@patrickdk77/office-defuse 0.2.1 → 0.2.4

package/dist/ppt.js

@@ -39,11 +39,15 @@ const cfb_1 = require("./cfb");
 const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
+const forms_1 = require("./forms");
 const io_1 = require("./io");
 const links_1 = require("./links");
 const objects_1 = require("./objects");
 const offcrypto_1 = require("./offcrypto");
 const oleobj_1 = require("./oleobj");
+const plan_1 = require("./plan");
+const ppt_writer_1 = require("./ppt-writer");
+const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
 /** Record types of the PowerPoint binary format (MS-PPT 2.13.24). */
 const T = {
@@ -71,29 +75,44 @@ const header = (b) => ({ version: b[0] & 0x0f, instance: (b[0] | (b[1] << 8)) >>
  * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
  * current edit names. This reads every record at the top level of the stream as well as every object the persist
  * directories name, so an object that one route hides is still read.
+ *
+ * With `plan`, what the strip findings name is removed by a full save of the stream: the persist objects the current
+ * edit reaches, written again with the records that go left out, a new persist directory and a new UserEditAtom.
  */
-async function powerPointRules(ctx, cfb, stream) {
+async function powerPointRules(ctx, cfb, stream, plan) {
     const location = stream.name;
     let source = cfb.source(stream);
     let reader = new io_1.Reader(source, stream.size, 16384, 8);
     const persist = new Map();
+    const edits = (0, ppt_writer_1.noPresentationEdits)();
     const current = cfb.child(cfb.root, 'Current User');
+    let editAt = 0;
+    let session;
     if (current?.kind === 'stream') {
         const cu = await cfb.source(current).read(0, 24);
         if (cu.length >= 20 && header(cu).type === T.currentUserAtom) {
-            await readPersist(reader, stream.size, u32(cu, 16), persist, ctx.settings.deadline);
+            editAt = u32(cu, 16);
+            await readPersist(reader, stream.size, editAt, persist, ctx.settings.deadline);
             if (u32(cu, 12) === ENCRYPTED_TOKEN) {
-                source = await decryptPresentation(ctx, reader, stream, u32(cu, 16), persist);
+                const before = ctx.findings.length;
+                const opened = await decryptPresentation(ctx, reader, stream, editAt, persist);
+                source = opened.source;
+                session = opened.session;
                 reader = new io_1.Reader(source, stream.size, 16384, 8);
+                // The rewrite writes the presentation decrypted, so one VelvetSweatshop opens is rewritten when that finding strips.
+                if (ctx.findings.slice(before).some(f => f.category === types_1.OfficeCategory.Encrypted && f.detail === types_1.OfficeDetail.DefaultPassword && f.action === 'strip'))
+                    edits.decrypt = true;
             }
         }
     }
     const storages = new Map();
-    /** ExOleObjAtom types by the persist id of the storage they name: 0 embedded, 1 linked, 2 a control. */
+    /** ExOleObjAtoms by the persist id of the storage they name: the object's type, 0 embedded, 1 linked, 2 a control, and the container that holds the atom. */
     const roles = new Map();
-    const vba = new Set();
+    /** VBAInfoAtoms by the persist id of the project's storage, with the VBAInfoContainer around each. */
+    const vba = new Map();
+    const containers = [];
     const visited = new Set();
-    const walk = async (start, end, depth, siblings) => {
+    const walk = async (start, end, depth, siblings, parent) => {
         for (let pos = start; pos + 8 <= end;) {
             (0, errors_1.checkTime)(ctx.settings.deadline);
             const h = header(await reader.read(pos, 8));
@@ -106,32 +125,87 @@ async function powerPointRules(ctx, cfb, stream) {
                 storages.set(pos, { offset: pos, header: h });
             else if (h.type === T.exOleObjAtom && h.length >= 20) {
                 const b = await reader.read(pos + 8, 20);
-                roles.set(u32(b, 16), u32(b, 4));
+                roles.set(u32(b, 16), { type: u32(b, 4), container: parent });
+            }
+            else if (h.type === T.vbaInfoAtom && h.length >= 4) {
+                const id = u32(await reader.read(pos + 8, 4), 0);
+                vba.set(id, [...(vba.get(id) ?? []), parent]);
             }
-            else if (h.type === T.vbaInfoAtom && h.length >= 4)
-                vba.add(u32(await reader.read(pos + 8, 4), 0));
             if (h.version === 0x0f && depth < MAX_DEPTH) {
                 const kids = [];
-                await walk(pos + 8, bodyEnd, depth + 1, kids);
-                await containerRules(ctx, reader, h, pos, kids, location);
+                await walk(pos + 8, bodyEnd, depth + 1, kids, pos);
+                containers.push({ h, offset: pos, kids });
             }
             pos = bodyEnd;
         }
     };
     // Every record at the top level, then each persist object that does not start on a record already read.
