@patrickdk77/office-defuse 0.2.2 → 0.3.0

package/dist/ppt-writer.d.ts

@@ -0,0 +1,27 @@
+import type { SpillSink } from './io';
+import type { ByteSource } from './types';
+/** What the rewrite of a PowerPoint Document stream changes, each record by its offset in the stream as read. */
+export interface PresentationEdits {
+    /** Records that go, with everything inside them. */
+    remove: Set<number>;
+    /** Records whose body is replaced, the header written for the new length. */
+    replace: Map<number, Uint8Array>;
+    /** Persist objects, by persist id, that the new persist directory leaves out. */
+    dropPersist: Set<number>;
+    /** The presentation is rewritten only to decrypt it. A rewrite of an encrypted presentation always decrypts it. */
+    decrypt: boolean;
+}
+export declare const noPresentationEdits: () => PresentationEdits;
+export declare const hasPresentationEdits: (e: PresentationEdits) => boolean;
+/** The current edit as its UserEditAtom (MS-PPT 2.3.3) gives it. */
+export interface CurrentEdit {
+    /** The atom's body, kept but for the offsets the rewrite writes anew. */
+    body: Uint8Array;
+}
+/**
+ * Writes a PowerPoint Document stream again as a full save (MS-PPT 2.1.2): each persist object the current edit
+ * reaches, in persist id order, then one persist directory for them and one UserEditAtom with no edit before it.
+ * `source` is the stream as read, decrypted when it was encrypted, and `persist` maps each persist id to the offset of
+ * its object. Returns the offset of the new UserEditAtom, which the Current User stream points at.
+ */
+export declare function rewritePresentation(source: ByteSource, size: number, persist: ReadonlyMap<number, number>, current: CurrentEdit, edits: PresentationEdits, sink: SpillSink, deadline?: number): Promise<number>;

