@patrickdk77/pdf-defuse 0.0.0-stage → 0.1.0

package/dist/score.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMBINATIONS = exports.DEFAULT_BANDS = void 0;
+exports.weightOf = weightOf;
+exports.scoreFindings = scoreFindings;
+exports.riskFor = riskFor;
+const findings_1 = require("./findings");
+const types_1 = require("./types");
+exports.DEFAULT_BANDS = { low: 1, medium: 25, high: 50, critical: 80 };
+exports.COMBINATIONS = [
+    {
+        name: 'auto-run with an outside action',
+        weight: 20,
+        test: has => (has(types_1.PdfCategory.JavaScript, types_1.PdfDetail.OpenAction) || has(types_1.PdfCategory.JavaScript, types_1.PdfDetail.Document) || has(types_1.PdfCategory.Action, types_1.PdfDetail.Triggered) || has(types_1.PdfCategory.JavaScript, types_1.PdfDetail.Page)) &&
+            (has(types_1.PdfCategory.Action, types_1.PdfDetail.Launch) || has(types_1.PdfCategory.Action, types_1.PdfDetail.RemoteGoto) || has(types_1.PdfCategory.Action, types_1.PdfDetail.EmbeddedGoto) || has(types_1.PdfCategory.Action, types_1.PdfDetail.SubmitForm)),
+    },
+    { name: 'JavaScript with escaped keywords', weight: 20, test: has => has(types_1.PdfCategory.JavaScript) && has(types_1.PdfCategory.Structure, types_1.PdfDetail.EscapedNames) },
+    { name: 'JavaScript with an embedded file', weight: 15, test: has => has(types_1.PdfCategory.JavaScript) && has(types_1.PdfCategory.EmbeddedFile) },
+    {
+        name: 'JavaScript with empty-password encryption or JBIG2',
+        weight: 10,
+        test: has => has(types_1.PdfCategory.JavaScript) && (has(types_1.PdfCategory.Encrypted, types_1.PdfDetail.EmptyPassword) || has(types_1.PdfCategory.Content, types_1.PdfDetail.Jbig2Image)),
+    },
+];
+/** The caller's weights first, then the built-in table. A kind from another package scores at the weight it carries. */
+function weightOf(f, options) {
+    const w = options.scoreWeights ?? [];
+    const exact = w.find(x => x.category === f.category && x.detail === f.detail);
+    if (exact)
+        return exact.weight;
+    const cat = w.find(x => x.category === f.category && x.detail === undefined);
+    if (cat)
+        return cat.weight;
+    return (0, findings_1.findingSpec)(f.category, f.detail)?.weight ?? f.weight ?? 0;
+}
+/** Highest weight in full, a quarter of each other kind's weight, plus combinations, capped at 100. */
+function scoreFindings(findings, options) {
+    // Each kind of finding counts once, so twenty copies of one minor finding do not add up to a critical file.
+    const byKind = new Map();
+    for (const f of findings) {
+        const k = `${f.category}/${f.detail}`;
+        byKind.set(k, Math.max(byKind.get(k) ?? 0, weightOf(f, options)));
+    }
+    const weights = [...byKind.values()].sort((a, b) => b - a);
+    let score = weights.length ? weights[0] + weights.slice(1).reduce((s, w) => s + w / 4, 0) : 0;
+    const has = (c, d) => findings.some(f => f.category === c && (d === undefined || f.detail === d) && weightOf(f, options) > 0);
+    for (const combo of exports.COMBINATIONS)
+        if (combo.test(has))
+            score += combo.weight;
+    score = Math.min(100, Math.round(score));
+    return { score, risk: riskFor(score, options.scoreBands ?? exports.DEFAULT_BANDS) };
+}
+function riskFor(score, bands) {
+    if (score >= bands.critical)
+        return types_1.PdfRisk.Critical;
+    if (score >= bands.high)
+        return types_1.PdfRisk.High;
+    if (score >= bands.medium)
+        return types_1.PdfRisk.Medium;
+    if (score >= bands.low)
+        return types_1.PdfRisk.Low;
+    return types_1.PdfRisk.None;
+}

package/dist/sniff.d.ts

@@ -0,0 +1,15 @@
+/** Identifies a file type from its first bytes. Returns a MIME type or undefined. */
+export declare function sniffType(head: Uint8Array): string | undefined;
+/** Maps MIME types that share a container format, and common aliases of one type, onto one family. */
+export declare function family(mime: string): string;
+/**
+ * A file name's extension, lowercased. Windows drops trailing dots and spaces when it saves a file, so the extension
+ * of "page.html." is html.
