@patrickdk77/script-defuse 0.1.0 → 0.3.0

package/README.md

@@ -1,8 +1,8 @@
 # script-defuse
 
-Tell a PDF form's scripts from the rest. script-defuse parses a script and calls it a form script when every call and every property it uses formats, checks or calculates form fields. It reads AcroForm JavaScript, and the JavaScript and FormCalc of XFA forms. Any other script is unsafe, and its findings name what it reaches and on which line: a web address, a form submit, mail, another document, an attached file, the network, code built from a string, or text it hides.
+Tell a document's harmless scripts from the rest. script-defuse parses a PDF form's script and calls it a form script when every call and every property it uses formats, checks or calculates form fields. It reads AcroForm JavaScript, and the JavaScript and FormCalc of XFA forms. It also reads the VBA modules of Office documents, and passes a module that calls nothing on its list of the ways a macro reaches outside its document. Any other script is unsafe, and its findings name what it reaches and on which line: a web address, a form submit, mail, another document or file, the network, a program, code built from a string, or text it hides.
 
-It plugs into [pdf-defuse](https://github.com/patrickdk77/pdf-defuse) as a script plugin, so a fillable form keeps its calculations, formats and checks while every other script goes. It parses with [acorn](https://github.com/acornjs/acorn), its one runtime dependency, and follows the shapes of the other defuse packages.
+It plugs into [pdf-defuse](https://github.com/patrickdk77/pdf-defuse) and [office-defuse](https://github.com/patrickdk77/office-defuse) as a script plugin. A fillable form keeps its calculations, formats and checks, and a workbook keeps the macros that only work on the workbook, while every other script goes. It parses JavaScript with [acorn](https://github.com/acornjs/acorn), its one runtime dependency, and follows the shapes of the other defuse packages.
 
 ```
 npm install @patrickdk77/script-defuse
@@ -35,9 +35,22 @@ const result = await disarmPdf(bytes, { scriptPlugins: [formScriptPlugin()] });
 
 pdf-defuse removes every script unless a plugin keeps it. This plugin keeps the form scripts and removes the rest. From pdf-defuse 0.2.4 the plugin's findings go into the PDF's report at each script's location.
 
+The plugin's answer is final, and its findings are what the script scores. Each finding's `weight` is what it adds to that script's score from `inspectScript`: a finding that strips weighs what `scoreWeights` or the table gives it, and one that only describes the script weighs 0. A form script the plugin keeps therefore adds nothing to the PDF's score from pdf-defuse 0.3.0 and office-defuse 0.3.0. Earlier versions scored a kept script at their own weight for it.
+
 Make one plugin per PDF. pdf-defuse hands it the document-level scripts first, and the plugin remembers the globals of the ones it kept, so a field script may call a helper they define. A field script that calls a helper from a document script the plugin removed is removed too.
 
-With [file-defuse](https://github.com/patrickdk77/file-defuse), pass it in the pdf section: `disarmFile(bytes, { pdf: { scriptPlugins: [formScriptPlugin()] } })`.
+With [file-defuse](https://github.com/patrickdk77/file-defuse) 0.1.4 or later, every PDF and Office file already gets one.
+
+### With office-defuse
+
+```js
+const { disarmOffice } = require('@patrickdk77/office-defuse');
+const { formScriptPlugin } = require('@patrickdk77/script-defuse');
+
+const result = await disarmOffice(bytes, { scriptPlugins: [formScriptPlugin()] });
+```
+
+office-defuse 0.2.3 and later shows the plugin each module of a VBA project and keeps the project only when every module passes. It then writes the project without its compiled code, so Office compiles the source script-defuse read. See [VBA](#vba).
 
 ## What a form script may use
 
@@ -90,6 +103,26 @@ References such as `$host.messageBox`, `$.rawValue`, `xfa.event.change` and `$re
 
 An XFA script defines no globals for other scripts, which reach its functions through the node that holds it.
 
+## VBA
+
+`context.language: 'vba'` reads a VBA module as Office stores it, with `form: 'office'`. A macro cannot have an allowlist the way a form script does. Its own procedures, the document's sheets and controls, and the whole Office object model are names no list holds. So script-defuse lists the ways out of the document instead, and removes a module that uses one:
+
+- VBA's file statements and functions, such as `Open`, `Print #`, `Get`, `Put`, `Name`, `Kill`, `Dir` and `MkDir`. `Shell`, `SendKeys`, `AppActivate` and `MacScript`. `SaveSetting` and `GetSetting`, the DDE functions, and `Environ`.
+- `Declare`, `VarPtr`, `StrPtr`, `ObjPtr` and `AddressOf`.
+- `CreateObject`, `GetObject`, and `New` of a library's class. `New` of the module's own classes, `Collection`, `Dictionary` and `RegExp` is fine, and `New FileSystemObject` and `New Application` are not.
+- Office members that open another file or a URL, send mail, save elsewhere, print, import or export, run code by name or later, or change the VBA project: `Workbooks.Open`, `FollowHyperlink`, `Hyperlinks.Add`, `AttachedTemplate`, `SendMail`, `SaveAs`, `SaveCopyAs`, `ExportAsFixedFormat`, `PrintOut`, `QueryTables`, `OLEObjects.Add`, `Application.Run` with an argument, `Evaluate` of anything but a string, `ExecuteExcel4Macro`, `OnTime`, `CallByName`, `WordBasic`, `VBProject`, `VBE`, `AddIns` and the others in `src/vba.ts`.
+- A formula string that calls WEBSERVICE, CALL, REGISTER, EXEC, RTD or HYPERLINK, a DDE formula, and a macro name in another file, as `'other.xlsm'!Macro`.
+
+A name VBA or Office defines counts wherever it is written, as `Shell`, `VBA.Shell` or `.Shell` inside a `With` block. A module that declares a variable of the same name does not hide it, since the name means VBA's again in the next procedure.
+
+The project's references matter as much as its calls, since a library can add global functions a list never sees. office-defuse gives them with the project's first module, in `context.references`. script-defuse accepts VBA, OLE Automation, Office, Excel, Word, PowerPoint, Visio, Publisher, Project, Forms 2.0, the Ref Edit control, the Scripting runtime and VBScript regular expressions, by type library GUID. Any other library, and any project but Word's Normal template, is SCRIPT_EXTERNAL/REFERENCE.
+
+VBA has its own ways to hide text, and each strips the module:
+
+- `Chr` of a printable character six or more times in one statement, as `Chr(112) & Chr(111)`. A string literal could hold those characters, so only hiding them explains it. `Chr` of a control character, the quote or an accented letter is how macros write those, and stays.
+- `Chr(Asc(Mid(s, i, 1)) Xor k)` and other decoders that rebuild a string a character at a time, `StrReverse`, and `Replace` of filler out of a literal.
+- Strings that spell a payload word only once they are joined, as `"pow" & "ersh" & "ell"`, in one statement or appended to one variable across statements. The words are programs, script hosts, `http://`, file types that run, and the objects that fetch and write files. A joined string is checked for encoded data too. A long message joined from many literals hides nothing and stays.
+
 ## Obfuscation
 
 A form script has nothing to hide, so each of these strips the script:
@@ -112,6 +145,7 @@ A form script has nothing to hide, so each of these strips the script:
 | Kind | Action | Weight | When |
 |---|---|---|---|
 | SCRIPT_FORM/COMPUTATION | info | 0 | The script only formats, checks or calculates form fields |
+| SCRIPT_FORM/DOCUMENT_MACRO | info | 0 | The VBA module calls nothing on the list of ways out of its document |
 | SCRIPT_EXTERNAL/URL | strip | 60 | `app.launchURL`, `this.getURL`, `xfa.host.gotoURL`, setting a node's `href` |
 | SCRIPT_EXTERNAL/SUBMIT | strip | 50 | `this.submitForm` |
 | SCRIPT_EXTERNAL/MAIL | strip | 50 | `this.mailDoc`, `mailForm`, `app.mailMsg` |
@@ -122,6 +156,14 @@ A form script has nothing to hide, so each of these strips the script:
 | SCRIPT_EXTERNAL/MENU_COMMAND | strip | 60 | `app.execMenuItem`, `app.execDialog` |
 | SCRIPT_EXTERNAL/PRINT | strip | 20 | `this.print`, `xfa.host.print` |
 | SCRIPT_EXTERNAL/SAVE | strip | 30 | `this.saveAs`, `closeDoc` |
+| SCRIPT_EXTERNAL/FILE_SYSTEM | strip | 70 | VBA's file statements and functions, `FileSystemObject` |
+| SCRIPT_EXTERNAL/PROCESS | strip | 90 | `Shell`, `SendKeys`, `AppActivate`, `MacScript`, `New Application`, a formula that calls EXEC |
+| SCRIPT_EXTERNAL/REGISTRY | strip | 60 | `SaveSetting`, `GetSetting`, `PrivateProfileString` |
+| SCRIPT_EXTERNAL/DDE | strip | 80 | `DDEInitiate` and the other DDE functions, a DDE formula |
+| SCRIPT_EXTERNAL/COM_OBJECT | strip | 80 | `CreateObject`, `GetObject`, `New` of a library's class |
+| SCRIPT_EXTERNAL/NATIVE_CODE | strip | 90 | `Declare`, `RegisterXLL`, a formula that calls CALL or REGISTER |
+| SCRIPT_EXTERNAL/ENVIRONMENT | strip | 30 | `Environ`, `Command` |
+| SCRIPT_EXTERNAL/REFERENCE | strip | 60 | A VBA project's reference to a library or project outside the list |
 | SCRIPT_DYNAMIC_CODE/EVAL | strip | 80 | `eval`, `Function`, `import()`, FormCalc's `Eval`, `applyXSL` |
 | SCRIPT_DYNAMIC_CODE/TIMER | strip | 70 | `app.setTimeOut`, `setInterval` |
 | SCRIPT_DYNAMIC_CODE/INSTALL_SCRIPT | strip | 70 | `addScript`, `setAction`, `setPageAction`, menu and toolbar items, XFA nodes created to carry script, `loadXML` and `assignNode` outside the data |
@@ -130,6 +172,7 @@ A form script has nothing to hide, so each of these strips the script:
 | SCRIPT_DYNAMIC_CODE/PROTOTYPE | strip | 60 | `constructor`, `__proto__`, `prototype`, `Object.defineProperty`, `Proxy`, `Reflect` |
 | SCRIPT_DYNAMIC_CODE/WITH | strip | 40 | A with statement |
 | SCRIPT_DYNAMIC_CODE/SELF_REFERENCE | strip | 60 | `arguments.callee`, a function's own `toString` |
+| SCRIPT_DYNAMIC_CODE/LEGACY_MACRO | strip | 80 | `WordBasic` |
 | SCRIPT_OBFUSCATION/CHAR_CODES | strip | 50 | `String.fromCharCode` |
 | SCRIPT_OBFUSCATION/DECODE | strip | 60 | Decoders, number bases, text hidden among filler, FormCalc's `Decode` |
 | SCRIPT_OBFUSCATION/CONCATENATION | strip | 40 | A string joined from many short pieces |
@@ -141,10 +184,12 @@ A form script has nothing to hide, so each of these strips the script:
 | SCRIPT_API/EXPLOITED | strip | 80 | `getAnnots`, `syncAnnotScan`, `media`, `spell`, signature calls, `xfa.signature`, `util.printf` with a computed format or a field width past 100 |
 | SCRIPT_API/UNKNOWN | strip | 30 | A viewer API or global name that is not form computation |
 | SCRIPT_API/PASSWORD_PROMPT | strip | 50 | `app.response` or `xfa.host.response` with the password option set |
-| SCRIPT_SYNTAX/UNPARSEABLE | strip | 50 | The script is not valid JavaScript, or FormCalc for a FormCalc script |
+| SCRIPT_SYNTAX/UNPARSEABLE | strip | 50 | The script does not parse as JavaScript, as FormCalc for a FormCalc script, or as VBA for a VBA module |
 | SCRIPT_LIMIT/SIZE | strip | 30 | The script is longer than `limits.scriptSize` |
 | SCRIPT_LIMIT/DEPTH | strip | 30 | The script nests deeper than `limits.depth` |
 
+The rows above name the PDF APIs. VBA's calls go to the same kinds where they fit: `Workbooks.Open` and `AttachedTemplate` are SCRIPT_EXTERNAL/OPEN_DOCUMENT, `FollowHyperlink` SCRIPT_EXTERNAL/URL, `Application.Run` and `Evaluate` SCRIPT_DYNAMIC_CODE/EVAL, `VBProject` SCRIPT_DYNAMIC_CODE/INSTALL_SCRIPT.
+
 The categories start with `SCRIPT_` so they never read as another package's kinds in a shared report. pdf-defuse has a FORM category of its own.
 
 Each finding carries the API in `data.api` where there is one, and its `location` gives the line, after the location the container gave. `allFindingSpecs()` returns this table.
@@ -162,7 +207,7 @@ The score takes the highest weight in full and a quarter of each other kind's we
 | `actionOverrides` | none | `[{ category, detail?, action }]` sets a kind to `strip` or `info`. An `info` kind no longer makes a script unsafe |
 | `scoreWeights` | none | `[{ category, detail?, weight }]` |
 | `scoreBands` | above | `{ low, medium, high, critical }` |
-| `context` | none | `inspectScript` only. `{ trigger, location, fieldName, language, form }`. The first three go into the findings' locations. `language: 'formcalc'` reads FormCalc, and `form: 'xfa'` reads JavaScript against the XFA object model |
+| `context` | none | `inspectScript` only. `{ trigger, location, fieldName, language, form, references }`. `location`, or `trigger` without it, goes into the findings' locations. `language: 'formcalc'` reads FormCalc, `language: 'vba'` reads a VBA module, and `form: 'xfa'` reads JavaScript against the XFA object model. `references` are a VBA project's, as `{ name, kind, libid }` |
 | `knownGlobals` | none | `inspectScript` only. Global names scripts that ran before defined and kept |
 
 A limit left out is not enforced. `formScriptPlugin(options)` takes the same options but `context` and `knownGlobals`, which it fills in itself, and keeps every decision it made in `plugin.decisions`.
@@ -172,6 +217,8 @@ A limit left out is not enforced. `formScriptPlugin(options)` takes the same opt
 - A form script can loop forever. script-defuse does not decide whether a loop ends.
 - pdf-defuse removes an XFA form's submits, connections, unsafe links and the images no plugin keeps. script-defuse sees only the scripts it is handed.
 - A form that uses a viewer API outside the allowlist loses that script. An action override keeps a kind you accept.
+- In VBA, the list of ways out is a deny list. An Office member that reaches outside the document and is not on it gets through. script-defuse checks the project's references and the classes a module creates, which keeps a library from adding ways the list does not know.
+- A macro that only works on its document can still change or delete what the document holds.
 - JavaScript files, and scripts in HTML, are not covered yet.
 
 ## Development
@@ -181,7 +228,7 @@ npm install
 npm test
 ```
 
