@syncfusion/ej2-office-common 35.1.37

package/src/encryption/cfb-reader.js

@@ -0,0 +1,345 @@
+/*
+ * Minimal OLE Compound File Binary (CFB) reader for OFFCRYPTO streams.
+ *
+ * @remarks
+ * Reads only what is required to extract root storage streams named
+ * `EncryptionInfo` and `EncryptedPackage` ([MS-OFFCRYPTO] §2.3.4.4,
+ * §2.3.4.10). Layout fields follow the well-known CFB header / FAT /
+ * directory structure used by ECMA-376 encrypted packages. This is **not** a
+ * full [MS-CFB] implementation — no local MS-CFB corpus is present under
+ * `specs/`; only the subset needed for named-stream extraction is coded.
+ *
+ * Fail closed on truncated headers, broken FAT chains, or missing streams.
+ *
+ * @private
+ */
+var __values = (this && this.__values) || function (o) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator], i = 0;
+    if (m) return m.call(o);
+    return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
+        }
+    };
+};
+import { EncryptedPackageError } from './errors';
+import { STREAM_ENCRYPTED_PACKAGE, STREAM_ENCRYPTION_INFO } from './agile-constants';
+/** OLE CFB header signature ([MS-CFB]). */
+var OLE_CFB_SIGNATURE = Object.freeze([0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]);
+/** Sector size shift for 512-byte sectors (common default). */
+var SECTOR_SHIFT_512 = 9;
+/** Sector size shift for 4096-byte sectors. */
+var SECTOR_SHIFT_4096 = 12;
+var ENDOFCHAIN = 0xfffffffe;
+var FREESECT = 0xffffffff;
+var FATSECT = 0xfffffffd;
+var DIFSECT = 0xfffffffc;
+var DIR_ENTRY_SIZE = 128;
+var MAX_DIR_ENTRIES = 65536;
+var MAX_FAT_SECTORS = 1048576;
+/**
+ * Extracts `\EncryptionInfo` and `\EncryptedPackage` from an OFFCRYPTO CFB.
+ *
+ * @param input - Entire OLE compound-file bytes.
+ * @throws {EncryptedPackageError} When structure is incomplete or streams missing.
+ */
+export function readOffCryptoStreams(input) {
+    if (input.byteLength < 512) {
+        throw new EncryptedPackageError('OFFCRYPTO package is truncated (CFB header)');
+    }
+    for (var i = 0; i < OLE_CFB_SIGNATURE.length; i++) {
+        if (input[i] !== OLE_CFB_SIGNATURE[i]) {
+            throw new EncryptedPackageError('Package is not a valid OLE compound file');
+        }
+    }
+    var view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+    var sectorShift = view.getUint16(30, true);
+    if (sectorShift !== SECTOR_SHIFT_512 && sectorShift !== SECTOR_SHIFT_4096) {
+        throw new EncryptedPackageError('Unsupported CFB sector size');
+    }
+    var sectorSize = 1 << sectorShift;
+    var miniSectorShift = view.getUint16(32, true);
+    if (miniSectorShift !== 6) {
+        // Standard mini-sector is 64 bytes; refuse unknown layouts.
