@patrickdk77/office-defuse 0.2.2 → 0.3.0

package/dist/xls-writer.js

@@ -0,0 +1,250 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RewriteError = exports.hasEdits = exports.noEdits = void 0;
+exports.rewriteWorkbook = rewriteWorkbook;
+const biff_1 = require("./biff");
+const noEdits = () => ({ emptySheets: new Set(), names: new Map(), objMacros: new Set(), selfBooks: new Set(), hyperlinks: new Set(), decrypt: false });
+exports.noEdits = noEdits;
+const hasEdits = (e) => e.decrypt || e.emptySheets.size > 0 || e.names.size > 0 || e.objMacros.size > 0 || e.selfBooks.size > 0 || e.hyperlinks.size > 0;
+exports.hasEdits = hasEdits;
+/** A rewrite that cannot keep the stream's offsets right, which leaves the stream as it was. */
+class RewriteError extends Error {
+}
+exports.RewriteError = RewriteError;
+const T = { index: 0x020b, dbcell: 0x00d7, extsst: 0x00ff, defColWidth: 0x0055, dimensions: 0x0200, window2: 0x023e, hlinkTooltip: 0x0800 };
+/** Records that hold stream positions: BoundSheet8, Index, DBCell and ExtSST. */
+const POINTERS = new Set([biff_1.R.boundSheet, T.index, T.dbcell, T.extsst]);
+/** BIFF8's largest record body. */
+const MAX_BODY = 8224;
+const u16 = (b, at) => b[at] | (b[at + 1] << 8);
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const put32 = (b, at, v) => {
+    b[at] = v & 0xff;
+    b[at + 1] = (v >>> 8) & 0xff;
+    b[at + 2] = (v >>> 16) & 0xff;
+    b[at + 3] = (v >>> 24) & 0xff;
+};
+const record = (type, body) => ({ type, body, old: -1 });
+/**
+ * Writes a workbook stream again into `sink`, record by record in the order the stream holds them, with the edits
+ * made. Records change size, so the stream positions other records hold are written anew: BoundSheet8's lbPlyPos,
+ * Index's ibXF and rgibRw, DBCell's dbRtrw and ExtSST's ib. A position that does not fall where a record of the stream
+ * starts, or inside one that keeps its bytes, throws RewriteError before anything is written. `decrypt` turns each
+ * record after FILEPASS into its plain bytes. Bytes after the last whole record are not written.
+ *
+ * The stream is read twice: once for the record headers and the few bodies the edits change, and once to copy the
+ * rest, so the rewrite holds the records' headers, not their bytes.
+ */
+async function rewriteWorkbook(cfb, stream, edits, biff8, decrypt, sink, deadline) {
+    const heads = [];
+    /** The plain bodies the first pass needs: each BOF, the records that hold stream positions, and those the edits change. */
+    const bodies = new Map();
+    let filePass = -1;
+    const plainOf = (r, i) => Uint8Array.from(filePass >= 0 && i > filePass && decrypt ? decrypt(r) : r.body);
+    const reader = new biff_1.RecordReader(cfb, stream, 0, deadline);
+    for (let r = await reader.next(); r; r = await reader.next()) {
+        const i = heads.length;
+        heads.push({ type: r.type, offset: r.offset, length: r.body.length });
+        // office-defuse does not encrypt, so an encrypted workbook is written without FILEPASS, every record decrypted.
+        if (r.type === biff_1.R.filePass && filePass < 0) {
+            if (!decrypt)
+                throw new RewriteError('an encrypted workbook without its key');
+            filePass = i;
+            continue;
+        }
+        if (r.type === biff_1.R.bof || POINTERS.has(r.type) || edits.names.has(r.offset) || edits.objMacros.has(r.offset) || edits.selfBooks.has(r.offset))
+            bodies.set(r.offset, plainOf(r, i));
+    }
+    if (heads[0]?.type !== biff_1.R.bof)
+        throw new RewriteError('the stream does not start with a BOF record');
+    const indexOf = new Map(heads.map((h, i) => [h.offset, i]));
+    // Each substream, from a BOF at the top level to the EOF that closes it, by the offset of its BOF.
