@patrickdk77/office-defuse 0.2.4 → 0.3.0

package/README.md

@@ -285,9 +285,11 @@ A file comes as a `ContainedFile`. `name` is the part or entry name, a Packager
 | `removed` | goes, with every reference to it | EMBEDDED/PLUGIN_REMOVED, `strip` |
 | `scrubbed` with nothing written, or an error | goes, with every reference to it | EMBEDDED/PLUGIN_FAILED, `strip` |
 
-A file goes whatever the overrides say about these findings. A file no plugin accepts gets the rule it gets without plugins, such as EMBEDDED/OLE_OBJECT, and a picture, which no rule names, stays. When a plugin keeps a file, the findings that name the file for being there, such as EMBEDDED/PACKAGE or MACRO/VBA_PROJECT for `vbaProject.bin`, turn to `info` and leave the score, as pdf-defuse leaves out an attached file a plugin kept. Other rules still decide for themselves, so an Equation Editor object a plugin passes goes anyway, since EMBEDDED/EQUATION strips it. A plugin's output for an object's storage must be a compound file, whose storages and streams then take the storage's place. Where the rewrite cannot change the container, as for an object stored in a PowerPoint record, the output keeps the file as it arrived, so a plugin's `scrubbed` or `removed` there fails the output check.
+A file goes whatever the overrides say about these findings. A file no plugin accepts gets the rule it gets without plugins, such as EMBEDDED/OLE_OBJECT, and a picture, which no rule names, stays. A file whose plugin failed gets that rule too, and goes.
 
-The findings a plugin returns go into the report with their `location` after the file's own and with `attachment` naming the file. A `reject` inside the file becomes `strip`, since the file goes and the file holding it stays. Each scores at its `weight`. The upload's score leaves out PLUGIN_PASSED and PLUGIN_SCRUBBED, and the output's counts them. The check of the output does not ask the plugins again. It matches each file by the MD5 of its bytes against what the plugins kept, and reports the `outputFindings` the plugin gave for it.
+A plugin's answer is final. A file a plugin passed, scrubbed or removed gets none of office-defuse's own findings: no EMBEDDED/PACKAGE, EMBEDDED/OLE_OBJECT or EMBEDDED/EQUATION, and no MACRO/VBA_PROJECT for `vbaProject.bin`. office-defuse does not look inside it either, so an object's storage is not searched for VBA projects or other objects. An Equation Editor object a plugin passes stays. Through file-defuse no plugin takes a bare object storage, so EMBEDDED/EQUATION still removes one there. A plugin's output for an object's storage must be a compound file, whose storages and streams then take the storage's place. Where the rewrite cannot change the container, as for an object stored in a PowerPoint record, the output keeps the file as it arrived, so a plugin's `scrubbed` or `removed` there fails the output check.
+
+The findings a plugin returns go into the report with their `location` after the file's own and with `attachment` naming the file. A `reject` inside the file becomes `strip`, since the file goes and the file holding it stays. Each scores at its `weight`, and they are all the file adds to the score. PLUGIN_PASSED and PLUGIN_SCRUBBED weigh 0, in the upload's score and the output's. The check of the output does not ask the plugins again. It matches each file by the MD5 of its bytes against what the plugins kept, and reports the `outputFindings` the plugin gave for it.
 
 The plugin context has `depth`, the file's depth in the upload, and `deadline`, which every file of the upload shares. An error with `code: 'DEFUSE_LIMIT'` or `code: 'DEFUSE_IO'` from a plugin stops the whole upload. At depth 0, a limit becomes LIMIT/TIME or LIMIT/NESTING_DEPTH, and an I/O error is thrown as its cause.
 
@@ -314,11 +316,13 @@ await disarmOffice(bytes, { filePlugins: [officePlugin()] });
 
 The first plugin whose `accepts` returns true decides a module. A module it passes gets MACRO/PLUGIN_PASSED, `info`. Any other answer, `scrubbed` included, is MACRO/PLUGIN_REMOVED, and an error is MACRO/PLUGIN_FAILED, both `strip`, since office-defuse writes no module a plugin rewrote. The plugin's findings go into the report as they are.
 
-The project stays when every module passed. Otherwise it goes, as it does without plugins, and so does a project with a module no plugin took. A project that stays is written without its compiled code, the way Mandiant's OfficePurge writes one. Each module stream holds only its source, compressed again, the dir stream says each source starts at 0, `_VBA_PROJECT` names no VBA version, and the `__SRP_` caches go. Office then compiles the source the plugins read, so p-code that does something other than its source, which VBA stomping relies on, never runs. MACRO/COMPILED_CODE, `strip`, reports the purge, and MACRO/VBA_PROJECT turns to `info`.
+The project stays when every module passed. Otherwise it goes, as it does without plugins, and so does a project with a module no plugin took. A project that stays is written without its compiled code, the way Mandiant's OfficePurge writes one. Each module stream holds only its source, compressed again, the dir stream says each source starts at 0, `_VBA_PROJECT` names no VBA version, and the `__SRP_` caches go. Office then compiles the source the plugins read, so p-code that does something other than its source, which VBA stomping relies on, never runs. MACRO/COMPILED_CODE, `strip`, reports the purge.
+
+When a plugin passed or removed every module, the answers are final. The report holds MACRO/PLUGIN_PASSED and PLUGIN_REMOVED with the plugins' findings, and no MACRO/VBA_PROJECT, and the project scores what the plugins found in it. MACRO/VBA_PROJECT, at office-defuse's weight, reports a project with a module no plugin took or a plugin failed on, or one office-defuse removes for a reason of its own, such as a user form that holds an ActiveX control.
 
 A user form stays with its project when its designer storage holds Forms 2.0 controls only. The designer must be the UserForm designer, the storages under it must be Forms 2.0 forms, frames and multipages, and every form's class table must be empty, since a class table can name any ActiveX control. A form that fails gets CONTROL/ACTIVEX at its designer, and while that finding strips, the project goes.
 
