@patrickdk77/office-defuse 0.2.2 → 0.3.0

package/dist/forms.d.ts

@@ -0,0 +1,51 @@
+import { type CfbEntry, type CompoundFile } from './cfb';
+/** The number of classes in the class table of a FormControl (MS-OFORMS 2.2.10.1), the `f` stream. */
+export declare function classTableCount(f: Uint8Array): number;
+/**
+ * Why a user form's designer storage may hold something other than Forms 2.0 controls, or undefined when it holds
+ * only those: the UserForm designer, storages of Forms 2.0 classes, and forms whose class tables are empty.
+ */
+export declare function designerProblem(cfb: CompoundFile, storage: CfbEntry, limit: number): Promise<string | undefined>;
+/**
+ * The properties a Forms 2.0 control persists, in the order of its property mask (MS-OFORMS 2.2). Each takes the
+ * next bit. A number sits in the data block, aligned to its size; a string or a pair in the extra data block; a
+ * picture in the stream data; a flag holds no data. A bit MS-OFORMS leaves undefined must be clear.
+ */
+type Prop = 'u8' | 'u16' | 'u32' | 'pair' | 'string' | 'picture' | 'flag' | 'undefined';
+interface ControlLayout {
+    props: Prop[];
+    /** The property mask is 64 bits wide. */
+    wide: boolean;
+    text: boolean;
+}
+/** The Forms 2.0 controls office-defuse reads, by class id. Frames, multipages and tab strips hold other controls and are not here. */
+export declare const FORMS_CONTROLS: ReadonlyMap<string, ControlLayout>;
+/** The ProgIDs of those controls, which a property bag or CompObj may name. */
+export declare const FORMS_PROGIDS: ReadonlyMap<string, string>;
+/**
+ * Why the persisted data of a Forms 2.0 control may not be what Forms 2.0 writes, or undefined when it is: the
+ * control's property block, then its TextProps for a control with text, then the column infos a list control counts,
+ * and nothing after. A picture or a mouse icon counts as a problem, since its bytes are a picture file Office decodes
+ * and office-defuse cannot rewrite in place.
+ */
+export declare function controlProblem(classId: string, data: Uint8Array): string | undefined;
+/**
+ * Why a Forms 2.0 control persisted as a property bag in its activeX part may hold more than plain values, or
+ * undefined when it does not. `props` are the bag's name and value pairs, `nested` says ax:ocx held any other element,
+ * inside an ax:ocxPr or beside one, such as a font or a picture.
+ */
+export declare function bagProblem(classId: string, props: ReadonlyArray<{
+    name: string;
+    value: string;
+}>, nested: boolean): string | undefined;
+/** Streams a control's storage holds in an OOXML binary part: its class and its properties. */
+export declare const OOXML_CONTROL_STREAMS: ReadonlySet<string>;
+/** In a Word document, the storage also holds the control's name and its picture for printing. */
+export declare const WORD_CONTROL_STREAMS: ReadonlySet<string>;
+/**
+ * Why a control's storage may not hold a Forms 2.0 control as Office persists one, or undefined when it does. Its
+ * class is the storage's class id, or its CompObj's ProgID when that is null, and must be `classId` when given. It
+ * holds only the `allowed` streams and a contents stream that `controlProblem` passes.
+ */
+export declare function controlStorageProblem(cfb: CompoundFile, storage: CfbEntry, allowed: ReadonlySet<string>, classId?: string): Promise<string | undefined>;
+export {};

package/dist/forms.js

@@ -0,0 +1,316 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WORD_CONTROL_STREAMS = exports.OOXML_CONTROL_STREAMS = exports.FORMS_PROGIDS = exports.FORMS_CONTROLS = void 0;
+exports.classTableCount = classTableCount;
+exports.designerProblem = designerProblem;
+exports.controlProblem = controlProblem;
+exports.bagProblem = bagProblem;
+exports.controlStorageProblem = controlStorageProblem;
+const cfb_1 = require("./cfb");
+const oleobj_1 = require("./oleobj");
+/**
+ * The designer storage of a VBA user form (MS-OVBA 2.2.10), which holds the form and its controls as Forms 2.0
+ * persists them (MS-OFORMS). A form site names its control's class by an index into Forms 2.0's own controls, or
+ * into the form's class table, which may name any ActiveX control. A form whose class tables are empty therefore
+ * holds Forms 2.0 controls only.