+    const ends = new Map();
+    let depth = 0;
+    let open = -1;
+    heads.forEach((h, i) => {
+        if (h.type === biff_1.R.bof) {
+            if (depth === 0)
+                open = i;
+            depth++;
+        }
+        else if (h.type === biff_1.R.eof && depth > 0 && --depth === 0)
+            ends.set(heads[open].offset, i);
+    });
+    const empty = new Map();
+    for (const at of edits.emptySheets) {
+        const body = bodies.get(at);
+        if (!body || heads[indexOf.get(at) ?? -1]?.type !== biff_1.R.boundSheet)
+            throw new RewriteError('an edit names no BoundSheet record');
+        const start = u32(body, 0);
+        const end = ends.get(start);
+        if (end === undefined)
+            throw new RewriteError('a sheet whose position is not where a substream starts');
+        empty.set(start, end);
+    }
+    const out = [];
+    for (let i = 0; i < heads.length; i++) {
+        const h = heads[i];
+        if (i === filePass)
+            continue;
+        if (edits.hyperlinks.has(h.offset)) {
+            if (heads[i + 1]?.type === T.hlinkTooltip)
+                i++;
+            continue;
+        }
+        const end = empty.get(h.offset);
+        if (end !== undefined) {
+            emptyWorksheet(bodies.get(h.offset) ?? new Uint8Array(0), biff8).forEach((x, k) => {
+                out.push({ type: x.type, source: -1, old: k === 0 ? h.offset : -1, length: x.body.length, body: x.body });
+            });
+            i = end;
+            continue;
+        }
+        let body = bodies.get(h.offset);
+        let changed = false;
+        if (body && h.type === biff_1.R.boundSheet && edits.emptySheets.has(h.offset)) {
+            body = Uint8Array.from(body);
+            body[5] = 0;
+            changed = true;
+        }
+        const name = edits.names.get(h.offset);
+        if (body && name !== undefined)
+            [body, changed] = [renamed(body, name, biff8), true];
+        if (body && edits.objMacros.has(h.offset))
+            [body, changed] = [withoutMacro(body), true];
+        if (body && edits.selfBooks.has(h.offset))
+            [body, changed] = [selfBook(body), true];
+        const length = changed && body ? body.length : h.length;
+        if (length > MAX_BODY)
+            throw new RewriteError('a record past 8,224 bytes');
+        out.push({ type: h.type, source: i, old: h.offset, length, body: changed ? body : undefined });
+    }
+    // New offsets, and the old offset of each record kept as it was, so positions can be followed.
+    const moved = new Map();
+    const kept = [];
+    let pos = 0;
+    for (const x of out) {
+        if (x.old >= 0) {
+            moved.set(x.old, pos);
+            if (x.source >= 0 && !x.body)
+                kept.push({ old: x.old, now: pos, length: 4 + x.length });
+        }
+        pos += 4 + x.length;
+    }
+    const start = (old) => {
+        const now = moved.get(old);
+        if (now === undefined)
+            throw new RewriteError(`a stream position, ${old}, where no record starts`);
+        return now;
+    };
+    // Kept records are in stream order, so the one around a position is found by halving.
+    const inside = (old) => {
+        let lo = 0;
+        let hi = kept.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (kept[mid].old <= old)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        const k = kept[lo];
+        if (!k || old < k.old || old >= k.old + k.length)
+            throw new RewriteError(`a stream position, ${old}, inside no record the rewrite keeps as it was`);
+        return k.now + (old - k.old);
+    };
+    const patched = (x, b, at) => {
+        if (x.type === biff_1.R.boundSheet && b.length >= 4)
+            put32(b, 0, start(u32(b, 0)));
+        else if (x.type === T.index && b.length >= (biff8 ? 16 : 12)) {
+            // BIFF8 writes rwMic and rwMac in 4 bytes each, BIFF5 in 2.
+            const ib = biff8 ? 12 : 8;
+            if (u32(b, ib))
+                put32(b, ib, start(u32(b, ib)));
+            for (let k = ib + 4; k + 4 <= b.length; k += 4)
+                put32(b, k, start(u32(b, k)));
+        }
+        else if (x.type === T.dbcell && b.length >= 4 && x.old >= 0)
+            put32(b, 0, at - start(x.old - u32(b, 0)));
+        else if (x.type === T.extsst)
+            for (let k = 2; k + 8 <= b.length; k += 8)
+                put32(b, k, inside(u32(b, k)));
+        return b;
+    };
+    // The records that hold positions are written anew here, so a position that does not resolve fails before the
+    // second pass writes anything.