-    await walk(0, stream.size, 0, []);
+    await walk(0, stream.size, 0, [], -1);
     for (const offset of persist.values()) {
         if (visited.has(offset) || offset + 8 > stream.size)
             continue;
         const h = header(await reader.read(offset, 8));
-        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, []);
+        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, [], -1);
     }
+    // The storages come first: a VBA project that stays keeps the actions that run its macros.
     const byOffset = new Map([...persist].map(([id, offset]) => [offset, id]));
     for (const s of storages.values()) {
         const id = byOffset.get(s.offset);
-        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id) === 2 ? 'control' : 'object';
-        await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`);
+        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id)?.type === 2 ? 'control' : 'object';
+        const verdict = await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`, plan !== undefined);
+        if (id === undefined || verdict === 'keep')
+            continue;
+        if (verdict === 'remove') {
+            // The storage goes, and so does what names it: the VBAInfoContainer, or the object's container in ExObjList.
+            edits.dropPersist.add(id);
+            if (role === 'vba')
+                for (const c of vba.get(id) ?? [])
+                    edits.remove.add(c);
+            else {
+                const holder = roles.get(id)?.container;
+                if (holder !== undefined && holder >= 0)
+                    edits.remove.add(holder);
+            }
+        }
+        else
+            edits.replace.set(s.offset, verdict.body);
+    }
+    const links = new Map();
+    const actions = [];
+    for (const c of containers)
+        await containerRules(ctx, reader, c.h, c.offset, c.kids, location, edits, links, actions);
+    // An action that opens a hyperlink that went does nothing.
+    for (const a of actions) {
+        if (a.action !== 4 || !links.has(a.hyperlink) || edits.replace.has(a.offset))
+            continue;
+        const body = Uint8Array.from(await reader.read(a.offset + 8, 16));
+        body[8] = 0;
+        edits.replace.set(a.offset, body);
     }
+    if (!plan || !current || !(0, ppt_writer_1.hasPresentationEdits)(edits))
+        return;
+    // An encrypted presentation's pictures and summary are encrypted too, in streams this rewrite does not decrypt. It
+    // is left as it was, and the check of the output says what it still holds.
+    if (session !== undefined && ['Pictures', 'EncryptedSummary'].some(n => (cfb.child(cfb.root, n)?.size ?? 0) > 0))
+        return;
+    if (session !== undefined) {
+        edits.decrypt = true;
+        edits.dropPersist.add(session);
+    }
+    const userEdit = header(await reader.read(editAt, 8));
+    const body = await reader.read(editAt + 8, Math.min(userEdit.length, 64));
+    if (userEdit.type !== T.userEditAtom || body.length < 28)
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    const newEdit = await (0, ppt_writer_1.rewritePresentation)(source, stream.size, persist, { body }, edits, sink, ctx.settings.deadline);
+    await sink.close();
+    plan.replace.set(stream, sink);
+    const user = Uint8Array.from(await cfb.bytes(current));
+    user.set([newEdit & 0xff, (newEdit >>> 8) & 0xff, (newEdit >>> 16) & 0xff, (newEdit >>> 24) & 0xff], 16);
+    if (edits.decrypt)
+        user.set([0x5f, 0xc0, 0x91, 0xe3], 12);
+    plan.replace.set(current, await (0, contained_1.spillOf)(ctx.run, user));
 }
 /**
  * The PowerPoint Document stream of an encrypted presentation, decrypted (MS-PPT 2.3.7). The current edit names the
@@ -142,7 +216,8 @@ async function powerPointRules(ctx, cfb, stream) {
 async function decryptPresentation(ctx, reader, stream, edit, persist) {
     const required = (reason) => new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, `The presentation is encrypted: ${reason}`, { stream: stream.name, reason });
     const u = await reader.read(edit, 40);
-    const sessionAt = u.length >= 40 && header(u).type === T.userEditAtom ? persist.get(u32(u, 36)) : undefined;
+    const sessionId = u.length >= 40 && header(u).type === T.userEditAtom ? u32(u, 36) : -1;
+    const sessionAt = persist.get(sessionId);
     if (sessionAt === undefined || sessionAt + 8 > stream.size)
         throw required('the current edit names no CryptSession10Container');
     const h = header(await reader.read(sessionAt, 8));
@@ -162,7 +237,7 @@ async function decryptPresentation(ctx, reader, stream, edit, persist) {
         copy.set(head, offset);
         copy.set(rc4.crypt(copy.subarray(offset + 8, offset + 8 + length)), offset + 8);
     }
-    return (0, io_1.bufferSource)(copy);
+    return { source: (0, io_1.bufferSource)(copy), session: sessionId };
 }
 /** Reads the persist directories of the current edit and every edit before it. Newer entries win. */
 async function readPersist(reader, size, start, persist, deadline) {
@@ -190,10 +265,15 @@ async function readPersist(reader, size, start, persist, deadline) {
         edit = u32(u, 16);
     }
 }
-/** One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. */
-async function storageRules(ctx, source, s, role, location) {
+/**
+ * One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. With
+ * `rewrite`, a VBA project goes to the script plugins and stays, without its compiled code, when they pass it; a
+ * Forms 2.0 control stays; an object stays as the file plugins left it. Anything a strip finding names goes.