+ */
+export declare function extensionOf(name?: string): string | undefined;
+export declare function typeFromName(name?: string): string | undefined;
+/**
+ * True when any two of the declared type, the name's extension and the sniffed content contradict each other, or
+ * when the declared type or the name claims a type sniffType recognizes and the content matched no signature.
+ */
+export declare function typesDisagree(declared: string | undefined, name: string | undefined, sniffed: string | undefined): boolean;

package/dist/sniff.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sniffType = sniffType;
+exports.family = family;
+exports.extensionOf = extensionOf;
+exports.typeFromName = typeFromName;
+exports.typesDisagree = typesDisagree;
+/** Identifies a file type from its first bytes. Returns a MIME type or undefined. */
+function sniffType(head) {
+    const b = Buffer.from(head.buffer, head.byteOffset, head.byteLength);
+    // PDF readers accept the header anywhere in the first 1024 bytes.
+    const s = b.subarray(0, 1024).toString('latin1');
+    if (s.includes('%PDF-'))
+        return 'application/pdf';
+    if (b[0] === 0x50 && b[1] === 0x4b && (b[2] === 0x03 || b[2] === 0x05 || b[2] === 0x07))
+        return 'application/zip';
+    if (b[0] === 0x89 && s.startsWith('\x89PNG'))
+        return 'image/png';
+    if (b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff)
+        return 'image/jpeg';
+    if (s.startsWith('GIF87a') || s.startsWith('GIF89a'))
+        return 'image/gif';
+    if (b[0] === 0xd0 && b[1] === 0xcf && b[2] === 0x11 && b[3] === 0xe0)
+        return 'application/x-ole-storage';
+    if (s.startsWith('MZ'))
+        return 'application/x-msdownload';
+    if (s.startsWith('\x7fELF'))
+        return 'application/x-executable';
+    const text = s.replace(/^\xef\xbb\xbf/, '').trimStart();
+    if (/^<svg[\s>/]/i.test(text) || (/^<\?xml/i.test(text) && /<svg[\s>/]/i.test(s)))
+        return 'image/svg+xml';
+    if (/^<\?xml/i.test(text))
+        return 'application/xml';
+    if (/^<!doctype html|^<html[\s>]/i.test(text))
+        return 'text/html';
+    return undefined;
+}
+const EXT = {
+    pdf: 'application/pdf',
+    zip: 'application/zip',
+    docx: 'application/zip',
+    xlsx: 'application/zip',
+    pptx: 'application/zip',
+    odt: 'application/zip',
+    ods: 'application/zip',
+    odp: 'application/zip',
+    epub: 'application/zip',
+    jar: 'application/zip',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    svg: 'image/svg+xml',
+    xml: 'application/xml',
+    html: 'text/html',
+    htm: 'text/html',
+    doc: 'application/x-ole-storage',
+    xls: 'application/x-ole-storage',
+    ppt: 'application/x-ole-storage',
+    msg: 'application/x-ole-storage',
+    exe: 'application/x-msdownload',
+    dll: 'application/x-msdownload',
+    csv: 'text/csv',
+    tsv: 'text/tab-separated-values',
+    tab: 'text/tab-separated-values',
+    json: 'application/json',
+};
+/** Maps MIME types that share a container format, and common aliases of one type, onto one family. */
+function family(mime) {
+    const m = mime.toLowerCase().split(';')[0].trim();
+    if (m === 'image/jpg' || m === 'image/pjpeg')
+        return 'image/jpeg';
+    if (m === 'image/x-png')
+        return 'image/png';
+    if (m === 'application/x-pdf')
+        return 'application/pdf';
+    if (m === 'application/zip' ||
+        m === 'application/x-zip-compressed' ||
+        m === 'application/x-zip' ||
+        m.includes('openxmlformats') ||
+        m.includes('opendocument') ||
+        m === 'application/epub+zip' ||
+        m === 'application/java-archive')
+        return 'zip';
+    if (m === 'image/svg+xml')
+        return 'svg';
+    if (m === 'application/xml' || m === 'text/xml')
+        return 'xml';
+    if (m === 'application/msword' || m === 'application/vnd.ms-excel' || m === 'application/vnd.ms-powerpoint' || m === 'application/x-ole-storage' || m === 'application/vnd.ms-outlook')
+        return 'ole';
+    return m;
+}
+/**
+ * A file name's extension, lowercased. Windows drops trailing dots and spaces when it saves a file, so the extension
+ * of "page.html." is html.
