@patrickdk77/office-defuse 0.2.1 → 0.2.4

package/dist/xls.d.ts

@@ -1,6 +1,7 @@
 import { type BiffRecord } from './biff';
 import type { CfbEntry, CompoundFile } from './cfb';
 import { type RunContext } from './context';
+import type { CompoundPlan } from './plan';
 /** Turns an encrypted record body into its plain bytes. Without encryption the body is as stored. */
 export type Decrypt = (r: BiffRecord) => Uint8Array;
 /**
@@ -23,7 +24,14 @@ export declare function workbookKind(cfb: CompoundFile, stream: CfbEntry, deadli
  * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
  * hyperlinks. An encrypted workbook goes through `unlock`.
  */
-export declare function excelRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, unlock: Unlock): Promise<void>;
+/** An ActiveX control a sheet's Obj record keeps in the Ctls stream: its ProgID and where its data is. */
+export interface CtlsControl {
+    progId: string;
+    position: number;
+    size: number;
+    sheet: string;
+}
+export declare function excelRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, unlock: Unlock, plan?: CompoundPlan, controls?: CtlsControl[]): Promise<void>;
 /**
  * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
  * volume, the root, a folder, a step up, a URL's volume or Excel's startup folders.

package/dist/xls.js

@@ -8,9 +8,11 @@ const biff_1 = require("./biff");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const formulas_1 = require("./formulas");
+const io_1 = require("./io");
 const links_1 = require("./links");
 const oleobj_1 = require("./oleobj");
 const types_1 = require("./types");
+const xls_writer_1 = require("./xls-writer");
 const STATES = ['visible', 'hidden', 'very hidden', 'hidden'];
 /** Record types of cell formulas (MS-XLS 2.4.127, 2.4.260 and 2.4.4): FORMULA, SHRFMLA and ARRAY. */
 const FORMULA = 0x0006;
@@ -41,13 +43,7 @@ async function workbookKind(cfb, stream, deadline) {
     }
     return kind;
 }
-/**
- * Inspects an Excel 5.0 to 2003 workbook stream. Excel reads the globals substream from the start of the stream,
- * then each sheet from where its BoundSheet record says the sheet starts. The globals give the macro sheets, the
- * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
- * hyperlinks. An encrypted workbook goes through `unlock`.
- */
-async function excelRules(ctx, cfb, stream, unlock) {
+async function excelRules(ctx, cfb, stream, unlock, plan, controls = []) {
     const location = stream.name;
     const records = new biff_1.RecordReader(cfb, stream, 0, ctx.settings.deadline);
     const first = await records.next();
@@ -60,24 +56,32 @@ async function excelRules(ctx, cfb, stream, unlock) {
     const names = [];
     /** The SupBook each XTI of the ExternSheet record names. */
     const xti = [];
+    const edits = (0, xls_writer_1.noEdits)();
+    /** Names that run a macro and go, by their Lbl record, given new names once every name is known. */
+    const renames = [];
     for (let r = await records.next(); r && r.type !== biff_1.R.eof; r = await records.next()) {
         if (r.type === biff_1.R.filePass) {
+            const before = ctx.findings.length;
             decrypt = await unlock(ctx, r, location);
+            // The rewrite writes the workbook decrypted, so one VelvetSweatshop opens is rewritten when that finding strips.
+            if (ctx.findings.slice(before).some(f => f.category === types_1.OfficeCategory.Encrypted && f.detail === types_1.OfficeDetail.DefaultPassword && f.action === 'strip'))
+                edits.decrypt = true;
             continue;
         }
         const body = decrypt(r);
         if (r.type === biff_1.R.boundSheet)
-            sheets.push((0, biff_1.parseBoundSheet)(body, biff8));
+            sheets.push({ ...(0, biff_1.parseBoundSheet)(body, biff8), record: r.offset });
         else if (r.type === biff_1.R.lbl) {
             const name = (0, biff_1.parseLbl)(body, biff8);
             names.push(name.name);
             const auto = (0, biff_1.autoName)(name.name);
-            if (auto)
-                ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, location, { event: auto.event, name: (0, context_1.clip)(name.name) });
+            // Removing the name would renumber the names after it, which formulas refer to by number, so it is renamed.
