upload-safety 0.2.1 → 0.4.0

package/src/archive-content.ts

@@ -0,0 +1,306 @@
+/**
+ * Reads ZIP, TAR and gzip archives as containers and hands every regular file in them to a
+ * caller-supplied check. Anything the reader cannot follow exactly (links, devices, unsafe names,
+ * extensions it does not model, oversized content) fails closed as 'mismatch'.
+ */
+
+import { gunzipSync } from 'node:zlib';
+
+import {
+	hasEncryptedZipEntry, isSafeName, MAX_ZIP_ENTRIES, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES, MAX_ZIP_UNCOMPRESSED_BYTES,
+	readZipEntries, readZipEntryData
+} from './zip-entries.js';
+
+export type ArchiveVerdict = 'valid' | 'macros' | 'encrypted' | 'mismatch';
+
+/** Checks one file inside an archive by its name and bytes. */
+export type EntryCheck = ( name: string, bytes: Buffer ) => ArchiveVerdict;
+
+const BLOCK_SIZE = 512;
+const TAR_NAME_OFFSET = 0;
+const TAR_NAME_LENGTH = 100;
+const TAR_SIZE_OFFSET = 124;
+const TAR_SIZE_LENGTH = 12;
+const TAR_CHECKSUM_OFFSET = 148;
+const TAR_CHECKSUM_LENGTH = 8;
+const TAR_TYPE_OFFSET = 156;
+const TAR_MAGIC_OFFSET = 257;
+const TAR_PREFIX_OFFSET = 345;
+const TAR_PREFIX_LENGTH = 155;
+const TAR_MAGICS = [ Buffer.from( 'ustar\x0000', 'latin1' ), Buffer.from( 'ustar  \0', 'latin1' ) ];
+const TAR_MAGIC_LENGTH = 8;
+/** Longest pax header or GNU long name accepted; real paths are far shorter. */
+const MAX_TAR_NAME_DATA_BYTES = 64 * 1024;
+const OCTAL = /^[0-7]+$/;
+const PAX_RECORD_LENGTH = /^[1-9][0-9]*$/;
+
+const GZIP_MAGIC = [ 0x1f, 0x8b ];
+const GZIP_DEFLATE_METHOD = 8;
+const GZIP_FIXED_HEADER_SIZE = 10;
+const GZIP_FLAGS_OFFSET = 3;
+const GZIP_FHCRC = 0x02;
+const GZIP_FEXTRA = 0x04;
+const GZIP_FNAME = 0x08;
+const GZIP_FCOMMENT = 0x10;
+const GZIP_RESERVED_FLAGS = 0xe0;
+
+const APPLE_DOUBLE_MAGIC = Buffer.from( [ 0x00, 0x05, 0x16, 0x07 ] );
+const DS_STORE_MAGIC = Buffer.from( '\0\0\0\x01Bud1', 'latin1' );
+const APPLE_DOUBLE_DIRECTORY = '__MACOSX/';
+const APPLE_DOUBLE_PREFIX = '._';
+const DS_STORE_NAME = '.DS_Store';
+
+function baseName( name: string ): string {
+	return name.slice( name.search( /[^/\\]*$/ ) );
+}
+
+/** Whether a file is the macOS metadata Finder adds to archives and its bytes really are that metadata. */
+function isMacJunk( name: string, bytes: Buffer ): boolean {
+	const base = baseName( name );
+	if ( base === DS_STORE_NAME ) {
+		return bytes.subarray( 0, DS_STORE_MAGIC.length ).equals( DS_STORE_MAGIC );
+	}
+	return name.startsWith( APPLE_DOUBLE_DIRECTORY ) && base.startsWith( APPLE_DOUBLE_PREFIX ) &&
+		bytes.subarray( 0, APPLE_DOUBLE_MAGIC.length ).equals( APPLE_DOUBLE_MAGIC );
+}
+
+/** Checks files one at a time, remembering whether any real file was seen and the first failure. */
+class EntryRunner {
+	files = 0;
+
+	constructor( private readonly checkEntry: EntryCheck ) {}
+
+	/** The verdict for one file, or null while the archive may still pass. */
+	run( name: string, bytes: Buffer ): ArchiveVerdict | null {
+		if ( isMacJunk( name, bytes ) ) {
+			return null;
+		}
+		this.files++;
+		const verdict = this.checkEntry( name, bytes );
+		return verdict === 'valid' ? null : verdict;
+	}
+
+	/** The final verdict once every file has been run. */
+	finish(): ArchiveVerdict {
+		return this.files > 0 ? 'valid' : 'mismatch';
