body.set(le32(0), 8);
+    body.set(le32(dirAt), 12);
+    const editAt = pos;
+    await sink.write(Uint8Array.from([...head(0, USER_EDIT, body.length), ...body]));
+    return editAt;
+}

package/dist/ppt.d.ts

@@ -1,8 +1,12 @@
 import { type CfbEntry, CompoundFile } from './cfb';
 import { type RunContext } from './context';
+import { CompoundPlan } from './plan';
 /**
  * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
  * current edit names. This reads every record at the top level of the stream as well as every object the persist
  * directories name, so an object that one route hides is still read.
+ *
+ * With `plan`, what the strip findings name is removed by a full save of the stream: the persist objects the current
+ * edit reaches, written again with the records that go left out, a new persist directory and a new UserEditAtom.
  */
-export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;
+export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, plan?: CompoundPlan): Promise<void>;