@patrickdk77/office-defuse 0.2.2 → 0.3.0

package/dist/objects.js

@@ -11,7 +11,9 @@ const cfb_writer_1 = require("./cfb-writer");
 const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
+const forms_1 = require("./forms");
 const io_1 = require("./io");
+const macros_1 = require("./macros");
 const oleobj_1 = require("./oleobj");
 const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
@@ -44,35 +46,78 @@ const at = (prefix, e) => [prefix, (0, cfb_1.entryPath)(e)].filter(Boolean).join
  */
 async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision) {
     const projects = new Set();
+    /** Storages of embedded objects, whose contents the plugins that take the object decide. */
+    const objects = new Set();
+    const inObject = (e) => {
+        for (let p = e.parent; p; p = p.parent)
+            if (objects.has(p))
+                return true;
+        return false;
+    };
+    /** User form designers of a VBA project that stays, which go with the project rather than as objects. */
+    const designers = new Set();
+    const inDesigner = (e) => {
+        for (let p = e; p; p = p.parent)
+            if (designers.has(p))
+                return true;
+        return false;
+    };
     const drop = (r, e) => {
         if (r.action === 'strip' && e.kind !== 'root')
             plan?.drop.add(e);
     };
+    /** Objects a plugin answered for. Its answer is final, so nothing inside them gets the rules here. */
+    const answered = new Set();
+    const inAnswered = (e) => {
+        for (let p = e.parent; p; p = p.parent)
+            if (answered.has(p))
+                return true;
+        return false;
+    };
+    // A storage comes after the storage that holds it, so an object is decided before what it holds.
     for (const e of cfb.entries) {
-        if (e.kind === 'stream')
+        if (e.kind === 'stream' || inDesigner(e) || inAnswered(e))
             continue;
         const child = (name) => e.children.find(c => upper(c) === name);
+        const names = new Set(e.children.map(upper));
+        const parent = e.parent ? upper(e.parent) : '';
+        const isObject = e.kind === 'root'
+            ? rootIsObject
+            : [...names].some(n => OBJECT_STREAMS.has(n) || CONTROL_STREAMS.has(n)) ||
+                (parent === 'OBJECTPOOL' && e.parent?.parent?.kind === 'root') ||
+                (e.parent?.kind === 'root' && /^MBD[0-9A-F]{8}$/i.test(e.name));
+        if (isObject) {
+            objects.add(e);
+            const decided = await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined);
+            for (const r of decided.found)
+                drop(r, e);
+            if (decided.answered) {
+                answered.add(e);
+                continue;
+            }
+        }
         // A VBA project: a VBA storage with a dir stream, which names the modules (MS-OVBA 2.2). The storage that holds
-        // the project goes, or the VBA storage when that is the root.
+        // the project goes, or the VBA storage when that is the root. With script plugins, the project stays when they
+        // pass every module and the rewrite can take out its compiled code: in the file the rewrite writes, and outside any
+        // embedded object, whose plugins decide what it holds.
         const vba = child('VBA');
         if (vba?.kind === 'storage' && vba.children.some(c => c.kind === 'stream' && upper(c) === 'DIR')) {
             projects.add(e);
-            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), { storage: at(prefix, vba) }), e.kind === 'root' ? vba : e);
+            const decision = plan && !objects.has(e) && !inObject(e) ? await (0, macros_1.decideVba)(ctx, cfb, vba, at(prefix, vba), plan) : undefined;
+            const data = { storage: at(prefix, vba), ...(decision?.reason ? { reason: decision.reason } : {}) };
+            if (decision?.keep)
+                for (const d of decision.designers ?? [])
+                    designers.add(d);
+            // The plugins' answers are final: the report holds them, and nothing of office-defuse's own about the project.