+ */
+/** The Forms 2.0 form, frame and multipage, the classes a designer and the storages under it are written as. */
+const FORM_CLASSES = new Set(['C62A69F0-16DC-11CE-9E98-00AA00574A4F', '6E182020-F460-11CE-9BCD-00AA00608E01', '46E31370-3F7A-11CE-BED6-00AA00611080']);
+const FORM_PROGIDS = new Set(['forms.form.1', 'forms.frame.1', 'forms.multipage.1']);
+/** The UserForm designer, which \x03VBFrame names. */
+const USER_FORM = 'C62A69F0-16DC-11CE-9E98-00AA00574A4F';
+const NULL_CLSID = '00000000-0000-0000-0000-000000000000';
+/** StdFont's GUID, as GuidAndFont writes it, which a StdFont structure follows; any other is TextProps. */
+const STD_FONT = '0352e30b918fce119de300aa004bb851';
+/** FORM_FLAG_DONTSAVECLASSTABLE, in BooleanProperties. */
+const NO_CLASS_TABLE = 0x8000;
+class FormError extends Error {
+}
+/** The number of classes in the class table of a FormControl (MS-OFORMS 2.2.10.1), the `f` stream. */
+function classTableCount(f) {
+    const b = Buffer.from(f.buffer, f.byteOffset, f.byteLength);
+    const need = (at, n) => {
+        if (at + n > b.length)
+            throw new FormError('a form stream cut short');
+    };
+    need(0, 8);
+    if (b[1] !== 0x04)
+        throw new FormError(`a form of version ${b[1]}.${b[0]}`);
+    const cbForm = b.readUInt16LE(2);
+    const mask = b.readUInt32LE(4);
+    // BooleanProperties follows BackColor, ForeColor and NextAvailableID, each 4 bytes when present.
+    let booleans = 0x04;
+    if (mask & (1 << 6)) {
+        let at = 8;
+        for (const bit of [1, 2, 3])
+            if (mask & (1 << bit))
+                at += 4;
+        need(at, 4);
+        booleans = b.readUInt32LE(at);
+    }
+    // cbForm counts the property mask and the data blocks; the stream data follows them.
+    let p = 4 + cbForm;
+    const picture = () => {
+        need(p, 24);
+        p += 16;
+        if (b.readUInt32LE(p) !== 0x746c)
+            throw new FormError('a form picture without its preamble');
+        p += 8 + b.readUInt32LE(p + 4);
+    };
+    if (mask & (1 << 15))
+        picture();
+    if (mask & (1 << 20)) {
+        need(p, 16);
+        const stdFont = b.subarray(p, p + 16).toString('hex') === STD_FONT;
+        p += 16;
+        if (stdFont) {
+            need(p, 11);
+            p += 11 + b[p + 10];
+        }
+        else {
+            need(p, 4);
+            p += 4 + b.readUInt16LE(p + 2);
+        }
+    }
+    if (mask & (1 << 21))
+        picture();
+    if (booleans & NO_CLASS_TABLE)
+        return 0;
+    need(p, 2);
+    return b.readUInt16LE(p);
+}
+/**
+ * Why a user form's designer storage may hold something other than Forms 2.0 controls, or undefined when it holds
+ * only those: the UserForm designer, storages of Forms 2.0 classes, and forms whose class tables are empty.