package/dist/ppt-writer.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasPresentationEdits = exports.noPresentationEdits = void 0;
+exports.rewritePresentation = rewritePresentation;
+const errors_1 = require("./errors");
+const noPresentationEdits = () => ({ remove: new Set(), replace: new Map(), dropPersist: new Set(), decrypt: false });
+exports.noPresentationEdits = noPresentationEdits;
+const hasPresentationEdits = (e) => e.decrypt || e.remove.size > 0 || e.replace.size > 0 || e.dropPersist.size > 0;
+exports.hasPresentationEdits = hasPresentationEdits;
+const USER_EDIT = 0x0ff5;
+const PERSIST_DIRECTORY = 0x1772;
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const le32 = (n) => Uint8Array.of(n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+function head(verInst, type, length) {
+    return Uint8Array.of(verInst & 0xff, verInst >> 8, type & 0xff, type >> 8, ...le32(length));
+}
+/**
+ * The bytes of one record, from `offset` in `source`, with the edits inside it made. A container is written from its
+ * children, so its length follows what they become; a record without edits inside is copied as it is.
+ */
+async function recordBytes(source, offset, end, edits, touched, deadline) {
+    (0, errors_1.checkTime)(deadline);
+    const h = await source.read(offset, 8);
+    const verInst = h[0] | (h[1] << 8);
+    const type = h[2] | (h[3] << 8);
+    const length = Math.min(u32(h, 4), end - offset - 8);
+    if (edits.remove.has(offset))
+        return [];
+    const replaced = edits.replace.get(offset);
+    if (replaced)
+        return [head(verInst, type, replaced.length), replaced];
+    const bodyEnd = offset + 8 + length;
+    if ((verInst & 0x0f) !== 0x0f || !touched(offset + 8, bodyEnd))
+        return [head(verInst, type, length), await source.read(offset + 8, length)];
+    const parts = [];
+    let total = 0;
+    for (let pos = offset + 8; pos + 8 <= bodyEnd;) {
+        const kh = await source.read(pos, 8);
+        const kidEnd = Math.min(bodyEnd, pos + 8 + u32(kh, 4));
+        for (const p of await recordBytes(source, pos, kidEnd, edits, touched, deadline)) {
+            parts.push(p);
+            total += p.length;
+        }
+        pos = kidEnd;
+    }
+    return [head(verInst, type, total), ...parts];
+}
+/**
+ * Writes a PowerPoint Document stream again as a full save (MS-PPT 2.1.2): each persist object the current edit
+ * reaches, in persist id order, then one persist directory for them and one UserEditAtom with no edit before it.
+ * `source` is the stream as read, decrypted when it was encrypted, and `persist` maps each persist id to the offset of
+ * its object. Returns the offset of the new UserEditAtom, which the Current User stream points at.
+ */
+async function rewritePresentation(source, size, persist, current, edits, sink, deadline) {
+    const marks = [...edits.remove, ...edits.replace.keys()].sort((a, b) => a - b);
+    const touched = (from, to) => {
+        let lo = 0;
+        let hi = marks.length;
+        while (lo < hi) {
+            const mid = (lo + hi) >> 1;
+            if (marks[mid] < from)
+                lo = mid + 1;
+            else
+                hi = mid;
+        }
+        return lo < marks.length && marks[lo] < to;
+    };
+    const written = new Map();
+    let pos = 0;
+    for (const [id, offset] of [...persist].sort((a, b) => a[0] - b[0])) {
+        if (edits.dropPersist.has(id) || offset + 8 > size)
+            continue;
+        const parts = await recordBytes(source, offset, size, edits, touched, deadline);
+        if (!parts.length)
+            continue;
+        written.set(id, pos);
+        for (const p of parts) {
+            await sink.write(p);
+            pos += p.length;
+        }
+    }
+    // The directory: runs of consecutive ids, each a 20-bit first id and a 12-bit count, then their offsets.
+    const ids = [...written.keys()].sort((a, b) => a - b);
+    const dir = [];
+    for (let i = 0; i < ids.length;) {
+        let n = 1;
+        while (i + n < ids.length && ids[i + n] === ids[i] + n && n < 0xfff)
+            n++;
+        dir.push(...le32((ids[i] & 0xfffff) | (n << 20)));
+        for (let k = 0; k < n; k++)
+            dir.push(...le32(written.get(ids[i + k]) ?? 0));
+        i += n;
+    }
+    const dirAt = pos;
+    const dirRecord = Uint8Array.from([...head(0, PERSIST_DIRECTORY, dir.length), ...dir]);
+    await sink.write(dirRecord);
+    pos += dirRecord.length;
+    // The UserEditAtom: no edit before it, the new directory, and no encryption session once decrypted.
+    const body = Uint8Array.from(current.body.subarray(0, edits.decrypt ? 28 : current.body.length));
+    body.set(le32(0), 8);
+    body.set(le32(dirAt), 12);
+    const editAt = pos;
+    await sink.write(Uint8Array.from([...head(0, USER_EDIT, body.length), ...body]));
+    return editAt;
+}

package/dist/ppt.d.ts

@@ -1,8 +1,12 @@
 import { type CfbEntry, CompoundFile } from './cfb';
 import { type RunContext } from './context';
+import { CompoundPlan } from './plan';
 /**
  * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
  * current edit names. This reads every record at the top level of the stream as well as every object the persist
  * directories name, so an object that one route hides is still read.
+ *
+ * With `plan`, what the strip findings name is removed by a full save of the stream: the persist objects the current
+ * edit reaches, written again with the records that go left out, a new persist directory and a new UserEditAtom.
  */
-export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry): Promise<void>;
+export declare function powerPointRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, plan?: CompoundPlan): Promise<void>;