-When the document's own project stays, so does what runs its macros by name: an Excel shape's `macro`, a form control's `x:FmlaMacro`, a ribbon callback, PowerPoint's `ppaction://macro` and Word's MACROBUTTON field. Their findings turn to `info`. A name that points into another file, as `'other.xlsm'!Macro`, still goes.
+When the document's own project stays, so does what runs its macros by name: an Excel shape's `macro`, a form control's `x:FmlaMacro`, a ribbon callback, PowerPoint's `ppaction://macro` and Word's MACROBUTTON field. Their findings turn to `info`. A name that points into another file, as `'other.xlsm'!Macro`, still goes. Once the plugins answered for the project, kept or removed, these findings weigh 0, since the plugins scored the macros they run.
 
 office-defuse decides the `vbaProject.bin` part of an OOXML package, which with `scriptPlugins` set, even to an empty list, goes to the script plugins and not to the file plugins. It decides the project storages of a Word document, a workbook, a PowerPoint 97 presentation, a .ppa add-in and the other compound files. A project inside an embedded object is for the file plugins that take the object.
 
@@ -453,6 +457,8 @@ Three combinations add more. Code here means macros or DDE. Code or a run-progra
 
 The bands are NONE at 0, LOW from 1, MEDIUM from 25, HIGH from 50 and CRITICAL from 80. `scoreWeights` and `scoreBands` change them. A finding of a kind office-defuse does not make, such as one from another package, scores at its `weight`, or 0 without one.
 
+Content a plugin answered for scores at the weights of the plugin's findings alone, as [File plugins](#file-plugins) and [Script plugins](#script-plugins) describe. A workbook whose VBA project script-defuse keeps scores only what is left, such as the 10 of MACRO/COMPILED_CODE.
+
 ## Options
 
 | Option | Default | Purpose |

package/dist/contained.d.ts

@@ -1,6 +1,6 @@
-import type { RunContext, RunState } from './context';
+import type { Reported, RunContext, RunState } from './context';
 import { SpillSink } from './io';
-import { type DefuseFinding, type OfficeOptions, type PluginContext } from './types';
+import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeOptions, type PluginContext } from './types';
 /** The key under which office-defuse hands its run's options to a plugin. No other package can name it. */
 export declare const RUN_OPTIONS: unique symbol;
 /** A plugin context as office-defuse makes it. */
@@ -10,6 +10,11 @@ export type RunPluginContext = PluginContext & {
 /** What the plugins decided about a file inside the file. Undefined from `decideContained` means no plugin took it. */
 export interface ContainedDecision {
     keep: boolean;
+    /**
+     * A plugin passed, cleaned or removed the file. Its answer is final: the report holds it and what the plugin found,
+     * and office-defuse reports nothing of its own about the file.
+     */
+    answered?: boolean;
     /** The bytes a plugin kept in place of the file's own. */
     replacement?: SpillSink;
 }
@@ -43,9 +48,9 @@ export declare function pushContained(ctx: RunContext, found: DefuseFinding[] |
  */
 export declare function decideContained(ctx: RunContext, inner: InnerFile): Promise<ContainedDecision | undefined>;
 /**
- * The rule a file gets for being there, such as EMBEDDED/OLE_OBJECT, applies when no plugin took the file. A plugin
- * that kept the file turns those findings to info, since the content stays.
+ * Reports the rule a file gets for being there, such as EMBEDDED/OLE_OBJECT, when no plugin answered for the file. A
+ * plugin's answer is final: when one answered, nothing is reported, and the result only says whether the file stays.
  */
-export declare function presence(decision: ContainedDecision | undefined): 'info' | undefined;
+export declare function ownFinding(ctx: RunContext, decision: ContainedDecision | undefined, category: C, detail: D, location: string, data?: Record<string, string | number>): Reported;
 /** Bytes in a spill sink the run holds until it ends, as the rewrite takes a plugin's output. */
 export declare function spillOf(run: RunState, bytes: Uint8Array): Promise<SpillSink>;

package/dist/contained.js

@@ -4,7 +4,7 @@ exports.RUN_OPTIONS = void 0;
 exports.passOn = passOn;
 exports.pushContained = pushContained;
 exports.decideContained = decideContained;
-exports.presence = presence;
+exports.ownFinding = ownFinding;
 exports.spillOf = spillOf;
 const errors_1 = require("./errors");
 const io_1 = require("./io");
@@ -65,7 +65,7 @@ async function decideContained(ctx, inner) {
         if (expected) {
             ctx.report(types_1.OfficeCategory.Embedded, expected.result === 'passed' ? types_1.OfficeDetail.PluginPassed : types_1.OfficeDetail.PluginScrubbed, inner.location, { plugin: expected.plugin, name: name ?? '' });
             pushContained(ctx, expected.findings, inner.location, name);
-            return { keep: true };
+            return { keep: true, answered: true };
         }
         if (!plugins.length)
             return undefined;
@@ -108,6 +108,7 @@ async function decideContained(ctx, inner) {
                     }
                     else
                         ctx.removal(types_1.OfficeCategory.Embedded, r.result === 'removed' ? types_1.OfficeDetail.PluginRemoved : types_1.OfficeDetail.PluginFailed, inner.location, data);
+                    const answered = keep || r.result === 'removed';
                     pushContained(ctx, r.findings, inner.location, name);
                     const replacement = keep && out.length > 0 ? out : undefined;
                     if (replacement) {
@@ -117,7 +118,7 @@ async function decideContained(ctx, inner) {
                     }
                     else
                         await out.dispose();
-                    return { keep, replacement };
+                    return { keep, replacement, answered };
                 }
                 catch (e) {
                     await out.dispose();
@@ -137,11 +138,13 @@ async function decideContained(ctx, inner) {
     }
 }
 /**
- * The rule a file gets for being there, such as EMBEDDED/OLE_OBJECT, applies when no plugin took the file. A plugin
- * that kept the file turns those findings to info, since the content stays.
+ * Reports the rule a file gets for being there, such as EMBEDDED/OLE_OBJECT, when no plugin answered for the file. A
+ * plugin's answer is final: when one answered, nothing is reported, and the result only says whether the file stays.
  */
-function presence(decision) {
-    return decision?.keep ? 'info' : undefined;
+function ownFinding(ctx, decision, category, detail, location, data) {
+    if (decision?.answered)
+        return { action: decision.keep ? 'info' : 'strip' };
+    return ctx.report(category, detail, location, data);
 }
 /** Bytes in a spill sink the run holds until it ends, as the rewrite takes a plugin's output. */
 async function spillOf(run, bytes) {