+    for (const x of out) {
+        if (x.source < 0 || !POINTERS.has(x.type))
+            continue;
+        const base = x.body ?? bodies.get(x.old);
+        if (!base)
+            throw new RewriteError('a record that holds stream positions was not read');
+        x.body = patched(x, Uint8Array.from(base), moved.get(x.old) ?? 0);
+    }
+    const again = new biff_1.RecordReader(cfb, stream, 0, deadline);
+    let index = -1;
+    let current;
+    for (const x of out) {
+        let b;
+        if (x.body)
+            b = Uint8Array.from(x.body);
+        else {
+            while (index < x.source) {
+                current = await again.next();
+                index++;
+                if (!current)
+                    throw new RewriteError('the stream changed while it was read');
+            }
+            b = plainOf(current, index);
+        }
+        await sink.write(Uint8Array.of(x.type & 0xff, x.type >> 8, b.length & 0xff, b.length >> 8));
+        await sink.write(b);
+    }
+}
+/**
+ * The substream of an empty worksheet, from a sheet's BOF: the BOF saying worksheet, a default column width, empty
+ * dimensions, a window and EOF.
+ */
+function emptyWorksheet(bof, biff8) {
+    const head = Uint8Array.from(bof);
+    if (head.length >= 4) {
+        head[2] = 0x10;
+        head[3] = 0x00;
+    }
+    // BIFF5's Dimensions and Window2 are shorter: 2-byte rows, and a window without its zoom fields.
+    const window = new Uint8Array(biff8 ? 18 : 10);
+    window[0] = 0xb6;
+    window[6] = 0x40;
+    return [record(biff_1.R.bof, head), record(T.defColWidth, Uint8Array.of(8, 0)), record(T.dimensions, new Uint8Array(biff8 ? 14 : 10)), record(T.window2, window), record(biff_1.R.eof, new Uint8Array(0))];
+}
+/**
+ * An Lbl record (MS-XLS 2.4.150) under another name, which is not a built-in one. BIFF8 writes the name after a flag
+ * byte, and BIFF5 writes its characters alone.
+ */
+function renamed(b, name, biff8) {
+    const cch = b[3];
+    const wide = biff8 && (b[14] & 1) === 1;
+    const after = 14 + (biff8 ? 1 : 0) + cch * (wide ? 2 : 1);
+    if (after > b.length)
+        throw new RewriteError('an Lbl record cut short');
+    const head = Uint8Array.from(b.subarray(0, 14));
+    head[0] &= ~0x20;
+    head[3] = name.length;
+    return Uint8Array.from([...head, ...(biff8 ? [0] : []), ...Buffer.from(name, 'latin1'), ...b.subarray(after)]);
+}
+/** An Obj record (MS-XLS 2.4.181) without its FtMacro subrecord. */
+function withoutMacro(b) {
+    for (const { ft, at, data } of (0, biff_1.objSubrecords)(b))
+        if (ft === 0x04)
+            return Buffer.concat([b.subarray(0, at), b.subarray(at + 4 + data.length)]);
+    throw new RewriteError('an Obj record without the FtMacro to remove');
+}
+/** A SupBook record (MS-XLS 2.4.271) whose VirtualPath is U+0002, the workbook itself, with its sheet names kept. */
+function selfBook(b) {
+    const cch = u16(b, 2);
+    const wide = (b[4] & 1) === 1;
+    const after = 4 + 1 + cch * (wide ? 2 : 1);
+    if (cch === 0 || cch >= 0x0401 || after > b.length)
+        throw new RewriteError('a SupBook record without a path');
+    return Uint8Array.from([b[0], b[1], 1, 0, 0, 2, ...b.subarray(after)]);
+}

package/dist/xls.d.ts

@@ -1,6 +1,7 @@
 import { type BiffRecord } from './biff';
 import type { CfbEntry, CompoundFile } from './cfb';
 import { type RunContext } from './context';
+import type { CompoundPlan } from './plan';
 /** Turns an encrypted record body into its plain bytes. Without encryption the body is as stored. */
 export type Decrypt = (r: BiffRecord) => Uint8Array;
 /**
@@ -23,7 +24,14 @@ export declare function workbookKind(cfb: CompoundFile, stream: CfbEntry, deadli
  * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
  * hyperlinks. An encrypted workbook goes through `unlock`.