+            if (decision?.answered)
+                drop({ action: decision.keep ? 'info' : 'strip' }, e.kind === 'root' ? vba : e);
+            else
+                drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), data), e.kind === 'root' ? vba : e);
         }
         if (e.kind === 'storage' && (upper(e) === '_VBA_PROJECT_CUR' || upper(e) === 'MACROS') && e.children.length && !projects.has(e)) {
             // Excel's and Word's project storages, without the dir stream a whole project has.
             drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, e), { storage: at(prefix, e) }), e);
         }
-        const names = new Set(e.children.map(upper));
-        const parent = e.parent ? upper(e.parent) : '';
-        const isObject = e.kind === 'root'
-            ? rootIsObject
-            : [...names].some(n => OBJECT_STREAMS.has(n) || CONTROL_STREAMS.has(n)) ||
-                (parent === 'OBJECTPOOL' && e.parent?.parent?.kind === 'root') ||
-                (e.parent?.kind === 'root' && /^MBD[0-9A-F]{8}$/i.test(e.name));
-        if (isObject)
-            for (const r of await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined))
-                drop(r, e);
     }
 }
 /** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
@@ -159,6 +204,7 @@ async function objectFile(ctx, cfb, e, d, location, plan) {
  * One OLE object's storage: a control, a linked object, or an embedded one, with what it holds. Returns its findings,
  * and a strip when a plugin removed the object. In the file the rewrite writes, `plan` is set and an embedded object
  * goes to the plugins first. `given` is the verdict on an object whose container showed it to the plugins already.
+ * `answered` says a plugin answered for the object, so nothing else here looks at it or at what it holds.
  */
 async function objectRules(ctx, cfb, e, location, plan, given) {
     const d = await describeObject(cfb, e, location);
@@ -169,8 +215,19 @@ async function objectRules(ctx, cfb, e, location, plan, given) {
         data.progId = (0, context_1.clip)(d.progId);
     if (d.userType)
         data.className = (0, context_1.clip)(d.userType);
-    if (d.control)
-        return [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, d.controlName ? { ...data, name: (0, context_1.clip)(d.controlName) } : data)];
+    if (d.control) {
+        if (d.controlName)
+            data.name = (0, context_1.clip)(d.controlName);
+        // A Forms 2.0 control stays when its storage and properties are as Office writes them. Its picture for printing,
+        // a metafile beside them, goes on its own.
+        const problem = await (0, forms_1.controlStorageProblem)(cfb, e, forms_1.WORD_CONTROL_STREAMS);
+        if (problem)
+            return { found: [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...data, reason: (0, context_1.clip)(problem) })], answered: false };
+        const print = e.children.find(c => c.kind === 'stream' && c.name === '\x03PRINT');
+        if (print && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ControlPicture, `${location}/${(0, cfb_1.showName)(print.name)}`, { storage: location, bytes: print.size }).action === 'strip')
+            plan?.drop.add(print);
+        return { found: [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, location, data)], answered: false };
+    }
     const found = [];
     if (d.pkg) {
         Object.assign(data, packageData(d.pkg));
@@ -181,13 +238,15 @@ async function objectRules(ctx, cfb, e, location, plan, given) {
         found.push(linkedObject(ctx, d, location, { storage: location, ...(d.clsid ? { clsid: d.clsid } : {}) }));
     else {
         const decision = given ?? (plan ? await objectFile(ctx, cfb, e, d, location, plan) : undefined);
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, (0, contained_1.presence)(decision)));
+        if (decision?.answered)
+            return { found: [...found, { action: decision.keep ? 'info' : 'strip' }], answered: true };
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data));
         if (decision && !decision.keep)
             found.push({ action: 'strip' });
     }
     if (d.equation)
         found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data));
-    return found;
+    return { found, answered: false };
 }
 /**
  * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a

package/dist/odf.js

@@ -376,14 +376,14 @@ async function inspectOdf(ctx) {
         const key = (0, zip_1.nameKey)(e.name);
         const decision = await (0, contained_1.decideContained)(ctx, { name: e.name, location: e.name, chunks: () => zip.read(e) });
         if (decision) {
-            decided.set(key, decision.keep);
+            decided.set(key, decision);
             if (!decision.keep)
                 plan.drop.add(key);
             else if (decision.replacement)
                 plan.replace.set(key, decision.replacement);
         }
         if (!oleRefs.get(key)) {
-            const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name }, (0, contained_1.presence)(decision));
+            const r = (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name });
             if (!decision && r.action === 'strip')
                 plan.drop.add(key);
         }
@@ -398,15 +398,14 @@ async function inspectOdf(ctx) {
     }
     const files = new Set(zip.entries.filter(e => !e.directory).map(e => (0, zip_1.nameKey)(e.name)));
     for (const o of plan.objects) {
-        const kept = decided.get(o.target);
-        if (kept === true) {
-            // A plugin kept the object's file, so the object stays.