+            if (auto && ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, location, { event: auto.event, name: (0, context_1.clip)(name.name) }).action === 'strip')
+                renames.push({ offset: r.offset, event: auto.event });
         }
         else if (r.type === biff_1.R.supBook && body.length >= 4) {
             const cch = body[2] | (body[3] << 8);
-            books.push({ ctab: body[0] | (body[1] << 8), cch, path: cch > 0 && cch <= 0xff ? (0, biff_1.xlString)(body, 4, cch).text : '', ole: false, dde: false, names: [] });
+            books.push({ ctab: body[0] | (body[1] << 8), cch, path: cch > 0 && cch <= 0xff ? (0, biff_1.xlString)(body, 4, cch).text : '', ole: false, dde: false, names: [], offset: r.offset });
         }
         else if (r.type === biff_1.R.externSheet && biff8 && body.length >= 2) {
             const n = body[0] | (body[1] << 8);
@@ -95,31 +99,64 @@ async function excelRules(ctx, cfb, stream, unlock) {
                 books[books.length - 1].dde = true;
         }
     }
+    // A link that goes keeps its SupBook, which formulas count to by index, with a path to the workbook itself.
     for (const b of books)
-        linkRules(ctx, b, location);
+        if (linkRules(ctx, b, location)?.action === 'strip')
+            edits.selfBooks.add(b.offset);
     const nameOf = (ref) => (ref.kind === 'name' ? names[ref.index - 1] : books[xti[ref.ixti] ?? -1]?.names[ref.index - 1]);
+    // A macro of the workbook's own: an external name of the SupBook that is the workbook itself, as Excel names a VBA
+    // macro a button runs. A defined name may stand for anything, so it is not one.
+    const ownName = (ref) => (ref.kind === 'namex' && books[xti[ref.ixti] ?? -1]?.cch === 0x401 ? nameOf(ref) : undefined);
     for (const s of sheets)
-        await sheetRules(ctx, cfb, stream, s, decrypt, location, biff8 ? nameOf : undefined);
+        await sheetRules(ctx, cfb, stream, s, decrypt, location, edits, controls, biff8 ? nameOf : undefined, biff8 ? ownName : undefined);
+    const taken = new Set(names.map(n => n.toLowerCase()));
+    for (const { offset, event } of renames) {
+        let k = 1;
+        while (taken.has(`removed_${event}_${k}`.toLowerCase()))
+            k++;
+        const name = `Removed_${event}_${k}`;
+        taken.add(name.toLowerCase());
+        edits.names.set(offset, name);
+    }
+    // BIFF5 has no SupBook, HLink or Obj macro records in the shape BIFF8 has, so only its sheets and names change. What
+    // else strips stays, and the check of the output says so.
+    if (!biff8) {
+        edits.objMacros.clear();
+        edits.selfBooks.clear();
+        edits.hyperlinks.clear();
+    }
+    if (!plan || !(0, xls_writer_1.hasEdits)(edits))
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    try {
+        await (0, xls_writer_1.rewriteWorkbook)(cfb, stream, edits, biff8, decrypt, sink, ctx.settings.deadline);
+        await sink.close();
+        plan.replace.set(stream, sink);
+    }
+    catch (e) {
+        // Left as it is, the stream still holds what the findings name, and the check of the output says so.
+        if (!(e instanceof xls_writer_1.RewriteError))
+            throw e;
+    }
 }
-/** A SupBook record, read as MS-XLS 2.4.271 and oletools tell its kinds apart. */
+/**
+ * A SupBook record, read as MS-XLS 2.4.271 and oletools tell its kinds apart. A path that starts with U+0002 or U+0003
+ * refers to the workbook itself, as LibreOffice reads it.