  */
-export declare function excelRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, unlock: Unlock): Promise<void>;
+/** An ActiveX control a sheet's Obj record keeps in the Ctls stream: its ProgID and where its data is. */
+export interface CtlsControl {
+    progId: string;
+    position: number;
+    size: number;
+    sheet: string;
+}
+export declare function excelRules(ctx: RunContext, cfb: CompoundFile, stream: CfbEntry, unlock: Unlock, plan?: CompoundPlan, controls?: CtlsControl[]): Promise<void>;
 /**
  * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
  * volume, the root, a folder, a step up, a URL's volume or Excel's startup folders.

package/dist/xls.js

@@ -8,9 +8,11 @@ const biff_1 = require("./biff");
 const context_1 = require("./context");
 const errors_1 = require("./errors");
 const formulas_1 = require("./formulas");
+const io_1 = require("./io");
 const links_1 = require("./links");
 const oleobj_1 = require("./oleobj");
 const types_1 = require("./types");
+const xls_writer_1 = require("./xls-writer");
 const STATES = ['visible', 'hidden', 'very hidden', 'hidden'];
 /** Record types of cell formulas (MS-XLS 2.4.127, 2.4.260 and 2.4.4): FORMULA, SHRFMLA and ARRAY. */
 const FORMULA = 0x0006;
@@ -41,13 +43,7 @@ async function workbookKind(cfb, stream, deadline) {
     }
     return kind;
 }
-/**
- * Inspects an Excel 5.0 to 2003 workbook stream. Excel reads the globals substream from the start of the stream,
- * then each sheet from where its BoundSheet record says the sheet starts. The globals give the macro sheets, the
- * names Excel runs as macros, and the DDE, OLE and workbook links. The sheets give shapes that run macros and
- * hyperlinks. An encrypted workbook goes through `unlock`.
- */
-async function excelRules(ctx, cfb, stream, unlock) {
+async function excelRules(ctx, cfb, stream, unlock, plan, controls = []) {
     const location = stream.name;
     const records = new biff_1.RecordReader(cfb, stream, 0, ctx.settings.deadline);
     const first = await records.next();
@@ -60,24 +56,32 @@ async function excelRules(ctx, cfb, stream, unlock) {
     const names = [];
     /** The SupBook each XTI of the ExternSheet record names. */
     const xti = [];
+    const edits = (0, xls_writer_1.noEdits)();
+    /** Names that run a macro and go, by their Lbl record, given new names once every name is known. */
+    const renames = [];
     for (let r = await records.next(); r && r.type !== biff_1.R.eof; r = await records.next()) {
         if (r.type === biff_1.R.filePass) {
+            const before = ctx.findings.length;
             decrypt = await unlock(ctx, r, location);
+            // The rewrite writes the workbook decrypted, so one VelvetSweatshop opens is rewritten when that finding strips.
+            if (ctx.findings.slice(before).some(f => f.category === types_1.OfficeCategory.Encrypted && f.detail === types_1.OfficeDetail.DefaultPassword && f.action === 'strip'))
+                edits.decrypt = true;
             continue;
         }
         const body = decrypt(r);
         if (r.type === biff_1.R.boundSheet)
-            sheets.push((0, biff_1.parseBoundSheet)(body, biff8));
+            sheets.push({ ...(0, biff_1.parseBoundSheet)(body, biff8), record: r.offset });
         else if (r.type === biff_1.R.lbl) {
             const name = (0, biff_1.parseLbl)(body, biff8);
             names.push(name.name);
             const auto = (0, biff_1.autoName)(name.name);
-            if (auto)
-                ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, location, { event: auto.event, name: (0, context_1.clip)(name.name) });
+            // Removing the name would renumber the names after it, which formulas refer to by number, so it is renamed.