package/dist/ppt.js

@@ -39,11 +39,15 @@ const cfb_1 = require("./cfb");
 const contained_1 = require("./contained");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
+const forms_1 = require("./forms");
 const io_1 = require("./io");
 const links_1 = require("./links");
 const objects_1 = require("./objects");
 const offcrypto_1 = require("./offcrypto");
 const oleobj_1 = require("./oleobj");
+const plan_1 = require("./plan");
+const ppt_writer_1 = require("./ppt-writer");
+const rewrite_cfb_1 = require("./rewrite-cfb");
 const types_1 = require("./types");
 /** Record types of the PowerPoint binary format (MS-PPT 2.13.24). */
 const T = {
@@ -71,29 +75,44 @@ const header = (b) => ({ version: b[0] & 0x0f, instance: (b[0] | (b[1] << 8)) >>
  * Inspects a PowerPoint 97 to 2003 presentation. PowerPoint finds its objects through the persist directory that the
  * current edit names. This reads every record at the top level of the stream as well as every object the persist
  * directories name, so an object that one route hides is still read.
+ *
+ * With `plan`, what the strip findings name is removed by a full save of the stream: the persist objects the current
+ * edit reaches, written again with the records that go left out, a new persist directory and a new UserEditAtom.
  */
-async function powerPointRules(ctx, cfb, stream) {
+async function powerPointRules(ctx, cfb, stream, plan) {
     const location = stream.name;
     let source = cfb.source(stream);
     let reader = new io_1.Reader(source, stream.size, 16384, 8);
     const persist = new Map();
+    const edits = (0, ppt_writer_1.noPresentationEdits)();
     const current = cfb.child(cfb.root, 'Current User');
+    let editAt = 0;
+    let session;
     if (current?.kind === 'stream') {
         const cu = await cfb.source(current).read(0, 24);
         if (cu.length >= 20 && header(cu).type === T.currentUserAtom) {
-            await readPersist(reader, stream.size, u32(cu, 16), persist, ctx.settings.deadline);
+            editAt = u32(cu, 16);
+            await readPersist(reader, stream.size, editAt, persist, ctx.settings.deadline);
             if (u32(cu, 12) === ENCRYPTED_TOKEN) {
-                source = await decryptPresentation(ctx, reader, stream, u32(cu, 16), persist);
+                const before = ctx.findings.length;
+                const opened = await decryptPresentation(ctx, reader, stream, editAt, persist);
+                source = opened.source;
+                session = opened.session;
                 reader = new io_1.Reader(source, stream.size, 16384, 8);
+                // The rewrite writes the presentation decrypted, so one VelvetSweatshop opens is rewritten when that finding strips.
+                if (ctx.findings.slice(before).some(f => f.category === types_1.OfficeCategory.Encrypted && f.detail === types_1.OfficeDetail.DefaultPassword && f.action === 'strip'))
+                    edits.decrypt = true;
             }
         }
     }
     const storages = new Map();
-    /** ExOleObjAtom types by the persist id of the storage they name: 0 embedded, 1 linked, 2 a control. */
+    /** ExOleObjAtoms by the persist id of the storage they name: the object's type, 0 embedded, 1 linked, 2 a control, and the container that holds the atom. */
     const roles = new Map();
-    const vba = new Set();
+    /** VBAInfoAtoms by the persist id of the project's storage, with the VBAInfoContainer around each. */
+    const vba = new Map();
+    const containers = [];
     const visited = new Set();
-    const walk = async (start, end, depth, siblings) => {
+    const walk = async (start, end, depth, siblings, parent) => {
         for (let pos = start; pos + 8 <= end;) {
             (0, errors_1.checkTime)(ctx.settings.deadline);
             const h = header(await reader.read(pos, 8));
@@ -106,32 +125,87 @@ async function powerPointRules(ctx, cfb, stream) {
                 storages.set(pos, { offset: pos, header: h });
             else if (h.type === T.exOleObjAtom && h.length >= 20) {
                 const b = await reader.read(pos + 8, 20);
-                roles.set(u32(b, 16), u32(b, 4));
+                roles.set(u32(b, 16), { type: u32(b, 4), container: parent });
+            }
+            else if (h.type === T.vbaInfoAtom && h.length >= 4) {
+                const id = u32(await reader.read(pos + 8, 4), 0);
+                vba.set(id, [...(vba.get(id) ?? []), parent]);
             }
-            else if (h.type === T.vbaInfoAtom && h.length >= 4)
-                vba.add(u32(await reader.read(pos + 8, 4), 0));
             if (h.version === 0x0f && depth < MAX_DEPTH) {
                 const kids = [];
-                await walk(pos + 8, bodyEnd, depth + 1, kids);
-                await containerRules(ctx, reader, h, pos, kids, location);
+                await walk(pos + 8, bodyEnd, depth + 1, kids, pos);