+        throw new EncryptedPackageError('Unsupported CFB mini-sector size');
+    }
+    var miniSectorSize = 1 << miniSectorShift;
+    var miniStreamCutoff = view.getUint32(56, true);
+    var firstDirSector = view.getUint32(48, true);
+    var firstMiniFatSector = view.getUint32(60, true);
+    var miniFatSectorCount = view.getUint32(64, true);
+    var fatSectorCount = view.getUint32(44, true);
+    var firstDifatSector = view.getUint32(68, true);
+    var difatSectorCount = view.getUint32(72, true);
+    if (fatSectorCount > MAX_FAT_SECTORS) {
+        throw new EncryptedPackageError('CFB FAT is unreasonably large');
+    }
+    var difat = [];
+    for (var i = 0; i < 109; i++) {
+        var sect = view.getUint32(76 + i * 4, true);
+        if (sect !== FREESECT) {
+            difat.push(sect);
+        }
+    }
+    var difatSect = firstDifatSector;
+    for (var n = 0; n < difatSectorCount; n++) {
+        if (difatSect === ENDOFCHAIN || difatSect === FREESECT) {
+            break;
+        }
+        var offset = sectorOffset(difatSect, sectorSize);
+        ensureRange(input, offset, sectorSize);
+        var entriesPerSector = sectorSize / 4 - 1;
+        for (var i = 0; i < entriesPerSector; i++) {
+            var sect = view.getUint32(offset + i * 4, true);
+            if (sect !== FREESECT) {
+                difat.push(sect);
+            }
+        }
+        difatSect = view.getUint32(offset + entriesPerSector * 4, true);
+    }
+    if (difat.length < fatSectorCount) {
+        throw new EncryptedPackageError('CFB DIFAT is truncated');
+    }
+    var fat = [];
+    for (var i = 0; i < fatSectorCount; i++) {
+        var fatSect = difat[i];
+        if (fatSect === undefined) {
+            throw new EncryptedPackageError('CFB DIFAT is truncated');
+        }
+        var offset = sectorOffset(fatSect, sectorSize);
+        ensureRange(input, offset, sectorSize);
+        var entries_1 = sectorSize / 4;
+        for (var j = 0; j < entries_1; j++) {
+            fat.push(view.getUint32(offset + j * 4, true));
+        }
+    }
+    var directoryBytes = readChain(input, view, fat, firstDirSector, sectorSize, undefined);
+    if (directoryBytes.byteLength < DIR_ENTRY_SIZE) {
+        throw new EncryptedPackageError('CFB directory is empty');
+    }
+    var entryCount = Math.min(Math.floor(directoryBytes.byteLength / DIR_ENTRY_SIZE), MAX_DIR_ENTRIES);
+    var dirView = new DataView(directoryBytes.buffer, directoryBytes.byteOffset, directoryBytes.byteLength);
+    var entries = [];
+    for (var i = 0; i < entryCount; i++) {
+        var base = i * DIR_ENTRY_SIZE;
+        var nameLength = dirView.getUint16(base + 64, true);
+        // nameLength includes the terminating null (2 bytes) when non-zero.
+        var charCount = nameLength >= 2 ? Math.floor((nameLength - 2) / 2) : 0;
+        var name_1 = '';
+        for (var c = 0; c < charCount && c < 32; c++) {
+            name_1 += String.fromCharCode(dirView.getUint16(base + c * 2, true));
+        }
+        var objectType = dirView.getUint8(base + 66);
+        var childId = dirView.getUint32(base + 76, true);
+        var startSector = dirView.getUint32(base + 116, true);
+        // Stream size is 8 bytes LE; OFFCRYPTO streams fit in lower 32 bits for our limits.
+        var streamSizeLow = dirView.getUint32(base + 120, true);
+        var streamSizeHigh = dirView.getUint32(base + 124, true);
+        if (streamSizeHigh !== 0) {
+            throw new EncryptedPackageError('OFFCRYPTO stream exceeds supported size');
+        }
+        entries.push({
+            name: name_1,
+            objectType: objectType,
+            startSector: startSector,
+            streamSize: streamSizeLow,
+            childId: childId,
+        });
+    }
+    var root = entries[0];
+    if (root === undefined || root.objectType !== 5) {
+        throw new EncryptedPackageError('CFB root storage is missing');
+    }
+    // Collect names under root via sibling tree walk (left/right/child).
