@patrickdk77/script-defuse 0.2.0 → 0.3.0

package/README.md

@@ -35,6 +35,8 @@ const result = await disarmPdf(bytes, { scriptPlugins: [formScriptPlugin()] });
 
 pdf-defuse removes every script unless a plugin keeps it. This plugin keeps the form scripts and removes the rest. From pdf-defuse 0.2.4 the plugin's findings go into the PDF's report at each script's location.
 
+The plugin's answer is final, and its findings are what the script scores. Each finding's `weight` is what it adds to that script's score from `inspectScript`: a finding that strips weighs what `scoreWeights` or the table gives it, and one that only describes the script weighs 0. A form script the plugin keeps therefore adds nothing to the PDF's score from pdf-defuse 0.3.0 and office-defuse 0.3.0. Earlier versions scored a kept script at their own weight for it.
+
 Make one plugin per PDF. pdf-defuse hands it the document-level scripts first, and the plugin remembers the globals of the ones it kept, so a field script may call a helper they define. A field script that calls a helper from a document script the plugin removed is removed too.
 
 With [file-defuse](https://github.com/patrickdk77/file-defuse) 0.1.4 or later, every PDF and Office file already gets one.

package/dist/plugins.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formScriptPlugin = formScriptPlugin;
 const engine_1 = require("./engine");
+const score_1 = require("./score");
 /**
  * A plugin that keeps a script only when inspectScript calls it a form script, and removes every other one.
  *
@@ -22,8 +23,11 @@ function formScriptPlugin(options = {}) {
             if (result === 'passed')
                 for (const name of r.definedGlobals)
                     known.add(name);
-            decisions.push({ script, result, findings: r.findings });
-            return { result, findings: r.findings };
+            // The container scores the script by these weights alone, so they are the ones this script's score counted:
+            // a finding that strips, at the caller's weight, and nothing for one that only describes the script.
+            const findings = r.findings.map(f => ({ ...f, weight: f.action === 'strip' ? (0, score_1.weightOf)(f, options) : 0 }));
+            decisions.push({ script, result, findings });
+            return { result, findings };
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/script-defuse",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Inspect document scripts: PDF form scripts in JavaScript and FormCalc, from AcroForm and XFA forms, and the VBA modules of Office documents. Keeps a form script only when every call and property it uses formats, checks or calculates form fields, and a macro only when it calls nothing that reaches outside its document. Reports external access, dynamic code and obfuscation. Includes a script plugin for pdf-defuse and office-defuse.",
   "license": "MIT",
   "author": "patrickdk77",