+                containers.push({ h, offset: pos, kids });
             }
             pos = bodyEnd;
         }
     };
     // Every record at the top level, then each persist object that does not start on a record already read.
-    await walk(0, stream.size, 0, []);
+    await walk(0, stream.size, 0, [], -1);
     for (const offset of persist.values()) {
         if (visited.has(offset) || offset + 8 > stream.size)
             continue;
         const h = header(await reader.read(offset, 8));
-        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, []);
+        await walk(offset, Math.min(stream.size, offset + 8 + h.length), 0, [], -1);
     }
+    // The storages come first: a VBA project that stays keeps the actions that run its macros.
     const byOffset = new Map([...persist].map(([id, offset]) => [offset, id]));
     for (const s of storages.values()) {
         const id = byOffset.get(s.offset);
-        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id) === 2 ? 'control' : 'object';
-        await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`);
+        const role = id !== undefined && vba.has(id) ? 'vba' : id !== undefined && roles.get(id)?.type === 2 ? 'control' : 'object';
+        const verdict = await storageRules(ctx, source, s, role, `${location}, offset ${s.offset}`, plan !== undefined);
+        if (id === undefined || verdict === 'keep')
+            continue;
+        if (verdict === 'remove') {
+            // The storage goes, and so does what names it: the VBAInfoContainer, or the object's container in ExObjList.
+            edits.dropPersist.add(id);
+            if (role === 'vba')
+                for (const c of vba.get(id) ?? [])
+                    edits.remove.add(c);
+            else {
+                const holder = roles.get(id)?.container;
+                if (holder !== undefined && holder >= 0)
+                    edits.remove.add(holder);
+            }
+        }
+        else
+            edits.replace.set(s.offset, verdict.body);
+    }
+    const links = new Map();
+    const actions = [];
+    for (const c of containers)
+        await containerRules(ctx, reader, c.h, c.offset, c.kids, location, edits, links, actions);
+    // An action that opens a hyperlink that went does nothing.
+    for (const a of actions) {
+        if (a.action !== 4 || !links.has(a.hyperlink) || edits.replace.has(a.offset))
+            continue;
+        const body = Uint8Array.from(await reader.read(a.offset + 8, 16));
+        body[8] = 0;
+        edits.replace.set(a.offset, body);
     }
+    if (!plan || !current || !(0, ppt_writer_1.hasPresentationEdits)(edits))
+        return;
+    // An encrypted presentation's pictures and summary are encrypted too, in streams this rewrite does not decrypt. It
+    // is left as it was, and the check of the output says what it still holds.
+    if (session !== undefined && ['Pictures', 'EncryptedSummary'].some(n => (cfb.child(cfb.root, n)?.size ?? 0) > 0))
+        return;
+    if (session !== undefined) {
+        edits.decrypt = true;
+        edits.dropPersist.add(session);
+    }
+    const userEdit = header(await reader.read(editAt, 8));
+    const body = await reader.read(editAt + 8, Math.min(userEdit.length, 64));
+    if (userEdit.type !== T.userEditAtom || body.length < 28)
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    const newEdit = await (0, ppt_writer_1.rewritePresentation)(source, stream.size, persist, { body }, edits, sink, ctx.settings.deadline);
+    await sink.close();
+    plan.replace.set(stream, sink);
+    const user = Uint8Array.from(await cfb.bytes(current));
+    user.set([newEdit & 0xff, (newEdit >>> 8) & 0xff, (newEdit >>> 16) & 0xff, (newEdit >>> 24) & 0xff], 16);
+    if (edits.decrypt)
+        user.set([0x5f, 0xc0, 0x91, 0xe3], 12);
+    plan.replace.set(current, await (0, contained_1.spillOf)(ctx.run, user));
 }
 /**
  * The PowerPoint Document stream of an encrypted presentation, decrypted (MS-PPT 2.3.7). The current edit names the
@@ -142,7 +216,8 @@ async function powerPointRules(ctx, cfb, stream) {
 async function decryptPresentation(ctx, reader, stream, edit, persist) {
     const required = (reason) => new errors_1.StopError(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.PasswordRequired, `The presentation is encrypted: ${reason}`, { stream: stream.name, reason });
     const u = await reader.read(edit, 40);
-    const sessionAt = u.length >= 40 && header(u).type === T.userEditAtom ? persist.get(u32(u, 36)) : undefined;
+    const sessionId = u.length >= 40 && header(u).type === T.userEditAtom ? u32(u, 36) : -1;
+    const sessionAt = persist.get(sessionId);
     if (sessionAt === undefined || sessionAt + 8 > stream.size)
         throw required('the current edit names no CryptSession10Container');
     const h = header(await reader.read(sessionAt, 8));
@@ -162,7 +237,7 @@ async function decryptPresentation(ctx, reader, stream, edit, persist) {