-`npm test` runs the linter, builds, and runs the tests. The tests build each script they check. No sample from a real form or a malicious file goes in this repository.
+`npm test` runs the linter, builds, and runs the tests. The tests build each script and module they check. No sample from a real form, document or malicious file goes in this repository.
 
 ## License
 

package/dist/engine.d.ts

@@ -6,7 +6,7 @@ export interface InspectScriptOptions extends ScriptOptions {
     knownGlobals?: Iterable<string>;
 }
 /**
- * Inspect one script, in JavaScript or, when the context says so, in FormCalc. The verdict is 'form' when no finding strips it: every call and property it uses formats,
- * checks or calculates form fields, and nothing in it hides what it does.
+ * Inspect one script, in JavaScript or, when the context says so, in FormCalc or VBA. The verdict is 'form' when no finding strips it: every call and property a form
+ * script uses formats, checks or calculates form fields, or a VBA module calls nothing known to reach outside its document, and nothing in it hides what it does.
  */
 export declare function inspectScript(text: string, options?: InspectScriptOptions): ScriptInspection;

package/dist/engine.js

@@ -4,14 +4,18 @@ exports.inspectScript = inspectScript;
 const analyze_1 = require("./analyze");
 const formcalc_1 = require("./formcalc");
 const score_1 = require("./score");
+const vba_1 = require("./vba");
 /**
- * Inspect one script, in JavaScript or, when the context says so, in FormCalc. The verdict is 'form' when no finding strips it: every call and property it uses formats,
- * checks or calculates form fields, and nothing in it hides what it does.
+ * Inspect one script, in JavaScript or, when the context says so, in FormCalc or VBA. The verdict is 'form' when no finding strips it: every call and property a form
+ * script uses formats, checks or calculates form fields, or a VBA module calls nothing known to reach outside its document, and nothing in it hides what it does.
  */
 function inspectScript(text, options = {}) {
-    const { findings, definedGlobals } = options.context?.language === 'formcalc'
+    const language = options.context?.language;
+    const { findings, definedGlobals } = language === 'formcalc'
         ? (0, formcalc_1.analyzeFormCalc)({ text, context: options.context, options })
-        : (0, analyze_1.analyzeScript)({ text, context: options.context, options, known: new Set(options.knownGlobals ?? []) });
+        : language === 'vba'
+            ? (0, vba_1.analyzeVba)({ text, context: options.context, options })
+            : (0, analyze_1.analyzeScript)({ text, context: options.context, options, known: new Set(options.knownGlobals ?? []) });
     const counted = findings.filter(f => f.action === 'strip');
     const { score, risk } = (0, score_1.scoreFindings)(counted, options);
     return { verdict: counted.length ? 'unsafe' : 'form', score, risk, findings, definedGlobals };