+ */
+function extensionOf(name) {
+    return /\.([^./\\]+)$/.exec((name ?? '').replace(/[. ]+$/, ''))?.[1].toLowerCase();
+}
+function typeFromName(name) {
+    const ext = extensionOf(name);
+    // Only the table's own entries: "x.constructor" names no type.
+    return ext !== undefined && Object.hasOwn(EXT, ext) ? EXT[ext] : undefined;
+}
+/** Families sniffType has a signature for. Content that claims one of them and matches no signature is not what it claims. */
+const SNIFFABLE = new Set(['application/pdf', 'zip', 'image/png', 'image/jpeg', 'image/gif', 'ole', 'application/x-msdownload', 'application/x-executable', 'svg', 'xml', 'text/html']);
+/**
+ * True when any two of the declared type, the name's extension and the sniffed content contradict each other, or
+ * when the declared type or the name claims a type sniffType recognizes and the content matched no signature.
+ */
+function typesDisagree(declared, name, sniffed) {
+    const claimed = [declared, typeFromName(name)].filter((t) => t !== undefined && t !== '' && family(t) !== 'application/octet-stream').map(family);
+    const all = sniffed ? [...claimed, family(sniffed)] : claimed;
+    const same = (a, b) => a === b || (a === 'svg' && b === 'xml') || (a === 'xml' && b === 'svg');
+    if (all.some(a => all.some(b => !same(a, b))))
+        return true;
+    return !sniffed && claimed.some(f => SNIFFABLE.has(f));
+}

package/dist/types.d.ts

@@ -0,0 +1,294 @@
+/** High-level kind of a finding. */
+export declare enum PdfCategory {
+    Encrypted = "ENCRYPTED",
+    Corrupted = "CORRUPTED",
+    JavaScript = "JAVASCRIPT",
+    Action = "ACTION",
+    Link = "LINK",
+    EmbeddedFile = "EMBEDDED_FILE",
+    Media = "MEDIA",
+    Annotation = "ANNOTATION",
+    Form = "FORM",
+    Signature = "SIGNATURE",
+    Structure = "STRUCTURE",
+    Content = "CONTENT",
+    Metadata = "METADATA",
+    Limit = "LIMIT",
+    Processing = "PROCESSING"
+}
+/** Exact variant of a finding. Some details appear under more than one category. */
+export declare enum PdfDetail {
+    EmptyPassword = "EMPTY_PASSWORD",
+    UserPassword = "USER_PASSWORD",
+    OwnerPassword = "OWNER_PASSWORD",
+    PasswordRequired = "PASSWORD_REQUIRED",
+    CertificateHandler = "CERTIFICATE_HANDLER",
+    UnknownHandler = "UNKNOWN_HANDLER",
+    UnknownCryptFilter = "UNKNOWN_CRYPT_FILTER",
+    Rc4_40 = "RC4_40",
+    Rc4_128 = "RC4_128",
+    Rc4Other = "RC4_OTHER",
+    Aes128 = "AES_128",
+    Aes256 = "AES_256",
+    MetadataUnencrypted = "METADATA_UNENCRYPTED",
+    Unparseable = "UNPARSEABLE",
+    Truncated = "TRUNCATED",
+    XrefRebuilt = "XREF_REBUILT",
+    MalformedObject = "MALFORMED_OBJECT",
+    StreamLengthWrong = "STREAM_LENGTH_WRONG",
+    LeadingBytes = "LEADING_BYTES",
+    TrailingBytes = "TRAILING_BYTES",
+    Document = "DOCUMENT",
+    OpenAction = "OPEN_ACTION",
+    Page = "PAGE",
+    Field = "FIELD",
+    Annotation = "ANNOTATION",
+    Link = "LINK",
+    Bookmark = "BOOKMARK",