package/dist/context.d.ts

@@ -68,11 +68,6 @@ export interface RunState {
     kept: Map<string, Expected>;
     /** Plugin output that waits for the rewrite. The run disposes of it when it ends. */
     held: SpillSink[];
-    /**
-     * Findings whose content a plugin kept, such as EMBEDDED/PACKAGE for a package a plugin passed. They stay in the
-     * report as info and leave the score to what the plugin found, as pdf-defuse leaves out a kept attached file.
-     */
-    superseded: WeakSet<DefuseFinding>;
     /** Sources the rewrite reads from, such as a compound file a plugin returned, which the run closes when it ends. */
     sources: ByteSource[];
     /** The container, once the format rules have read it. */
@@ -82,12 +77,9 @@ export interface RunState {
      * that run one of its macros by name then stay too.
      */
     macrosKept?: boolean;
+    /** The script plugins answered for the document's own VBA project, whether they kept it or removed it. */
+    macrosAnswered?: boolean;
 }
-/**
- * 'info' for a link or callback that runs one of the document's own macros when its project stays, so the finding
- * reports it without removing it. Undefined otherwise, leaving the action to the overrides.
- */
-export declare function ownMacro(run: RunState, name: string): 'info' | undefined;
 /** A finding the rules made, with its action, which the rewrite reads. Past 200 of one kind, `finding` is absent. */
 export interface Reported {
     action: OfficeFindingAction;
@@ -125,11 +117,23 @@ export declare class RunContext {
     withPlan(): PlanContext;
     /**
      * Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. `action` replaces the
-     * action the overrides give, for content whose fate a plugin decided.
+     * action the overrides give, for content whose fate a plugin decided. Such a finding as info weighs nothing.
      */
     report(category: C, detail: D, location?: string, data?: Record<string, string | number>, action?: OfficeFindingAction): Reported;
+    /**
+     * Reports a link, callback or field that runs the macro `name`. When the script plugins answered for the document's
+     * own VBA project, a trigger of one of its macros follows their answer: it stays, as info, when they kept the
+     * project, and the overrides decide it when they removed the project. Either way it weighs nothing, since the
+     * plugins scored the macro it runs.
+     */
+    macroTrigger(category: C, detail: D, location: string, data: Record<string, string | number>, name: string | undefined): Reported;
     /** Reports content that goes whatever the overrides say: its action is strip, or reject when the caller asked for that. */
     removal(category: C, detail: D, location?: string, data?: Record<string, string | number>): Reported;
+    /**
+     * Takes back a finding reported before a plugin answered for its content, whose answer is final. A finding past the
+     * first 200 of its kind was only counted, so there is none to take back.
+     */
+    retract(finding: DefuseFinding | undefined): void;
     /** Adds findings from another package as they are, such as those a plugin made inside a file. */
     push(findings: DefuseFinding[]): void;
     /** Reports a link, classified by pdf-defuse's checks of its target. */

package/dist/context.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ZipContext = exports.PlanContext = exports.RunContext = exports.clip = void 0;
-exports.ownMacro = ownMacro;
 const links_1 = require("./links");
 const plan_1 = require("./plan");
+const score_1 = require("./score");
 const types_1 = require("./types");
 const xml_1 = require("./xml");
 const OLE_SIGNATURE = [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1];
@@ -15,13 +15,6 @@ const clip = (raw, n = 200) => {
 exports.clip = clip;
 /** A macro of the document's own project, by name: Macro, Module.Macro, or Excel's [0]!Macro for this workbook. */
 const OWN_MACRO = /^(?:\[0\]!)?[\p{L}_][\p{L}\p{N}_]*(?:\.[\p{L}_][\p{L}\p{N}_]*)?$/u;
-/**
- * 'info' for a link or callback that runs one of the document's own macros when its project stays, so the finding
- * reports it without removing it. Undefined otherwise, leaving the action to the overrides.
- */
-function ownMacro(run, name) {
-    return run.macrosKept && OWN_MACRO.test(name.trim()) ? 'info' : undefined;
-}
 /** What one inspection holds while the format rules run. */
 class RunContext {
     factory;
@@ -61,7 +54,7 @@ class RunContext {
     }
     /**
      * Records a finding. Past 200 of one kind, as in pdf-defuse, one more finding counts the rest. `action` replaces the
-     * action the overrides give, for content whose fate a plugin decided.
+     * action the overrides give, for content whose fate a plugin decided. Such a finding as info weighs nothing.
      */
     report(category, detail, location, data, action) {
         const act = action ?? this.factory.actionFor(category, detail);
@@ -74,7 +67,7 @@ class RunContext {
             const finding = this.factory.make(category, detail, location, data);
             finding.action = act;
             if (action === 'info')
-                this.run.superseded.add(finding);
+                (0, score_1.pluginDecided)(finding);
             this.shared.findings.push(finding);
             return { action: act, finding };
         }
@@ -86,17 +79,39 @@ class RunContext {
             const finding = this.factory.make(category, detail, 'additional occurrences', counted);
             finding.action = act;
             if (action === 'info')
-                this.run.superseded.add(finding);
+                (0, score_1.pluginDecided)(finding);
             this.shared.findings.push(finding);
         }
         counted.count = Number(counted.count) + 1;
         return { action: act };
     }
+    /**
+     * Reports a link, callback or field that runs the macro `name`. When the script plugins answered for the document's
+     * own VBA project, a trigger of one of its macros follows their answer: it stays, as info, when they kept the
+     * project, and the overrides decide it when they removed the project. Either way it weighs nothing, since the
+     * plugins scored the macro it runs.
+     */
+    macroTrigger(category, detail, location, data, name) {
+        const own = name !== undefined && this.run.macrosAnswered === true && OWN_MACRO.test(name.trim());
+        const r = this.report(category, detail, location, data, own && this.run.macrosKept ? 'info' : undefined);
+        if (own && r.finding)
+            (0, score_1.pluginDecided)(r.finding);
+        return r;
+    }
     /** Reports content that goes whatever the overrides say: its action is strip, or reject when the caller asked for that. */
     removal(category, detail, location, data) {
         const act = this.factory.actionFor(category, detail);
         return this.report(category, detail, location, data, act === 'info' ? 'strip' : act);
     }
+    /**
+     * Takes back a finding reported before a plugin answered for its content, whose answer is final. A finding past the
+     * first 200 of its kind was only counted, so there is none to take back.
+     */
+    retract(finding) {
+        const i = finding ? this.shared.findings.indexOf(finding) : -1;
+        if (i >= 0)
+            this.shared.findings.splice(i, 1);
+    }
     /** Adds findings from another package as they are, such as those a plugin made inside a file. */
     push(findings) {
         this.shared.findings.push(...findings);