+	}
+}
+
+/** Checks every regular file of a ZIP archive; password-protected entries give 'encrypted'. */
+export function inspectZipArchive( content: Buffer, checkEntry: EntryCheck ): ArchiveVerdict {
+	const entries = readZipEntries( content );
+	if ( ! entries ) {
+		return hasEncryptedZipEntry( content ) ? 'encrypted' : 'mismatch';
+	}
+
+	const runner = new EntryRunner( checkEntry );
+	let budget = MAX_ZIP_UNCOMPRESSED_BYTES;
+	for ( const entry of entries ) {
+		if ( entry.symlink ) {
+			return 'mismatch';
+		}
+		if ( entry.name.endsWith( '/' ) ) {
+			continue;
+		}
+		const bytes = readZipEntryData( content, entry, Math.min( budget, MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES ) );
+		if ( ! bytes ) {
+			return 'mismatch';
+		}
+		budget -= bytes.length;
+		const verdict = runner.run( entry.name, bytes );
+		if ( verdict ) {
+			return verdict;
+		}
+	}
+	return runner.finish();
+}
+
+function isZeroBlock( block: Buffer ): boolean {
+	return block.every( ( byte ) => byte === 0 );
+}
+
+/** The text up to the first NUL. */
+function cString( bytes: Buffer ): string {
+	const end = bytes.indexOf( 0 );
+	return bytes.toString( 'utf8', 0, end < 0 ? bytes.length : end );
+}
+
+/** A number in a tar header field, or null unless it is plain octal (base-256 is not supported). */
+function parseOctal( field: Buffer ): number | null {
+	const text = field.toString( 'latin1' ).replace( /^ +/, '' ).replace( /[\0 ]+$/, '' );
+	return OCTAL.test( text ) ? parseInt( text, 8 ) : null;
+}
+
+function hasValidChecksum( header: Buffer ): boolean {
+	const stored = parseOctal( header.subarray( TAR_CHECKSUM_OFFSET, TAR_CHECKSUM_OFFSET + TAR_CHECKSUM_LENGTH ) );
+	if ( stored === null ) {
+		return false;
+	}
+	let unsigned = 0;
+	let signed = 0;
+	for ( let index = 0; index < BLOCK_SIZE; index++ ) {
+		const inChecksum = index >= TAR_CHECKSUM_OFFSET && index < TAR_CHECKSUM_OFFSET + TAR_CHECKSUM_LENGTH;
+		const byte = inChecksum ? 0x20 : header[ index ];
+		unsigned += byte;
+		signed += byte > 127 ? byte - 256 : byte;
+	}
+	return stored === unsigned || stored === signed;
+}
+
+function hasTarMagic( header: Buffer ): boolean {
+	const magic = header.subarray( TAR_MAGIC_OFFSET, TAR_MAGIC_OFFSET + TAR_MAGIC_LENGTH );
+	return TAR_MAGICS.some( ( expected ) => expected.equals( magic ) );
+}
+
+/**
+ * The `path` of a pax extended header (`<length> <key>=<value>\n` records), '' when it has none,
+ * or null when the header is malformed or sets something this reader does not model.
+ */
+function parsePaxPath( data: Buffer ): string | null {
+	let path = '';
+	let position = 0;
+	while ( position < data.length ) {
+		const space = data.indexOf( 0x20, position );
+		const lengthText = space < 0 ? '' : data.toString( 'latin1', position, space );
+		if ( ! PAX_RECORD_LENGTH.test( lengthText ) ) {
+			return null;
+		}
+		const end = position + Number( lengthText );
+		if ( end > data.length || end <= space + 1 || data[ end - 1 ] !== 0x0a ) {
+			return null;
+		}
+		const record = data.toString( 'utf8', space + 1, end - 1 );
+		const equals = record.indexOf( '=' );
+		if ( equals < 0 ) {
+			return null;
+		}
+		const key = record.slice( 0, equals );
+		// A pax size would change where the next header starts.