+ */
 function linkRules(ctx, b, location) {
-    if (b.cch === 0x401 || b.cch === 0x3a01 || b.path === ' ' || b.path === '\0' || !b.path)
-        return;
+    if (b.cch === 0x401 || b.cch === 0x3a01 || b.path === ' ' || b.path === '\0' || !b.path || b.path.charCodeAt(0) === 2 || b.path.charCodeAt(0) === 3)
+        return undefined;
     if (b.ctab === 0) {
         // A DDE or OLE data source: the application or class, U+0003, and the topic or file.
         const [application, topic = ''] = b.path.split('\x03');
         if (b.ole && !b.dde) {
             const data = { source: 'SupBook', className: (0, context_1.clip)(application) };
-            if (topic)
-                ctx.external(types_1.OfficeDetail.Object, topic, location, data, 'linked object');
-            else
-                ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
+            return topic ? ctx.external(types_1.OfficeDetail.Object, topic, location, data, 'linked object') : ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
         }
-        else
-            ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, location, { application: (0, context_1.clip)(application), topic: (0, context_1.clip)(topic) });
-        return;
+        return ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, location, { application: (0, context_1.clip)(application), topic: (0, context_1.clip)(topic) });
     }
-    ctx.external(types_1.OfficeDetail.Workbook, virtualPath(b.path), location, { source: 'SupBook' }, 'external workbook');
+    return ctx.external(types_1.OfficeDetail.Workbook, virtualPath(b.path), location, { source: 'SupBook' }, 'external workbook');
 }
 /**
  * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
@@ -152,7 +189,7 @@ function virtualPath(p) {
     return out;
 }
 /** One sheet's substream, with any chart substreams inside it: Obj records that run macros, and hyperlinks. */
-async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
+async function sheetRules(ctx, cfb, stream, s, decrypt, location, edits, controls, nameOf, ownName) {
     const records = new biff_1.RecordReader(cfb, stream, s.position, ctx.settings.deadline);
     const bof = await records.next();
     if (bof?.type !== biff_1.R.bof || bof.body.length < 4)
@@ -160,8 +197,9 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
     const bofType = bof.body[2] | (bof.body[3] << 8);
     // The sheet's own BOF says what it is, and so does its BoundSheet record. Either one makes a macro sheet.
     const macroSheet = s.type === 1 || bofType === 0x0040;
-    if (macroSheet)
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, location, { sheet: (0, context_1.clip)(s.name), state: STATES[s.state] });
+    // A macro sheet becomes an empty worksheet of the same name, so the sheets after it keep their indexes.
+    if (macroSheet && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, location, { sheet: (0, context_1.clip)(s.name), state: STATES[s.state] }).action === 'strip' && s.record !== undefined)
+        edits.emptySheets.add(s.record);
     let depth = 1;
     for (let r = await records.next(); r && depth > 0; r = await records.next()) {
         if (r.type === biff_1.R.bof)
@@ -169,13 +207,23 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
         else if (r.type === biff_1.R.eof)
             depth--;
         else if (r.type === biff_1.R.obj) {
-            if (objMacro(decrypt(r)))
-                ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, { sheet: (0, context_1.clip)(s.name) });
+            const body = decrypt(r);
+            const control = ctlsControl(body);
+            if (control)
+                controls.push({ ...control, sheet: s.name });
+            const macro = objMacro(body);
+            if (!macro)
+                continue;
+            // A shape that runs one of the workbook's own macros stays when its VBA project does.