package/dist/engine.js

@@ -59,21 +59,21 @@ const xmlLimitsOf = (limits) => ({
     entityExpansions: limits.xmlEntityExpansions,
     entitySize: limits.xmlEntitySize,
 });
-const PLUGIN_KEPT = new Set([types_1.OfficeDetail.PluginPassed, types_1.OfficeDetail.PluginScrubbed]);
 /**
  * `incomplete` marks a run that stopped before it read the whole package. It is rejected without a score, whatever
  * the actions say, because an override can make the finding that stopped it look harmless. In the check of an output,
  * `isOutput`, the files plugins kept count in the score; in an upload they do not, and a file a plugin cleaned makes
  * the upload strippable, since the output must be written.
  */
-function finish(findings, options, incomplete, format, isOutput = false, superseded) {
+function finish(findings, options, incomplete, format, isOutput = false) {
     const named = { format: format?.format ?? '', mimeType: format?.mimeType ?? '' };
     if (incomplete)
         return { status: 'rejected', score: null, risk: types_1.OfficeRisk.Unknown, findings, ...named };
     const rejected = findings.some(f => f.action === 'reject');
     const strippable = findings.some(f => f.action === 'strip' || (!isOutput && f.detail === types_1.OfficeDetail.PluginScrubbed));
-    const scored = findings.filter(f => !superseded?.has(f) && (isOutput || !PLUGIN_KEPT.has(f.detail)));
-    const { score, risk } = (0, score_1.scoreFindings)(scored, options);
+    // What a plugin decided counts at the weights of the plugin's own findings; the PLUGIN_* findings that record its
+    // answer weigh nothing.
+    const { score, risk } = (0, score_1.scoreFindings)(findings, options);
     return { status: rejected ? 'rejected' : strippable ? 'strippable' : 'clean', score, risk, findings, ...named };
 }
 /**
@@ -167,7 +167,6 @@ function newRun(options, depth, deadline, verify) {
         verify,
         kept: new Map(),
         held: [],
-        superseded: new WeakSet(),
         sources: [],
     };
 }
@@ -246,7 +245,7 @@ async function analyze(run, source) {
         findings.push(...ctx.findings);
         if (run.temp.ioError !== undefined)
             throw run.temp.ioError;
-        return finish(findings, options, false, ctx.format, isOutput, run.superseded);
+        return finish(findings, options, false, ctx.format, isOutput);
     }
     catch (e) {
         if (src.failure !== undefined)

package/dist/fields.js

@@ -29,7 +29,7 @@ function evaluateField(ctx, location, code, computed, result = '') {
     if (name === 'DDE' || name === 'DDEAUTO')
         actions.push(ctx.report(types_1.OfficeCategory.Dde, types_1.OfficeDetail.Field, location, data).action);
     else if (name === 'MACROBUTTON')
-        actions.push(ctx.report(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') }, (0, context_1.ownMacro)(ctx.run, words[1]?.text ?? '')).action);
+        actions.push(ctx.macroTrigger(types_1.OfficeCategory.Field, types_1.OfficeDetail.Macrobutton, location, { ...data, macro: (0, context_1.clip)(words[1]?.text ?? '') }, words[1]?.text ?? '').action);
     else if (name === 'INCLUDETEXT' || name === 'INCLUDEPICTURE' || name === 'IMPORT' || name === 'LINK') {
         const target = arg(name === 'LINK' ? 2 : 1);
         if (target === undefined)