+    Chained = "CHAINED",
+    Rendition = "RENDITION",
+    Url = "URL",
+    Unattached = "UNATTACHED",
+    PluginPassed = "PLUGIN_PASSED",
+    PluginScrubbed = "PLUGIN_SCRUBBED",
+    PluginFailed = "PLUGIN_FAILED",
+    PluginRemoved = "PLUGIN_REMOVED",
+    Launch = "LAUNCH",
+    RemoteGoto = "REMOTE_GOTO",
+    EmbeddedGoto = "EMBEDDED_GOTO",
+    SubmitForm = "SUBMIT_FORM",
+    ImportData = "IMPORT_DATA",
+    Hide = "HIDE",
+    SetLayerState = "SET_LAYER_STATE",
+    Named = "NAMED",
+    Triggered = "TRIGGERED",
+    Unknown = "UNKNOWN",
+    Safe = "SAFE",
+    FileUrl = "FILE_URL",
+    NetworkPath = "NETWORK_PATH",
+    DataUrl = "DATA_URL",
+    OtherScheme = "OTHER_SCHEME",
+    Credentials = "CREDENTIALS",
+    IpHost = "IP_HOST",
+    LookalikeHost = "LOOKALIKE_HOST",
+    EncodedHost = "ENCODED_HOST",
+    TextMismatch = "TEXT_MISMATCH",
+    FullPage = "FULL_PAGE",
+    Relative = "RELATIVE",
+    NoPlugin = "NO_PLUGIN",
+    TypeMismatch = "TYPE_MISMATCH",
+    Portfolio = "PORTFOLIO",
+    Movie = "MOVIE",
+    Sound = "SOUND",
+    Screen = "SCREEN",
+    RichMedia = "RICH_MEDIA",
+    ThreeD = "THREE_D",
+    Slideshow = "SLIDESHOW",
+    UnknownSubtype = "UNKNOWN_SUBTYPE",
+    Fields = "FIELDS",
+    Xfa = "XFA",
+    CalculationOrder = "CALCULATION_ORDER",
+    Signed = "SIGNED",
+    Certified = "CERTIFIED",
+    UsageRights = "USAGE_RIGHTS",
+    IncrementalUpdates = "INCREMENTAL_UPDATES",
+    UnreferencedObjects = "UNREFERENCED_OBJECTS",
+    VersionUpgraded = "VERSION_UPGRADED",
+    EscapedNames = "ESCAPED_NAMES",
+    ShadowedObjects = "SHADOWED_OBJECTS",
+    Jbig2Image = "JBIG2_IMAGE",
+    JpxImage = "JPX_IMAGE",
+    Type3Font = "TYPE3_FONT",
+    InfoDictionary = "INFO_DICTIONARY",
+    Xmp = "XMP",
+    Stripped = "STRIPPED",
+    FileSize = "FILE_SIZE",
+    ObjectCount = "OBJECT_COUNT",
+    DecompressedSize = "DECOMPRESSED_SIZE",
+    NestingDepth = "NESTING_DEPTH",
+    Time = "TIME",
+    MemoryFallback = "MEMORY_FALLBACK",
+    VerificationFailed = "VERIFICATION_FAILED",
+    ContentRemoved = "CONTENT_REMOVED"
+}
+export type PdfFindingAction = 'reject' | 'strip' | 'info';
+/**
+ * A finding as any package of the defuse family reports it. Category and detail are plain strings, since the string
+ * enums of two packages never match each other.
+ */
+export interface DefuseFinding {
+    category: string;
+    detail: string;
+    /** Plain sentence, safe to show the uploader. */
+    description: string;
+    /** Default action after any caller override. */
+    action: 'reject' | 'strip' | 'info';
+    /** Where in the file, e.g. "page 3, annotation 2". */
+    location?: string;
+    /** Extra values: the URI, key length, plugin name, counts. */
+    data?: Record<string, string | number>;
+    /**
+     * Set when the finding comes from inside a contained file, such as a PDF attached to the PDF: the file's
+     * name, with " > " between nesting levels. `location` then starts with where that file sits.
