-
Only parts the inspector reads are listed. Each link goes to the ECMA-376 5th edition page that publishes the section defining it. Parts we do not understand still appear in the diagram, labelled as unhandled.
+
Only parts the inspector reads are listed. Each link goes to the ECMA-376 5th edition page. Parts we do not understand still appear in the diagram, labelled as unhandled.
| Part | What we read | Spec |
|---|
@@ -542,70 +506,20 @@
"use strict";
var SAMPLE_NAME = "Hale-engagement-letter.docx";
- var SAMPLE_NOTE = "Preloaded sample (sample.docx, a real .docx). It is fetched and unzipped by the same code as a file you drop — not a canned report.";
+ var SAMPLE_NOTE = "Preloaded sample, decoded from sample.b64 and unzipped by the same code as a file you drop — not a canned report.";
var ECMA = "https://ecma-international.org/publications-and-standards/standards/ecma-376/";
var PARTS = {
- "[Content_Types].xml": {
- title: "Content Types stream",
- spec: "ECMA-376 Part 2, §10.1.2",
- note: "Names the media type of every part. Office uses it to decide which XML vocabulary a part speaks. It is not itself a leak, but a missing or odd override is a sign the package was hand-edited.",
- send: "yes"
- },
- "docProps/core.xml": {
- title: "Core properties",
- spec: "ECMA-376 Part 2, §11.1",
- note: "Dublin Core metadata: title, creator, lastModifiedBy, revision, created and modified. This is the usual place a previous client's name or your own name survives a Save As.",
- send: "no"
- },
- "docProps/app.xml": {
- title: "Extended properties",
- spec: "ECMA-376 Part 1, §22.2",
- note: "Application, company, template name, and page or word counts. The template name often identifies the firm or the prior engagement the file was cloned from.",
- send: "careful"
- },
- "docProps/thumbnail.jpeg": {
- title: "Package thumbnail",
- spec: "ECMA-376 Part 2, thumbnail relationship",
- note: "A JPEG preview of the document, stored even when you never inserted an image. It can show a page you have since deleted, and its EXIF can name the author.",
- send: "no"
- },
- "word/document.xml": {
- title: "Main document part",
- spec: "ECMA-376 Part 1, §17.13",
- note: "The visible text, plus tracked insertions (w:ins), tracked deletions (w:del / w:delText) and comment markers. Accepting changes in Word is not the same as this XML being clean.",
- send: "careful"
- },
- "word/comments.xml": {
- title: "Comments part",
- spec: "ECMA-376 Part 1, §17.13.4",
- note: "Comment authors, timestamps and the comment text. Deleting a comment in the UI does not always remove this part.",
- send: "no"
- },
- "word/people.xml": {
- title: "People part",
- spec: "ECMA-376 people part",
- note: "Authors who have touched the document, sometimes with a provider user id or email. Easy to miss because Word never shows this file.",
- send: "no"
- },
- "word/styles.xml": {
- title: "Styles part",
- spec: "ECMA-376 Part 1, §17.7",
- note: "Paragraph and character styles. Rarely a direct leak; style names copied from a client template can still identify the source firm.",
- send: "yes"
- },
- "xl/workbook.xml": {
- title: "Workbook part",
- spec: "ECMA-376 Part 1, §18.2",
- note: "Sheet index. state=\"hidden\" or state=\"veryHidden\" marks a sheet the recipient will not see in the tab bar but can unhide.",
- send: "careful"
- },
- "ppt/presentation.xml": {
- title: "Presentation part",
- spec: "ECMA-376 Part 1, §19.2",
- note: "Slide list. show=\"0\" marks a hidden slide. Hidden is not deleted — the slide XML is still in the package.",
- send: "careful"
- }