+		if ( key === 'size' ) {
+			return null;
+		}
+		if ( key === 'path' ) {
+			path = record.slice( equals + 1 );
+		}
+		position = end;
+	}
+	return path;
+}
+
+/** Checks every regular file of a tar archive. */
+export function inspectTarArchive( content: Buffer, checkEntry: EntryCheck ): ArchiveVerdict {
+	const runner = new EntryRunner( checkEntry );
+	let position = 0;
+	let headers = 0;
+	let totalBytes = 0;
+	let nextName: string | null = null;
+	for ( ;; ) {
+		if ( position === content.length ) {
+			return nextName === null ? runner.finish() : 'mismatch';
+		}
+		const header = content.subarray( position, position + BLOCK_SIZE );
+		if ( header.length < BLOCK_SIZE ) {
+			return 'mismatch';
+		}
+		if ( isZeroBlock( header ) ) {
+			// Nothing but padding may follow the end marker.
+			return nextName === null && content.subarray( position ).every( ( byte ) => byte === 0 ) ? runner.finish() : 'mismatch';
+		}
+		if ( ++headers > MAX_ZIP_ENTRIES || ! hasTarMagic( header ) || ! hasValidChecksum( header ) ) {
+			return 'mismatch';
+		}
+
+		const size = parseOctal( header.subarray( TAR_SIZE_OFFSET, TAR_SIZE_OFFSET + TAR_SIZE_LENGTH ) );
+		const type = String.fromCharCode( header[ TAR_TYPE_OFFSET ] );
+		const dataStart = position + BLOCK_SIZE;
+		const next = dataStart + Math.ceil( ( size ?? 0 ) / BLOCK_SIZE ) * BLOCK_SIZE;
+		if ( size === null || size > MAX_ZIP_ENTRY_UNCOMPRESSED_BYTES || next > content.length ) {
+			return 'mismatch';
+		}
+		const data = content.subarray( dataStart, dataStart + size );
+		position = next;
+
+		if ( type === 'g' ) {
+			continue;
+		}
+		if ( type === 'x' || type === 'L' ) {
+			const name = type === 'x' ? parsePaxPath( data ) : cString( data );
+			if ( name === null || size > MAX_TAR_NAME_DATA_BYTES ) {
+				return 'mismatch';
+			}
+			// An empty pax path leaves a pending long name in force.
+			nextName = name || nextName;
+			continue;
+		}
+
+		const prefix = cString( header.subarray( TAR_PREFIX_OFFSET, TAR_PREFIX_OFFSET + TAR_PREFIX_LENGTH ) );
+		const ownName = cString( header.subarray( TAR_NAME_OFFSET, TAR_NAME_OFFSET + TAR_NAME_LENGTH ) );
+		const name = nextName ?? ( prefix ? `${ prefix }/${ ownName }` : ownName );
+		nextName = null;
+		const isDirectory = type === '5' || ( ( type === '0' || type === '\0' ) && name.endsWith( '/' ) && size === 0 );
+		if ( ! isSafeName( name ) ) {
+			return 'mismatch';
+		}
+		if ( isDirectory ) {
+			continue;
+		}
+		if ( type !== '0' && type !== '\0' ) {
+			return 'mismatch';
+		}
+		totalBytes += size;
+		if ( totalBytes > MAX_ZIP_UNCOMPRESSED_BYTES ) {
+			return 'mismatch';
+		}
+		const verdict = runner.run( name, data );
+		if ( verdict ) {
+			return verdict;
+		}
+	}
+}
+
+/** The FNAME of a gzip header, '' when it has none, or null when the header is malformed. */
+function readGzipName( content: Buffer ): string | null {
+	if ( content.length < GZIP_FIXED_HEADER_SIZE || content[ 0 ] !== GZIP_MAGIC[ 0 ] || content[ 1 ] !== GZIP_MAGIC[ 1 ] ||
+		content[ 2 ] !== GZIP_DEFLATE_METHOD ) {
+		return null;
+	}
+	const flags = content[ GZIP_FLAGS_OFFSET ];
+	if ( flags & GZIP_RESERVED_FLAGS ) {
+		return null;
+	}
+	let position = GZIP_FIXED_HEADER_SIZE;
+	if ( flags & GZIP_FEXTRA ) {
+		if ( position + 2 > content.length ) {
+			return null;
+		}
+		position += 2 + content.readUInt16LE( position );
+	}
+	if ( ! ( flags & GZIP_FNAME ) ) {
+		return '';
+	}
+	const end = content.indexOf( 0, position );
+	return position <= end ? content.toString( 'latin1', position, end ) : null;
+}
+
+/** Checks the contents of a gzip file: `tarOnly` for .tgz, else a .gz holding a tar or a single file named in its header. */
+export function inspectGzip( content: Buffer, checkEntry: EntryCheck, tarOnly: boolean ): ArchiveVerdict {
+	const name = readGzipName( content );
+	if ( name === null ) {
+		return 'mismatch';
+	}
+	let data: Buffer;
+	try {
+		data = gunzipSync( content, { maxOutputLength: MAX_ZIP_UNCOMPRESSED_BYTES } );
+	} catch {
+		return 'mismatch';
+	}
+
+	if ( data.length >= BLOCK_SIZE && hasTarMagic( data.subarray( 0, BLOCK_SIZE ) ) ) {
+		return inspectTarArchive( data, checkEntry );
+	}
+	const file = baseName( name );
+	if ( tarOnly || ! file || ! isSafeName( file ) ) {
+		return 'mismatch';
+	}
+	return checkEntry( file, data );
+}

package/src/asf-media.ts

@@ -0,0 +1,184 @@
+/**
+ * Checks the structure of WMA and WMV files (Microsoft ASF) and removes their metadata (title,
+ * author, WM/ tags, cover pictures) without moving a byte. The metadata objects are overwritten
+ * in place with Padding Objects of the same size and a zeroed payload.
