@patrickdk77/script-defuse 0.2.0 → 0.3.1

package/README.md

@@ -35,6 +35,8 @@ const result = await disarmPdf(bytes, { scriptPlugins: [formScriptPlugin()] });
 
 pdf-defuse removes every script unless a plugin keeps it. This plugin keeps the form scripts and removes the rest. From pdf-defuse 0.2.4 the plugin's findings go into the PDF's report at each script's location.
 
+The plugin's answer is final, and its findings are what the script scores. Each finding's `weight` is what it adds to that script's score from `inspectScript`: a finding that strips weighs what `scoreWeights` or the table gives it, and one that only describes the script weighs 0. A form script the plugin keeps therefore adds nothing to the PDF's score from pdf-defuse 0.3.0 and office-defuse 0.3.0. Earlier versions scored a kept script at their own weight for it.
+
 Make one plugin per PDF. pdf-defuse hands it the document-level scripts first, and the plugin remembers the globals of the ones it kept, so a field script may call a helper they define. A field script that calls a helper from a document script the plugin removed is removed too.
 
 With [file-defuse](https://github.com/patrickdk77/file-defuse) 0.1.4 or later, every PDF and Office file already gets one.

package/dist/analyze.js

@@ -196,10 +196,10 @@ function analyzeScript(input) {
     declare(program, top);
     // 2. What each binding is given: initializers and assignments. An assignment to a name nothing declares makes a
     // global, unless it is a property of the document, which an AcroForm script's bare names reach.
-    const global = (name) => (!xfa && api_1.DOC_ALL.has(name) ? undefined : top.declare(name));
+    const declareGlobal = (name) => (!xfa && api_1.DOC_ALL.has(name) ? undefined : top.declare(name));
     const assign = (target, expr, scope) => {
         for (const name of patternNames(target)) {
-            const b = scope.lookup(name) ?? global(name);
+            const b = scope.lookup(name) ?? declareGlobal(name);
             if (!b)
                 continue;
             if (expr && target.type === 'Identifier')
@@ -231,11 +231,11 @@ function analyzeScript(input) {
                 assign(n.left, n.right, scope);
             else
                 for (const name of patternNames(n.left))
-                    (scope.lookup(name) ?? global(name))?.kinds.add(n.operator === '+=' ? 'data' : 'number');
+                    (scope.lookup(name) ?? declareGlobal(name))?.kinds.add(n.operator === '+=' ? 'data' : 'number');
         }
         else if ((n.type === 'ForInStatement' || n.type === 'ForOfStatement') && n.left.type !== 'VariableDeclaration' && n.left.type !== 'MemberExpression') {
             for (const name of patternNames(n.left))
-                (scope.lookup(name) ?? global(name))?.kinds.add(n.type === 'ForInStatement' ? 'string' : 'unknown');
+                (scope.lookup(name) ?? declareGlobal(name))?.kinds.add(n.type === 'ForInStatement' ? 'string' : 'unknown');
         }
         else if ((n.type === 'ForInStatement' || n.type === 'ForOfStatement') && n.left.type === 'VariableDeclaration') {
             for (const d of n.left.declarations)
@@ -243,7 +243,7 @@ function analyzeScript(input) {
                     (scope.lookup(name) ?? scope.declare(name)).kinds.add(n.type === 'ForInStatement' ? 'string' : 'unknown');
         }
         else if (n.type === 'UpdateExpression' && n.argument.type === 'Identifier')
-            (scope.lookup(n.argument.name) ?? global(n.argument.name))?.kinds.add('number');
+            (scope.lookup(n.argument.name) ?? declareGlobal(n.argument.name))?.kinds.add('number');
         for (const c of children(n))
             collect(c, inner);
     };

package/dist/plugins.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formScriptPlugin = formScriptPlugin;
 const engine_1 = require("./engine");
+const score_1 = require("./score");
 /**
  * A plugin that keeps a script only when inspectScript calls it a form script, and removes every other one.
  *
@@ -22,8 +23,11 @@ function formScriptPlugin(options = {}) {
             if (result === 'passed')
                 for (const name of r.definedGlobals)
                     known.add(name);
-            decisions.push({ script, result, findings: r.findings });
-            return { result, findings: r.findings };
+            // The container scores the script by these weights alone, so they are the ones this script's score counted:
+            // a finding that strips, at the caller's weight, and nothing for one that only describes the script.
+            const findings = r.findings.map(f => ({ ...f, weight: f.action === 'strip' ? (0, score_1.weightOf)(f, options) : 0 }));
+            decisions.push({ script, result, findings });
+            return { result, findings };
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@patrickdk77/script-defuse",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Inspect document scripts: PDF form scripts in JavaScript and FormCalc, from AcroForm and XFA forms, and the VBA modules of Office documents. Keeps a form script only when every call and property it uses formats, checks or calculates form fields, and a macro only when it calls nothing that reaches outside its document. Reports external access, dynamic code and obfuscation. Includes a script plugin for pdf-defuse and office-defuse.",
   "license": "MIT",
   "author": "patrickdk77",