+            const name = macro.ref && ownName ? ownName(macro.ref) : undefined;
+            const data = { sheet: (0, context_1.clip)(s.name), ...(macro.ref && nameOf ? { macro: (0, context_1.clip)(nameOf(macro.ref) ?? '') } : {}) };
+            if (ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name === undefined ? undefined : (0, context_1.ownMacro)(ctx.run, name)).action === 'strip')
+                edits.objMacros.add(r.offset);
         }
         else if (r.type === biff_1.R.hlink) {
             const target = hyperlink(decrypt(r));
-            if (target.trim() && !(0, links_1.isFragment)(target))
-                ctx.link(target, location, { sheet: (0, context_1.clip)(s.name), source: 'HLink record' });
+            if (target.trim() && !(0, links_1.isFragment)(target) && ctx.link(target, location, { sheet: (0, context_1.clip)(s.name), source: 'HLink record' }).action === 'strip')
+                edits.hyperlinks.add(r.offset);
         }
         else if (nameOf && !macroSheet && FORMULA_AT.has(r.type)) {
             // A macro sheet's formulas are its macros, which its own finding covers.
@@ -189,20 +237,55 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
         }
     }
 }
-/** Whether an Obj record (MS-XLS 2.4.181) holds an FtMacro subrecord, the macro a click runs. */
+/**
+ * The FtMacro subrecord of an Obj record (MS-XLS 2.4.181), the macro a click runs, with the name its formula refers
+ * to when the formula is one PtgName or PtgNameX and nothing else. Undefined when the record has none.
+ */
 function objMacro(b) {
-    let at = 0;
-    while (at + 4 <= b.length) {
-        const ft = b[at] | (b[at + 1] << 8);
-        const cb = b[at + 2] | (b[at + 3] << 8);
-        // FtEnd ends the list, and FtLbsData's length does not count all its data, so the walk stops there.
-        if (ft === 0x00 || ft === 0x13)
-            return false;
-        if (ft === 0x04)
-            return cb > 0;
-        at += 4 + cb;
+    for (const { ft, data: f } of (0, biff_1.objSubrecords)(b)) {
+        if (ft !== 0x04)
+            continue;
+        if (f.length === 0)
+            return undefined;
+        // As Excel writes it: cce in 15 bits, 4 unused bytes, and the tokens. PtgName and PtgNameX are classed tokens,
+        // 0x23, 0x43 or 0x63 and 0x39, 0x59 or 0x79; a base token below 0x20 shares their low bits and is neither.
+        const cce = f.length >= 2 ? (f[0] | (f[1] << 8)) & 0x7fff : 0;
+        const rgce = f.subarray(6, 6 + cce);
+        const ptg = rgce[0] ?? 0;
+        const u32 = (k) => (rgce[k] | (rgce[k + 1] << 8) | (rgce[k + 2] << 16) | (rgce[k + 3] << 24)) >>> 0;
+        if (ptg >= 0x20 && (ptg & 0x1f) === 0x03 && cce === 5 && rgce.length === 5)
+            return { ref: { kind: 'name', index: u32(1) } };
+        if (ptg >= 0x20 && (ptg & 0x1f) === 0x19 && cce === 7 && rgce.length === 7)
+            return { ref: { kind: 'namex', ixti: rgce[1] | (rgce[2] << 8), index: u32(3) } };
+        return {};
+    }
+    return undefined;
+}
+/**
+ * The control an Obj record keeps in the Ctls stream: FtPioGrbit says an ActiveX control (fCtl) whose data is in Ctls
+ * (fPrstm), and FtPictFmla gives its ProgID, in the formula's embedInfo, and its place in Ctls after the formula.
+ */
+function ctlsControl(b) {
+    let flags = 0;
+    for (const { ft, data: d } of (0, biff_1.objSubrecords)(b)) {
+        if (ft === 0x08 && d.length >= 2)
+            flags = d[0] | (d[1] << 8);
+        if (ft !== 0x09 || (flags & 0x30) !== 0x30 || d.length < 2)
+            continue;
+        // ObjFmla: cbFmla, then cce, 4 unused bytes, the tokens, and PictFmlaEmbedInfo: 0x03, cbClass, a reserved byte
+        // and the class name. lPosInCtlStm and cbBufInCtlStm follow.