package/dist/findings.js

@@ -10,6 +10,7 @@ function def(c, d, action, weight, description) {
 }
 // FORM
 def(types_1.ScriptCategory.Form, types_1.ScriptDetail.Computation, 'info', 0, 'The script only formats, checks or calculates form fields');
+def(types_1.ScriptCategory.Form, types_1.ScriptDetail.DocumentMacro, 'info', 0, 'The macro calls nothing script-defuse knows to reach outside its document');
 // EXTERNAL
 def(types_1.ScriptCategory.External, types_1.ScriptDetail.Url, 'strip', 60, '<api> opens a web address');
 def(types_1.ScriptCategory.External, types_1.ScriptDetail.Submit, 'strip', 50, '<api> sends the form data somewhere');
@@ -21,6 +22,14 @@ def(types_1.ScriptCategory.External, types_1.ScriptDetail.Network, 'strip', 70,
 def(types_1.ScriptCategory.External, types_1.ScriptDetail.MenuCommand, 'strip', 60, '<api> runs a viewer menu command');
 def(types_1.ScriptCategory.External, types_1.ScriptDetail.Print, 'strip', 20, '<api> prints');
 def(types_1.ScriptCategory.External, types_1.ScriptDetail.Save, 'strip', 30, '<api> saves or closes the document');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.FileSystem, 'strip', 70, '<api> reads, writes or lists files and folders');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.Process, 'strip', 90, '<api> starts a program or sends keystrokes to one');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.Registry, 'strip', 60, '<api> reads or writes the registry or settings files');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.Dde, 'strip', 80, '<api> talks to another program over DDE');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.ComObject, 'strip', 80, '<api> creates or gets an object from outside the document, such as a shell or a web request');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.NativeCode, 'strip', 90, '<api> calls native code in a library');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.Environment, 'strip', 30, '<api> reads the environment of the computer it runs on');
+def(types_1.ScriptCategory.External, types_1.ScriptDetail.Reference, 'strip', 60, 'The project refers to <api>, a library or project from outside the document');
 // DYNAMIC_CODE
 def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.Eval, 'strip', 80, '<api> runs code built from a string');
 def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.Timer, 'strip', 70, '<api> runs code later, from a string');
@@ -30,6 +39,7 @@ def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.ComputedAccess, 'st
 def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.Prototype, 'strip', 60, '<api> reaches the language machinery behind objects and functions');
 def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.With, 'strip', 40, 'A with statement changes what names refer to');
 def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.SelfReference, 'strip', 60, '<api> reads the source of the running code, the way self-decrypting scripts do');
+def(types_1.ScriptCategory.DynamicCode, types_1.ScriptDetail.LegacyMacro, 'strip', 80, '<api> runs a command of an older macro language, which reaches outside the document');
 // OBFUSCATION
 def(types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.CharCodes, 'strip', 50, 'Text is built from character codes');
 def(types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.Decode, 'strip', 60, '<api> decodes hidden text');
@@ -44,7 +54,7 @@ def(types_1.ScriptCategory.Api, types_1.ScriptDetail.Exploited, 'strip', 80, '<a
 def(types_1.ScriptCategory.Api, types_1.ScriptDetail.Unknown, 'strip', 30, '<api> is not a form calculation, format or check');
 def(types_1.ScriptCategory.Api, types_1.ScriptDetail.PasswordPrompt, 'strip', 50, '<api> asks for a password in a prompt, as a fake sign-in does. A form takes a password in a field of its own');
 // SYNTAX
-def(types_1.ScriptCategory.Syntax, types_1.ScriptDetail.Unparseable, 'strip', 50, 'The script is not valid JavaScript, so what it does cannot be told');
+def(types_1.ScriptCategory.Syntax, types_1.ScriptDetail.Unparseable, 'strip', 50, 'The script does not parse, so what it does cannot be told');
 // LIMIT
 def(types_1.ScriptCategory.Limit, types_1.ScriptDetail.Size, 'strip', 30, 'The script is longer than limits.scriptSize');
 def(types_1.ScriptCategory.Limit, types_1.ScriptDetail.Depth, 'strip', 30, 'The script nests deeper than limits.depth');

package/dist/index.d.ts

@@ -5,3 +5,4 @@ export { analyzeFormCalc } from './formcalc';
 export { type FormScriptPlugin, formScriptPlugin, type PluginScript } from './plugins';
 export { COMBINATIONS, DEFAULT_BANDS, scoreFindings } from './score';
 export * from './types';
+export { analyzeVba } from './vba';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.scoreFindings = exports.DEFAULT_BANDS = exports.COMBINATIONS = exports.formScriptPlugin = exports.analyzeFormCalc = exports.allFindingSpecs = exports.inspectScript = exports.analyzeScript = void 0;
+exports.analyzeVba = exports.scoreFindings = exports.DEFAULT_BANDS = exports.COMBINATIONS = exports.formScriptPlugin = exports.analyzeFormCalc = exports.allFindingSpecs = exports.inspectScript = exports.analyzeScript = void 0;
 var analyze_1 = require("./analyze");
 Object.defineProperty(exports, "analyzeScript", { enumerable: true, get: function () { return analyze_1.analyzeScript; } });
 var engine_1 = require("./engine");
@@ -30,3 +30,5 @@ Object.defineProperty(exports, "COMBINATIONS", { enumerable: true, get: function
 Object.defineProperty(exports, "DEFAULT_BANDS", { enumerable: true, get: function () { return score_1.DEFAULT_BANDS; } });
 Object.defineProperty(exports, "scoreFindings", { enumerable: true, get: function () { return score_1.scoreFindings; } });
 __exportStar(require("./types"), exports);
+var vba_1 = require("./vba");
+Object.defineProperty(exports, "analyzeVba", { enumerable: true, get: function () { return vba_1.analyzeVba; } });

package/dist/index.mjs

@@ -1,3 +1,3 @@
 import cjs from './index.js';
-export const { analyzeScript, inspectScript, allFindingSpecs, analyzeFormCalc, formScriptPlugin, COMBINATIONS, DEFAULT_BANDS, scoreFindings, ScriptCategory, ScriptDetail, ScriptRisk } = cjs;
+export const { analyzeScript, inspectScript, allFindingSpecs, analyzeFormCalc, formScriptPlugin, COMBINATIONS, DEFAULT_BANDS, scoreFindings, analyzeVba, ScriptCategory, ScriptDetail, ScriptRisk } = cjs;
 export default cjs;

package/dist/plugins.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formScriptPlugin = formScriptPlugin;
 const engine_1 = require("./engine");
+const score_1 = require("./score");
 /**
  * A plugin that keeps a script only when inspectScript calls it a form script, and removes every other one.
  *
@@ -22,8 +23,11 @@ function formScriptPlugin(options = {}) {
             if (result === 'passed')
                 for (const name of r.definedGlobals)
                     known.add(name);
-            decisions.push({ script, result, findings: r.findings });
-            return { result, findings: r.findings };
+            // The container scores the script by these weights alone, so they are the ones this script's score counted:
+            // a finding that strips, at the caller's weight, and nothing for one that only describes the script.
+            const findings = r.findings.map(f => ({ ...f, weight: f.action === 'strip' ? (0, score_1.weightOf)(f, options) : 0 }));
+            decisions.push({ script, result, findings });
+            return { result, findings };
         },
     };
 }