         copy.set(head, offset);
         copy.set(rc4.crypt(copy.subarray(offset + 8, offset + 8 + length)), offset + 8);
     }
-    return (0, io_1.bufferSource)(copy);
+    return { source: (0, io_1.bufferSource)(copy), session: sessionId };
 }
 /** Reads the persist directories of the current edit and every edit before it. Newer entries win. */
 async function readPersist(reader, size, start, persist, deadline) {
@@ -190,10 +265,15 @@ async function readPersist(reader, size, start, persist, deadline) {
         edit = u32(u, 16);
     }
 }
-/** One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. */
-async function storageRules(ctx, source, s, role, location) {
+/**
+ * One ExOleObjStg: a VBA project, a control or an OLE object, stored as a compound file that may be compressed. With
+ * `rewrite`, a VBA project goes to the script plugins and stays, without its compiled code, when they pass it; a
+ * Forms 2.0 control stays; an object stays as the file plugins left it. Anything a strip finding names goes.
+ */
+async function storageRules(ctx, source, s, role, location, rewrite) {
+    const compressed = s.header.instance === 1;
     let inner;
-    if (s.header.instance === 1) {
+    if (compressed) {
         const raw = await source.read(s.offset + 8, s.header.length);
         const declared = raw.length >= 4 ? u32(raw, 0) : 0;
         if (declared > ctx.settings.decompressedBytes)
@@ -203,8 +283,7 @@ async function storageRules(ctx, source, s, role, location) {
             bytes = zlib.inflateSync(raw.subarray(4), { maxOutputLength: Math.max(1, declared) });
         }
         catch {
-            unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
-            return;
+            return unreadable(ctx, role, location, 'its compressed data does not inflate to its declared size');
         }
         inner = { size: async () => bytes.length, read: async (offset, length) => bytes.subarray(offset, offset + length) };
     }
@@ -223,28 +302,69 @@ async function storageRules(ctx, source, s, role, location) {
     catch (e) {
         if (!(e instanceof errors_1.StopError) || e.category !== types_1.OfficeCategory.Container)
             throw e;
-        unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
-        return;
+        return unreadable(ctx, role, location, `its storage does not read: ${e.message}`);
     }
     (0, objects_1.nestedNotes)(ctx, cfb, location);
-    if (role === 'control')
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) });
-    // An object's storage goes to the plugins as the compound file it is. The rewrite cannot change the presentation's
-    // records, so only a plugin that passes the object keeps it in the output.
+    const strips = ctx.strips;
+    if (role === 'control') {
+        const data = { storage: location, ...(cfb.root.clsid === '00000000-0000-0000-0000-000000000000' ? {} : { clsid: cfb.root.clsid }) };
+        const problem = await (0, forms_1.controlStorageProblem)(cfb, cfb.root, forms_1.OOXML_CONTROL_STREAMS);
+        if (problem)
+            ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...data, reason: (0, context_1.clip)(problem) });
+        else
+            ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, location, data);
+        // What the storage holds besides the control gets the rules any compound file gets.
+        await (0, objects_1.compoundRules)(ctx, cfb, location, false);
+        return ctx.strips > strips ? 'remove' : 'keep';
+    }
+    if (role === 'vba') {
+        // The project's storage is the root of the compound file, so the rules give it a plan of its own.
+        const own = new plan_1.CompoundPlan();
+        await (0, objects_1.compoundRules)(ctx, cfb, location, false, rewrite ? own : undefined);
+        const project = cfb.child(cfb.root, 'VBA');
+        if (!rewrite || !project || own.drop.has(project))
+            return ctx.strips > strips ? 'remove' : 'keep';
+        // The project stays: written again without its compiled code and whatever else its rules removed.
+        if (ctx.strips === strips && !own.replace.size && !own.drop.size)
+            return 'keep';
+        return { body: await storageBody(ctx, cfb, own, compressed) };
+    }
+    // An object's storage goes to the plugins as the compound file it is, and stays as they leave it.
     const size = await inner.size();
-    const decision = role === 'object' ? await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) }) : undefined;
-    await (0, objects_1.compoundRules)(ctx, cfb, location, role === 'object', undefined, decision);
+    const decision = await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) });
+    // A plugin's answer is final, so the object's own rules do not run.
+    if (!decision?.answered)
+        await (0, objects_1.compoundRules)(ctx, cfb, location, true, undefined, decision);