+            if (auto && ctx.report(types_1.OfficeCategory.Macro, auto.onOpen ? types_1.OfficeDetail.EventOnOpen : types_1.OfficeDetail.Event, location, { event: auto.event, name: (0, context_1.clip)(name.name) }).action === 'strip')
+                renames.push({ offset: r.offset, event: auto.event });
         }
         else if (r.type === biff_1.R.supBook && body.length >= 4) {
             const cch = body[2] | (body[3] << 8);
-            books.push({ ctab: body[0] | (body[1] << 8), cch, path: cch > 0 && cch <= 0xff ? (0, biff_1.xlString)(body, 4, cch).text : '', ole: false, dde: false, names: [] });
+            books.push({ ctab: body[0] | (body[1] << 8), cch, path: cch > 0 && cch <= 0xff ? (0, biff_1.xlString)(body, 4, cch).text : '', ole: false, dde: false, names: [], offset: r.offset });
         }
         else if (r.type === biff_1.R.externSheet && biff8 && body.length >= 2) {
             const n = body[0] | (body[1] << 8);
@@ -95,31 +99,64 @@ async function excelRules(ctx, cfb, stream, unlock) {
                 books[books.length - 1].dde = true;
         }
     }
+    // A link that goes keeps its SupBook, which formulas count to by index, with a path to the workbook itself.
     for (const b of books)
-        linkRules(ctx, b, location);
+        if (linkRules(ctx, b, location)?.action === 'strip')
+            edits.selfBooks.add(b.offset);
     const nameOf = (ref) => (ref.kind === 'name' ? names[ref.index - 1] : books[xti[ref.ixti] ?? -1]?.names[ref.index - 1]);
+    // A macro of the workbook's own: an external name of the SupBook that is the workbook itself, as Excel names a VBA
+    // macro a button runs. A defined name may stand for anything, so it is not one.
+    const ownName = (ref) => (ref.kind === 'namex' && books[xti[ref.ixti] ?? -1]?.cch === 0x401 ? nameOf(ref) : undefined);
     for (const s of sheets)
-        await sheetRules(ctx, cfb, stream, s, decrypt, location, biff8 ? nameOf : undefined);
+        await sheetRules(ctx, cfb, stream, s, decrypt, location, edits, controls, biff8 ? nameOf : undefined, biff8 ? ownName : undefined);
+    const taken = new Set(names.map(n => n.toLowerCase()));
+    for (const { offset, event } of renames) {
+        let k = 1;
+        while (taken.has(`removed_${event}_${k}`.toLowerCase()))
+            k++;
+        const name = `Removed_${event}_${k}`;
+        taken.add(name.toLowerCase());
+        edits.names.set(offset, name);
+    }
+    // BIFF5 has no SupBook, HLink or Obj macro records in the shape BIFF8 has, so only its sheets and names change. What
+    // else strips stays, and the check of the output says so.
+    if (!biff8) {
+        edits.objMacros.clear();
+        edits.selfBooks.clear();
+        edits.hyperlinks.clear();
+    }
+    if (!plan || !(0, xls_writer_1.hasEdits)(edits))
+        return;
+    const sink = new io_1.SpillSink(ctx.run.temp, ctx.run.threshold);
+    ctx.run.held.push(sink);
+    try {
+        await (0, xls_writer_1.rewriteWorkbook)(cfb, stream, edits, biff8, decrypt, sink, ctx.settings.deadline);
+        await sink.close();
+        plan.replace.set(stream, sink);
+    }
+    catch (e) {
+        // Left as it is, the stream still holds what the findings name, and the check of the output says so.
+        if (!(e instanceof xls_writer_1.RewriteError))
+            throw e;
+    }
 }
-/** A SupBook record, read as MS-XLS 2.4.271 and oletools tell its kinds apart. */
+/**
+ * A SupBook record, read as MS-XLS 2.4.271 and oletools tell its kinds apart. A path that starts with U+0002 or U+0003
+ * refers to the workbook itself, as LibreOffice reads it.