+ */
+async function designerProblem(cfb, storage, limit) {
+    const frame = storage.children.find(c => c.kind === 'stream' && c.name === '\x03VBFrame');
+    if (!frame)
+        return 'it has no \\x03VBFrame stream';
+    if (frame.size > limit)
+        return 'its \\x03VBFrame stream is past the limit';
+    const designer = /Begin\s+\{([0-9A-Fa-f-]{36})\}/.exec(Buffer.from(await cfb.bytes(frame)).toString('latin1'))?.[1]?.toUpperCase();
+    if (designer !== USER_FORM)
+        return `its designer is ${designer ?? 'not named'}, not the UserForm designer`;
+    const walk = async (s, top) => {
+        for (const c of s.children) {
+            if (c.kind === 'storage') {
+                if (!/^i\d+$/.test(c.name))
+                    return `it holds a storage named ${JSON.stringify(c.name)}`;
+                const cls = c.clsid === NULL_CLSID ? '' : c.clsid;
+                if (!cls) {
+                    const compObj = c.children.find(x => x.kind === 'stream' && x.name === '\x01CompObj');
+                    const progId = compObj && compObj.size <= 65536 ? (0, oleobj_1.parseCompObj)(await cfb.bytes(compObj)).progId : undefined;
+                    if (!progId || !FORM_PROGIDS.has(progId.trim().toLowerCase()))
+                        return `it holds a control of class ${progId ?? 'not named'}`;
+                }
+                else if (!FORM_CLASSES.has(cls))
+                    return `it holds a control of class ${cls}`;
+                const inner = await walk(c, false);
+                if (inner)
+                    return inner;
+                continue;
+            }
+            if (c.name === 'f') {
+                if (c.size > limit)
+                    return 'a form stream is past the limit';
+                try {
+                    if (classTableCount(await cfb.bytes(c)) > 0)
+                        return 'a form names controls in its class table, which may be any ActiveX control';
+                }
+                catch (e) {
+                    if (!(e instanceof FormError))
+                        throw e;
+                    return e.message;
+                }
+            }
+            else if (!['o', 'x', '\x01CompObj'].includes(c.name) && !(top && c.name === '\x03VBFrame'))
+                return `it holds a stream named ${JSON.stringify(c.name)}`;
+        }
+        return undefined;
+    };
+    return walk(storage, true);
+}
+const BUTTON = ['u32', 'u32', 'u32', 'string', 'u32', 'pair', 'u8', 'picture', 'u16', 'flag', 'picture'];
+const LABEL = ['u32', 'u32', 'u32', 'string', 'u32', 'pair', 'u8', 'u32', 'u16', 'u16', 'picture', 'u16', 'picture'];
+// TextBox, ListBox, ComboBox, CheckBox, OptionButton and ToggleButton. The 16th property counts the column infos.
+const MORPH = [
+    ...['u32', 'u32', 'u32', 'u32', 'u8', 'u8', 'u8', 'u8', 'pair', 'u16', 'u32', 'u16', 'u16', 'u16', 'u16', 'u16'],
+    ...['u8', 'u8', 'u8', 'undefined', 'u8', 'u8', 'string', 'string', 'u32', 'u32', 'u32', 'picture', 'picture', 'u16', 'undefined', 'flag', 'string'],
+];
+const MORPH_COLUMN_INFOS = 15;
+const SPIN = ['u32', 'u32', 'u32', 'pair', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'picture', 'u8'];
+const SCROLL = ['u32', 'u32', 'u32', 'pair', 'u8', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u32', 'u16', 'u32', 'picture'];
+/** TextProps (MS-OFORMS 2.3.1), the font a control with text writes after its own properties. */
+const TEXT_PROPS = ['string', 'u32', 'u32', 'u32', 'u8', 'u8', 'u8', 'u16'];
+const COLUMN_INFO = ['u32'];
+/** The Forms 2.0 controls office-defuse reads, by class id. Frames, multipages and tab strips hold other controls and are not here. */
+exports.FORMS_CONTROLS = new Map([
+    ['D7053240-CE69-11CD-A777-00DD01143C57', { props: BUTTON, wide: false, text: true }],
+    ['978C9E23-D4B0-11CE-BF2D-00AA003F40D0', { props: LABEL, wide: false, text: true }],
+    ...['8BD21D10', '8BD21D20', '8BD21D30', '8BD21D40', '8BD21D50', '8BD21D60'].map((p) => [`${p}-EC42-11CE-9E0D-00AA006002F3`, { props: MORPH, wide: true, text: true }]),
+    ['79176FB0-B7F2-11CE-97EF-00AA006D2776', { props: SPIN, wide: false, text: false }],
+    ['DFD181E0-5E2F-11CE-A449-00AA004A803D', { props: SCROLL, wide: false, text: false }],
+]);
+/** The ProgIDs of those controls, which a property bag or CompObj may name. */
+exports.FORMS_PROGIDS = new Map([
+    ['forms.commandbutton.1', 'D7053240-CE69-11CD-A777-00DD01143C57'],
+    ['forms.label.1', '978C9E23-D4B0-11CE-BF2D-00AA003F40D0'],
+    ['forms.textbox.1', '8BD21D10-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.listbox.1', '8BD21D20-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.combobox.1', '8BD21D30-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.checkbox.1', '8BD21D40-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.optionbutton.1', '8BD21D50-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.togglebutton.1', '8BD21D60-EC42-11CE-9E0D-00AA006002F3'],
+    ['forms.spinbutton.1', '79176FB0-B7F2-11CE-97EF-00AA006D2776'],
+    ['forms.scrollbar.1', 'DFD181E0-5E2F-11CE-A449-00AA004A803D'],
+]);
+/** Strings a control persists are at most this many bytes, as Forms 2.0 and LibreOffice read them. */
+const MAX_STRING = 0x20000;
+/**
+ * Reads one property block at `start`: version 2.0, the block size, the property mask and the properties it names.