+ *
+ * Refused: a Script Command Object makes Windows Media Player open URLs, and the DRM objects
+ * carry license acquisition URLs that it opens too (Trojan.Wimad); DRM content cannot be checked
+ * either.
+ *
+ * Limitation: markers, the file creation date and the codec data are kept.
+ */
+
+/** Bounds far above real files that keep a crafted one cheap. */
+const MAX_TOP_LEVEL_OBJECTS = 1000;
+const MAX_HEADER_OBJECTS = 10_000;
+
+const GUID_LENGTH = 16;
+const OBJECT_HEADER = GUID_LENGTH + 8;
+/** Header Object: object header, u32 number of objects, two reserved bytes. */
+const HEADER_OBJECT_PREFIX = OBJECT_HEADER + 6;
+/** Header Extension payload: reserved GUID, u16 reserved, u32 data size. */
+const EXTENSION_PREFIX = GUID_LENGTH + 2 + 4;
+
+/** Converts the textual GUID of the ASF specification to its on-disk byte order (first three groups little-endian). */
+function guid( text: string ): Buffer {
+	const hex = text.replaceAll( '-', '' );
+	const bytes = Buffer.from( hex, 'hex' );
+	bytes.subarray( 0, 4 ).reverse();
+	bytes.subarray( 4, 6 ).reverse();
+	bytes.subarray( 6, 8 ).reverse();
+	return bytes;
+}
+
+const HEADER_OBJECT = guid( '75B22630-668E-11CF-A6D9-00AA0062CE6C' );
+const DATA_OBJECT = guid( '75B22636-668E-11CF-A6D9-00AA0062CE6C' );
+const FILE_PROPERTIES_OBJECT = guid( '8CABDCA1-A947-11CF-8EE4-00C00C205365' );
+const STREAM_PROPERTIES_OBJECT = guid( 'B7DC0791-A9B7-11CF-8EE6-00C00C205365' );
+const HEADER_EXTENSION_OBJECT = guid( '5FBF03B5-A92E-11CF-8EE3-00C00C205365' );
+const CONTENT_DESCRIPTION_OBJECT = guid( '75B22633-668E-11CF-A6D9-00AA0062CE6C' );
+const EXTENDED_CONTENT_DESCRIPTION_OBJECT = guid( 'D2D0A440-E307-11D2-97F0-00A0C95EA850' );
+const METADATA_OBJECT = guid( 'C5F8CBEA-5BAF-4877-8467-AA8C44FA4CCA' );
+const METADATA_LIBRARY_OBJECT = guid( '44231C94-9498-49D1-A141-1D134E457054' );
+const PADDING_OBJECT = guid( '1806D474-CADF-4509-A4BA-9AABCB96AAE8' );
+const SCRIPT_COMMAND_OBJECT = guid( '1EFB1A30-0B62-11D0-A39B-00A0C90348F6' );
+const AUDIO_MEDIA = guid( 'F8699E40-5B4D-11CF-A8FD-00805F5C442B' );
+const VIDEO_MEDIA = guid( 'BC19EFC0-5B4D-11CF-A8FD-00805F5C442B' );
+
+const SIMPLE_INDEX_OBJECT = guid( '33000890-E5B1-11CF-89F4-00A0C90349CB' );
+const INDEX_OBJECT = guid( 'D6E229D3-35DA-11D1-9034-00A0C90349BE' );
+const MEDIA_OBJECT_INDEX_OBJECT = guid( 'FEB103F8-12AD-4C64-840F-2A1D2F7AD48C' );
+const TIMECODE_INDEX_OBJECT = guid( '3CB73FD0-0C4A-4803-953D-EDF7B6228F0C' );