+ */
 function linkRules(ctx, b, location) {
-    if (b.cch === 0x401 || b.cch === 0x3a01 || b.path === ' ' || b.path === '\0' || !b.path)
-        return;
+    if (b.cch === 0x401 || b.cch === 0x3a01 || b.path === ' ' || b.path === '\0' || !b.path || b.path.charCodeAt(0) === 2 || b.path.charCodeAt(0) === 3)
+        return undefined;
     if (b.ctab === 0) {
         // A DDE or OLE data source: the application or class, U+0003, and the topic or file.
         const [application, topic = ''] = b.path.split('\x03');
         if (b.ole && !b.dde) {
             const data = { source: 'SupBook', className: (0, context_1.clip)(application) };
-            if (topic)
-                ctx.external(types_1.OfficeDetail.Object, topic, location, data, 'linked object');
-            else
-                ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
+            return topic ? ctx.external(types_1.OfficeDetail.Object, topic, location, data, 'linked object') : ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
         }
-        else
-            ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, location, { application: (0, context_1.clip)(application), topic: (0, context_1.clip)(topic) });
-        return;
+        return ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Link, location, { application: (0, context_1.clip)(application), topic: (0, context_1.clip)(topic) });
     }
-    ctx.external(types_1.OfficeDetail.Workbook, virtualPath(b.path), location, { source: 'SupBook' }, 'external workbook');
+    return ctx.external(types_1.OfficeDetail.Workbook, virtualPath(b.path), location, { source: 'SupBook' }, 'external workbook');
 }
 /**
  * A VirtualPath (MS-XLS 2.5.277) written out. One that starts with U+0001 is encoded: its control characters name a
@@ -152,7 +189,7 @@ function virtualPath(p) {
     return out;
 }
 /** One sheet's substream, with any chart substreams inside it: Obj records that run macros, and hyperlinks. */
-async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
+async function sheetRules(ctx, cfb, stream, s, decrypt, location, edits, controls, nameOf, ownName) {
     const records = new biff_1.RecordReader(cfb, stream, s.position, ctx.settings.deadline);
     const bof = await records.next();
     if (bof?.type !== biff_1.R.bof || bof.body.length < 4)
@@ -160,8 +197,9 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
     const bofType = bof.body[2] | (bof.body[3] << 8);
     // The sheet's own BOF says what it is, and so does its BoundSheet record. Either one makes a macro sheet.
     const macroSheet = s.type === 1 || bofType === 0x0040;
-    if (macroSheet)
-        ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, location, { sheet: (0, context_1.clip)(s.name), state: STATES[s.state] });
+    // A macro sheet becomes an empty worksheet of the same name, so the sheets after it keep their indexes.
+    if (macroSheet && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, location, { sheet: (0, context_1.clip)(s.name), state: STATES[s.state] }).action === 'strip' && s.record !== undefined)
+        edits.emptySheets.add(s.record);
     let depth = 1;
     for (let r = await records.next(); r && depth > 0; r = await records.next()) {
         if (r.type === biff_1.R.bof)
@@ -169,13 +207,23 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
         else if (r.type === biff_1.R.eof)
             depth--;
         else if (r.type === biff_1.R.obj) {
-            if (objMacro(decrypt(r)))
-                ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, { sheet: (0, context_1.clip)(s.name) });
+            const body = decrypt(r);
+            const control = ctlsControl(body);
+            if (control)
+                controls.push({ ...control, sheet: s.name });
+            const macro = objMacro(body);
+            if (!macro)
+                continue;
+            // A shape that runs one of the workbook's own macros stays when its VBA project does.
+            const name = macro.ref && ownName ? ownName(macro.ref) : undefined;
+            const data = { sheet: (0, context_1.clip)(s.name), ...(macro.ref && nameOf ? { macro: (0, context_1.clip)(nameOf(macro.ref) ?? '') } : {}) };
+            if (ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name).action === 'strip')
+                edits.objMacros.add(r.offset);
         }
         else if (r.type === biff_1.R.hlink) {
             const target = hyperlink(decrypt(r));
-            if (target.trim() && !(0, links_1.isFragment)(target))
-                ctx.link(target, location, { sheet: (0, context_1.clip)(s.name), source: 'HLink record' });
+            if (target.trim() && !(0, links_1.isFragment)(target) && ctx.link(target, location, { sheet: (0, context_1.clip)(s.name), source: 'HLink record' }).action === 'strip')
+                edits.hyperlinks.add(r.offset);
         }
         else if (nameOf && !macroSheet && FORMULA_AT.has(r.type)) {
             // A macro sheet's formulas are its macros, which its own finding covers.