+ "[Content_Types].xml": { title: "Content Types stream", spec: "ECMA-376 Part 2, §10.1.2", note: "Names the media type of every part. Office uses it to decide which XML vocabulary a part speaks. It is not itself a leak, but a missing or odd override is a sign the package was hand-edited.", send: "yes" },
+ "docProps/core.xml": { title: "Core properties", spec: "ECMA-376 Part 2, §11.1", note: "Dublin Core metadata: title, creator, lastModifiedBy, revision, created and modified. This is the usual place a previous client's name or your own name survives a Save As.", send: "no" },
+ "docProps/app.xml": { title: "Extended properties", spec: "ECMA-376 Part 1, §22.2", note: "Application, company, template name, and page or word counts. The template name often identifies the firm or the prior engagement the file was cloned from.", send: "careful" },
+ "docProps/thumbnail.jpeg": { title: "Package thumbnail", spec: "ECMA-376 Part 2, thumbnail relationship", note: "A JPEG preview of the document, stored even when you never inserted an image. It can show a page you have since deleted, and its EXIF can name the author.", send: "no" },
+ "word/document.xml": { title: "Main document part", spec: "ECMA-376 Part 1, §17.13", note: "The visible text, plus tracked insertions (w:ins), tracked deletions (w:del / w:delText) and comment markers. Accepting changes in Word is not the same as this XML being clean.", send: "careful" },
+ "word/comments.xml": { title: "Comments part", spec: "ECMA-376 Part 1, §17.13.4", note: "Comment authors, timestamps and the comment text. Deleting a comment in the UI does not always remove this part.", send: "no" },
+ "word/people.xml": { title: "People part", spec: "ECMA-376 people part", note: "Authors who have touched the document, sometimes with a provider user id or email. Easy to miss because Word never shows this file.", send: "no" },
+ "word/styles.xml": { title: "Styles part", spec: "ECMA-376 Part 1, §17.7", note: "Paragraph and character styles. Rarely a direct leak; style names copied from a client template can still identify the source firm.", send: "yes" },
+ "xl/workbook.xml": { title: "Workbook part", spec: "ECMA-376 Part 1, §18.2", note: "Sheet index. state=\"hidden\" or state=\"veryHidden\" marks a sheet the recipient will not see in the tab bar but can unhide.", send: "careful" },
+ "ppt/presentation.xml": { title: "Presentation part", spec: "ECMA-376 Part 1, §19.2", note: "Slide list. show=\"0\" marks a hidden slide. Hidden is not deleted — the slide XML is still in the package.", send: "careful" }
};
var treeEl = document.getElementById("tree");
@@ -620,17 +534,20 @@
var dropEl = document.getElementById("drop");
var fileEl = document.getElementById("file");
- function esc(s) {
- return String(s).replace(/&/g, "&").replace(//g, ">");
- }
+ function esc(s) { return String(s).replace(/&/g, "&").replace(//g, ">"); }
function u16(b, o) { return b[o] | (b[o + 1] << 8); }
function u32(b, o) { return (b[o] | (b[o + 1] << 8) | (b[o + 2] << 16) | (b[o + 3] << 24)) >>> 0; }
+ function b64ToBytes(b64) {
+ var bin = atob(b64.replace(/\s+/g, ""));
+ var out = new Uint8Array(bin.length);
+ for (var i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+ return out;
+ }
+
function findEocd(bytes) {
var start = Math.max(0, bytes.length - 22 - 65535);
- for (var i = bytes.length - 22; i >= start; i--) {
- if (u32(bytes, i) === 0x06054b50) return i;
- }
+ for (var i = bytes.length - 22; i >= start; i--) if (u32(bytes, i) === 0x06054b50) return i;
return -1;
}
@@ -642,9 +559,7 @@
var entries = [];
var p = cdOff;
for (var i = 0; i < count; i++) {
- if (p + 46 > bytes.length || u32(bytes, p) !== 0x02014b50) {
- throw new Error("Central directory is truncated or not a ZIP.");
- }