+
+/** The only top-level objects after the Data Object. */
+const INDEX_OBJECTS: readonly Buffer[] = [ SIMPLE_INDEX_OBJECT, INDEX_OBJECT, MEDIA_OBJECT_INDEX_OBJECT, TIMECODE_INDEX_OBJECT ];
+
+const CONTENT_ENCRYPTION_OBJECT = guid( '2211B3FB-BD23-11D2-B4B7-00A0C955FC6E' );
+const EXTENDED_CONTENT_ENCRYPTION_OBJECT = guid( '298AE614-2622-4C17-B935-DAE07EE9289C' );
+const DIGITAL_SIGNATURE_OBJECT = guid( '2211B3FC-BD23-11D2-B4B7-00A0C955FC6E' );
+const ADVANCED_CONTENT_ENCRYPTION_OBJECT = guid( '43058533-6981-49E6-9B74-AD12CB86D58C' );
+
+const ENCRYPTION_OBJECTS: readonly Buffer[] = [
+	CONTENT_ENCRYPTION_OBJECT,
+	EXTENDED_CONTENT_ENCRYPTION_OBJECT,
+	DIGITAL_SIGNATURE_OBJECT,
+	ADVANCED_CONTENT_ENCRYPTION_OBJECT,
+];
+const METADATA_OBJECTS: readonly Buffer[] = [
+	CONTENT_DESCRIPTION_OBJECT,
+	EXTENDED_CONTENT_DESCRIPTION_OBJECT,
+	METADATA_OBJECT,
+	METADATA_LIBRARY_OBJECT,
+];
+
+export interface AsfInspection {
+	verdict: 'valid' | 'macros' | 'encrypted' | 'mismatch';
+	/** The cleaned file when the verdict is `valid` (the input itself when nothing changed), else null. */
+	bytes: Buffer | null;
+}
+
+interface AsfObject {
+	/** Where the object's header starts. */
+	start: number;
+	end: number;
+}
+
+const MISMATCH: AsfInspection = { verdict: 'mismatch', bytes: null };
+
+const hasGuid = ( bytes: Buffer, offset: number, expected: Buffer ): boolean => bytes.compare( expected, 0, GUID_LENGTH, offset, offset + GUID_LENGTH ) === 0;
+const isOneOf = ( bytes: Buffer, offset: number, guids: readonly Buffer[] ): boolean => guids.some( ( expected ) => hasGuid( bytes, offset, expected ) );
+
+/** The objects that follow each other exactly over `[start, end)`, or null when one does not read or there are more than `max`. */
+function readObjects( bytes: Buffer, start: number, end: number, max: number ): AsfObject[] | null {
+	const objects: AsfObject[] = [];
+	for ( let offset = start; offset < end; ) {
+		if ( objects.length === max || end - offset < OBJECT_HEADER ) {
+			return null;
+		}
+		const size = bytes.readBigUInt64LE( offset + GUID_LENGTH );
+		if ( size < BigInt( OBJECT_HEADER ) || size > BigInt( end - offset ) ) {
+			return null;
+		}
+		objects.push( { start: offset, end: offset + Number( size ) } );
+		offset += Number( size );
+	}
+	return objects;
+}
+
+/**
+ * Checks an ASF file as a WMA (`video` false) or WMV (`video` true) and blanks its metadata.
+ * Never throws.