+    if ((decision && !decision.keep) || ctx.strips > strips)
+        return 'remove';
+    if (decision?.replacement) {
+        const bytes = await (0, io_1.readAll)(decision.replacement);
+        return { body: compressed ? Buffer.concat([Buffer.from(le32(bytes.length)), zlib.deflateSync(bytes)]) : bytes };
+    }
+    return 'keep';
 }
+/** An ExOleObjStg's data for a compound file written with `plan`: deflated after its size when it was compressed. */
+async function storageBody(ctx, cfb, plan, compressed) {
+    const sink = (0, io_1.bufferSink)();
+    await (0, rewrite_cfb_1.writeCompound)(ctx.run, cfb, plan, sink);
+    const bytes = sink.result();
+    return compressed ? Buffer.concat([Buffer.from(le32(bytes.length)), zlib.deflateSync(bytes)]) : bytes;
+}
+const le32 = (n) => [n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff];
 function unreadable(ctx, role, location, reason) {
-    if (role === 'vba')
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason });
-    else if (role === 'control')
-        ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason });
-    else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+    const r = role === 'vba'
+        ? ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, location, { storage: location, reason })
+        : role === 'control'
+            ? ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { storage: location, reason })
+            : ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, { storage: location, reason });
+    return r.action === 'strip' ? 'remove' : 'keep';
 }
-/** The rules of one container record, from its children: actions, hyperlinks and linked media. */
-async function containerRules(ctx, reader, h, offset, kids, stream) {
+/**
+ * The rules of one container record, from its children: actions, hyperlinks and linked media. What strips goes in the
+ * edits: an action becomes no action, a hyperlink goes, and a linked file's path is emptied. `links` collects the ids
+ * of the hyperlinks that go, and `actions` every action, for the actions that open those.
+ */
+async function containerRules(ctx, reader, h, offset, kids, stream, edits, links, actions) {
     const location = `${stream}, offset ${offset}`;
     const strings = async () => {
         const out = new Map();
@@ -257,25 +377,38 @@ async function containerRules(ctx, reader, h, offset, kids, stream) {
         const atom = kids.find(k => k.h.type === T.interactiveInfoAtom && k.h.length >= 16);
         if (!atom)
             return;
-        const action = (await reader.read(atom.offset + 8 + 8, 1))[0];
+        const body = Uint8Array.from(await reader.read(atom.offset + 8, 16));
+        const action = body[8];
+        actions.push({ offset: atom.offset, hyperlink: u32(body, 4), action });
         const name = (await strings()).get(2) ?? '';
         const data = { trigger: h.instance === 1 ? 'mouse over' : 'click', ...(name ? { action: (0, context_1.clip)(name) } : {}) };
+        let r;
         if (action === 2)
-            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+            r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
+        // A macro of a VBA project that stays keeps its action.
         else if (action === 1)
-            ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data);
+            r = ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name);
         else if (action === 5)
-            ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+            r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
+        if (r?.action === 'strip') {
+            body[8] = 0;
+            edits.replace.set(atom.offset, body);
+        }
     }
     else if (h.type === T.exHyperlink) {
         const s = await strings();
         const target = s.get(1) ?? '';
-        if (target.trim() && !(0, links_1.isFragment)(target))
-            ctx.link(target, location, { source: 'PowerPoint hyperlink' });
+        const atom = kids.find(k => k.h.type === T.exHyperlinkAtom && k.h.length >= 4);
+        if (target.trim() && !(0, links_1.isFragment)(target) && ctx.link(target, location, { source: 'PowerPoint hyperlink' }).action === 'strip') {
+            edits.remove.add(offset);
+            if (atom)
+                links.set(u32(await reader.read(atom.offset + 8, 4), 0), offset);
+        }
     }
     else if (MEDIA_LINKS.has(h.type)) {
         const path = (await strings()).get(0) ?? '';
-        if (path.trim())
-            ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media');
+        const string = kids.find(k => k.h.type === T.cString && k.h.instance === 0);
+        if (path.trim() && ctx.external(types_1.OfficeDetail.Other, path, location, { source: 'linked sound or movie' }, 'linked media').action === 'strip' && string)
+            edits.replace.set(string.offset, new Uint8Array(0));
     }
 }