-            if (o.finding) {
-                o.finding.action = 'info';
-                ctx.run.superseded.add(o.finding);
-            }
+        const decision = decided.get(o.target);
+        // A plugin's answer on the object's file is final, so the object's own finding is taken back.
+        if (decision?.answered)
+            ctx.retract(o.finding);
+        const kept = decision?.keep;
+        // A plugin kept the object's file, so the object stays.
+        if (kept === true)
             continue;
-        }
         if (kept === false || o.strips) {
             plan.element(o.part, o.index, { remove: true });
             if (files.has(o.target))

package/dist/ole.d.ts

@@ -1,9 +1,9 @@
-import type { CompoundFile } from './cfb';
-import type { RunContext } from './context';
+import { type CompoundFile } from './cfb';
+import { type RunContext } from './context';
 import type { Format } from './formats';
 import { ZipArchive } from './zip';
 /** The families a compound file can hold, by the stream or storage that marks each. */
-export type Family = 'word' | 'excel' | 'powerpoint' | 'visio' | 'outlook' | 'publisher' | 'project' | 'encrypted';
+export type Family = 'word' | 'excel' | 'powerpoint' | 'powerpoint-addin' | 'visio' | 'outlook' | 'publisher' | 'project' | 'encrypted';
 /** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
 export declare function families(cfb: CompoundFile): Family[];
 /**

package/dist/ole.js

@@ -5,7 +5,10 @@ exports.mainFamily = mainFamily;
 exports.compoundFormat = compoundFormat;
 exports.openEncryptedPackage = openEncryptedPackage;
 exports.inspectCompound = inspectCompound;
+const cfb_1 = require("./cfb");
+const context_1 = require("./context");
 const errors_1 = require("./errors");
+const forms_1 = require("./forms");
 const msg_1 = require("./msg");
 const objects_1 = require("./objects");
 const offcrypto_1 = require("./offcrypto");
@@ -20,6 +23,11 @@ const zip_1 = require("./zip");
 const f = (format, mimeType) => ({ format, mimeType });
 const upper = (e) => e.name.toUpperCase();
 const PUBLISHER_CLSIDS = new Set(['00021200-0000-0000-00C0-000000000046', '00021201-0000-0000-00C0-000000000046']);
+/**
+ * The class id PowerPoint 97 to 2003 writes at the root of an add-in, a .ppa, whose root is its VBA project. An add-in
+ * whose project was removed keeps it, and is still an add-in.