+ * Returns where the block ends and the numbers read, by property index. Throws FormError on a picture, a bit of an
+ * undefined property, a bit past the last property, or a property that runs past the block.
+ */
+function readBlock(d, start, props, wide) {
+    const need = (at, n, what) => {
+        if (at + n > d.length)
+            throw new FormError(`${what} cut short`);
+    };
+    need(start, wide ? 12 : 8, 'a control property block');
+    if (d[start] !== 0 || d[start + 1] !== 2)
+        throw new FormError(`a control property block of version ${d[start + 1]}.${d[start]}`);
+    const end = start + 4 + d.readUInt16LE(start + 2);
+    if (end > d.length)
+        throw new FormError('a control property block that runs past its stream');
+    let low = d.readUInt32LE(start + 4);
+    let high = wide ? d.readUInt32LE(start + 8) : 0;
+    let pos = start + (wide ? 12 : 8);
+    const align = (n) => {
+        pos += (n - ((pos - start) % n)) % n;
+    };
+    const values = new Map();
+    const extra = [];
+    props.forEach((p, i) => {
+        const has = i < 32 ? (low >>> i) & 1 : (high >>> (i - 32)) & 1;
+        if (i < 32)
+            low &= ~(1 << i);
+        else
+            high &= ~(1 << (i - 32));
+        if (!has || p === 'flag')
+            return;
+        if (p === 'undefined')
+            throw new FormError('a control property MS-OFORMS leaves undefined');
+        if (p === 'picture')
+            throw new FormError('a control that holds a picture');
+        if (p === 'pair')
+            extra.push({ kind: 'pair' });
+        else if (p === 'string') {
+            align(4);
+            need(pos, 4, 'a control string size');
+            extra.push({ kind: 'string', size: d.readUInt32LE(pos) });
+            pos += 4;
+        }
+        else {
+            const n = p === 'u8' ? 1 : p === 'u16' ? 2 : 4;
+            align(n);
+            need(pos, n, 'a control property');
+            values.set(i, n === 1 ? d[pos] : n === 2 ? d.readUInt16LE(pos) : d.readUInt32LE(pos));
+            pos += n;
+        }
+    });
+    if (low !== 0 || high !== 0)
+        throw new FormError('a control property mask with bits past its last property');
+    align(4);
+    for (const x of extra) {
+        const n = x.kind === 'pair' ? 8 : x.size & 0x7fffffff;
+        if (n > MAX_STRING)
+            throw new FormError('a control string past 128 KiB');
+        pos += n;
+        align(4);
+    }
+    if (pos > end)
+        throw new FormError('control properties that run past their block');
+    return { end, values };
+}
+/**
+ * Why the persisted data of a Forms 2.0 control may not be what Forms 2.0 writes, or undefined when it is: the
+ * control's property block, then its TextProps for a control with text, then the column infos a list control counts,
+ * and nothing after. A picture or a mouse icon counts as a problem, since its bytes are a picture file Office decodes
+ * and office-defuse cannot rewrite in place.