+        const cbFmla = d[0] | (d[1] << 8);
+        const f = d.subarray(2, 2 + cbFmla);
+        const cce = f.length >= 2 ? (f[0] | (f[1] << 8)) & 0x7fff : 0;
+        const info = f.subarray(6 + cce);
+        const progId = info[0] === 0x03 && info.length >= 4 ? (0, biff_1.xlString)(info, 3, info[1]).text : '';
+        const after = 2 + cbFmla;
+        if (after + 8 > d.length)
+            return undefined;
+        const u32 = (k) => (d[k] | (d[k + 1] << 8) | (d[k + 2] << 16) | (d[k + 3] << 24)) >>> 0;
+        return { progId, position: u32(after), size: u32(after + 4) };
     }
-    return false;
+    return undefined;
 }
 /** The target of an HLink record: its Hyperlink Object (MS-OSHARED 2.3.7.1) after the cell range and class id. */
 function hyperlink(b) {

package/dist/xml.d.ts

@@ -159,6 +159,9 @@ export declare class XmlTokenizer {
     /** The XML declaration says standalone="yes". */
     private standalone;
     private encoding;
+    /** Set by a declaration of US-ASCII, which agrees with UTF-8 only while every byte is ASCII. */
+    private asciiDeclared;
+    private nonAscii;
     /** Start tags read so far, which numbers the elements. */
     private elements;
     /** An attribute value of the tag being read referred to an entity of the internal subset. */

package/dist/xml.js

@@ -190,6 +190,9 @@ class XmlTokenizer {
     /** The XML declaration says standalone="yes". */
     standalone = false;
     encoding = 'utf-8';
+    /** Set by a declaration of US-ASCII, which agrees with UTF-8 only while every byte is ASCII. */
+    asciiDeclared = false;
+    nonAscii = false;
     /** Start tags read so far, which numbers the elements. */
     elements = 0;
     /** An attribute value of the tag being read referred to an entity of the internal subset. */
@@ -263,6 +266,14 @@ class XmlTokenizer {
         return decoder;
     }
     decode(decoder, bytes, more) {
+        if (!this.nonAscii)
+            for (const c of bytes)
+                if (c >= 0x80) {
+                    this.nonAscii = true;
+                    break;
+                }
+        if (this.asciiDeclared && this.nonAscii)
+            this.stop(types_1.OfficeDetail.Encoding, 'The declaration says us-ascii, the bytes are not all ASCII');
         try {
             return decoder.decode(bytes, { stream: more });
         }
@@ -279,9 +290,16 @@ class XmlTokenizer {
         const declared = /\bencoding\s*=\s*(["'])([^"']*)\1/.exec(body)?.[2]?.toLowerCase();
         if (declared === undefined)
             return;
-        const ok = this.encoding === 'utf-8' ? declared === 'utf-8' || declared === 'utf8' : declared === 'utf-16' || declared === this.encoding;
+        // SharePoint declares us-ascii on the custom XML it writes. ASCII bytes read the same in UTF-8.
+        const ascii = this.encoding === 'utf-8' && (declared === 'us-ascii' || declared === 'ascii');
+        const ok = this.encoding === 'utf-8' ? declared === 'utf-8' || declared === 'utf8' || ascii : declared === 'utf-16' || declared === this.encoding;
         if (!ok)
             this.stop(types_1.OfficeDetail.Encoding, `The declaration says ${declared}, the bytes are ${this.encoding.toUpperCase()}`);
+        if (ascii) {
+            this.asciiDeclared = true;
+            if (this.nonAscii)
+                this.stop(types_1.OfficeDetail.Encoding, 'The declaration says us-ascii, the bytes are not all ASCII');
+        }
     }
     feed(text, final) {
         this.buf = this.pos < this.buf.length ? this.buf.slice(this.pos) + text : text;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",