+     */
+    attachment?: string;
+    /** How much the finding adds to a score, set by the package that made it. */
+    weight?: number;
+}
+/** A finding pdf-defuse makes itself. */
+export interface PdfFinding extends DefuseFinding {
+    category: PdfCategory;
+    detail: PdfDetail;
+}
+export declare enum PdfRisk {
+    None = "NONE",
+    Low = "LOW",
+    Medium = "MEDIUM",
+    High = "HIGH",
+    Critical = "CRITICAL",
+    /** The file could not be inspected: wrong password, unparseable, or a limit stopped the run. */
+    Unknown = "UNKNOWN"
+}
+export interface PdfInspection {
+    status: 'clean' | 'strippable' | 'rejected';
+    /** 0 to 100, null when risk is UNKNOWN. */
+    score: number | null;
+    risk: PdfRisk;
+    findings: DefuseFinding[];
+    version: string;
+    pages?: number;
+}
+export interface PdfDisarmResult {
+    status: 'clean' | 'defused' | 'rejected';
+    /** The uploaded file and its score. */
+    before: PdfInspection;
+    /** The output and its remaining score. Absent when rejected. */
+    after?: PdfInspection;
+    /** Findings whose content was removed. */
+    removed: DefuseFinding[];
+}
+/** Random-access input. A buffer, a local file and an S3 ranged GetObject all fit. */
+export interface ByteSource {
+    size(): Promise<number>;
+    read(offset: number, length: number): Promise<Uint8Array>;
+    close?(): Promise<void>;
+}
+/** Append-only output. Never seeks. */
+export interface ByteSink {
+    write(chunk: Uint8Array): Promise<void>;
+    close(): Promise<void>;
+    /** Called instead of close() when copying to the sink fails, so a partial output is not taken for a whole one. */
+    abort?(error: unknown): Promise<void>;
+}
+export interface PdfLimits {
+    /** Bytes. */
+    fileSize?: number;
+    /** Live objects in the file. */
+    objects?: number;
+    /** Decoded size of any one stream. */
+    decompressedBytes?: number;
+    /**
+     * The deepest a PDF may sit in the upload. The upload is at depth 0 and a file inside it at 1, and files of every
+     * format in between count.
+     */
+    nestingDepth?: number;
+    timeMs?: number;
+}
+/** What a contained file plugin learns of the run, with nothing PDF-specific, so any package of the family can make one. */
+export interface PluginContext {
+    /** The depth of the file itself: 0 for the upload, 1 for a file inside it, and so on, whatever the formats. */
+    depth: number;
+    /** When `limits.timeMs` is set, the Date.now() value the whole run must finish by. Nested runs share it. */
+    deadline?: number;
+}
+export interface ContainedFile {
+    name?: string;
+    /** The MIME type the container declares for the file, such as the /Subtype of a PDF's embedded file stream. */
+    declaredType?: string;
+    /** From the first bytes. */
+    sniffedType?: string;
+    /** Decoded size. */
+    size: number;
+    location: string;
+    /** The depth of the file itself: 0 for the upload, 1 for a file inside it, and so on, whatever the formats. */
+    depth: number;
+    /** Decoded and decrypted bytes. */
+    source: ByteSource;
+}
+/** What a file plugin did, plus anything it found inside the file. */
+export interface ContainedFileResult {
+    result: 'scrubbed' | 'passed' | 'removed';
+    /** Findings inside the file as it arrived. They go into the report of the file that contains it. */