+ */
+export function inspectAsf( content: Buffer, video: boolean ): AsfInspection {
+	const top = readObjects( content, 0, content.length, MAX_TOP_LEVEL_OBJECTS );
+	if ( ! top || top.length < 2 || ! hasGuid( content, top[ 0 ].start, HEADER_OBJECT ) ) {
+		return MISMATCH;
+	}
+	const [ header, ...rest ] = top;
+	if ( header.end - header.start < HEADER_OBJECT_PREFIX || content.readUInt16BE( header.start + OBJECT_HEADER + 4 ) !== 0x0102 ) {
+		return MISMATCH;
+	}
+	if ( ! hasGuid( content, rest[ 0 ].start, DATA_OBJECT ) || ! rest.slice( 1 ).every( ( object ) => isOneOf( content, object.start, INDEX_OBJECTS ) ) ) {
+		return MISMATCH;
+	}
+
+	const children = readObjects( content, header.start + HEADER_OBJECT_PREFIX, header.end, MAX_HEADER_OBJECTS );
+	if ( ! children ) {
+		return MISMATCH;
+	}
+	const budget = { left: MAX_HEADER_OBJECTS - children.length };
+	const all: AsfObject[] = [];
+	for ( const child of children ) {
+		all.push( child );
+		if ( hasGuid( content, child.start, HEADER_EXTENSION_OBJECT ) ) {
+			const prefixEnd = child.start + OBJECT_HEADER + EXTENSION_PREFIX;
+			if ( prefixEnd > child.end || content.readUInt32LE( prefixEnd - 4 ) !== child.end - prefixEnd ) {
+				return MISMATCH;
+			}
+			const inner = readObjects( content, prefixEnd, child.end, Math.max( budget.left, 0 ) );
+			if ( ! inner ) {
+				return MISMATCH;
+			}
+			budget.left -= inner.length;
+			all.push( ...inner );
+		}
+	}
+
+	let hasFileProperties = false;
+	let hasAudio = false;
+	let hasVideo = false;
+	for ( const object of all ) {
+		if ( isOneOf( content, object.start, ENCRYPTION_OBJECTS ) ) {
+			return { verdict: 'encrypted', bytes: null };
+		}
+		if ( hasGuid( content, object.start, SCRIPT_COMMAND_OBJECT ) ) {
+			return { verdict: 'macros', bytes: null };
+		}
+	}
+	for ( const object of all ) {
+		if ( hasGuid( content, object.start, FILE_PROPERTIES_OBJECT ) ) {
+			hasFileProperties = true;
+		} else if ( hasGuid( content, object.start, STREAM_PROPERTIES_OBJECT ) ) {
+			if ( object.end - object.start < OBJECT_HEADER + GUID_LENGTH ) {
+				return MISMATCH;
+			}
+			const type = object.start + OBJECT_HEADER;
+			hasAudio ||= hasGuid( content, type, AUDIO_MEDIA );
+			hasVideo ||= hasGuid( content, type, VIDEO_MEDIA );
+		}
+	}
+	if ( ! hasFileProperties || ! ( video ? hasVideo : hasAudio && ! hasVideo ) ) {
+		return MISMATCH;
+	}
+
+	const metadata = all.filter( ( object ) => isOneOf( content, object.start, METADATA_OBJECTS ) );
+	if ( metadata.length === 0 ) {
+		return { verdict: 'valid', bytes: content };
+	}
+	const cleaned = Buffer.from( content );
+	for ( const object of metadata ) {
+		PADDING_OBJECT.copy( cleaned, object.start );
+		cleaned.fill( 0, object.start + OBJECT_HEADER, object.end );
+	}
+	return { verdict: 'valid', bytes: cleaned };
+}

package/src/check-upload.ts

@@ -36,7 +36,7 @@ export function checkUpload( { filename, mimeType, bytes }: UploadInput, options
 		return descriptor;
 	}
 	const { extension, sanitizedFilename } = descriptor;
-	const verdict = inspectFileContent( extension, bytes );
+	const verdict = inspectFileContent( extension, bytes, options.allowedExtensions );
 	if ( verdict === 'macros' || verdict === 'encrypted' ) {
 		return { ok: false, reason: verdict };
 	}

package/src/heif-metadata.ts

@@ -5,7 +5,7 @@
  * `irot` and `imir` properties, which stay. Image sequences (`moov`) are refused.
  */
 
-interface Box {
+export interface Box {
 	type: string;
 	/** Where the box's content starts, past its header. */
 	start: number;
@@ -22,7 +22,7 @@ const EMPTY_EXIF = Buffer.from( '00000000' + '4d4d002a00000008' + '0000' + '0000
 const SPACE = 0x20;
 
 /** The boxes in `[start, end)`, or null when one runs past it or there are too many. */
-function readBoxes( bytes: Buffer, start: number, end: number ): Box[] | null {
+export function readBoxes( bytes: Buffer, start: number, end: number ): Box[] | null {
 	const boxes: Box[] = [];
 	for ( let offset = start; offset < end; ) {
 		if ( offset + 8 > end || boxes.length === MAX_BOXES ) {