package/dist/findings.js

@@ -76,7 +76,7 @@ def(types_1.OfficeCategory.Encrypted, types_1.OfficeDetail.UnsupportedAlgorithm,
 // MACRO
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, 'strip', 70, 'The document holds VBA macros');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.CompiledCode, 'strip', 10, "The VBA project's compiled code was removed, so Office compiles the source the plugins checked");
-def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginPassed, 'info', 30, 'A VBA module was kept by <plugin {plugin}|a plugin>');
+def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginPassed, 'info', 0, 'A VBA module was kept by <plugin {plugin}|a plugin>');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginRemoved, 'strip', 0, '<Plugin {plugin}|A plugin> did not keep a VBA module, so the VBA project was removed');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginFailed, 'strip', 0, '<Plugin {plugin}|A plugin> failed on a VBA module, so the VBA project was removed');
 def(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, 'strip', 70, 'The workbook holds an Excel 4.0 macro sheet');
@@ -137,8 +137,8 @@ def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Applet, 'strip', 60, '
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Plugin, 'strip', 50, 'An embedded browser plug-in object');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, 'strip', 70, 'An Equation Editor 3.0 object, which CVE-2017-11882 and CVE-2018-0802 exploit');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, 'strip', 30, '<An attached file "{name}"|An attached file> (<{type}|unknown type>)');
-def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginPassed, 'info', 20, 'An embedded file was kept by <plugin {plugin}|a plugin> with nothing removed');
-def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginScrubbed, 'info', 10, 'An embedded file was cleaned and kept by <plugin {plugin}|a plugin>');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginPassed, 'info', 0, 'An embedded file was kept by <plugin {plugin}|a plugin> with nothing removed');
+def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginScrubbed, 'info', 0, 'An embedded file was cleaned and kept by <plugin {plugin}|a plugin>');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginFailed, 'strip', 0, '<Plugin {plugin}|A plugin> failed, so the embedded file was removed');
 def(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.PluginRemoved, 'strip', 0, 'An embedded file was removed by <plugin {plugin}|a plugin>');
 // CONTROL

package/dist/flat.js

@@ -281,13 +281,10 @@ async function decideBinaries(ctx, odf) {
         const object = plan.objects.find(o => o.index === parent.index);
         if (object) {
             decided.add(parent.index);
-            if (decision?.keep) {
-                if (object.finding) {
-                    object.finding.action = 'info';
-                    ctx.run.superseded.add(object.finding);
-                }
-            }
-            else if (decision || object.strips)
+            // A plugin's answer on the object's file is final, so the object's own finding is taken back.
+            if (decision?.answered)
+                ctx.retract(object.finding);
+            if (!decision?.keep && (decision || object.strips))
                 plan.element(exports.FLAT_ODF_PART, parent.index, { remove: true });
         }
         else if (decision && !decision.keep)

package/dist/macros.d.ts

@@ -8,6 +8,11 @@ export interface VbaDecision {
     reason?: string;
     /** The designer storages of the project's user forms, which stay with it and get no object rules of their own. */
     designers?: CfbEntry[];
+    /**
+     * A plugin passed or removed every module, and the project stays or goes by those answers alone. They are final:
+     * the report holds them, and nothing of office-defuse's own about the project.
+     */
+    answered?: boolean;
 }
 /**
  * Shows each module of the VBA project in `vba` to the script plugins. The first plugin that accepts a module decides

package/dist/macros.js

@@ -41,12 +41,14 @@ async function decideVba(ctx, cfb, vba, location, plan) {
         if (!(await (0, vba_1.isPurged)(cfb, project)))
             ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.CompiledCode, location, { storage: location });
         run.macrosKept = true;
-        return { keep: true, designers };
+        run.macrosAnswered = true;
+        return { keep: true, designers, answered: true };
     }
     if (!plugins.length)
         return { keep: false };
     const start = ctx.findings.length;
     let keep = project.modules.length > 0;
+    let answered = keep;
     const used = new Set();
     for (const [i, m] of project.modules.entries()) {
         const at = `${location}/${(0, cfb_1.showName)(m.stream.name)}`;
@@ -78,6 +80,8 @@ async function decideVba(ctx, cfb, vba, location, plan) {
                     ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginPassed, at, data);
                 else {
                     keep = false;
+                    if (r.result !== 'removed')
+                        answered = false;
                     ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginRemoved, at, data);
                 }
                 pushScript(ctx, r.findings);
@@ -85,15 +89,21 @@ async function decideVba(ctx, cfb, vba, location, plan) {
             catch (e) {
                 (0, contained_1.passOn)(run, e);
                 keep = false;
+                answered = false;
                 ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.PluginFailed, at, data);
             }
             break;
         }
-        if (!decided)
+        if (!decided) {
             keep = false;
+            answered = false;
+        }
+    }
+    if (!keep) {
+        if (answered)
+            run.macrosAnswered = true;
+        return { keep: false, answered };
     }
-    if (!keep)
-        return { keep: false };
     const passed = { result: 'passed', plugin: [...used].join(', '), findings: ctx.findings.slice(start).map(f => ({ ...f, data: f.data && { ...f.data } })) };
     const designers = await formDesigners(ctx, cfb, project, location);
     if (!designers)
@@ -117,7 +127,8 @@ async function decideVba(ctx, cfb, vba, location, plan) {
         ctx.removal(types_1.OfficeCategory.Macro, types_1.OfficeDetail.CompiledCode, location, { storage: location });
     }
     run.macrosKept = true;
-    return { keep: true, designers };
+    run.macrosAnswered = true;
+    return { keep: true, designers, answered: true };
 }
 /**
  * The designer storages of the project's user forms, beside its VBA storage, named as their modules. Undefined when

package/dist/msg.js

@@ -231,7 +231,7 @@ async function attachment(ctx, cfb, data, file, info, plan) {
     const decision = await (0, contained_1.decideContained)(ctx, { ...file, chunks: () => (0, io_1.chunksOf)(source, data.size) });
     if (decision?.replacement)
         plan?.replace.set(data, decision.replacement);
-    const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size }, (0, contained_1.presence)(decision));
+    const r = (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Attachment, file.location, { ...info, size: data.size });
     return decision && !decision.keep ? { ...r, action: 'strip' } : r;
 }
 /** The fixed-size values of a property stream (MS-OXMSG 2.4.2), by property id. An attachment's has an 8-byte header. */