+    findings?: DefuseFinding[];
+    /** Findings inside the bytes the plugin kept. They go into the report of the output. */
+    outputFindings?: DefuseFinding[];
+}
+export interface ContainedFilePlugin {
+    kind: 'file';
+    name: string;
+    accepts(file: ContainedFile): boolean | Promise<boolean>;
+    /** Writes the bytes to keep. Returning 'removed' drops the file after all. */
+    process(file: ContainedFile, sink: ByteSink, context: PluginContext): Promise<'scrubbed' | 'passed' | 'removed' | ContainedFileResult>;
+}
+export interface ContainedScript {
+    text: string;
+    /** "document", "open", "page-open", "field-format", "link", "bookmark", ... */
+    trigger: string;
+    location: string;
+    fieldName?: string;
+    /** Names of document-level scripts a plugin kept. */
+    keptDocumentScripts: string[];
+}
+export interface ScriptPlugin {
+    kind: 'script';
+    name: string;
+    accepts(script: ContainedScript): boolean | Promise<boolean>;
+    process(script: ContainedScript): Promise<{
+        result: 'scrubbed' | 'passed' | 'removed';
+        text?: string;
+    }>;
+}
+export interface PdfActionOverride {
+    category: PdfCategory;
+    detail?: PdfDetail;
+    action: PdfFindingAction;
+}
+export interface PdfScoreWeight {
+    category: PdfCategory;
+    detail?: PdfDetail;
+    weight: number;
+}
+/** Lower bound of each band. */
+export interface PdfScoreBands {
+    low: number;
+    medium: number;
+    high: number;
+    critical: number;
+}
+export interface PdfOptions {
+    /** Default '', tried as the user password and then as the owner password. */
+    password?: string;
+    /** A limit left out is not enforced. */
+    limits?: PdfLimits;
+    /** Default false. */
+    stripMetadata?: boolean;
+    actionOverrides?: PdfActionOverride[];
+    scoreWeights?: PdfScoreWeight[];
+    scoreBands?: PdfScoreBands;
+    filePlugins?: ContainedFilePlugin[];
+    scriptPlugins?: ScriptPlugin[];
+    /** Directory for temporary files. Defaults to os.tmpdir(). */
+    tempDir?: string;
+    /**
+     * Default 8 MiB. disarmPdfSource keeps its copy of the upload in memory up to this size and in a temporary file
+     * above it. Each decoded attachment and object stream above it goes through a temporary file. Scrubbed attachment
+     * copies waiting for the write, and an attachment decoded again for its further names, share this much memory. A
+     * script that decodes larger than this is removed without going to the script plugins.
+     */
+    memoryThreshold?: number;
+    /**
+     * Default true. A clean file whose signature covers every byte but its own /Contents is copied byte for byte, so
+     * the signature stays valid. Every other file that is not rejected is rewritten. False rewrites signed files too.
+     */
+    preserveSignatures?: boolean;
+}

package/dist/types.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PdfRisk = exports.PdfDetail = exports.PdfCategory = void 0;
+/** High-level kind of a finding. */
+var PdfCategory;
+(function (PdfCategory) {
+    PdfCategory["Encrypted"] = "ENCRYPTED";
+    PdfCategory["Corrupted"] = "CORRUPTED";
+    PdfCategory["JavaScript"] = "JAVASCRIPT";
+    PdfCategory["Action"] = "ACTION";
+    PdfCategory["Link"] = "LINK";
+    PdfCategory["EmbeddedFile"] = "EMBEDDED_FILE";
+    PdfCategory["Media"] = "MEDIA";