+    var found = new Map();
+    var visited = new Set();
+    var walk = function (id) {
+        if (id > 0xfffffffa || id >= entries.length || visited.has(id)) {
+            return;
+        }
+        visited.add(id);
+        var e = entries[id];
+        if (e === undefined) {
+            return;
+        }
+        var left = dirView.getUint32(id * DIR_ENTRY_SIZE + 68, true);
+        var right = dirView.getUint32(id * DIR_ENTRY_SIZE + 72, true);
+        walk(left);
+        if (e.objectType === 2 /* stream */) {
+            found.set(e.name, e);
+        }
+        walk(right);
+        if (e.objectType === 1 /* storage */ || e.objectType === 5 /* root */) {
+            walk(e.childId);
+        }
+    };
+    walk(root.childId);
+    var infoEntry = found.get(STREAM_ENCRYPTION_INFO);
+    var pkgEntry = found.get(STREAM_ENCRYPTED_PACKAGE);
+    if (infoEntry === undefined || pkgEntry === undefined) {
+        throw new EncryptedPackageError('OFFCRYPTO streams EncryptionInfo and/or EncryptedPackage are missing');
+    }
+    var miniFat;
+    var miniStream;
+    var readStream = function (entry) {
+        if (entry.streamSize === 0) {
+            return new Uint8Array(0);
+        }
+        if (entry.streamSize < miniStreamCutoff && entry !== root) {
+            if (miniFat === undefined) {
+                miniFat = readMiniFat(input, view, fat, firstMiniFatSector, miniFatSectorCount, sectorSize);
+                // Root stream size may be larger than mini data; chain until end.
+                miniStream = readChain(input, view, fat, root.startSector, sectorSize, undefined);
+            }
+            if (miniStream === undefined) {
+                throw new EncryptedPackageError('CFB mini-stream is unavailable');
+            }
+            return readMiniChain(miniStream, miniFat, entry.startSector, miniSectorSize, entry.streamSize);
+        }
+        return readChain(input, view, fat, entry.startSector, sectorSize, entry.streamSize);
+    };
+    return {
+        encryptionInfo: readStream(infoEntry),
+        encryptedPackage: readStream(pkgEntry),
+    };
+}
+function sectorOffset(sectorIndex, sectorSize) {
+    // Sector 0 starts after the 512-byte header for 512-byte sectors; for 4096,
+    // header occupies the first sector region — offset is still (sector+1)*size
+    // relative to file start for standard CFB.
+    return (sectorIndex + 1) * sectorSize;
+}
+function ensureRange(input, offset, length) {
+    if (offset < 0 || length < 0 || offset + length > input.byteLength) {
+        throw new EncryptedPackageError('OFFCRYPTO package is truncated (CFB sector)');
+    }
+}
+function readChain(input, view, fat, startSector, sectorSize, maxBytes) {
+    if (startSector === ENDOFCHAIN || startSector === FREESECT) {
+        return new Uint8Array(0);
+    }
+    var chunks = [];
+    var total = 0;
+    var sector = startSector;
+    var guard = 0;
+    var maxGuard = fat.length + 2;
+    while (sector !== ENDOFCHAIN && sector !== FREESECT) {
+        if (guard++ > maxGuard) {
+            throw new EncryptedPackageError('CFB FAT chain is cyclic or unbounded');
+        }
+        if (sector === FATSECT || sector === DIFSECT) {
+            throw new EncryptedPackageError('CFB FAT chain contains reserved sector');
+        }
+        if (sector < 0 || sector >= fat.length) {
+            // Allow reading last data sector without FAT entry for short files: still need bounds.