+ */
+const PPA_CLSID = '817246F0-720A-11CF-8718-00AA0060263B';
 /** What the root of a compound file holds, read by the names of its children, ignoring case as MS-CFB does. */
 function families(cfb) {
     const names = new Map(cfb.root.children.map(c => [upper(c), c]));
@@ -33,6 +41,8 @@ function families(cfb) {
         out.push('excel');
     if (stream('POWERPOINT DOCUMENT'))
         out.push('powerpoint');
+    if (cfb.root.clsid === PPA_CLSID)
+        out.push('powerpoint-addin');
     if (stream('VISIODOCUMENT'))
         out.push('visio');
     if (stream('__PROPERTIES_VERSION1.0'))
@@ -91,6 +101,8 @@ async function compoundFormat(cfb, family, deadline) {
         }
         case 'powerpoint':
             return f('ppt', 'application/vnd.ms-powerpoint');
+        case 'powerpoint-addin':
+            return f('ppa', 'application/vnd.ms-powerpoint');
         case 'visio':
             return f('vsd', 'application/vnd.visio');
         case 'outlook':
@@ -134,21 +146,29 @@ async function inspectCompound(ctx, cfb) {
     if (word)
         await (0, word_1.wordRules)(ctx, cfb, word, family === 'encrypted');
     if (family === 'excel') {
+        const found = [];
         for (const name of ['Workbook', 'Book']) {
             const s = stream(name);
             if (s)
-                await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook);
+                await (0, xls_1.excelRules)(ctx, cfb, s, offcrypto_1.unlockWorkbook, plan, found);
         }
-        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream.
+        // Excel keeps the data of a workbook's ActiveX controls in one Ctls stream. It stays when every control in it is a
+        // Forms 2.0 control as Office persists one, and the Obj records account for all of it.
         const controls = stream('Ctls');
-        if (controls && controls.size > 0 && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name }).action === 'strip')
-            plan.drop.add(controls);
+        if (controls && controls.size > 0) {
+            const problem = await ctlsProblem(cfb, controls, found);
+            const reported = problem
+                ? [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, controls.name, { stream: controls.name, reason: (0, context_1.clip)(problem) })]
+                : found.map(c => ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, `${controls.name}, offset ${c.position}`, { stream: controls.name, sheet: (0, context_1.clip)(c.sheet), progId: (0, context_1.clip)(c.progId) }));
+            if (reported.some(r => r.action === 'strip'))
+                plan.drop.add(controls);
+        }
     }
     if (family === 'outlook')
         await (0, msg_1.messageRules)(ctx, cfb, cfb.root, 0, plan);
     const ppt = stream('PowerPoint Document');
     if (family === 'powerpoint' && ppt)
-        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt);
+        await (0, ppt_1.powerPointRules)(ctx, cfb, ppt, plan);
     const visio = stream('VisioDocument');
     if (family === 'visio' && visio)
         await (0, vsd_1.visioRules)(ctx, cfb, visio);
@@ -165,3 +185,33 @@ async function inspectCompound(ctx, cfb) {
             ctx.run.output = { kind: 'zip', zip, plan: zctx.plan, format: ctx.format };
     }
 }
+/**
+ * Why the Ctls stream may hold more than Forms 2.0 controls as Office persists them, or undefined when it does not.
+ * Each control is its class id and then its properties, at the place its Obj record gives, and the places cover the
+ * stream with nothing between or after them.
+ */
+async function ctlsProblem(cfb, ctls, controls) {
+    if (!controls.length)
+        return 'no Obj record names a control in it';
+    if (ctls.size > 16 * 1024 * 1024)
+        return 'it is larger than Forms 2.0 controls without pictures';
+    const bytes = await cfb.bytes(ctls);
+    let covered = 0;
+    for (const c of [...controls].sort((a, b) => a.position - b.position)) {
+        if (c.position !== covered)
+            return `bytes at offset ${covered} that no control's place covers`;
+        if (c.position + c.size > bytes.length || c.size < 16)
+            return `a control's place runs past the stream`;
+        const classId = forms_1.FORMS_PROGIDS.get(c.progId.trim().toLowerCase());
+        if (!classId)
+            return `a control of class ${c.progId || 'not named'}`;
+        const data = bytes.subarray(c.position, c.position + c.size);