package/dist/rtf.js

@@ -670,7 +670,9 @@ async function objectData(ctx, o, bytes, location, base, cuts) {
             cuts.push({ start: o.objdata[0], end: o.objdata[1], text: objdataGroup((0, oleobj_1.replaceSized)(bytes, ole1.dataAt, native.length, newNative)) });
         }
     }
-    const act = (0, contained_1.presence)(decision);
+    // A plugin's answer is final, so the object's own rules do not run.
+    if (decision?.answered)
+        return;
     if (pkg)
         Object.assign(data, (0, objects_1.packageData)(pkg));
     else if (native && native.length >= 8 && cfb_1.CFB_SIGNATURE.every((v, i) => native[i] === v)) {
@@ -707,7 +709,7 @@ async function objectData(ctx, o, bytes, location, base, cuts) {
     if (className.toLowerCase() === 'ole2link')
         ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
     else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, act);
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data);
     if (equation)
         ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
 }

package/dist/score.d.ts

@@ -1,5 +1,7 @@
 import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeOptions, OfficeRisk, type OfficeScoreBands } from './types';
 export declare const DEFAULT_BANDS: OfficeScoreBands;
+/** Marks a finding as one a plugin's answer decided. */
+export declare function pluginDecided(f: DefuseFinding): void;
 interface Combination {
     name: string;
     weight: number;

package/dist/score.js

@@ -1,12 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMBINATIONS = exports.DEFAULT_BANDS = void 0;
+exports.pluginDecided = pluginDecided;
 exports.weightOf = weightOf;
 exports.scoreFindings = scoreFindings;
 exports.riskFor = riskFor;
 const findings_1 = require("./findings");
 const types_1 = require("./types");
 exports.DEFAULT_BANDS = { low: 1, medium: 25, high: 50, critical: 80 };
+/**
+ * Findings whose fate a plugin's answer decided, such as a button that runs a macro the plugins kept. They weigh
+ * nothing, in this run's score and in the weights a container gets: the plugin's own findings score that content.
+ */
+const decided = new WeakSet();
+/** Marks a finding as one a plugin's answer decided. */
+function pluginDecided(f) {
+    decided.add(f);
+}
 /** Code that runs, in any of its forms. */
 const runsCode = (has) => has(types_1.OfficeCategory.Macro) || has(types_1.OfficeCategory.Dde);
 exports.COMBINATIONS = [
@@ -24,6 +34,8 @@ exports.COMBINATIONS = [
 ];
 /** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
 function weightOf(f, options) {
+    if (decided.has(f))
+        return 0;
     const w = options.scoreWeights ?? [];
     const exact = w.find(x => x.category === f.category && x.detail === f.detail);
     if (exact)