+ */
+async function storageRules(ctx, source, s, role, location, rewrite) {
+    const compressed = s.header.instance === 1;
     let inner;
-    if (s.header.instance === 1) {
+    if (compressed) {
         const raw = await source.read(s.offset + 8, s.header.length);
         const declared = raw.length >= 4 ? u32(raw, 0) : 0;
         if (declared > ctx.settings.decompressedBytes)
@@ -203,8 +283,7 @@ async function storageRules(ctx, source, s, role, location) {
             bytes = zlib.inflateSync(raw.subarray(4), { maxOutputLength: Math.max(1, declared) });
         }
         catch {
-            unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
-            return;
+            return unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
         }
         inner = { size: async () => bytes.length, read: async (offset, length) => bytes.subarray(offset, offset + length) };
     }
@@ -223,28 +302,67 @@ async function storageRules(ctx, source, s, role, location) {
     catch (e) {
         if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
             throw e;
-        unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
-        return;
+        return unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
     }
     (0, objects_1.nestedNotes)(ctx, cfb, location);
-    if (role === 'control')
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) });
-    // An object's storage goes to the plugins as the compound file it is. The rewrite cannot change the presentation's
-    // records, so only a plugin that passes the object keeps it in the output.
+    const strips = ctx.strips;
+    if (role === 'control') {
+        const data = { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) };
+        const problem = await (0, forms_1.controlStorageProblem)(cfb, cfb.root, forms_1.OOXML_CONTROL_STREAMS);
+        if (problem)
+            ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...data, reason: (0, context_1.clip)(problem) });
+        else
+            ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, location, data);
+        // What the storage holds besides the control gets the rules any compound file gets.
+        await (0, objects_1.compoundRules)(ctx, cfb, location, false);
+        return ctx.strips > strips ? 'remove' : 'keep';
+    }
+    if (role === 'vba') {
+        // The project's storage is the root of the compound file, so the rules give it a plan of its own.
+        const own = new plan_1.CompoundPlan();
+        await (0, objects_1.compoundRules)(ctx, cfb, location, false, rewrite ? own : undefined);
+        const project = cfb.child(cfb.root, 'VBA');
+        if (!rewrite || !project || own.drop.has(project))
+            return ctx.strips > strips ? 'remove' : 'keep';
+        // The project stays: written again without its compiled code and whatever else its rules removed.
+        if (ctx.strips === strips && !own.replace.size && !own.drop.size)
+            return 'keep';
+        return { body: await storageBody(ctx, cfb, own, compressed) };
+    }
+    // An object's storage goes to the plugins as the compound file it is, and stays as they leave it.