+        if ((0, cfb_1.guid)(data, 0) !== classId)
+            return `a control whose data names another class than ${c.progId}`;
+        const problem = (0, forms_1.controlProblem)(classId, data.subarray(16));
+        if (problem)
+            return problem;
+        covered = c.position + c.size;
+    }
+    return covered === bytes.length ? undefined : `${bytes.length - covered} bytes after the last control`;
+}

package/dist/ooxml.d.ts

@@ -1,3 +1,4 @@
+import { type ContainedDecision } from './contained';
 import { type ZipContext } from './context';
 import { type Format } from './formats';
 import { type XmlElement } from './xml';
@@ -52,6 +53,30 @@ export interface Part {
     /** The parts its own relationships reach. */
     targets: Set<Part>;
     ole: boolean;
+    /** For a VBA project part read before the XML parts, what became of it. */
+    vba?: ContainedDecision;
+    /** For an activeX part, the control its ax:ocx element describes. */
+    activeX?: ActiveXInfo;
+    /** For an activeX part, what the check of its control found. */
+    forms?: FormsVerdict;
+    /** A binary part that holds the data of a Forms 2.0 control that stays. */
+    formsData?: boolean;
+}
+/** What an activeX part's ax:ocx element says: the class, how the control persists itself, and a property bag. */
+export interface ActiveXInfo {
+    classId: string;
+    persistence?: string;
+    props: Array<{
+        name: string;
+        value: string;
+    }>;
+    /** An element below ax:ocxPr, such as a font or picture, or one ax:ocx does not hold. */
+    nested: boolean;
+}
+/** An activeX part's control as checked: its class, and why it may not be a Forms 2.0 control as Office writes one. */
+interface FormsVerdict {
+    classId?: string;
+    problem?: string;
 }
 /** What the rewrite needs of an OOXML package: its parts, which part each relationships part belongs to, and the roots. */
 export interface OoxmlGraph {
@@ -112,3 +137,4 @@ export declare function nameOoxml(ctx: ZipContext, contentTypes: ZipEntry): Prom
  * OPC package unpacked into a ZIP archive, and the package's own format is returned.
  */
 export declare function inspectOoxml(ctx: ZipContext, contentTypes: ZipEntry, outer?: Format): Promise<Format>;
+export {};

package/dist/ooxml.js

@@ -10,14 +10,19 @@ exports.readMain = readMain;
 exports.nameOoxml = nameOoxml;
 exports.inspectOoxml = inspectOoxml;
 const biff_1 = require("./biff");
+const cfb_1 = require("./cfb");
 const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const fields_1 = require("./fields");
 const formats_1 = require("./formats");
+const forms_1 = require("./forms");
 const formulas_1 = require("./formulas");
+const io_1 = require("./io");
 const links_1 = require("./links");
+const objects_1 = require("./objects");
 const plan_1 = require("./plan");
+const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
 const xlsb_1 = require("./xlsb");
 const xml_1 = require("./xml");
@@ -98,6 +103,7 @@ exports.R_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/r
 const CUSTOM_UI_NS = new Set(['http://schemas.microsoft.com/office/2006/01/customui', 'http://schemas.microsoft.com/office/2009/07/customui']);
 const VML_EXCEL_NS = 'urn:schemas-microsoft-com:office:excel';
 const VISIO_NS = 'http://schemas.microsoft.com/office/visio/2012/main';
+const ACTIVEX_NS = 'http://schemas.microsoft.com/office/2006/activex';
 const EXTENDED_NS = new Set(['http://schemas.openxmlformats.org/officedocument/2006/extended-properties', 'http://purl.oclc.org/ooxml/officedocument/extendedproperties']);
 /**
  * The attributes of a SpreadsheetML data connection that name where it loads from (ECMA-376 18.13): an ODC file or an
@@ -310,6 +316,8 @@ class PartRules {
     hyperlinkBase;
     /** The parts this XPS part names in its markup, by key, which count as reached from it. */
     refs = new Set();
+    /** The control an activeX part describes in its ax:ocx element. */
+    activeX;
     /**
      * The labels of the hyperlinks the part names by relationship Id: their text, tooltips and display text. The
      * relationships part comes after the part, so the targets are compared with these as it is read.
@@ -358,14 +366,27 @@ class PartRules {
     }
     start(el) {
         const ns = this.lowerNs(el);
+        // Below ax:ocx only ax:ocxPr may stand, and nothing below it: anything else marks the bag as more than plain values.