package/dist/types.d.ts

@@ -1,8 +1,8 @@
 /** Prefixed with SCRIPT_, so they never read as another package's kinds in a shared report, such as pdf-defuse's FORM. */
 export declare enum ScriptCategory {
-    /** The script only formats, checks or calculates form fields. */
+    /** The script only formats, checks or calculates form fields, or a macro calls nothing known to reach outside its document. */
     Form = "SCRIPT_FORM",
-    /** The script reaches outside the form: a URL, mail, a submit, another file, an attachment, the network. */
+    /** The script reaches outside the form or document: a URL, mail, a submit, another file, the network, a program, a library. */
     External = "SCRIPT_EXTERNAL",
     /** The script runs code it builds at run time, installs scripts, or reaches the language's own machinery. */
     DynamicCode = "SCRIPT_DYNAMIC_CODE",
@@ -15,6 +15,7 @@ export declare enum ScriptCategory {
 }
 export declare enum ScriptDetail {
     Computation = "COMPUTATION",
+    DocumentMacro = "DOCUMENT_MACRO",
     Url = "URL",
     Submit = "SUBMIT",
     Mail = "MAIL",
@@ -25,6 +26,14 @@ export declare enum ScriptDetail {
     MenuCommand = "MENU_COMMAND",
     Print = "PRINT",
     Save = "SAVE",
+    FileSystem = "FILE_SYSTEM",
+    Process = "PROCESS",
+    Registry = "REGISTRY",
+    Dde = "DDE",
+    ComObject = "COM_OBJECT",
+    NativeCode = "NATIVE_CODE",
+    Environment = "ENVIRONMENT",
+    Reference = "REFERENCE",
     Eval = "EVAL",
     Timer = "TIMER",
     InstallScript = "INSTALL_SCRIPT",
@@ -33,6 +42,7 @@ export declare enum ScriptDetail {
     Prototype = "PROTOTYPE",
     With = "WITH",
     SelfReference = "SELF_REFERENCE",
+    LegacyMacro = "LEGACY_MACRO",
     CharCodes = "CHAR_CODES",
     Decode = "DECODE",
     Concatenation = "CONCATENATION",
@@ -108,19 +118,28 @@ export interface ScriptOptions {
     scoreWeights?: ScriptScoreWeight[];
     scoreBands?: ScriptScoreBands;
 }
-/** Where a script runs, as a container reports it. pdf-defuse's ContainedScript fits. */
+/** A type library or another VBA project a VBA project refers to, as office-defuse reads it from the dir stream. */
+export interface ScriptReference {
+    name: string;
+    kind: 'registered' | 'control' | 'project';
+    /** A type library's LibidReference, such as `*\G{...}#2.0#0#path#description`, or a project's path. */
+    libid: string;
+}
+/** Where a script runs, as a container reports it. pdf-defuse's and office-defuse's ContainedScript fit. */
 export interface ScriptContext {
-    /** "document", "open", "field-format", "field-calculate", "click", ... */
+    /** "document", "open", "field-format", "field-calculate", "click", ...; for a VBA module "vba-" and its kind. */
     trigger?: string;
     location?: string;
     fieldName?: string;
-    /** 'javascript' unless the script is FormCalc, which only XFA forms carry. */
-    language?: 'javascript' | 'formcalc';
-    /** 'xfa' for a script in an XFA form, which runs against the XFA object model. */
-    form?: 'acroform' | 'xfa';
+    /** 'javascript' unless the script is FormCalc, which only XFA forms carry, or a VBA module. */
+    language?: 'javascript' | 'formcalc' | 'vba';
+    /** 'xfa' for a script in an XFA form, which runs against the XFA object model; 'office' for a VBA module. */
+    form?: 'acroform' | 'xfa' | 'office';
+    /** For a VBA module, the references of its project. office-defuse gives them with the project's first module. */
+    references?: ScriptReference[];
 }
 export interface ScriptInspection {
-    /** 'form' when no finding strips the script: it only formats, checks or calculates form fields. */
+    /** 'form' when no finding strips the script: it only formats, checks or calculates form fields, or a VBA module calls nothing known to reach outside its document. */
     verdict: 'form' | 'unsafe';
     score: number;
     risk: ScriptRisk;

package/dist/types.js

@@ -4,9 +4,9 @@ exports.ScriptRisk = exports.ScriptDetail = exports.ScriptCategory = void 0;
 /** Prefixed with SCRIPT_, so they never read as another package's kinds in a shared report, such as pdf-defuse's FORM. */
 var ScriptCategory;
 (function (ScriptCategory) {
-    /** The script only formats, checks or calculates form fields. */
+    /** The script only formats, checks or calculates form fields, or a macro calls nothing known to reach outside its document. */
     ScriptCategory["Form"] = "SCRIPT_FORM";
-    /** The script reaches outside the form: a URL, mail, a submit, another file, an attachment, the network. */
+    /** The script reaches outside the form or document: a URL, mail, a submit, another file, the network, a program, a library. */
     ScriptCategory["External"] = "SCRIPT_EXTERNAL";
     /** The script runs code it builds at run time, installs scripts, or reaches the language's own machinery. */
     ScriptCategory["DynamicCode"] = "SCRIPT_DYNAMIC_CODE";
@@ -21,6 +21,7 @@ var ScriptDetail;
 (function (ScriptDetail) {
     // FORM
     ScriptDetail["Computation"] = "COMPUTATION";
+    ScriptDetail["DocumentMacro"] = "DOCUMENT_MACRO";
     // EXTERNAL
     ScriptDetail["Url"] = "URL";
     ScriptDetail["Submit"] = "SUBMIT";
@@ -32,6 +33,14 @@ var ScriptDetail;
     ScriptDetail["MenuCommand"] = "MENU_COMMAND";
     ScriptDetail["Print"] = "PRINT";
     ScriptDetail["Save"] = "SAVE";
+    ScriptDetail["FileSystem"] = "FILE_SYSTEM";
+    ScriptDetail["Process"] = "PROCESS";
+    ScriptDetail["Registry"] = "REGISTRY";
+    ScriptDetail["Dde"] = "DDE";
+    ScriptDetail["ComObject"] = "COM_OBJECT";
+    ScriptDetail["NativeCode"] = "NATIVE_CODE";
+    ScriptDetail["Environment"] = "ENVIRONMENT";
+    ScriptDetail["Reference"] = "REFERENCE";
     // DYNAMIC_CODE
     ScriptDetail["Eval"] = "EVAL";
     ScriptDetail["Timer"] = "TIMER";
@@ -41,6 +50,7 @@ var ScriptDetail;
     ScriptDetail["Prototype"] = "PROTOTYPE";
     ScriptDetail["With"] = "WITH";
     ScriptDetail["SelfReference"] = "SELF_REFERENCE";
+    ScriptDetail["LegacyMacro"] = "LEGACY_MACRO";
     // OBFUSCATION
     ScriptDetail["CharCodes"] = "CHAR_CODES";
     ScriptDetail["Decode"] = "DECODE";

package/dist/vba.d.ts

@@ -0,0 +1,11 @@
+import { type ScriptContext, type ScriptFinding, type ScriptOptions } from './types';
+export interface VbaInput {
+    text: string;
+    context?: ScriptContext;
+    options?: ScriptOptions;
+}
+/** Inspects one VBA module. Its findings say what it calls that reaches outside the document, and what it hides. */
+export declare function analyzeVba(input: VbaInput): {
+    findings: ScriptFinding[];
+    definedGlobals: string[];
+};