+    PdfCategory["Annotation"] = "ANNOTATION";
+    PdfCategory["Form"] = "FORM";
+    PdfCategory["Signature"] = "SIGNATURE";
+    PdfCategory["Structure"] = "STRUCTURE";
+    PdfCategory["Content"] = "CONTENT";
+    PdfCategory["Metadata"] = "METADATA";
+    PdfCategory["Limit"] = "LIMIT";
+    PdfCategory["Processing"] = "PROCESSING";
+})(PdfCategory || (exports.PdfCategory = PdfCategory = {}));
+/** Exact variant of a finding. Some details appear under more than one category. */
+var PdfDetail;
+(function (PdfDetail) {
+    // ENCRYPTED
+    PdfDetail["EmptyPassword"] = "EMPTY_PASSWORD";
+    PdfDetail["UserPassword"] = "USER_PASSWORD";
+    PdfDetail["OwnerPassword"] = "OWNER_PASSWORD";
+    PdfDetail["PasswordRequired"] = "PASSWORD_REQUIRED";
+    PdfDetail["CertificateHandler"] = "CERTIFICATE_HANDLER";
+    PdfDetail["UnknownHandler"] = "UNKNOWN_HANDLER";
+    PdfDetail["UnknownCryptFilter"] = "UNKNOWN_CRYPT_FILTER";
+    PdfDetail["Rc4_40"] = "RC4_40";
+    PdfDetail["Rc4_128"] = "RC4_128";
+    PdfDetail["Rc4Other"] = "RC4_OTHER";
+    PdfDetail["Aes128"] = "AES_128";
+    PdfDetail["Aes256"] = "AES_256";
+    PdfDetail["MetadataUnencrypted"] = "METADATA_UNENCRYPTED";
+    // CORRUPTED
+    PdfDetail["Unparseable"] = "UNPARSEABLE";
+    PdfDetail["Truncated"] = "TRUNCATED";
+    PdfDetail["XrefRebuilt"] = "XREF_REBUILT";
+    PdfDetail["MalformedObject"] = "MALFORMED_OBJECT";
+    PdfDetail["StreamLengthWrong"] = "STREAM_LENGTH_WRONG";
+    PdfDetail["LeadingBytes"] = "LEADING_BYTES";
+    PdfDetail["TrailingBytes"] = "TRAILING_BYTES";
+    // JAVASCRIPT
+    PdfDetail["Document"] = "DOCUMENT";
+    PdfDetail["OpenAction"] = "OPEN_ACTION";
+    PdfDetail["Page"] = "PAGE";
+    PdfDetail["Field"] = "FIELD";
+    PdfDetail["Annotation"] = "ANNOTATION";
+    PdfDetail["Link"] = "LINK";
+    PdfDetail["Bookmark"] = "BOOKMARK";
+    PdfDetail["Chained"] = "CHAINED";
+    PdfDetail["Rendition"] = "RENDITION";
+    PdfDetail["Url"] = "URL";
+    PdfDetail["Unattached"] = "UNATTACHED";
+    PdfDetail["PluginPassed"] = "PLUGIN_PASSED";
+    PdfDetail["PluginScrubbed"] = "PLUGIN_SCRUBBED";
+    PdfDetail["PluginFailed"] = "PLUGIN_FAILED";
+    PdfDetail["PluginRemoved"] = "PLUGIN_REMOVED";
+    // ACTION
+    PdfDetail["Launch"] = "LAUNCH";
+    PdfDetail["RemoteGoto"] = "REMOTE_GOTO";
+    PdfDetail["EmbeddedGoto"] = "EMBEDDED_GOTO";
+    PdfDetail["SubmitForm"] = "SUBMIT_FORM";
+    PdfDetail["ImportData"] = "IMPORT_DATA";
+    PdfDetail["Hide"] = "HIDE";
+    PdfDetail["SetLayerState"] = "SET_LAYER_STATE";
+    PdfDetail["Named"] = "NAMED";
+    PdfDetail["Triggered"] = "TRIGGERED";
+    PdfDetail["Unknown"] = "UNKNOWN";
+    // LINK
+    PdfDetail["Safe"] = "SAFE";
+    PdfDetail["FileUrl"] = "FILE_URL";
+    PdfDetail["NetworkPath"] = "NETWORK_PATH";
+    PdfDetail["DataUrl"] = "DATA_URL";
+    PdfDetail["OtherScheme"] = "OTHER_SCHEME";
+    PdfDetail["Credentials"] = "CREDENTIALS";
+    PdfDetail["IpHost"] = "IP_HOST";
+    PdfDetail["LookalikeHost"] = "LOOKALIKE_HOST";
+    PdfDetail["EncodedHost"] = "ENCODED_HOST";
+    PdfDetail["TextMismatch"] = "TEXT_MISMATCH";
+    PdfDetail["FullPage"] = "FULL_PAGE";
+    PdfDetail["Relative"] = "RELATIVE";
+    // EMBEDDED_FILE
+    PdfDetail["NoPlugin"] = "NO_PLUGIN";
+    PdfDetail["TypeMismatch"] = "TYPE_MISMATCH";
+    PdfDetail["Portfolio"] = "PORTFOLIO";