+        if (this.activeX && (el.depth > 2 || (el.depth === 2 && !(ns === ACTIVEX_NS && el.local === 'ocxPr'))))
+            this.activeX.nested = true;
+        if (ns === ACTIVEX_NS) {
+            const value = (local) => el.attributes.find(a => a.ns.toLowerCase() === ACTIVEX_NS && a.local === local)?.value;
+            if (el.depth === 1 && el.local === 'ocx')
+                this.activeX = { classId: value('classid') ?? '', persistence: value('persistence'), props: [], nested: false };
+            else if (this.activeX && el.depth === 2 && el.local === 'ocxPr')
+                this.activeX.props.push({ name: value('name') ?? '', value: value('value') ?? '' });
+            else if (this.activeX)
+                this.activeX.nested = true;
+            return;
+        }
         if (CUSTOM_UI_NS.has(ns)) {
             if (el.depth === 1)
                 this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Ribbon, this.part);
             for (const a of el.attributes) {
                 if (a.ns !== '' || !a.value.trim() || !/^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
                     continue;
-                // The callback goes and the control stays, doing nothing.
-                if (this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }).action === 'strip') {
+                // The callback goes and the control stays, doing nothing, unless it calls a macro of a project that stays.
+                if (this.ctx.macroTrigger(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }, a.value).action === 'strip') {
                     this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', a.local)]) });
                 }
             }
@@ -398,7 +419,7 @@ class PartRules {
         else if (XDR_NS.has(ns)) {
             const macro = (0, xml_1.attr)(el, '', 'macro');
             // The shape stays, and clicking it runs nothing.
-            if (macro?.trim() && this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }).action === 'strip') {
+            if (macro?.trim() && this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, macro).action === 'strip') {
                 this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', 'macro')]) });
             }
         }
@@ -455,8 +476,9 @@ class PartRules {
             this.formula = undefined;
         }
         if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
+            const macro = this.macroText.shown.text.trim();
             if (this.macroText.shown.content)
-                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(this.macroText.shown.text.trim()) }), this.macroText);
+                this.remove(this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, macro), this.macroText);
             this.macroText = undefined;
         }
         if (this.hyperlinkBase && EXTENDED_NS.has(ns) && el.local === 'HyperlinkBase') {
@@ -495,8 +517,10 @@ class PartRules {
         const data = { trigger: el.local, action: (0, context_1.clip)(written), ...(id === undefined ? {} : { relationship: (0, context_1.clip)(id) }) };
         if (action.startsWith('ppaction://program'))
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data), el);
-        else if (action.startsWith('ppaction://macro'))
-            this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data), el);
+        else if (action.startsWith('ppaction://macro')) {
+            const name = /[?&]name=([^&]*)/i.exec(written)?.[1] ?? '';
+            this.remove(this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data, safeDecode(name)), el);
+        }
         else if (action.startsWith('ppaction://ole'))
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data), el);
     }
@@ -641,6 +665,12 @@ async function inspectOoxml(ctx, contentTypes, outer) {
     };
     const { format, strict, xps } = await readMain(ctx, typed, (rels, r) => relate(rels, undefined, r));
     ctx.format = outer ?? format;
+    // A VBA project goes to the script plugins before the XML parts are read, whose buttons and callbacks keep running
+    // its macros only when it stays.
+    if (ctx.run.options.scriptPlugins !== undefined)
+        for (const p of parts.values())
+            if (exports.TYPE.vba.has(p.contentType ?? ''))
+                p.vba = await vbaPart(ctx, p.entry, p.entry.name);
     // OPC has no folders. A directory entry is still inflated once, so its bytes are checked like any other.
     for (const entry of ctx.zip.entries)
         if (entry.directory)
@@ -661,6 +691,8 @@ async function inspectOoxml(ctx, contentTypes, outer) {
             await ctx.parse(p.entry, rules, ct === exports.TYPE.vml);
             if (rules.labels.size)
                 labelsOf.set(key, rules.labels);
+            if (rules.activeX)
+                p.activeX = rules.activeX;
             for (const k of rules.refs) {
                 const t = parts.get(k);
                 if (t && t !== p)
@@ -686,6 +718,10 @@ async function inspectOoxml(ctx, contentTypes, outer) {
     for (const [source, rels] of relsOf)
         if (source !== '' && !parts.has(source))
             await readRelationships(ctx, rels, r => relate(rels, undefined, r));
+    // Controls are checked before any part's own rules, since a Forms 2.0 control that stays keeps its binary part.