     const size = await inner.size();
-    const decision = role === 'object' ? await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) }) : undefined;
-    await (0, objects_1.compoundRules)(ctx, cfb, location, role === 'object', undefined, decision);
+    const decision = await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) });
+    await (0, objects_1.compoundRules)(ctx, cfb, location, true, undefined, decision);
+    if ((decision && !decision.keep) || ctx.strips > strips)
+        return 'remove';
+    if (decision?.replacement) {
+        const bytes = await (0, io_1.readAll)(decision.replacement);
+        return { body: compressed ? Buffer.concat([Buffer.from(le32(bytes.length)), zlib.deflateSync(bytes)]) : bytes };
+    }
+    return 'keep';
 }
+/** An ExOleObjStg's data for a compound file written with `plan`: deflated after its size when it was compressed. */
+async function storageBody(ctx, cfb, plan, compressed) {
+    const sink = (0, io_1.bufferSink)();
+    await (0, rewrite_cfb_1.writeCompound)(ctx.run, cfb, plan, sink);
+    const bytes = sink.result();
+    return compressed ? Buffer.concat([Buffer.from(le32(bytes.length)), zlib.deflateSync(bytes)]) : bytes;
+}
+const le32 = (n) => [n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff];
 function unreadable(ctx, role, location, reason) {
-    if (role === 'vba')
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason });
-    else if (role === 'control')
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason });
-    else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+    const r = role === 'vba'
+        ? ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason })
+        : role === 'control'
+            ? ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason })
+            : ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+    return r.action === 'strip' ? 'remove' : 'keep';
 }
-/** The rules of one container record, from its children: actions, hyperlinks and linked media. */
-async function containerRules(ctx, reader, h, offset, kids, stream) {
+/**
+ * The rules of one container record, from its children: actions, hyperlinks and linked media. What strips goes in the
+ * edits: an action becomes no action, a hyperlink goes, and a linked file's path is emptied. `links` collects the ids
+ * of the hyperlinks that go, and `actions` every action, for the actions that open those.
+ */
+async function containerRules(ctx, reader, h, offset, kids, stream, edits, links, actions) {
     const location = `${stream}, offset ${offset}`;
     const strings = async () => {
         const out = new Map();
@@ -257,25 +375,38 @@ async function containerRules(ctx, reader, h, offset, kids, stream) {
         const atom = kids.find(k => k.h.type === T.interactiveInfoAtom && k.h.length >= 16);
         if (!atom)
             return;
-        const action = (await reader.read(atom.offset + 8 + 8, 1))[0];
+        const body = Uint8Array.from(await reader.read(atom.offset + 8, 16));
+        const action = body[8];
+        actions.push({ offset: atom.offset, hyperlink: u32(body, 4), action });
         const name = (await strings()).get(2) ?? '';
         const data = { trigger: h.instance === 1 ? 'mouse over' : 'click', ...(name ? { action: (0, context_1.clip)(name) } : {}) };
+        let r;
         if (action === 2)
-            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+            r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+        // A macro of a VBA project that stays keeps its action.
         else if (action === 1)
-            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data);
+            r = ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, (0, context_1.ownMacro)(ctx.run, name));
         else if (action === 5)
-            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+            r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+        if (r?.action === 'strip') {
+            body[8] = 0;
+            edits.replace.set(atom.offset, body);
+        }
     }
     else if (h.type === T.exHyperlink) {
         const s = await strings();
         const target = s.get(1) ?? '';
-        if (target.trim() && !(0, links_1.isFragment)(target))
-            ctx.link(target, location, { source: 'PowerPoint hyperlink' });
+        const atom = kids.find(k => k.h.type === T.exHyperlinkAtom && k.h.length >= 4);
+        if (target.trim() && !(0, links_1.isFragment)(target) && ctx.link(target, location, { source: 'PowerPoint hyperlink' }).action === 'strip') {
+            edits.remove.add(offset);
+            if (atom)
+                links.set(u32(await reader.read(atom.offset + 8, 4), 0), offset);
+        }
     }
     else if (MEDIA_LINKS.has(h.type)) {
         const path = (await strings()).get(0) ?? '';
-        if (path.trim())
-            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media');
+        const string = kids.find(k => k.h.type === T.cString && k.h.instance === 0);
+        if (path.trim() && ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media').action === 'strip' && string)
+            edits.replace.set(string.offset, new Uint8Array(0));
     }
 }

package/dist/rewrite-zip.js

@@ -281,7 +281,8 @@ async function writeOoxml(run, zip, plan, graph, format, limits, sink) {
         for (const [k, p] of graph.parts) {
             const removed = removedIds.get(k);
             const own = plan.parts.get(p.entry.name);
-            if (drops.has(k) || sheets.has(k) || plan.replace.has(k) || !(0, ooxml_1.isXmlType)(p.contentType) || (!removed && !own && !xpsDrops))
+            // An empty part, such as the presentation part PowerPoint writes into an add-in, refers to nothing.