+ */
+function controlProblem(classId, data) {
+    const layout = exports.FORMS_CONTROLS.get(classId.toUpperCase());
+    if (!layout)
+        return `its class ${classId} is not a Forms 2.0 control office-defuse reads`;
+    const d = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    try {
+        const own = readBlock(d, 0, layout.props, layout.wide);
+        let pos = own.end;
+        if (layout.text)
+            pos = readBlock(d, pos, TEXT_PROPS, false).end;
+        const columns = layout.props === MORPH ? (own.values.get(MORPH_COLUMN_INFOS) ?? 0) : 0;
+        for (let k = 0; k < columns; k++)
+            pos = readBlock(d, pos, COLUMN_INFO, false).end;
+        if (pos !== d.length)
+            return `${d.length - pos} bytes after the control's properties`;
+        return undefined;
+    }
+    catch (e) {
+        if (!(e instanceof FormError))
+            throw e;
+        return e.message;
+    }
+}
+/** Property bag names that load a picture, which a Forms 2.0 control takes from a part of its own. */
+const BAG_PICTURES = new Set(['picture', 'mouseicon']);
+/**
+ * Why a Forms 2.0 control persisted as a property bag in its activeX part may hold more than plain values, or
+ * undefined when it does not. `props` are the bag's name and value pairs, `nested` says ax:ocx held any other element,
+ * inside an ax:ocxPr or beside one, such as a font or a picture.
+ */
+function bagProblem(classId, props, nested) {
+    if (!exports.FORMS_CONTROLS.has(classId.toUpperCase()))
+        return `its class ${classId} is not a Forms 2.0 control office-defuse reads`;
+    if (nested)
+        return 'it holds elements besides plain ax:ocxPr values, such as a font or a picture';
+    const picture = props.find(p => BAG_PICTURES.has(p.name.toLowerCase()));
+    if (picture)
+        return `its ${picture.name} property loads a picture`;
+    return undefined;
+}
+/** Streams a control's storage holds in an OOXML binary part: its class and its properties. */
+exports.OOXML_CONTROL_STREAMS = new Set(['\x01CompObj', '\x03ObjInfo', 'contents']);
+/** In a Word document, the storage also holds the control's name and its picture for printing. */
+exports.WORD_CONTROL_STREAMS = new Set([...exports.OOXML_CONTROL_STREAMS, '\x03OCXNAME', '\x03PRINT']);
+/** A Forms 2.0 control's contents stream, without pictures, is far smaller. */
+const MAX_CONTENTS = 65536;
+/**
+ * Why a control's storage may not hold a Forms 2.0 control as Office persists one, or undefined when it does. Its
+ * class is the storage's class id, or its CompObj's ProgID when that is null, and must be `classId` when given. It
+ * holds only the `allowed` streams and a contents stream that `controlProblem` passes.
+ */
+async function controlStorageProblem(cfb, storage, allowed, classId) {
+    const stream = (name) => storage.children.find(c => c.kind === 'stream' && c.name === name);
+    let cls = storage.clsid === NULL_CLSID ? undefined : storage.clsid;
+    if (!cls) {
+        const compObj = stream('\x01CompObj');
+        const progId = compObj && compObj.size <= MAX_CONTENTS ? (0, oleobj_1.parseCompObj)(await cfb.bytes(compObj)).progId : undefined;
+        cls = progId ? exports.FORMS_PROGIDS.get(progId.trim().toLowerCase()) : undefined;
+        if (!cls)
+            return `its class ${progId ?? 'is not named'}${progId ? ' is not a Forms 2.0 control office-defuse reads' : ''}`;
+    }
+    if (classId && cls !== classId)
+        return 'its storage names another class';
+    if (!exports.FORMS_CONTROLS.has(cls))
+        return `its class ${cls} is not a Forms 2.0 control office-defuse reads`;
+    for (const c of storage.children)
+        if (c.kind !== 'stream' || !allowed.has(c.name))
+            return `it holds a ${c.kind} named ${JSON.stringify((0, cfb_1.showName)(c.name))}`;
+    const contents = stream('contents');
+    if (!contents)
+        return 'it has no contents stream';
+    if (contents.size > MAX_CONTENTS)
+        return 'its contents stream is larger than a Forms 2.0 control without pictures';
+    return controlProblem(cls, await cfb.bytes(contents));
+}

package/dist/macros.d.ts

@@ -0,0 +1,26 @@
+import { type CfbEntry, type CompoundFile } from './cfb';
+import { type RunContext } from './context';
+import type { CompoundPlan } from './plan';
+/** What the script plugins decided about a VBA project. */
+export interface VbaDecision {
+    keep: boolean;
+    /** Why the project could not go to the plugins. */
+    reason?: string;
+    /** The designer storages of the project's user forms, which stay with it and get no object rules of their own. */
+    designers?: CfbEntry[];
+    /**
+     * A plugin passed or removed every module, and the project stays or goes by those answers alone. They are final:
+     * the report holds them, and nothing of office-defuse's own about the project.