+    for (const p of parts.values())
+        if (exports.TYPE.control.has(p.contentType ?? '') || (p.reachedAs & AS.control) !== 0)
+            p.forms = await formsControl(ctx, p);
     for (const p of parts.values())
         await partRules(ctx, p);
     unreferenced(ctx, parts, relsOf, roots);
@@ -711,28 +747,140 @@ async function partRules(ctx, p) {
     // Besides OLE parts and packages, every part that is a whole file in a format of its own, such as an image, goes
     // to the plugins. Such a part has no rule of its own, so one no plugin takes stays.
     const wholeFile = !(0, exports.isXmlType)(p.contentType) && !formatBinary(ct);
+    // The data of a Forms 2.0 control that stays was read with the control, and stays with it.
+    if (p.formsData)
+        return;
     const contained = vba || ole || pkg || controlBinary || p.ole || wholeFile;
-    const decision = contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined;
-    const act = (0, contained_1.presence)(decision);
+    // With script plugins, a VBA project part is read here, so its modules go to them, rather than to the file plugins.
+    const vbaDecision = p.vba ?? (vba && ctx.run.options.scriptPlugins !== undefined ? await vbaPart(ctx, p.entry, loc) : undefined);
+    const decision = vbaDecision ?? (contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined);
     const found = [];
-    if (vba)
-        found.push(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data, act));
+    // A plugin's answer is final, so a file it answered for gets none of office-defuse's own findings.
+    if (vba && !vbaDecision)
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data));
     // A macro sheet becomes an empty worksheet, so the indexes of the sheets after it stay right.
     if ((exports.TYPE.macrosheet.has(ct) || as(AS.macrosheet)) && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data).action === 'strip')
         ctx.plan.sheets.add(key);
     if (ole)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data));
     if (pkg)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data, act));
-    if (control || (controlBinary && !p.claimed))
-        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, data, control ? undefined : act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data));
+    if (control && p.forms && !p.forms.problem)
+        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, loc, { ...data, clsid: p.forms.classId ?? '' }));
+    else if (control || (controlBinary && !p.claimed)) {
+        const why = control && p.forms ? { ...(p.forms.classId ? { clsid: p.forms.classId } : {}), ...(p.forms.problem ? { reason: (0, context_1.clip)(p.forms.problem) } : {}) } : {};
+        found.push(control ? ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }) : (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }));
+    }
     if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data));
     if (decision ? !decision.keep : found.some(f => f.action === 'strip'))
         ctx.plan.drop.add(key);
     else if (decision?.replacement)
         ctx.plan.replace.set(key, decision.replacement);
 }
+/** Bytes a Forms 2.0 control's binary part holds at most, pictures left out. */
+const MAX_CONTROL_DATA = 65536;
+/**
+ * Checks the control an activeX part describes as a Forms 2.0 control that Office persisted: by its class, and by
+ * its properties, read from the property bag in the part or from the binary part its relationship names. A control
+ * persisted as a stream starts with its class id; one persisted as a storage holds its CompObj and contents. A
+ * control that passes marks its binary part, which then stays with it.