+            var offsetTry = sectorOffset(sector, sectorSize);
+            if (offsetTry + sectorSize > input.byteLength && offsetTry >= input.byteLength) {
+                throw new EncryptedPackageError('CFB FAT chain sector out of range');
+            }
+        }
+        var offset = sectorOffset(sector, sectorSize);
+        ensureRange(input, offset, Math.min(sectorSize, input.byteLength - offset));
+        var take = Math.min(sectorSize, input.byteLength - offset);
+        var slice = input.subarray(offset, offset + take);
+        chunks.push(slice);
+        total += slice.byteLength;
+        if (maxBytes !== undefined && total >= maxBytes) {
+            break;
+        }
+        if (sector >= fat.length) {
+            throw new EncryptedPackageError('CFB FAT chain sector out of range');
+        }
+        var nextSector = fat[sector];
+        if (nextSector === undefined) {
+            throw new EncryptedPackageError('CFB FAT chain sector out of range');
+        }
+        sector = nextSector;
+    }
+    var out = concat(chunks);
+    if (maxBytes !== undefined) {
+        if (out.byteLength < maxBytes) {
+            throw new EncryptedPackageError('OFFCRYPTO stream data is truncated');
+        }
+        return out.subarray(0, maxBytes);
+    }
+    return out;
+}
+function readMiniFat(input, view, fat, firstMiniFatSector, miniFatSectorCount, sectorSize) {
+    if (miniFatSectorCount === 0 || firstMiniFatSector === ENDOFCHAIN) {
+        return [];
+    }
+    var bytes = readChain(input, view, fat, firstMiniFatSector, sectorSize, miniFatSectorCount * sectorSize);
+    var dv = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    var entries = [];
+    for (var i = 0; i + 4 <= bytes.byteLength; i += 4) {
+        entries.push(dv.getUint32(i, true));
+    }
+    return entries;
+}
+function readMiniChain(miniStream, miniFat, startSector, miniSectorSize, streamSize) {
+    var chunks = [];
+    var total = 0;
+    var sector = startSector;
+    var guard = 0;
+    var maxGuard = miniFat.length + 2;
+    while (sector !== ENDOFCHAIN && sector !== FREESECT && total < streamSize) {
+        if (guard++ > maxGuard) {
+            throw new EncryptedPackageError('CFB mini-FAT chain is cyclic or unbounded');
+        }
+        var offset = sector * miniSectorSize;
+        if (offset >= miniStream.byteLength) {
+            throw new EncryptedPackageError('CFB mini-stream is truncated');
+        }
+        var take = Math.min(miniSectorSize, miniStream.byteLength - offset, streamSize - total);
+        chunks.push(miniStream.subarray(offset, offset + take));
+        total += take;
+        if (sector >= miniFat.length) {
+            throw new EncryptedPackageError('CFB mini-FAT sector out of range');
+        }
+        var nextMini = miniFat[sector];
+        if (nextMini === undefined) {
+            throw new EncryptedPackageError('CFB mini-FAT sector out of range');
+        }
+        sector = nextMini;
+    }
+    var out = concat(chunks);
+    if (out.byteLength < streamSize) {
+        throw new EncryptedPackageError('OFFCRYPTO mini-stream data is truncated');
+    }
+    return out.subarray(0, streamSize);
+}
+function concat(chunks) {
+    var e_1, _a, e_2, _b;
+    var total = 0;
+    try {
+        for (var chunks_1 = __values(chunks), chunks_1_1 = chunks_1.next(); !chunks_1_1.done; chunks_1_1 = chunks_1.next()) {
+            var c = chunks_1_1.value;
+            total += c.byteLength;
+        }
+    }
+    catch (e_1_1) { e_1 = { error: e_1_1 }; }
+    finally {
+        try {
+            if (chunks_1_1 && !chunks_1_1.done && (_a = chunks_1.return)) _a.call(chunks_1);
+        }
+        finally { if (e_1) throw e_1.error; }
+    }
+    var out = new Uint8Array(total);
+    var offset = 0;
+    try {
+        for (var chunks_2 = __values(chunks), chunks_2_1 = chunks_2.next(); !chunks_2_1.done; chunks_2_1 = chunks_2.next()) {
+            var c = chunks_2_1.value;
+            out.set(c, offset);
+            offset += c.byteLength;
+        }
+    }
+    catch (e_2_1) { e_2 = { error: e_2_1 }; }
+    finally {
+        try {
+            if (chunks_2_1 && !chunks_2_1.done && (_b = chunks_2.return)) _b.call(chunks_2);
+        }
+        finally { if (e_2) throw e_2.error; }
+    }
+    return out;
+}

package/src/encryption/crypto-primitives.d.ts

@@ -0,0 +1,74 @@
+/** Hash algorithm names as in EncryptionInfo XML ([MS-OFFCRYPTO] §2.3.4.10). */
+export declare type AgileHashName = 'SHA-1' | 'SHA256' | 'SHA384' | 'SHA512';
+/**
+ * Maps OFFCRYPTO hashAlgorithm attribute to an internal name.