+     */
+    answered?: boolean;
+}
+/**
+ * Shows each module of the VBA project in `vba` to the script plugins. The first plugin that accepts a module decides
+ * it. The project stays when every module passed; `plan` then writes it without its compiled code, so Office compiles
+ * the source the plugins read, and the run's kept map remembers the verdict for the output check. A module no plugin
+ * takes, or one a plugin does not pass, leaves the project to the VBA_PROJECT finding, as without plugins.
+ *
+ * In the run that checks an output, the plugins are not asked again: a project whose sources match one the plugins
+ * passed keeps their findings, and a compiled code finding if the output still holds p-code.
+ */
+export declare function decideVba(ctx: RunContext, cfb: CompoundFile, vba: CfbEntry, location: string, plan: CompoundPlan): Promise<VbaDecision>;

package/dist/macros.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decideVba = decideVba;
+const cfb_1 = require("./cfb");
+const contained_1 = require("./contained");
+const context_1 = require("./context");
+const forms_1 = require("./forms");
+const types_1 = require("./types");
+const vba_1 = require("./vba");
+/** Keys of the run's kept map for a VBA project, which never match the MD5 of a file. */
+const keyOf = (project) => `vba:${project.digest}`;
+/**
+ * Shows each module of the VBA project in `vba` to the script plugins. The first plugin that accepts a module decides
+ * it. The project stays when every module passed; `plan` then writes it without its compiled code, so Office compiles
+ * the source the plugins read, and the run's kept map remembers the verdict for the output check. A module no plugin
+ * takes, or one a plugin does not pass, leaves the project to the VBA_PROJECT finding, as without plugins.
+ *
+ * In the run that checks an output, the plugins are not asked again: a project whose sources match one the plugins
+ * passed keeps their findings, and a compiled code finding if the output still holds p-code.
+ */
+async function decideVba(ctx, cfb, vba, location, plan) {
+    const run = ctx.run;
+    const plugins = run.options.scriptPlugins ?? [];
+    if (!plugins.length && !run.verify?.size)
+        return { keep: false };
+    let project;
+    try {
+        project = await (0, vba_1.readProject)(cfb, vba, ctx.settings.decompressedBytes);
+    }
+    catch (e) {
+        if (!(e instanceof vba_1.VbaError))
+            throw e;
+        return { keep: false, reason: (0, context_1.clip)(e.message) };
+    }
+    const expected = run.verify?.get(keyOf(project));
+    if (expected) {
+        ctx.push((expected.findings ?? []).map(f => ({ ...f, data: f.data && { ...f.data } })));
+        const designers = await formDesigners(ctx, cfb, project, location);
+        if (!designers)
+            return { keep: false };
+        if (!(await (0, vba_1.isPurged)(cfb, project)))
+            ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.CompiledCode, location, { storage: location });
+        run.macrosKept = true;
+        run.macrosAnswered = true;
+        return { keep: true, designers, answered: true };
+    }
+    if (!plugins.length)
+        return { keep: false };
+    const start = ctx.findings.length;
+    let keep = project.modules.length > 0;
+    let answered = keep;
+    const used = new Set();
+    for (const [i, m] of project.modules.entries()) {
+        const at = `${location}/${(0, cfb_1.showName)(m.stream.name)}`;
+        const script = {
+            text: m.source,
+            trigger: `vba-${m.kind}`,
+            location: at,
+            fieldName: m.name,
+            language: 'vba',
+            form: 'office',
+            ...(i === 0 ? { references: project.references.map(r => ({ ...r })) } : {}),
+        };
+        let decided = false;
+        for (const plugin of plugins) {
+            try {
+                if (!(await plugin.accepts(script)))
+                    continue;
+            }
+            catch (e) {
+                (0, contained_1.passOn)(run, e);
+                continue;
+            }
+            decided = true;
+            used.add(plugin.name);
+            const data = { plugin: plugin.name, module: (0, context_1.clip)(m.name) };
+            try {
+                const r = await plugin.process(script);