+ */
+async function formsControl(ctx, p) {
+    const ax = p.activeX;
+    if (!ax)
+        return { problem: 'its part has no ax:ocx element' };
+    const classId = ax.classId.replace(/[{}]/g, '').trim().toUpperCase();
+    if (!forms_1.FORMS_CONTROLS.has(classId))
+        return { classId, problem: 'its class is not a Forms 2.0 control office-defuse reads' };
+    const binaries = [...p.targets].filter(t => t.claimed);
+    const persistence = ax.persistence ?? 'persistStreamInit';
+    if (persistence === 'persistPropertyBag') {
+        if (binaries.length)
+            return { classId, problem: 'a property bag with a binary part' };
+        return { classId, problem: (0, forms_1.bagProblem)(classId, ax.props, ax.nested) };
+    }
+    if (ax.props.length || ax.nested)
+        return { classId, problem: `properties in its part beside ${persistence}` };
+    if (binaries.length !== 1)
+        return { classId, problem: 'it has no binary part, or more than one' };
+    const bin = binaries[0];
+    if (bin.entry.size > MAX_CONTROL_DATA)
+        return { classId, problem: 'its binary part is larger than a Forms 2.0 control without pictures' };
+    const chunks = [];
+    for await (const c of ctx.zip.read(bin.entry))
+        chunks.push(c);
+    const bytes = Buffer.concat(chunks);
+    let problem;
+    if (persistence === 'persistStreamInit' || persistence === 'persistStream') {
+        problem = bytes.length < 16 || (0, cfb_1.guid)(bytes, 0) !== classId ? 'its binary part names another class' : (0, forms_1.controlProblem)(classId, bytes.subarray(16));
+    }
+    else if (persistence === 'persistStorage') {
+        let cfb;
+        try {
+            cfb = await cfb_1.CompoundFile.open((0, io_1.bufferSource)(bytes), ctx.settings, ctx.run.deadline);
+        }
+        catch (e) {
+            if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+                throw e;
+            problem = `its binary part is not a compound file: ${e.message}`;
+        }
+        if (cfb)
+            problem = await (0, forms_1.controlStorageProblem)(cfb, cfb.root, forms_1.OOXML_CONTROL_STREAMS, classId);
+    }
+    else
+        problem = `its persistence is ${persistence}`;
+    if (!problem)
+        bin.formsData = true;
+    return { classId, problem };
+}
+/**
+ * A VBA project part, read as the compound file it is: the rules every compound file gets, which show the project to
+ * the script plugins and the storages of its forms to the file plugins. The part stays, as the rewrite writes it, when
+ * the project does.
+ */
+async function vbaPart(ctx, entry, loc) {
+    const run = ctx.run;
+    const copy = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(copy);
+    for await (const c of ctx.zip.read(entry))
+        await copy.write(c);
+    await copy.close();
+    const source = copy.source();
+    run.sources.push(source);
+    let cfb;
+    try {
+        cfb = await cfb_1.CompoundFile.open(source, ctx.settings, run.deadline);
+    }
+    catch (e) {
+        if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
+            throw e;
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, { part: loc, reason: (0, context_1.clip)(`its compound file does not read: ${e.message}`) });
+        return { keep: false };
+    }
+    (0, objects_1.nestedNotes)(ctx, cfb, loc);
+    const plan = new plan_1.CompoundPlan();
+    await (0, objects_1.compoundRules)(ctx, cfb, loc, false, plan);
+    const vba = cfb.child(cfb.root, 'VBA');
+    if (!vba)
+        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, { part: loc, reason: 'it holds no VBA storage' });
+    if (!vba || plan.drop.has(vba))
+        return { keep: false };
+    const out = new io_1.SpillSink(run.temp, run.threshold);
+    run.held.push(out);
+    await (0, rewrite_cfb_1.writeCompound)(run, cfb, plan, out);
+    await out.close();
+    return { keep: true, replacement: out };
+}
+/** A percent-encoded value, or the value as written when it does not decode. */
+function safeDecode(v) {
+    try {
+        return decodeURIComponent(v);
+    }
+    catch {
+        return v;
+    }
+}
 /** Parts that no chain of internal relationships reaches from the package. */
 function unreferenced(ctx, parts, relsOf, roots) {
     const reached = new Set(roots);