package/dist/vba.js

@@ -0,0 +1,728 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeVba = analyzeVba;
+const analyze_1 = require("./analyze");
+const findings_1 = require("./findings");
+const types_1 = require("./types");
+const EXT = (d) => [types_1.ScriptCategory.External, d];
+const DYN = (d) => [types_1.ScriptCategory.DynamicCode, d];
+/** Names that reach outside the document wherever they appear, bare or as a member. */
+const DENY = new Map([
+    // VBA's own library.
+    ...['kill', 'filecopy', 'mkdir', 'rmdir', 'chdir', 'chdrive', 'setattr', 'dir', 'curdir', 'filelen', 'filedatetime', 'getattr', 'fileattr', 'loadpicture', 'savepicture'].map((n) => [n, EXT(types_1.ScriptDetail.FileSystem)]),
+    ...['shell', 'sendkeys', 'appactivate', 'macscript', 'applescripttask'].map((n) => [n, EXT(types_1.ScriptDetail.Process)]),
+    ...['savesetting', 'getsetting', 'getallsettings', 'deletesetting'].map((n) => [n, EXT(types_1.ScriptDetail.Registry)]),
+    ...['ddeinitiate', 'ddeexecute', 'ddepoke', 'dderequest', 'ddeterminate', 'ddeterminateall'].map((n) => [n, EXT(types_1.ScriptDetail.Dde)]),
+    ['createobject', EXT(types_1.ScriptDetail.ComObject)],
+    ['getobject', EXT(types_1.ScriptDetail.ComObject)],
+    ['callbyname', DYN(types_1.ScriptDetail.ComputedAccess)],
+    ...['varptr', 'strptr', 'objptr'].map((n) => [n, DYN(types_1.ScriptDetail.Privilege)]),
+    ['strreverse', [types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.Decode]],
+    // The Office object model.
+    ...['executeexcel4macro', 'runautomacros'].map((n) => [n, DYN(types_1.ScriptDetail.Eval)]),
+    ['wordbasic', DYN(types_1.ScriptDetail.LegacyMacro)],
+    ['ontime', DYN(types_1.ScriptDetail.Timer)],
+    ...[
+        'vbe',
+        'vbproject',
+        'vbcomponents',
+        'codemodule',
+        'addfromstring',
+        'addfromfile',
+        'addfromguid',
+        'insertlines',
+        'replaceline',
+        'deletelines',
+        'addins',
+        'addins2',
+        'comaddins',
+        'excel4macrosheets',
+        'excel4intlmacrosheets',
+    ].map((n) => [n, DYN(types_1.ScriptDetail.InstallScript)]),
+    ['registerxll', EXT(types_1.ScriptDetail.NativeCode)],
+    ['automationsecurity', DYN(types_1.ScriptDetail.Privilege)],
+    ...['followhyperlink', 'navigate', 'navigate2'].map((n) => [n, EXT(types_1.ScriptDetail.Url)]),
+    ...[
+        'opentext',
+        'openxml',
+        'opendatabase',
+        'opencurrentdatabase',
+        'insertfile',
+        'insertfromfile',
+        'addpicture',
+        'addpicture2',
+        'addmediaobject',
+        'addmediaobject2',
+        'attachedtemplate',
+        'sourcefullname',
+        'changelink',
+        'updatelink',
+        'opendatasource',
+        'insertdatabase',
+        'changefileopendirectory',
+    ].map((n) => [n, EXT(types_1.ScriptDetail.OpenDocument)]),
+    ['addoleobject', EXT(types_1.ScriptDetail.DataObject)],
+    ['querytables', EXT(types_1.ScriptDetail.Network)],
+    ...['sendmail', 'sendforreview', 'route', 'mailenvelope', 'sendfaxoverinternet'].map((n) => [n, EXT(types_1.ScriptDetail.Mail)]),
+    ['printout', EXT(types_1.ScriptDetail.Print)],
+    ...['saveas', 'saveas2', 'savecopyas', 'exportasfixedformat', 'exportasfixedformat2', 'exportasfixedformat3', 'saveasxmldata', 'publishobjects'].map((n) => [n, EXT(types_1.ScriptDetail.Save)]),
+    ...['importxml', 'xmlimport', 'xmlimportxml', 'exportxml'].map((n) => [n, EXT(types_1.ScriptDetail.ImportExport)]),
+    ['privateprofilestring', EXT(types_1.ScriptDetail.Registry)],
+    ['profilestring', EXT(types_1.ScriptDetail.Registry)],
+    ['activatemicrosoftapp', EXT(types_1.ScriptDetail.Process)],
+    // What the objects CreateObject and GetObject return offer. They only come from those, which are denied anyway.
+    ...['createtextfile', 'opentextfile', 'openastextstream', 'copyfile', 'movefile', 'deletefile', 'copyfolder', 'movefolder', 'deletefolder', 'createfolder', 'savetofile', 'loadfromfile'].map((n) => [n, EXT(types_1.ScriptDetail.FileSystem)]),
+    ...['exec', 'shellexecute'].map((n) => [n, EXT(types_1.ScriptDetail.Process)]),
+    ...['regwrite', 'regread', 'regdelete'].map((n) => [n, EXT(types_1.ScriptDetail.Registry)]),
+    ...['executeglobal', 'executestatement', 'addcode'].map((n) => [n, DYN(types_1.ScriptDetail.Eval)]),
+]);
+/** Names that reach outside only when written bare, since as a member they are common and harmless. */
+const BARE = new Map([
+    ['environ', EXT(types_1.ScriptDetail.Environment)],
+    ['command', EXT(types_1.ScriptDetail.Environment)],
+    ['input', EXT(types_1.ScriptDetail.FileSystem)],
+    ['tasks', EXT(types_1.ScriptDetail.Process)],
+]);
+/** Names that reach outside only as a member, since bare they are statements or the macro's own names. */
+const MEMBER = new Map([
+    ['open', EXT(types_1.ScriptDetail.OpenDocument)],
+    ['follow', EXT(types_1.ScriptDetail.Url)],
+    ['send', EXT(types_1.ScriptDetail.Mail)],
+    ['import', EXT(types_1.ScriptDetail.ImportExport)],
+    ['export', EXT(types_1.ScriptDetail.ImportExport)],
+    ['compare', EXT(types_1.ScriptDetail.OpenDocument)],
+]);
+/** A member that reaches outside after a particular collection: Hyperlinks.Add adds a link the document did not have. */
+const AFTER = new Map([
+    ['hyperlinks', new Map([['add', EXT(types_1.ScriptDetail.Url)]])],
+    ['oleobjects', new Map([['add', EXT(types_1.ScriptDetail.DataObject)]])],
+    [
+        'connections',
+        new Map([
+            ['add', EXT(types_1.ScriptDetail.Network)],
+            ['add2', EXT(types_1.ScriptDetail.Network)],
+        ]),
+    ],
+    ['xmlmaps', new Map([['add', EXT(types_1.ScriptDetail.ImportExport)]])],
+    ['pictures', new Map([['insert', EXT(types_1.ScriptDetail.OpenDocument)]])],
+]);
+/** Collections whose Add opens a template or file when given one. Without arguments, Add makes an empty document. */
+const ADD_WITH_FILE = new Set(['workbooks', 'documents', 'presentations']);
+/** Classes `New` may create: VBA's own, the Scripting runtime's dictionary, VBScript's regular expressions. */
+const NEW_ALLOWED = new Set(['collection', 'dictionary', 'regexp']);
+/** Classes of the allowed libraries that reach outside: the file system object, and another Office instance. */
+const NEW_DENIED = new Map([
+    ['filesystemobject', EXT(types_1.ScriptDetail.FileSystem)],
+    ['application', EXT(types_1.ScriptDetail.Process)],
+]);
+/**
+ * Type libraries a project may refer to: VBA, OLE Automation, Office, the Office applications, Forms 2.0, the Ref Edit
+ * control, the Scripting runtime and VBScript regular expressions. Every other library, and every other project but
+ * Word's Normal template, adds code or objects from outside the document.
+ */
+const LIBRARIES = new Set([
+    '000204EF-0000-0000-C000-000000000046',
+    '00020430-0000-0000-C000-000000000046',
+    '2DF8D04C-5BFA-101B-BDE5-00AA0044DE52',
+    '00020813-0000-0000-C000-000000000046',
+    '00020905-0000-0000-C000-000000000046',
+    '91493440-5A91-11CF-8700-00AA0060263B',
+    '00021A98-0000-0000-C000-000000000046',
+    '0002123C-0000-0000-C000-000000000046',
+    'A7107640-94DF-1068-855E-00DD01075445',
+    '0D452EE1-E08F-101A-852E-02608C4D0BB4',
+    '00024517-0000-0000-C000-000000000046',
+    '420B2830-E718-11CF-893D-00A0C9054228',
+    '3F4DACA7-160D-11D2-A8E9-00104B365C9F',
+].map(g => g.toUpperCase()));
+/** A worksheet formula that reaches outside when Excel calculates it, by the function it calls. */
+const FORMULA_FUNCTIONS = new Map([
+    ...['webservice', 'importdata', 'importxml', 'importhtml', 'importfeed', 'importrange', 'rtd'].map((n) => [n, EXT(types_1.ScriptDetail.Network)]),
+    ...['call', 'register', 'register.id'].map((n) => [n, EXT(types_1.ScriptDetail.NativeCode)]),
+    ['exec', EXT(types_1.ScriptDetail.Process)],
+    ['hyperlink', EXT(types_1.ScriptDetail.Url)],
+]);
+const FORMULA_CALL = /([A-Za-z][A-Za-z0-9.]*)\s*\(/g;
+/** A DDE formula, application|topic!item, as `=cmd|' /c calc'!A0`. */
+const DDE_FORMULA = /^[=+\-@][^"]*\w\s*\|[^!]*!/;
+/** A macro name that names another file, as `'other.xlsm'!Macro`, which Excel opens to run it. */
+const EXTERNAL_MACRO = /\.(?:xl[a-z]{1,2}|do[ct][a-z]?|pp[a-z]{1,2})'?!/i;
+class VbaSyntaxError extends Error {
+}
+/** The tokens of a module. A comment that ends in " _" is not taken to go on, so the line after it is read as code. */
+function tokenize(text) {
+    const out = [];
+    let i = 0;
+    let lineStart = true;
+    const push = (t, v, pos) => {
+        out.push({ t, v, pos });
+        lineStart = t === 'nl';
+    };
+    const idStart = (c) => /[\p{L}_]/u.test(c);
+    const idPart = (c) => /[\p{L}\p{N}_]/u.test(c);
+    while (i < text.length) {
+        const c = text[i];