+ if (p + 46 > bytes.length || u32(bytes, p) !== 0x02014b50) throw new Error("Central directory is truncated or not a ZIP.");
var method = u16(bytes, p + 10);
var compSize = u32(bytes, p + 20);
var nameLen = u16(bytes, p + 28);
@@ -670,14 +585,11 @@
function readLocal(bytes, entry) {
var lp = entry.localOff;
- if (lp + 30 > bytes.length || u32(bytes, lp) !== 0x04034b50) {
- throw new Error("Local header missing for " + entry.name);
- }
+ if (lp + 30 > bytes.length || u32(bytes, lp) !== 0x04034b50) throw new Error("Local header missing for " + entry.name);
var method = u16(bytes, lp + 8);
var nlen = u16(bytes, lp + 26);
var elen = u16(bytes, lp + 28);
- var start = lp + 30 + nlen + elen;
- var comp = bytes.subarray(start, start + entry.compSize);
+ var comp = bytes.subarray(lp + 30 + nlen + elen, lp + 30 + nlen + elen + entry.compSize);
if (method === 0) return Promise.resolve(comp.slice());
if (method === 8) return inflateRaw(comp);
return Promise.reject(new Error(entry.name + " uses ZIP method " + method + ". Docscope only inflates stored (0) and deflate (8)."));
@@ -702,38 +614,28 @@
}
function asText(bytes) { return new TextDecoder("utf-8", { fatal: false }).decode(bytes); }
-
function parseXml(text) {
var doc = new DOMParser().parseFromString(text, "application/xml");
- if (doc.querySelector("parsererror")) return null;
- return doc;
+ return doc.querySelector("parsererror") ? null : doc;
}
-
function localName(el) { return el.localName || el.nodeName; }
-
function all(doc, name) {
if (!doc) return [];
- var out = [];
- var nodes = doc.getElementsByTagName("*");
+ var out = [], nodes = doc.getElementsByTagName("*");
for (var i = 0; i < nodes.length; i++) if (localName(nodes[i]) === name) out.push(nodes[i]);
return out;
}
-
function textOf(el) { return (el.textContent || "").replace(/\s+/g, " ").trim(); }
-
function attr(el, name) {
if (el.hasAttribute(name)) return el.getAttribute(name);
- var attrs = el.attributes;
- for (var i = 0; i < attrs.length; i++) {
- if (attrs[i].localName === name || attrs[i].name === name) return attrs[i].value;
+ for (var i = 0; i < el.attributes.length; i++) {
+ if (el.attributes[i].localName === name || el.attributes[i].name === name) return el.attributes[i].value;
}
return "";
}
-
function looksText(bytes) {
if (!bytes.length) return false;
- var n = Math.min(bytes.length, 800);
- var odd = 0;
+ var n = Math.min(bytes.length, 800), odd = 0;
for (var i = 0; i < n; i++) {
var c = bytes[i];
if (c === 0) return false;
@@ -741,13 +643,10 @@
}
return odd / n < 0.05;
}
-
function hexPreview(bytes) {
- var n = Math.min(bytes.length, 256);
- var lines = [];
+ var n = Math.min(bytes.length, 256), lines = [];
for (var i = 0; i < n; i += 16) {
- var hex = [];
- var asc = "";
+ var hex = [], asc = "";
for (var j = 0; j < 16 && i + j < n; j++) {
var c = bytes[i + j];
hex.push((c < 16 ? "0" : "") + c.toString(16));
@@ -769,15 +668,12 @@
if (marker === 0xd8 || marker === 0xd9) { o += 2; continue; }
var len = (bytes[o + 2] << 8) | bytes[o + 3];
if (len < 2 || o + 2 + len > bytes.length) break;
- if (marker === 0xe1 && asText(bytes.subarray(o + 4, o + 10)).indexOf("Exif") === 0) {
- tags = tags.concat(readTiff(bytes.subarray(o + 10, o + 2 + len)));
- }
+ if (marker === 0xe1 && asText(bytes.subarray(o + 4, o + 10)).indexOf("Exif") === 0) tags = tags.concat(readTiff(bytes.subarray(o + 10, o + 2 + len)));
o += 2 + len;
if (marker === 0xda) break;
}
return tags;
}
-
function readTiff(tiff) {
var out = [];
if (tiff.length < 8) return out;
@@ -786,9 +682,8 @@
if (!le && !be) return out;
function r16(off) { return le ? tiff[off] | (tiff[off + 1] << 8) : (tiff[off] << 8) | tiff[off + 1]; }
function r32(off) {
- return le