+            if (drops.has(k) || sheets.has(k) || plan.replace.has(k) || !(0, ooxml_1.isXmlType)(p.contentType) || p.entry.size === 0 || (!removed && !own && !xpsDrops))
                 continue;
             const rules = {
                 element(el) {

package/dist/types.d.ts

@@ -79,6 +79,7 @@ export declare enum OfficeDetail {
     UnsupportedAlgorithm = "UNSUPPORTED_ALGORITHM",
     XorObfuscation = "XOR_OBFUSCATION",
     VbaProject = "VBA_PROJECT",
+    CompiledCode = "COMPILED_CODE",
     XlmMacrosheet = "XLM_MACROSHEET",
     WordBasic = "WORDBASIC",
     OdfBasic = "ODF_BASIC",
@@ -132,6 +133,8 @@ export declare enum OfficeDetail {
     PluginFailed = "PLUGIN_FAILED",
     PluginRemoved = "PLUGIN_REMOVED",
     ActiveX = "ACTIVEX",
+    FormsControl = "FORMS_CONTROL",
+    ControlPicture = "CONTROL_PICTURE",
     VerificationFailed = "VERIFICATION_FAILED"
 }
 export type OfficeFindingAction = 'reject' | 'strip' | 'info';
@@ -293,6 +296,41 @@ export interface ContainedFilePlugin {
     /** Writes the bytes to keep. Returning 'removed' drops the file after all. */
     process(file: ContainedFile, sink: ByteSink, context: PluginContext): Promise<'scrubbed' | 'passed' | 'removed' | ContainedFileResult>;
 }
+/** A type library or project a VBA project refers to, as its dir stream lists it. */
+export interface VbaReferenceInfo {
+    name: string;
+    kind: 'registered' | 'control' | 'project';
+    /** A type library's LibidReference, such as `*\G{...}#2.0#0#path#description`, or a project's path. */
+    libid: string;
+}
+/** A VBA module, as office-defuse shows it to a script plugin. */
+export interface ContainedScript {
+    /** The module's source, decoded with the project's code page. */
+    text: string;
+    /** "vba-" and the module's kind: "vba-document", "vba-standard", "vba-class" or "vba-form". */
+    trigger: string;
+    location: string;
+    /** The module's name. */
+    fieldName: string;
+    language: 'vba';
+    form: 'office';
+    /** The references of the module's project. office-defuse gives them with the project's first module only. */
+    references?: VbaReferenceInfo[];
+}
+export interface ScriptPlugin {
+    kind: 'script';
+    name: string;
+    accepts(script: ContainedScript): boolean | Promise<boolean>;
+    /**
+     * 'passed' keeps the module. Anything else removes the VBA project, since office-defuse writes no module a plugin
+     * rewrote. `findings` go into the report at the module's location.
+     */
+    process(script: ContainedScript): Promise<{
+        result: 'scrubbed' | 'passed' | 'removed';
+        text?: string;
+        findings?: DefuseFinding[];
+    }>;
+}
 export interface OfficeActionOverride {
     category: OfficeCategory;
     detail?: OfficeDetail;
@@ -323,6 +361,12 @@ export interface OfficeOptions {
     scoreBands?: OfficeScoreBands;
     /** Plugins that decide about the files inside the file: embedded objects and packages, OLE parts and attachments. */
     filePlugins?: ContainedFilePlugin[];
+    /**
+     * Plugins that decide about each module of a VBA project in a compound file or an OOXML package. The first plugin that
+     * accepts a module decides it. The project stays when every module passed, written without its compiled code so
+     * Office compiles the source the plugins read. Otherwise it goes, as it does without plugins.
+     */
+    scriptPlugins?: ScriptPlugin[];
     /** Directory for temporary files. Defaults to os.tmpdir(). */
     tempDir?: string;
     /**

package/dist/types.js

@@ -90,6 +90,7 @@ var OfficeDetail;
     OfficeDetail["XorObfuscation"] = "XOR_OBFUSCATION";
     // MACRO
     OfficeDetail["VbaProject"] = "VBA_PROJECT";
+    OfficeDetail["CompiledCode"] = "COMPILED_CODE";
     OfficeDetail["XlmMacrosheet"] = "XLM_MACROSHEET";
     OfficeDetail["WordBasic"] = "WORDBASIC";
     OfficeDetail["OdfBasic"] = "ODF_BASIC";
@@ -151,6 +152,8 @@ var OfficeDetail;
     OfficeDetail["PluginRemoved"] = "PLUGIN_REMOVED";
     // CONTROL
     OfficeDetail["ActiveX"] = "ACTIVEX";
+    OfficeDetail["FormsControl"] = "FORMS_CONTROL";
+    OfficeDetail["ControlPicture"] = "CONTROL_PICTURE";
     // PROCESSING
     OfficeDetail["VerificationFailed"] = "VERIFICATION_FAILED";
 })(OfficeDetail || (exports.OfficeDetail = OfficeDetail = {}));

package/dist/vba.d.ts

@@ -0,0 +1,78 @@
+import type { CfbEntry, CompoundFile } from './cfb';
+/**
+ * A VBA project as MS-OVBA stores one: a VBA storage with a dir stream that lists the modules, and a stream per module
+ * that holds the module's compiled p-code and then its compressed source. Office runs the p-code when the same VBA
+ * version compiled it, so the p-code can do something other than the source says (VBA stomping). A project kept after
+ * its source was checked is written without the p-code, and with the source compressed again, so Office compiles the
+ * text that was checked.