package/dist/objects.js

@@ -66,8 +66,17 @@ async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision)
         if (r.action === 'strip' && e.kind !== 'root')
             plan?.drop.add(e);
     };
+    /** Objects a plugin answered for. Its answer is final, so nothing inside them gets the rules here. */
+    const answered = new Set();
+    const inAnswered = (e) => {
+        for (let p = e.parent; p; p = p.parent)
+            if (answered.has(p))
+                return true;
+        return false;
+    };
+    // A storage comes after the storage that holds it, so an object is decided before what it holds.
     for (const e of cfb.entries) {
-        if (e.kind === 'stream' || inDesigner(e))
+        if (e.kind === 'stream' || inDesigner(e) || inAnswered(e))
             continue;
         const child = (name) => e.children.find(c => upper(c) === name);
         const names = new Set(e.children.map(upper));
@@ -77,8 +86,16 @@ async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision)
             : [...names].some(n => OBJECT_STREAMS.has(n) || CONTROL_STREAMS.has(n)) ||
                 (parent === 'OBJECTPOOL' && e.parent?.parent?.kind === 'root') ||
                 (e.parent?.kind === 'root' && /^MBD[0-9A-F]{8}$/i.test(e.name));
-        if (isObject)
+        if (isObject) {
             objects.add(e);
+            const decided = await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined);
+            for (const r of decided.found)
+                drop(r, e);
+            if (decided.answered) {
+                answered.add(e);
+                continue;
+            }
+        }
         // A VBA project: a VBA storage with a dir stream, which names the modules (MS-OVBA 2.2). The storage that holds
         // the project goes, or the VBA storage when that is the root. With script plugins, the project stays when they
         // pass every module and the rewrite can take out its compiled code: in the file the rewrite writes, and outside any
@@ -91,15 +108,16 @@ async function compoundRules(ctx, cfb, prefix, rootIsObject, plan, rootDecision)
             if (decision?.keep)
                 for (const d of decision.designers ?? [])
                     designers.add(d);
-            drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), data, decision?.keep ? 'info' : undefined), e.kind === 'root' ? vba : e);
+            // The plugins' answers are final: the report holds them, and nothing of office-defuse's own about the project.
+            if (decision?.answered)
+                drop({ action: decision.keep ? 'info' : 'strip' }, e.kind === 'root' ? vba : e);
+            else
+                drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, vba), data), e.kind === 'root' ? vba : e);
         }
         if (e.kind === 'storage' && (upper(e) === '_VBA_PROJECT_CUR' || upper(e) === 'MACROS') && e.children.length && !projects.has(e)) {
             // Excel's and Word's project storages, without the dir stream a whole project has.
             drop(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, at(prefix, e), { storage: at(prefix, e) }), e);
         }
-        if (isObject)
-            for (const r of await objectRules(ctx, cfb, e, at(prefix, e), plan, e.kind === 'root' ? rootDecision : undefined))
-                drop(r, e);
     }
 }
 /** Reads an OLE object's storage: its class, its CompObj and OLE streams, and Packager's native data. */
@@ -186,6 +204,7 @@ async function objectFile(ctx, cfb, e, d, location, plan) {
  * One OLE object's storage: a control, a linked object, or an embedded one, with what it holds. Returns its findings,
  * and a strip when a plugin removed the object. In the file the rewrite writes, `plan` is set and an embedded object
  * goes to the plugins first. `given` is the verdict on an object whose container showed it to the plugins already.
+ * `answered` says a plugin answered for the object, so nothing else here looks at it or at what it holds.
  */
 async function objectRules(ctx, cfb, e, location, plan, given) {
     const d = await describeObject(cfb, e, location);
@@ -203,11 +222,11 @@ async function objectRules(ctx, cfb, e, location, plan, given) {
         // a metafile beside them, goes on its own.
         const problem = await (0, forms_1.controlStorageProblem)(cfb, e, forms_1.WORD_CONTROL_STREAMS);
         if (problem)
-            return [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...data, reason: (0, context_1.clip)(problem) })];
+            return { found: [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, location, { ...data, reason: (0, context_1.clip)(problem) })], answered: false };
         const print = e.children.find(c => c.kind === 'stream' && c.name === '\x03PRINT');
         if (print && ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ControlPicture, `${location}/${(0, cfb_1.showName)(print.name)}`, { storage: location, bytes: print.size }).action === 'strip')
             plan?.drop.add(print);
-        return [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, location, data)];
+        return { found: [ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, location, data)], answered: false };
     }
     const found = [];
     if (d.pkg) {
@@ -219,13 +238,15 @@ async function objectRules(ctx, cfb, e, location, plan, given) {
         found.push(linkedObject(ctx, d, location, { storage: location, ...(d.clsid ? { clsid: d.clsid } : {}) }));
     else {
         const decision = given ?? (plan ? await objectFile(ctx, cfb, e, d, location, plan) : undefined);
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, (0, contained_1.presence)(decision)));
+        if (decision?.answered)
+            return { found: [...found, { action: decision.keep ? 'info' : 'strip' }], answered: true };
+        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data));
         if (decision && !decision.keep)
             found.push({ action: 'strip' });
     }
     if (d.equation)
         found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data));
-    return found;
+    return { found, answered: false };
 }
 /**
  * Reports a linked object. A URL moniker's target loads from outside the file whatever its text looks like: a