+        if (c === '\r' || c === '\n') {
+            if (out.length && out[out.length - 1].t !== 'nl')
+                push('nl', '', i);
+            lineStart = true;
+            i++;
+            continue;
+        }
+        if (c === ' ' || c === '\t' || c === '\f' || c === '\v' || c === '\u00a0') {
+            i++;
+            continue;
+        }
+        if (c === '_' && /^_[ \t]*\r?\n/.test(text.slice(i, i + 64)) && (i === 0 || /[ \t]/.test(text[i - 1]))) {
+            // A line continuation: the statement goes on on the next line.
+            i = text.indexOf('\n', i) + 1;
+            continue;
+        }
+        if (c === "'") {
+            while (i < text.length && text[i] !== '\n' && text[i] !== '\r')
+                i++;
+            continue;
+        }
+        if (c === '"') {
+            const start = i;
+            let s = '';
+            i++;
+            for (;;) {
+                if (i >= text.length || text[i] === '\n' || text[i] === '\r')
+                    throw new VbaSyntaxError(`a string that does not end on its line, at offset ${start}`);
+                if (text[i] === '"') {
+                    if (text[i + 1] === '"') {
+                        s += '"';
+                        i += 2;
+                        continue;
+                    }
+                    i++;
+                    break;
+                }
+                s += text[i++];
+            }
+            push('str', s, start);
+            continue;
+        }
+        if (c === '[') {
+            const end = text.indexOf(']', i);
+            const nl = text.slice(i, end < 0 ? text.length : end).search(/[\r\n]/);
+            if (end < 0 || nl >= 0)
+                throw new VbaSyntaxError(`a bracketed name that does not end on its line, at offset ${i}`);
+            push('bracket', text.slice(i + 1, end), i);
+            i = end + 1;
+            continue;
+        }
+        if (c === '#') {
+            const date = /^#[0-9/:\- ,.APMapm]+#/.exec(text.slice(i, i + 64));
+            if (date && /\d/.test(date[0])) {
+                push('date', date[0], i);
+                i += date[0].length;
+                continue;
+            }
+            push('op', '#', i);
+            i++;
+            continue;
+        }
+        if (/[0-9]/.test(c) || (c === '.' && /[0-9]/.test(text[i + 1] ?? '')) || (c === '&' && /[hHoO]/.test(text[i + 1] ?? '') && /[0-9a-fA-F]/.test(text[i + 2] ?? ''))) {
+            const m = /^(?:&[hH][0-9a-fA-F]+|&[oO][0-7]+|(?:\d+\.?\d*|\.\d+)(?:[eEdD][+-]?\d+)?)[%&!#@^]?/.exec(text.slice(i, i + 64));
+            const n = m ? m[0] : c;
+            push('num', n, i);
+            i += n.length;
+            continue;
+        }
+        if (idStart(c)) {
+            const start = i;
+            while (i < text.length && idPart(text[i]))
+                i++;
+            const name = text.slice(start, i);
+            // A type character: $ always; the others only where no operand follows.
+            if (text[i] === '$' || (/[%&!#@]/.test(text[i] ?? '') && !idStart(text[i + 1] ?? '') && !/[0-9"(]/.test(text[i + 1] ?? '')))
+                i++;
+            const lower = name.toLowerCase();
+            if (lower === 'rem' && (lineStart || out[out.length - 1]?.t === 'nl')) {
+                while (i < text.length && text[i] !== '\n' && text[i] !== '\r')
+                    i++;
+                continue;
+            }
+            push('id', lower, start);
+            continue;
+        }
+        if (c === ':' && text[i + 1] === '=') {
+            push('op', ':=', i);
+            i += 2;
+            continue;
+        }
+        if (c === ':') {
+            push('nl', ':', i);
+            i++;
+            continue;
+        }
+        const two = text.slice(i, i + 2);
+        if (two === '<>' || two === '<=' || two === '>=') {
+            push('op', two, i);
+            i += 2;
+            continue;
+        }
+        if ('=<>+-*/\\^&(),.!;'.includes(c)) {
+            push('op', c, i);
+            i++;
+            continue;
+        }
+        throw new VbaSyntaxError(`a character VBA does not have, ${JSON.stringify(c)}, at offset ${i}`);
+    }
+    return out;
+}
+/** Statement keywords after which a new statement starts on the same line. */
+const STATEMENT_AFTER = new Set(['then', 'else']);
+/** Keywords that may come before Declare and the other statements a rule looks for. */
+const MODIFIERS = new Set(['public', 'private', 'friend', 'static', 'global']);
+/** Statements that declare the names after them. */
+const DECLARES = new Set(['dim', 'const', 'sub', 'function', 'property', 'type', 'enum', 'static', 'redim', 'global', 'public', 'private', 'friend', 'event']);
+/** Keywords inside a declaration that are not names it declares. */
+const DECLARATION_WORDS = new Set([...DECLARES, 'get', 'let', 'set', 'withevents', 'as', 'new', 'optional', 'byval', 'byref', 'paramarray', 'preserve', 'to', 'declare', 'ptrsafe', 'lib', 'alias']);
+/** Where a procedure starts and ends, for names declared inside it. */
+const PROCEDURES = new Set(['sub', 'function', 'property']);
+/** Constants an Add of a new workbook, document or presentation takes in place of a template file. */
+const BUILTIN_CONSTANT = /^(?:xl|wd|pp|mso|vb)/;
+/** Inspects one VBA module. Its findings say what it calls that reaches outside the document, and what it hides. */
+function analyzeVba(input) {
+    const options = input.options ?? {};
+    const overrides = options.actionOverrides ?? [];
+    const findings = [];
+    const reported = new Set();
+    const lines = [0];
+    for (let i = 0; i < input.text.length; i++)
+        if (input.text[i] === '\n')
+            lines.push(i + 1);
+    const lineOf = (pos) => {
+        let lo = 0;
+        let hi = lines.length - 1;
+        while (lo < hi) {
+            const mid = (lo + hi + 1) >> 1;
+            if (lines[mid] <= pos)
+                lo = mid;
+            else
+                hi = mid - 1;
+        }
+        return lo + 1;
+    };
+    const where = (pos) => [input.context?.location ?? input.context?.trigger, pos === undefined ? '' : `line ${lineOf(pos)}`].filter(Boolean).join(', ') || undefined;
+    const report = (f, pos, data) => {
+        const key = `${f[0]}/${f[1]}/${String(data?.api ?? '')}`;
+        if (reported.has(key))
+            return;
+        reported.add(key);
+        findings.push((0, findings_1.makeFinding)(f[0], f[1], overrides, where(pos), data));
+    };
+    const done = () => {
+        if (!findings.some(f => f.action === 'strip'))
+            report([types_1.ScriptCategory.Form, types_1.ScriptDetail.DocumentMacro]);
+        return { findings, definedGlobals: [] };
+    };
+    for (const r of input.context?.references ?? [])
+        checkReference(r, report);
+    const limits = options.limits ?? {};
+    if (limits.scriptSize !== undefined && input.text.length > limits.scriptSize) {
+        report([types_1.ScriptCategory.Limit, types_1.ScriptDetail.Size], undefined, { length: input.text.length });
+        return done();
+    }
+    let tokens;
+    try {
+        tokens = tokenize(input.text);
+    }
+    catch (err) {
+        report([types_1.ScriptCategory.Syntax, types_1.ScriptDetail.Unparseable], undefined, { reason: err instanceof Error ? err.message : String(err) });
+        return done();
+    }
+    // Names the module declares at its top and inside each procedure, which a bare name may mean in place of VBA's or
+    // Office's. A name declared in one procedure means nothing in another.
+    const moduleNames = new Set();
+    const scopeOf = new Array(tokens.length);
+    {
+        let scope = moduleNames;
+        let inProcedure = false;
+        for (let i = 0; i < tokens.length; i++) {
+            const tok = tokens[i];
+            const prev = tokens[i - 1];
+            const startsStatement = !prev || prev.t === 'nl';
+            if (tok.t === 'id' && tok.v === 'end' && tokens[i + 1]?.t === 'id' && PROCEDURES.has(tokens[i + 1].v)) {
+                scopeOf[i] = scope;
+                inProcedure = false;
+                scope = moduleNames;
+                continue;
+            }
+            if (startsStatement && tok.t === 'id' && (DECLARES.has(tok.v) || tok.v === 'declare')) {
+                let j = i;
+                while (tokens[j]?.t === 'id' && DECLARATION_WORDS.has(tokens[j].v))
+                    j++;
+                const procedure = tokens.slice(i, j).some(x => PROCEDURES.has(x.v) && tokens[i].v !== 'declare');
+                // The procedure's own name belongs to the module; its parameters and locals to the procedure.
+                if (procedure && tokens[j]?.t === 'id')
+                    moduleNames.add(tokens[j].v);
+                if (procedure && !inProcedure) {