+                if (r.result === 'passed')
+                    ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginPassed, at, data);
+                else {
+                    keep = false;
+                    if (r.result !== 'removed')
+                        answered = false;
+                    ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginRemoved, at, data);
+                }
+                pushScript(ctx, r.findings);
+            }
+            catch (e) {
+                (0, contained_1.passOn)(run, e);
+                keep = false;
+                answered = false;
+                ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginFailed, at, data);
+            }
+            break;
+        }
+        if (!decided) {
+            keep = false;
+            answered = false;
+        }
+    }
+    if (!keep) {
+        if (answered)
+            run.macrosAnswered = true;
+        return { keep: false, answered };
+    }
+    const passed = { result: 'passed', plugin: [...used].join(', '), findings: ctx.findings.slice(start).map(f => ({ ...f, data: f.data && { ...f.data } })) };
+    const designers = await formDesigners(ctx, cfb, project, location);
+    if (!designers)
+        return { keep: false };
+    run.kept.set(keyOf(project), passed);
+    if (!(await (0, vba_1.isPurged)(cfb, project))) {
+        let streams;
+        try {
+            streams = (0, vba_1.purge)(project);
+        }
+        catch (e) {
+            if (!(e instanceof vba_1.VbaError))
+                throw e;
+            run.kept.delete(keyOf(project));
+            return { keep: false, reason: (0, context_1.clip)(e.message) };
+        }
+        for (const [entry, bytes] of streams.replace)
+            plan.replace.set(entry, await (0, contained_1.spillOf)(run, bytes));
+        for (const entry of streams.drop)
+            plan.drop.add(entry);
+        ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.CompiledCode, location, { storage: location });
+    }
+    run.macrosKept = true;
+    run.macrosAnswered = true;
+    return { keep: true, designers, answered: true };
+}
+/**
+ * The designer storages of the project's user forms, beside its VBA storage, named as their modules. Undefined when
+ * one may hold a control that is not a Forms 2.0 control, which CONTROL/ACTIVEX reports at the designer.
+ */
+async function formDesigners(ctx, cfb, project, location) {
+    const holder = project.storage.parent;
+    if (!holder)
+        return [];
+    const base = location.slice(0, location.length - (0, cfb_1.showName)(project.storage.name).length);
+    const designers = [];
+    for (const m of project.modules) {
+        if (m.kind !== 'form')
+            continue;
+        const designer = holder.children.find(c => c.kind === 'storage' && c.name.toUpperCase() === m.name.toUpperCase());
+        if (!designer)
+            continue;
+        const problem = await (0, forms_1.designerProblem)(cfb, designer, ctx.settings.decompressedBytes);
+        const at = `${base}${(0, cfb_1.showName)(designer.name)}`;
+        if (problem && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, at, { storage: at, reason: (0, context_1.clip)(problem) }).action === 'strip')
+            return undefined;
+        designers.push(designer);
+    }
+    return designers;
+}
+/** Adds a script plugin's findings, which already name the module. A reject removes the module, so it counts as strip. */
+function pushScript(ctx, found) {
+    ctx.push((found ?? []).map(f => ({ ...f, action: f.action === 'reject' ? 'strip' : f.action, data: f.data && { ...f.data } })));
+}

package/dist/msg.js

@@ -231,7 +231,7 @@ async function attachment(ctx, cfb, data, file, info, plan) {
     const decision = await (0, contained_1.decideContained)(ctx, { ...file, chunks: () => (0, io_1.chunksOf)(source, data.size) });
     if (decision?.replacement)
         plan?.replace.set(data, decision.replacement);
-    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size }, (0, contained_1.presence)(decision));
+    const r = (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size });
     return decision && !decision.keep ? { ...r, action: 'strip' } : r;
 }
 /** The fixed-size values of a property stream (MS-OXMSG 2.4.2), by property id. An attachment's has an 8-byte header. */