package/dist/types.d.ts

@@ -79,6 +79,7 @@ export declare enum OfficeDetail {
     UnsupportedAlgorithm = "UNSUPPORTED_ALGORITHM",
     XorObfuscation = "XOR_OBFUSCATION",
     VbaProject = "VBA_PROJECT",
+    CompiledCode = "COMPILED_CODE",
     XlmMacrosheet = "XLM_MACROSHEET",
     WordBasic = "WORDBASIC",
     OdfBasic = "ODF_BASIC",
@@ -132,6 +133,8 @@ export declare enum OfficeDetail {
     PluginFailed = "PLUGIN_FAILED",
     PluginRemoved = "PLUGIN_REMOVED",
     ActiveX = "ACTIVEX",
+    FormsControl = "FORMS_CONTROL",
+    ControlPicture = "CONTROL_PICTURE",
     VerificationFailed = "VERIFICATION_FAILED"
 }
 export type OfficeFindingAction = 'reject' | 'strip' | 'info';
@@ -293,6 +296,41 @@ export interface ContainedFilePlugin {
     /** Writes the bytes to keep. Returning 'removed' drops the file after all. */
     process(file: ContainedFile, sink: ByteSink, context: PluginContext): Promise<'scrubbed' | 'passed' | 'removed' | ContainedFileResult>;
 }
+/** A type library or project a VBA project refers to, as its dir stream lists it. */
+export interface VbaReferenceInfo {
+    name: string;
+    kind: 'registered' | 'control' | 'project';
+    /** A type library's LibidReference, such as `*\G{...}#2.0#0#path#description`, or a project's path. */
+    libid: string;
+}
+/** A VBA module, as office-defuse shows it to a script plugin. */
+export interface ContainedScript {
+    /** The module's source, decoded with the project's code page. */
+    text: string;
+    /** "vba-" and the module's kind: "vba-document", "vba-standard", "vba-class" or "vba-form". */
+    trigger: string;
+    location: string;
+    /** The module's name. */
+    fieldName: string;
+    language: 'vba';
+    form: 'office';
+    /** The references of the module's project. office-defuse gives them with the project's first module only. */
+    references?: VbaReferenceInfo[];
+}
+export interface ScriptPlugin {
+    kind: 'script';
+    name: string;
+    accepts(script: ContainedScript): boolean | Promise<boolean>;
+    /**
+     * 'passed' keeps the module. Anything else removes the VBA project, since office-defuse writes no module a plugin
+     * rewrote. `findings` go into the report at the module's location.
+     */
+    process(script: ContainedScript): Promise<{
+        result: 'scrubbed' | 'passed' | 'removed';
+        text?: string;
+        findings?: DefuseFinding[];
+    }>;
+}
 export interface OfficeActionOverride {
     category: OfficeCategory;
     detail?: OfficeDetail;
@@ -323,6 +361,12 @@ export interface OfficeOptions {
     scoreBands?: OfficeScoreBands;
     /** Plugins that decide about the files inside the file: embedded objects and packages, OLE parts and attachments. */
     filePlugins?: ContainedFilePlugin[];
+    /**
+     * Plugins that decide about each module of a VBA project in a compound file or an OOXML package. The first plugin that
+     * accepts a module decides it. The project stays when every module passed, written without its compiled code so
+     * Office compiles the source the plugins read. Otherwise it goes, as it does without plugins.
+     */
+    scriptPlugins?: ScriptPlugin[];
     /** Directory for temporary files. Defaults to os.tmpdir(). */
     tempDir?: string;
     /**

package/dist/types.js

@@ -90,6 +90,7 @@ var OfficeDetail;
     OfficeDetail["XorObfuscation"] = "XOR_OBFUSCATION";
     // MACRO
     OfficeDetail["VbaProject"] = "VBA_PROJECT";
+    OfficeDetail["CompiledCode"] = "COMPILED_CODE";
     OfficeDetail["XlmMacrosheet"] = "XLM_MACROSHEET";
     OfficeDetail["WordBasic"] = "WORDBASIC";
     OfficeDetail["OdfBasic"] = "ODF_BASIC";
@@ -151,6 +152,8 @@ var OfficeDetail;
     OfficeDetail["PluginRemoved"] = "PLUGIN_REMOVED";
     // CONTROL
     OfficeDetail["ActiveX"] = "ACTIVEX";
+    OfficeDetail["FormsControl"] = "FORMS_CONTROL";
+    OfficeDetail["ControlPicture"] = "CONTROL_PICTURE";
     // PROCESSING
     OfficeDetail["VerificationFailed"] = "VERIFICATION_FAILED";
 })(OfficeDetail || (exports.OfficeDetail = OfficeDetail = {}));