package/dist/odf.js

@@ -376,14 +376,14 @@ async function inspectOdf(ctx) {
         const key = (0, zip_1.nameKey)(e.name);
         const decision = await (0, contained_1.decideContained)(ctx, { name: e.name, location: e.name, chunks: () => zip.read(e) });
         if (decision) {
-            decided.set(key, decision.keep);
+            decided.set(key, decision);
             if (!decision.keep)
                 plan.drop.add(key);
             else if (decision.replacement)
                 plan.replace.set(key, decision.replacement);
         }
         if (!oleRefs.get(key)) {
-            const r = ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name }, (0, contained_1.presence)(decision));
+            const r = (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, e.name, { part: e.name });
             if (!decision && r.action === 'strip')
                 plan.drop.add(key);
         }
@@ -398,15 +398,14 @@ async function inspectOdf(ctx) {
     }
     const files = new Set(zip.entries.filter(e => !e.directory).map(e => (0, zip_1.nameKey)(e.name)));
     for (const o of plan.objects) {
-        const kept = decided.get(o.target);
-        if (kept === true) {
-            // A plugin kept the object's file, so the object stays.
-            if (o.finding) {
-                o.finding.action = 'info';
-                ctx.run.superseded.add(o.finding);
-            }
+        const decision = decided.get(o.target);
+        // A plugin's answer on the object's file is final, so the object's own finding is taken back.
+        if (decision?.answered)
+            ctx.retract(o.finding);
+        const kept = decision?.keep;
+        // A plugin kept the object's file, so the object stays.
+        if (kept === true)
             continue;
-        }
         if (kept === false || o.strips) {
             plan.element(o.part, o.index, { remove: true });
             if (files.has(o.target))

package/dist/ooxml.js

@@ -386,7 +386,7 @@ class PartRules {
                 if (a.ns !== '' || !a.value.trim() || !/^(on[A-Z]|get[A-Z]|loadImage$)/.test(a.local))
                     continue;
                 // The callback goes and the control stays, doing nothing, unless it calls a macro of a project that stays.
-                if (this.ctx.report(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }, (0, context_1.ownMacro)(this.ctx.run, a.value)).action === 'strip') {
+                if (this.ctx.macroTrigger(types_1.OfficeCategory.Ui, types_1.OfficeDetail.Callback, this.part, { callback: `${a.local}=${(0, context_1.clip)(a.value)}` }, a.value).action === 'strip') {
                     this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', a.local)]) });
                 }
             }
@@ -419,7 +419,7 @@ class PartRules {
         else if (XDR_NS.has(ns)) {
             const macro = (0, xml_1.attr)(el, '', 'macro');
             // The shape stays, and clicking it runs nothing.
-            if (macro?.trim() && this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, (0, context_1.ownMacro)(this.ctx.run, macro)).action === 'strip') {
+            if (macro?.trim() && this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, macro).action === 'strip') {
                 this.ctx.plan.element(this.part, el.index, { strip: new Set([(0, plan_1.attributeKey)('', 'macro')]) });
             }
         }
@@ -478,7 +478,7 @@ class PartRules {
         if (ns === VML_EXCEL_NS && el.local === 'FmlaMacro' && this.macroText) {
             const macro = this.macroText.shown.text.trim();
             if (this.macroText.shown.content)
-                this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, (0, context_1.ownMacro)(this.ctx.run, macro)), this.macroText);
+                this.remove(this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, { macro: (0, context_1.clip)(macro) }, macro), this.macroText);
             this.macroText = undefined;
         }
         if (this.hyperlinkBase && EXTENDED_NS.has(ns) && el.local === 'HyperlinkBase') {
@@ -519,7 +519,7 @@ class PartRules {
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, this.part, data), el);
         else if (action.startsWith('ppaction://macro')) {
             const name = /[?&]name=([^&]*)/i.exec(written)?.[1] ?? '';
-            this.remove(this.ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data, (0, context_1.ownMacro)(this.ctx.run, safeDecode(name))), el);
+            this.remove(this.ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, this.part, data, safeDecode(name)), el);
         }
         else if (action.startsWith('ppaction://ole'))
             this.remove(this.ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, this.part, data), el);
@@ -754,25 +754,25 @@ async function partRules(ctx, p) {
     // With script plugins, a VBA project part is read here, so its modules go to them, rather than to the file plugins.
     const vbaDecision = p.vba ?? (vba && ctx.run.options.scriptPlugins !== undefined ? await vbaPart(ctx, p.entry, loc) : undefined);
     const decision = vbaDecision ?? (contained ? await (0, contained_1.decideContained)(ctx, { name: loc, declaredType: ct || undefined, location: loc, chunks: () => ctx.zip.read(p.entry) }) : undefined);
-    const act = (0, contained_1.presence)(decision);
     const found = [];
+    // A plugin's answer is final, so a file it answered for gets none of office-defuse's own findings.
     if (vba && !vbaDecision)
-        found.push(ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Macro, types_1.OfficeDetail.VbaProject, loc, data));
     // A macro sheet becomes an empty worksheet, so the indexes of the sheets after it stay right.
     if ((exports.TYPE.macrosheet.has(ct) || as(AS.macrosheet)) && ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.XlmMacrosheet, loc, data).action === 'strip')
         ctx.plan.sheets.add(key);
     if (ole)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, loc, data));
     if (pkg)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Package, loc, data));
     if (control && p.forms && !p.forms.problem)
         found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.FormsControl, loc, { ...data, clsid: p.forms.classId ?? '' }));
     else if (control || (controlBinary && !p.claimed)) {
         const why = control && p.forms ? { ...(p.forms.classId ? { clsid: p.forms.classId } : {}), ...(p.forms.problem ? { reason: (0, context_1.clip)(p.forms.problem) } : {}) } : {};
-        found.push(ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }, control ? undefined : act));
+        found.push(control ? ctx.report(types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }) : (0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Control, types_1.OfficeDetail.ActiveX, loc, { ...data, ...why }));
     }
     if (p.ole && !vba && !ole && !control && !controlBinary && !pkg)
-        found.push(ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data, act));
+        found.push((0, contained_1.ownFinding)(ctx, decision, types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleFile, loc, data));
     if (decision ? !decision.keep : found.some(f => f.action === 'strip'))
         ctx.plan.drop.add(key);
     else if (decision?.replacement)