@@ -189,20 +237,55 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, nameOf) {
         }
     }
 }
-/** Whether an Obj record (MS-XLS 2.4.181) holds an FtMacro subrecord, the macro a click runs. */
+/**
+ * The FtMacro subrecord of an Obj record (MS-XLS 2.4.181), the macro a click runs, with the name its formula refers
+ * to when the formula is one PtgName or PtgNameX and nothing else. Undefined when the record has none.
+ */
 function objMacro(b) {
-    let at = 0;
-    while (at + 4 <= b.length) {
-        const ft = b[at] | (b[at + 1] << 8);
-        const cb = b[at + 2] | (b[at + 3] << 8);
-        // FtEnd ends the list, and FtLbsData's length does not count all its data, so the walk stops there.
-        if (ft === 0x00 || ft === 0x13)
-            return false;
-        if (ft === 0x04)
-            return cb > 0;
-        at += 4 + cb;
+    for (const { ft, data: f } of (0, biff_1.objSubrecords)(b)) {
+        if (ft !== 0x04)
+            continue;
+        if (f.length === 0)
+            return undefined;
+        // As Excel writes it: cce in 15 bits, 4 unused bytes, and the tokens. PtgName and PtgNameX are classed tokens,
+        // 0x23, 0x43 or 0x63 and 0x39, 0x59 or 0x79; a base token below 0x20 shares their low bits and is neither.
+        const cce = f.length >= 2 ? (f[0] | (f[1] << 8)) & 0x7fff : 0;
+        const rgce = f.subarray(6, 6 + cce);
+        const ptg = rgce[0] ?? 0;
+        const u32 = (k) => (rgce[k] | (rgce[k + 1] << 8) | (rgce[k + 2] << 16) | (rgce[k + 3] << 24)) >>> 0;
+        if (ptg >= 0x20 && (ptg & 0x1f) === 0x03 && cce === 5 && rgce.length === 5)
+            return { ref: { kind: 'name', index: u32(1) } };
+        if (ptg >= 0x20 && (ptg & 0x1f) === 0x19 && cce === 7 && rgce.length === 7)
+            return { ref: { kind: 'namex', ixti: rgce[1] | (rgce[2] << 8), index: u32(3) } };
+        return {};
+    }
+    return undefined;
+}
+/**
+ * The control an Obj record keeps in the Ctls stream: FtPioGrbit says an ActiveX control (fCtl) whose data is in Ctls
+ * (fPrstm), and FtPictFmla gives its ProgID, in the formula's embedInfo, and its place in Ctls after the formula.
+ */
+function ctlsControl(b) {
+    let flags = 0;
+    for (const { ft, data: d } of (0, biff_1.objSubrecords)(b)) {
+        if (ft === 0x08 && d.length >= 2)
+            flags = d[0] | (d[1] << 8);
+        if (ft !== 0x09 || (flags & 0x30) !== 0x30 || d.length < 2)
+            continue;
+        // ObjFmla: cbFmla, then cce, 4 unused bytes, the tokens, and PictFmlaEmbedInfo: 0x03, cbClass, a reserved byte
+        // and the class name. lPosInCtlStm and cbBufInCtlStm follow.
+        const cbFmla = d[0] | (d[1] << 8);
+        const f = d.subarray(2, 2 + cbFmla);
+        const cce = f.length >= 2 ? (f[0] | (f[1] << 8)) & 0x7fff : 0;
+        const info = f.subarray(6 + cce);
+        const progId = info[0] === 0x03 && info.length >= 4 ? (0, biff_1.xlString)(info, 3, info[1]).text : '';
+        const after = 2 + cbFmla;
+        if (after + 8 > d.length)
+            return undefined;
+        const u32 = (k) => (d[k] | (d[k + 1] << 8) | (d[k + 2] << 16) | (d[k + 3] << 24)) >>> 0;
+        return { progId, position: u32(after), size: u32(after + 4) };
     }
-    return false;
+    return undefined;
 }
 /** The target of an HLink record: its Hyperlink Object (MS-OSHARED 2.3.7.1) after the cell range and class id. */
 function hyperlink(b) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",