+                    scope = new Set(moduleNames);
+                    inProcedure = true;
+                }
+                for (let k = procedure ? j + 1 : j; k < tokens.length && tokens[k].t !== 'nl'; k++) {
+                    // Every name of a declaration list but types and the parts of qualified names: Dim a, b As Long; Sub F(x As Long).
+                    const x = tokens[k];
+                    if (x.t === 'id' && !DECLARATION_WORDS.has(x.v) && tokens[k - 1]?.v !== 'as' && tokens[k - 1]?.v !== '.' && tokens[k - 1]?.v !== 'new')
+                        scope.add(x.v);
+                }
+            }
+            scopeOf[i] = scope;
+        }
+    }
+    const declaredAt = (pos) => scopeOf[pos] ?? moduleNames;
+    const indexOf = new Map(tokens.map((t, i) => [t, i]));
+    // Statements, split at line ends, colons, and after Then and Else.
+    const statements = [];
+    let current = [];
+    for (const tok of tokens) {
+        if (tok.t === 'nl') {
+            if (current.length)
+                statements.push(current);
+            current = [];
+            continue;
+        }
+        current.push(tok);
+        if (tok.t === 'id' && STATEMENT_AFTER.has(tok.v)) {
+            statements.push(current);
+            current = [];
+        }
+    }
+    if (current.length)
+        statements.push(current);
+    const appends = new Map();
+    for (const st of statements) {
+        let k = 0;
+        // A line number, as old macros carry, comes before the statement.
+        if (st[0].t === 'num')
+            k++;
+        while (st[k]?.t === 'id' && MODIFIERS.has(st[k].v))
+            k++;
+        const first = st[k];
+        const second = st[k + 1];
+        const head = first?.t === 'id' && st[k - 1]?.v !== '.' ? first.v : undefined;
+        if (head === 'declare')
+            report(EXT(types_1.ScriptDetail.NativeCode), first.pos, { api: `Declare ${second?.t === 'id' ? second.v : ''}`.trim() });
+        // The file statements: Open ... For, Print #, Write #, Input #, Line Input #, Get, Put, Lock, Unlock, Seek, Name ... As.
+        if (head === 'open' || head === 'print' || head === 'write' || head === 'lock' || head === 'unlock' || (head === 'line' && second?.v === 'input'))
+            report(EXT(types_1.ScriptDetail.FileSystem), first.pos, { api: head === 'line' ? 'Line Input' : cap(head) });
+        if ((head === 'get' || head === 'put' || head === 'seek' || head === 'width') && second?.v === '#')
+            report(EXT(types_1.ScriptDetail.FileSystem), first.pos, { api: cap(head) });
+        if ((head === 'get' || head === 'put') && st[k - 1]?.v !== 'property' && second && second.t !== 'id' && second.v !== '(')
+            report(EXT(types_1.ScriptDetail.FileSystem), first.pos, { api: cap(head) });
+        if (head === 'name' && second && !['=', '.', '(', '!'].includes(second.v) && st.some((x, n) => n > k + 1 && x.t === 'id' && x.v === 'as'))
+            report(EXT(types_1.ScriptDetail.FileSystem), first.pos, { api: 'Name' });
+        statementRules(st, k, declaredAt(indexOf.get(st[0]) ?? 0), report, appends);
+    }
+    for (const [name, j] of appends)
+        joinedRules(j, undefined, report, name);
+    return done();
+}
+const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+function checkReference(r, report) {
+    const api = r.name || r.libid.slice(0, 60);
+    if (r.kind === 'project') {
+        // *\C or *\D, then the path; Word's Normal template is named without one.
+        const path = r.libid.replace(/^\*\\[A-Za-z]/, '');
+        if (path.toLowerCase() !== 'normal')
+            report(EXT(types_1.ScriptDetail.Reference), undefined, { api });
+        return;
+    }
+    const guid = /\{([0-9A-Fa-f-]{36})\}/.exec(r.libid)?.[1]?.toUpperCase();
+    if (!guid || !LIBRARIES.has(guid))
+        report(EXT(types_1.ScriptDetail.Reference), undefined, { api });
+}
+/** The checks that look at the names, strings and calls of one statement. */
+function statementRules(st, start, declared, report, appends) {
+    let charCodes = 0;
+    for (let i = start; i < st.length; i++) {
+        const tok = st[i];
+        const prev = st[i - 1];
+        const next = st[i + 1];
+        if (tok.t === 'str') {
+            stringRules(tok.v, tok.pos, report);
+            continue;
+        }
+        if (tok.t === 'bracket') {
+            // In Excel, [A1] and [SUM(A1:A3)] are Evaluate written short.
+            formulaRules(`=${tok.v}`, tok.pos, report);
+            continue;
+        }
+        if (tok.t !== 'id')
+            continue;
+        const member = prev?.v === '.' || prev?.v === '!';
+        const name = tok.v;
+        // VBA's and Office's names are taken as theirs even where the module declares the same name, since a declaration
+        // in one procedure does not change what the name means in the next.
+        const denied = DENY.get(name) ?? (member ? MEMBER.get(name) : declared.has(name) ? undefined : BARE.get(name));
+        if (denied)
+            report(denied, tok.pos, { api: apiName(st, i) });
+        if (member && prev && st[i - 2]?.t === 'id') {
+            const before = st[i - 2].v;
+            const after = AFTER.get(before)?.get(name);
+            if (after)
+                report(after, tok.pos, { api: `${cap(before)}.${cap(name)}` });
+            if (name === 'add' && ADD_WITH_FILE.has(before) && takesArguments(next, st[i + 2]) && namesFile(st.slice(i + 1)))
+                report(EXT(types_1.ScriptDetail.OpenDocument), tok.pos, { api: `${cap(before)}.Add` });
+        }
+        if (name === 'new' && next?.t === 'id') {
+            let j = i + 1;
+            while (st[j + 1]?.v === '.' && st[j + 2]?.t === 'id')
+                j += 2;
+            const cls = st[j].v;
+            const deniedClass = NEW_DENIED.get(cls);
+            if (deniedClass)
+                report(deniedClass, tok.pos, { api: `New ${st[j].v}` });
+            else if (j > i + 1 && !NEW_ALLOWED.has(cls))
+                report(EXT(types_1.ScriptDetail.ComObject), tok.pos, { api: `New ${st[i + 1].v}.${cls}` });
+        }
+        if (name === 'addressof')
+            report(DYN(types_1.ScriptDetail.Privilege), tok.pos, { api: 'AddressOf' });
+        // Run "Macro" and Application.Run name, args run the macro a string names. Run alone, as SlideShowSettings.Run, runs a show.
+        if (name === 'run' && (member || !declared.has(name)) && takesArguments(next, st[i + 2]))
+            report(DYN(types_1.ScriptDetail.Eval), tok.pos, { api: member ? `${cap(st[i - 2]?.v ?? '')}.Run` : 'Run' });
+        if (name === 'evaluate') {
+            const arg = next?.v === '(' ? st[i + 2] : next;
+            const close = next?.v === '(' ? st[i + 3] : st[i + 2];
+            if (arg?.t === 'str' && (!close || close.v === ')' || close.t === 'nl'))
+                formulaRules(arg.v.startsWith('=') ? arg.v : `=${arg.v}`, arg.pos, report);
+            else
+                report(DYN(types_1.ScriptDetail.Eval), tok.pos, { api: 'Evaluate' });
+        }
+        if (CHR.has(name) && next?.v === '(') {
+            const inner = argumentTokens(st, i + 1);
+            if (hidesLetter(inner))
+                charCodes++;
+            const ids = new Set(inner.filter(x => x.t === 'id').map(x => x.v));
+            // Chr(Asc(Mid(s, i, 1)) Xor k): a string decoded one character at a time.
+            if (ids.has('xor') || ((ids.has('asc') || ids.has('ascw') || ids.has('ascb')) && (ids.has('mid') || ids.has('mid$'))))
+                report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.Decode], tok.pos, { api: 'Chr(Asc(...))' });
+        }
+        if (name === 'replace' && next?.v === '(') {
+            const args = splitArguments(argumentTokens(st, i + 1));
+            const [text, find, by] = args.map(a => (a.length === 1 && a[0].t === 'str' ? a[0].v : undefined));
+            // Replace("pXoXwXeXr", "X", ""): text hidden among filler in a string the macro wrote itself.
+            if (text !== undefined && find && by === '' && text.split(find).length - 1 >= 3)
+                report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.Decode], tok.pos, { api: 'Replace("...")' });
+        }
+    }
+    if (charCodes >= 6)
+        report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.CharCodes], st[start]?.pos, { api: 'Chr', count: charCodes });
+    const chains = literalChains(st, start);
+    for (const c of chains)
+        if (c.pieces.length > 1)
+            joinedRules(c, c.pos, report);
+    // x = x & "...": a string built up one piece per statement, judged on what it holds once joined.
+    const [target, eq, again, amp] = st.slice(start);
+    const first = chains[0];
+    if (target?.t === 'id' && eq?.v === '=' && again?.t === 'id' && again.v === target.v && (amp?.v === '&' || amp?.v === '+') && first?.start === start + 4) {