package/dist/ppt.js

@@ -332,7 +332,9 @@ async function storageRules(ctx, source, s, role, location, rewrite) {
     // An object's storage goes to the plugins as the compound file it is, and stays as they leave it.
     const size = await inner.size();
     const decision = await (0, contained_1.decideContained)(ctx, { location, chunks: () => (0, io_1.chunksOf)(inner, size) });
-    await (0, objects_1.compoundRules)(ctx, cfb, location, true, undefined, decision);
+    // A plugin's answer is final, so the object's own rules do not run.
+    if (!decision?.answered)
+        await (0, objects_1.compoundRules)(ctx, cfb, location, true, undefined, decision);
     if ((decision && !decision.keep) || ctx.strips > strips)
         return 'remove';
     if (decision?.replacement) {
@@ -385,7 +387,7 @@ async function containerRules(ctx, reader, h, offset, kids, stream, edits, links
             r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.RunProgram, location, data);
         // A macro of a VBA project that stays keeps its action.
         else if (action === 1)
-            r = ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, (0, context_1.ownMacro)(ctx.run, name));
+            r = ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name);
         else if (action === 5)
             r = ctx.report(types_1.OfficeCategory.Action, types_1.OfficeDetail.OleVerb, location, data);
         if (r?.action === 'strip') {

package/dist/rtf.js

@@ -670,7 +670,9 @@ async function objectData(ctx, o, bytes, location, base, cuts) {
             cuts.push({ start: o.objdata[0], end: o.objdata[1], text: objdataGroup((0, oleobj_1.replaceSized)(bytes, ole1.dataAt, native.length, newNative)) });
         }
     }
-    const act = (0, contained_1.presence)(decision);
+    // A plugin's answer is final, so the object's own rules do not run.
+    if (decision?.answered)
+        return;
     if (pkg)
         Object.assign(data, (0, objects_1.packageData)(pkg));
     else if (native && native.length >= 8 && cfb_1.CFB_SIGNATURE.every((v, i) => native[i] === v)) {
@@ -707,7 +709,7 @@ async function objectData(ctx, o, bytes, location, base, cuts) {
     if (className.toLowerCase() === 'ole2link')
         ctx.report(types_1.OfficeCategory.External, types_1.OfficeDetail.Object, location, data);
     else
-        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data, act);
+        ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.OleObject, location, data);
     if (equation)
         ctx.report(types_1.OfficeCategory.Embedded, types_1.OfficeDetail.Equation, location, data);
 }

package/dist/score.d.ts

@@ -1,5 +1,7 @@
 import { OfficeCategory as C, OfficeDetail as D, type DefuseFinding, type OfficeOptions, OfficeRisk, type OfficeScoreBands } from './types';
 export declare const DEFAULT_BANDS: OfficeScoreBands;
+/** Marks a finding as one a plugin's answer decided. */
+export declare function pluginDecided(f: DefuseFinding): void;
 interface Combination {
     name: string;
     weight: number;

package/dist/score.js

@@ -1,12 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMBINATIONS = exports.DEFAULT_BANDS = void 0;
+exports.pluginDecided = pluginDecided;
 exports.weightOf = weightOf;
 exports.scoreFindings = scoreFindings;
 exports.riskFor = riskFor;
 const findings_1 = require("./findings");
 const types_1 = require("./types");
 exports.DEFAULT_BANDS = { low: 1, medium: 25, high: 50, critical: 80 };
+/**
+ * Findings whose fate a plugin's answer decided, such as a button that runs a macro the plugins kept. They weigh
+ * nothing, in this run's score and in the weights a container gets: the plugin's own findings score that content.
+ */
+const decided = new WeakSet();
+/** Marks a finding as one a plugin's answer decided. */
+function pluginDecided(f) {
+    decided.add(f);
+}
 /** Code that runs, in any of its forms. */
 const runsCode = (has) => has(types_1.OfficeCategory.Macro) || has(types_1.OfficeCategory.Dde);
 exports.COMBINATIONS = [
@@ -24,6 +34,8 @@ exports.COMBINATIONS = [
 ];
 /** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
 function weightOf(f, options) {
+    if (decided.has(f))
+        return 0;
     const w = options.scoreWeights ?? [];
     const exact = w.find(x => x.category === f.category && x.detail === f.detail);
     if (exact)

package/dist/xls.js

@@ -217,7 +217,7 @@ async function sheetRules(ctx, cfb, stream, s, decrypt, location, edits, control
             // A shape that runs one of the workbook's own macros stays when its VBA project does.
             const name = macro.ref && ownName ? ownName(macro.ref) : undefined;
             const data = { sheet: (0, context_1.clip)(s.name), ...(macro.ref && nameOf ? { macro: (0, context_1.clip)(nameOf(macro.ref) ?? '') } : {}) };
-            if (ctx.report(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name === undefined ? undefined : (0, context_1.ownMacro)(ctx.run, name)).action === 'strip')
+            if (ctx.macroTrigger(types_1.OfficeCategory.Macro, types_1.OfficeDetail.Link, location, data, name).action === 'strip')
                 edits.objMacros.add(r.offset);
         }
         else if (r.type === biff_1.R.hlink) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/office-defuse",
-  "version": "0.2.4",
+  "version": "0.3.0",
   "description": "Inspect Office and OpenDocument files for VBA and Excel 4.0 macros, LibreOffice Basic and scripts, DDE, external templates and links, embedded OLE objects and ActiveX controls, and score the risk. Strict ZIP and XML readers, bounded memory, no runtime dependencies.",
   "license": "MIT",
   "author": "patrickdk77",