+ */
+export declare class VbaError extends Error {
+}
+/**
+ * Decompresses an MS-OVBA CompressedContainer (2.4.1.3.1). Throws VbaError when a copy token reaches before its chunk,
+ * a chunk decompresses past 4096 bytes, or the output passes `limit`. A chunk header without its signature bits is
+ * read like any other, and fewer than 3 bytes at the end are taken as padding: Office opens files written that way.
+ */
+export declare function decompress(data: Uint8Array, limit?: number): Uint8Array;
+/**
+ * Compresses `data` into an MS-OVBA CompressedContainer (2.4.1.3.6). The longest match comes from a hash chain of
+ * the positions in the chunk. Throws VbaError for a last chunk that compresses past 4096 bytes, which MS-OVBA can only
+ * write as a raw chunk padded to 4096 bytes, with padding Office would read as source.
+ */
+export declare function compress(data: Uint8Array): Uint8Array;
+/** One record of the dir stream (MS-OVBA 2.3.4.2), as read. */
+interface DirRecord {
+    id: number;
+    data: Uint8Array;
+}
+/** A module of a VBA project. */
+export interface VbaModule {
+    name: string;
+    /**
+     * What the PROJECT stream says the module is: a document's or a sheet's module, a code module, a class module or a
+     * user form. A module the PROJECT stream leaves out is a code or class module as its dir record says.
+     */
+    kind: 'document' | 'standard' | 'class' | 'form';
+    stream: CfbEntry;
+    /** Where the compressed source starts in the stream. The bytes before it are p-code. */
+    offset: number;
+    /** The source as stored, in the project's code page. */
+    bytes: Uint8Array;
+    source: string;
+}
+/** A type library or project the VBA project refers to (MS-OVBA 2.3.4.2.2). */
+export interface VbaReference {
+    name: string;
+    kind: 'registered' | 'control' | 'project';
+    /** The library's LibidReference (2.1.1.8), or for a project reference its absolute path (2.1.1.12). */
+    libid: string;
+}
+export interface VbaProject {
+    storage: CfbEntry;
+    dir: CfbEntry;
+    codePage: number;
+    modules: VbaModule[];
+    references: VbaReference[];
+    records: DirRecord[];
+    /** The MD5 of the references and the modules' names, kinds and sources: what a plugin's verdict is about. */
+    digest: string;
+}
+/**
+ * Reads the project in `vba`, the VBA storage: the dir stream, the references, and each module's source. Throws
+ * VbaError when a stream the dir names is missing or a source does not decompress, which leaves nothing to check.
+ */
+export declare function readProject(cfb: CompoundFile, vba: CfbEntry, limit?: number): Promise<VbaProject>;
+/** The `_VBA_PROJECT` stream of a project no VBA version compiled, which makes Office compile the source. */
+export declare const PURGED_VBA_PROJECT: Uint8Array<ArrayBuffer>;
+/**
+ * The project's streams without p-code, as Mandiant's OfficePurge writes them: each module stream holds only its
+ * source, compressed again; the dir stream says each source starts at 0; `_VBA_PROJECT` names no VBA version. The
+ * `__SRP_` caches and anything else in the VBA storage that the dir does not name go.
+ */
+export declare function purge(project: VbaProject): {
+    replace: Map<CfbEntry, Uint8Array>;
+    drop: CfbEntry[];
+};
+/** Whether the project is as `purge` writes it, so writing it again changes nothing. */
+export declare function isPurged(cfb: CompoundFile, project: VbaProject): Promise<boolean>;
+export {};