+        const j = appends.get(target.v) ?? { pieces: [], pos: target.pos };
+        if (j.pieces.length < 100000)
+            j.pieces.push(...first.pieces);
+        appends.set(target.v, j);
+    }
+}
+/** Words of a payload: programs, script hosts, URLs, file types that run, and the objects that fetch and write files. */
+const PAYLOAD_WORDS = [
+    'powershell',
+    'cmd.exe',
+    'cmd /c',
+    'wscript',
+    'cscript',
+    'mshta',
+    'rundll32',
+    'regsvr32',
+    'certutil',
+    'bitsadmin',
+    'schtasks',
+    'wmic',
+    'http://',
+    'https://',
+    'ftp://',
+    '.exe',
+    '.dll',
+    '.vbs',
+    '.hta',
+    '.ps1',
+    '.bat',
+    '.scr',
+    '.lnk',
+    'createobject',
+    'getobject',
+    'msxml2',
+    'xmlhttp',
+    'winhttp',
+    'adodb',
+    'savetofile',
+    'responsebody',
+    'shell.application',
+    'wscript.shell',
+    'filesystemobject',
+    'winmgmts',
+    'win32_process',
+    'frombase64string',
+    'downloadfile',
+    'downloadstring',
+    'webclient',
+    'invoke-expression',
+    'start-process',
+    '-encodedcommand',
+    'executionpolicy',
+    'urldownloadtofile',
+    'kernel32',
+    'virtualalloc',
+    'createthread',
+    'rtlmovememory',
+    '%temp%',
+    '%appdata%',
+];
+/**
+ * A joined string is obfuscation when it spells a payload word no piece holds on its own, as "pow" & "ersh" & "ell",
+ * and is checked as any string literal is: encoded data, a long blob, a formula.
+ */
+function joinedRules(j, pos, report, api) {
+    const text = j.pieces.join('');
+    const lower = text.toLowerCase();
+    const pieces = j.pieces.map(p => p.toLowerCase());
+    const hidden = PAYLOAD_WORDS.find(w => lower.includes(w) && !pieces.some(p => p.includes(w)));
+    if (hidden)
+        report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.Concatenation], pos ?? j.pos, { count: j.pieces.length, ...(api ? { api } : {}), word: hidden });
+    if (j.pieces.length > 1) {
+        if (analyze_1.ENCODED.some(re => re.test(text)))
+            report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.EncodedString], pos ?? j.pos, { length: text.length });
+        else if ((0, analyze_1.isLongBlob)(text))
+            report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.LongString], pos ?? j.pos, { length: text.length });
+        if (/^[=+\-@]/.test(text))
+            formulaRules(text, pos ?? j.pos, report);
+    }
+}
+const CHR = new Set(['chr', 'chrw', 'chrb']);
+/**
+ * Whether a Chr argument writes a character a string literal could hold as it is, which only hiding it explains:
+ * Chr(112) or Chr(115 - 3). Macros write control characters, the quote, the non-breaking space and smart quotes with
+ * Chr, and Chr(i) of a variable is a loop's work.
+ */
+function hidesLetter(arg) {
+    if (!arg.length || !arg.every(t => t.t === 'num' || (t.t === 'op' && '+-*/\\()'.includes(t.v))))
+        return false;
+    if (arg.length === 1) {
+        const code = numberOf(arg[0].v);
+        return code >= 33 && code <= 126 && code !== 34;
+    }
+    return true;
+}
+/**
+ * The chains of string literals and Chr calls joined by & or +, as "p" & "ow" & Chr(101) & "r". Pieces joined around
+ * variables, as a & "," & b, are separate chains. A Chr of a computed code stands for a character no one can tell.
+ */
+function literalChains(st, start) {
+    const chains = [];
+    let cur;
+    let i = start;
+    while (i < st.length) {
+        const tok = st[i];
+        let end = -1;
+        let piece = '';
+        if (tok.t === 'str') {
+            end = i + 1;
+            piece = tok.v;
+        }
+        else if (tok.t === 'id' && CHR.has(tok.v) && st[i + 1]?.v === '(') {
+            const arg = argumentTokens(st, i + 1);
+            end = i + 2 + arg.length + 1;
+            const code = arg.length === 1 && arg[0].t === 'num' ? numberOf(arg[0].v) : undefined;
+            piece = code !== undefined && code >= 0 && code < 0x110000 ? String.fromCodePoint(code) : '\ufffd';
+        }
+        if (end < 0) {
+            cur = undefined;
+            i++;
+            continue;
+        }
+        if (!cur) {
+            cur = { pieces: [], pos: tok.pos, start: i };
+            chains.push(cur);
+        }
+        cur.pieces.push(piece);
+        if (st[end]?.v === '&' || st[end]?.v === '+')
+            i = end + 1;
+        else {
+            cur = undefined;
+            i = end;
+        }
+    }
+    return chains;
+}
+/** A VBA number literal's value: decimal, &H hex or &O octal, with any type character. */
+function numberOf(v) {
+    const m = /^&([hHoO])([0-9a-fA-F]+)/.exec(v);
+    return m ? Number.parseInt(m[2], /[hH]/.test(m[1]) ? 16 : 8) : Number.parseFloat(v);
+}
+/** Whether the arguments of an Add name a file or template: anything but Office's constants, numbers and named-argument names. */
+function namesFile(args) {
+    return args.some((t, k) => (t.t === 'str' && t.v !== '') || (t.t === 'id' && !BUILTIN_CONSTANT.test(t.v) && args[k + 1]?.v !== ':=' && !['true', 'false'].includes(t.v)));
+}
+/** Whether a call's next tokens pass it arguments: anything but the end of the statement, "=", ")" or ",". */
+function takesArguments(next, after) {
+    if (!next || next.t === 'nl')
+        return false;
+    if (next.v === '(')
+        return after !== undefined && after.v !== ')';
+    if (next.t === 'op' && ['=', ')', ',', '.', ':=', '&', '+', '-', '*', '/', '<>', '<', '>', '<=', '>='].includes(next.v))
+        return false;
+    return !(next.t === 'id' && ['then', 'else', 'and', 'or', 'xor', 'mod', 'is', 'to', 'step'].includes(next.v));
+}
+/** The tokens inside the parentheses that open at `open`. */
+function argumentTokens(st, open) {
+    let depth = 0;
+    for (let j = open; j < st.length; j++) {
+        if (st[j].v === '(' && st[j].t === 'op')
+            depth++;
+        else if (st[j].v === ')' && st[j].t === 'op' && --depth === 0)
+            return st.slice(open + 1, j);
+    }
+    return st.slice(open + 1);
+}
+function splitArguments(tokens) {
+    const args = [[]];
+    let depth = 0;
+    for (const tok of tokens) {
+        if (tok.t === 'op' && tok.v === '(')
+            depth++;
+        if (tok.t === 'op' && tok.v === ')')
+            depth--;
+        if (tok.t === 'op' && tok.v === ',' && depth === 0)
+            args.push([]);
+        else
+            args[args.length - 1].push(tok);
+    }
+    return args;
+}
+/** The name a finding shows: the member with what it is a member of, as Workbooks.Open. */
+function apiName(st, i) {
+    const own = cap(st[i].v);
+    return (st[i - 1]?.v === '.' || st[i - 1]?.v === '!') && st[i - 2]?.t === 'id' ? `${cap(st[i - 2].v)}.${own}` : own;
+}
+function stringRules(s, pos, report) {
+    if (analyze_1.ENCODED.some(re => re.test(s)))
+        report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.EncodedString], pos, { length: s.length });
+    else if ((0, analyze_1.isLongBlob)(s))
+        report([types_1.ScriptCategory.Obfuscation, types_1.ScriptDetail.LongString], pos, { length: s.length });
+    if (/^[=+\-@]/.test(s))
+        formulaRules(s, pos, report);
+    if (EXTERNAL_MACRO.test(s))
+        report(EXT(types_1.ScriptDetail.OpenDocument), pos, { api: 'a macro in another file' });
+}
+/** A formula a macro writes into a cell or evaluates, checked for the functions and DDE links that reach outside. */
+function formulaRules(formula, pos, report) {
+    if (DDE_FORMULA.test(formula))
+        report(EXT(types_1.ScriptDetail.Dde), pos, { api: 'a DDE formula' });
+    for (const m of formula.matchAll(FORMULA_CALL)) {
+        const f = FORMULA_FUNCTIONS.get(m[1].toLowerCase().replace(/^_xlfn\./, ''));
+        if (f)
+            report(f, pos, { api: m[1].toUpperCase() });
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@patrickdk77/script-defuse",
-  "version": "0.1.0",
-  "description": "Inspect PDF form scripts in JavaScript and FormCalc, from AcroForm and XFA forms. Keeps a script only when every call and property it uses formats, checks or calculates form fields, and reports external access, dynamic code and obfuscation. Includes a script plugin for pdf-defuse.",
+  "version": "0.3.0",
+  "description": "Inspect document scripts: PDF form scripts in JavaScript and FormCalc, from AcroForm and XFA forms, and the VBA modules of Office documents. Keeps a form script only when every call and property it uses formats, checks or calculates form fields, and a macro only when it calls nothing that reaches outside its document. Reports external access, dynamic code and obfuscation. Includes a script plugin for pdf-defuse and office-defuse.",
   "license": "MIT",
   "author": "patrickdk77",
   "main": "./dist/index.js",