+ *
+ * @throws {UnsupportedEncryptionError} When the algorithm is not in the v1 set.
+ */
+export declare function resolveHashAlgorithm(name: string): AgileHashName;
+/**
+ * Validates cipherAlgorithm + cipherChaining for v1 (AES + CBC only).
+ *
+ * @throws {UnsupportedEncryptionError} When not AES/CBC.
+ */
+export declare function assertSupportedCipher(cipherAlgorithm: string, cipherChaining: string): void;
+/**
+ * Validates AES keyBits (128 / 192 / 256).
+ *
+ * @throws {UnsupportedEncryptionError} When key length is not a supported AES size.
+ */
+export declare function assertAesKeyBits(keyBits: number): void;
+/** Digest length in bytes for a resolved hash algorithm. */
+export declare function hashDigestLength(hash: AgileHashName): number;
+/** One-shot hash. */
+export declare function hashBytes(hash: AgileHashName, data: Uint8Array): Uint8Array;
+/** HMAC over message with key (DataIntegrity §2.3.4.14). */
+export declare function hmacBytes(hash: AgileHashName, key: Uint8Array, message: Uint8Array): Uint8Array;
+/**
+ * Concatenates byte arrays.
+ *
+ * @public
+ */
+export declare function concatBytes(...parts: Uint8Array[]): Uint8Array;
+/**
+ * Encodes a JavaScript string as UTF-16LE (Unicode password bytes, §2.3.4.11).
+ */
+export declare function encodePasswordUtf16Le(password: string): Uint8Array;
+/**
+ * Password-based encryption key (§2.3.4.11).
+ *
+ * H0 = H(salt + password); Hn = H(iterator LE u32 + Hn-1) for spinCount iterations;
+ * Hfinal = H(Hn + blockKey); pad/truncate to keyBits/8 with 0x36.
+ */
+export declare function deriveAgileKey(hash: AgileHashName, salt: Uint8Array, passwordUtf16Le: Uint8Array, spinCount: number, blockKey: Uint8Array, keyBits: number): Uint8Array;
+/**
+ * Initialization vector (§2.3.4.12).
+ *
+ * With blockKey: IV = H(keySalt + blockKey); without: IV = keySalt.
+ * Pad/truncate to blockSize with 0x36.
+ */
+export declare function deriveAgileIv(hash: AgileHashName, keySalt: Uint8Array, blockKey: Uint8Array | undefined, blockSize: number): Uint8Array;
+/**
+ * AES-CBC decrypt with zero padding (no PKCS #7 strip).
+ *
+ * @param key - AES key (16/24/32 bytes).
+ * @param iv - IV of blockSize bytes (AES block is 16; OFFCRYPTO blockSize is 16 for AES).
+ * @param ciphertext - Length MUST be a multiple of 16.
+ * @returns Plaintext of the same length as ciphertext (including zero pad).
+ */
+export declare function aesCbcDecrypt(key: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array): Uint8Array;
+/**
+ * AES-CBC encrypt with zero padding (no PKCS #7).
+ *
+ * @remarks
+ * Used by test fixture builders and host encrypt harnesses. Same zero-pad
+ * rules as decrypt ([MS-OFFCRYPTO] §2.3.4.13 / §2.3.4.15).
+ *
+ * @public
+ */
+export declare function aesCbcEncrypt(key: Uint8Array, iv: Uint8Array, plaintext: Uint8Array): Uint8Array;
+/**
+ * Constant-time comparison of two equal-length buffers.
+ * Returns false when lengths differ (not constant-time on length).
+ */
+export declare function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;