+    // MEDIA
+    PdfDetail["Movie"] = "MOVIE";
+    PdfDetail["Sound"] = "SOUND";
+    PdfDetail["Screen"] = "SCREEN";
+    PdfDetail["RichMedia"] = "RICH_MEDIA";
+    PdfDetail["ThreeD"] = "THREE_D";
+    PdfDetail["Slideshow"] = "SLIDESHOW";
+    // ANNOTATION
+    PdfDetail["UnknownSubtype"] = "UNKNOWN_SUBTYPE";
+    // FORM
+    PdfDetail["Fields"] = "FIELDS";
+    PdfDetail["Xfa"] = "XFA";
+    PdfDetail["CalculationOrder"] = "CALCULATION_ORDER";
+    // SIGNATURE
+    PdfDetail["Signed"] = "SIGNED";
+    PdfDetail["Certified"] = "CERTIFIED";
+    PdfDetail["UsageRights"] = "USAGE_RIGHTS";
+    // STRUCTURE
+    PdfDetail["IncrementalUpdates"] = "INCREMENTAL_UPDATES";
+    PdfDetail["UnreferencedObjects"] = "UNREFERENCED_OBJECTS";
+    PdfDetail["VersionUpgraded"] = "VERSION_UPGRADED";
+    PdfDetail["EscapedNames"] = "ESCAPED_NAMES";
+    PdfDetail["ShadowedObjects"] = "SHADOWED_OBJECTS";
+    // CONTENT
+    PdfDetail["Jbig2Image"] = "JBIG2_IMAGE";
+    PdfDetail["JpxImage"] = "JPX_IMAGE";
+    PdfDetail["Type3Font"] = "TYPE3_FONT";
+    // METADATA
+    PdfDetail["InfoDictionary"] = "INFO_DICTIONARY";
+    PdfDetail["Xmp"] = "XMP";
+    PdfDetail["Stripped"] = "STRIPPED";
+    // LIMIT
+    PdfDetail["FileSize"] = "FILE_SIZE";
+    PdfDetail["ObjectCount"] = "OBJECT_COUNT";
+    PdfDetail["DecompressedSize"] = "DECOMPRESSED_SIZE";
+    PdfDetail["NestingDepth"] = "NESTING_DEPTH";
+    PdfDetail["Time"] = "TIME";
+    // PROCESSING
+    PdfDetail["MemoryFallback"] = "MEMORY_FALLBACK";
+    PdfDetail["VerificationFailed"] = "VERIFICATION_FAILED";
+    PdfDetail["ContentRemoved"] = "CONTENT_REMOVED";
+})(PdfDetail || (exports.PdfDetail = PdfDetail = {}));
+var PdfRisk;
+(function (PdfRisk) {
+    PdfRisk["None"] = "NONE";
+    PdfRisk["Low"] = "LOW";
+    PdfRisk["Medium"] = "MEDIUM";
+    PdfRisk["High"] = "HIGH";
+    PdfRisk["Critical"] = "CRITICAL";
+    /** The file could not be inspected: wrong password, unparseable, or a limit stopped the run. */
+    PdfRisk["Unknown"] = "UNKNOWN";
+})(PdfRisk || (exports.PdfRisk = PdfRisk = {}));

package/dist/uri.d.ts

@@ -0,0 +1,29 @@
+import { PdfDetail as D } from './types';
+interface UriVerdict {
+    /** LINK detail, or JAVASCRIPT URL for javascript: and vbscript: links. */
+    detail: D;
+    host?: string;
+    /** For a safe target, the hosts a label is compared with, in order. They do not depend on the label. */
+    sites?: string[];
+}
+/**
+ * The hosts a label names, as a lookup: has() answers whether a host is one of them or a subdomain of one, or one of
+ * them is a subdomain of the host, at a cost that depends on the host and not on how many the label names. No
+ * public-suffix list is needed: evil.co.uk is not under mybank.co.uk.
+ */
+export declare class LabelSites {
+    private readonly hosts;
+    /** Every domain some label host is a subdomain of. */
+    private readonly parents;
+    constructor(names: string[]);
+    get size(): number;
+    has(host: string): boolean;
+}
+/**
+ * Classifies a link target. `base` is the catalog's URI Base, if any. The walker compares a safe target's `sites`
+ * with the hosts a link's labels name.
+ */
+export declare function checkUri(rawUri: string, base?: string): UriVerdict;
+/** Host names written in free text, such as a tooltip. */
+export declare function hostsIn(text: string): string[];
+export {};