- ? (tiff[off] | (tiff[off + 1] << 8) | (tiff[off + 2] << 16) | (tiff[off + 3] << 24)) >>> 0
- : ((tiff[off] << 24) | (tiff[off + 1] << 16) | (tiff[off + 2] << 8) | tiff[off + 3]) >>> 0;
+ return le ? (tiff[off] | (tiff[off + 1] << 8) | (tiff[off + 2] << 16) | (tiff[off + 3] << 24)) >>> 0
+ : ((tiff[off] << 24) | (tiff[off + 1] << 16) | (tiff[off + 2] << 8) | tiff[off + 3]) >>> 0;
}
var names = { 0x010e: "ImageDescription", 0x010f: "Make", 0x0110: "Model", 0x0131: "Software", 0x0132: "DateTime", 0x013b: "Artist", 0x8298: "Copyright", 0x9003: "DateTimeOriginal" };
function walk(ifd, depth) {
@@ -797,9 +692,7 @@
for (var i = 0; i < n; i++) {
var e = ifd + 2 + i * 12;
if (e + 12 > tiff.length) break;
- var tag = r16(e);
- var typ = r16(e + 2);
- var count = r32(e + 4);
+ var tag = r16(e), typ = r16(e + 2), count = r32(e + 4);
if (typ === 2 && count > 1 && count < 400) {
var start = count <= 4 ? e + 8 : r32(e + 8);
if (start >= 0 && start + count <= tiff.length) {
@@ -816,7 +709,6 @@
walk(r32(4), 0);
return out;
}
-
function readPngText(bytes) {
var out = [];
if (bytes.length < 8 || bytes[0] !== 0x89 || bytes[1] !== 0x50) return out;
@@ -835,21 +727,18 @@
}
return out;
}
-
function partByName(parts, name) {
for (var i = 0; i < parts.length; i++) if (parts[i].name === name) return parts[i];
return null;
}
function analyze(pkg) {
- var findings = [];
- var flags = {};
+ var findings = [], flags = {};
function flag(name, sev) { if (!flags[name] || sev === "leak") flags[name] = sev; }
function add(sev, label, html, partName) {
- findings.push({ sev: sev, label: label, html: html, part: partName });
+ findings.push({ sev: sev, label: label, html: html });
if (partName) flag(partName, sev);
}
-
var core = partByName(pkg.parts, "docProps/core.xml");
if (core) {
var cdoc = parseXml(asText(core.bytes));
@@ -861,9 +750,7 @@
if (modifiedBy.length) add("leak", "Last modified by", "cp:lastModifiedBy is " + esc(modifiedBy.join(", ")) + "" + (modified.length ? " (" + esc(modified.join(", ")) + ")" : "") + ".", "docProps/core.xml");
if (title.length) add("info", "Title", "dc:title is “" + esc(title.join(" / ")) + "”.", "docProps/core.xml");
if (!creator.length && !modifiedBy.length) add("ok", "Core properties", "No creator or lastModifiedBy in docProps/core.xml.", "docProps/core.xml");
- } else {
- add("ok", "Core properties", "No docProps/core.xml in this package.");
- }
+ } else add("ok", "Core properties", "No docProps/core.xml in this package.");
var app = partByName(pkg.parts, "docProps/app.xml");
if (app) {
@@ -880,41 +767,26 @@
if (text.indexOf("<") === -1) return;
var doc = parseXml(text);
if (!doc) return;
- var ins = all(doc, "ins");
- var del = all(doc, "del");
+ var ins = all(doc, "ins"), del = all(doc, "del");
if (ins.length || del.length) {
var bits = [];
- ins.slice(0, 6).forEach(function (el) {
- bits.push("insertion by " + esc(attr(el, "author") || "unknown") + (textOf(el) ? ": “" + esc(textOf(el).slice(0, 140)) + "”" : ""));
- });
- del.slice(0, 6).forEach(function (el) {
- bits.push("deletion by " + esc(attr(el, "author") || "unknown") + (textOf(el) ? ": “" + esc(textOf(el).slice(0, 140)) + "”" : ""));
- });
+ ins.slice(0, 6).forEach(function (el) { bits.push("insertion by " + esc(attr(el, "author") || "unknown") + (textOf(el) ? ": “" + esc(textOf(el).slice(0, 140)) + "”" : "")); });
+ del.slice(0, 6).forEach(function (el) { bits.push("deletion by " + esc(attr(el, "author") || "unknown") + (textOf(el) ? ": “" + esc(textOf(el).slice(0, 140)) + "”" : "")); });
add("leak", "Tracked changes", ins.length + " insertion" + (ins.length === 1 ? "" : "s") + " (w:ins) and " + del.length + " deletion" + (del.length === 1 ? "" : "s") + " (w:del) still in " + esc(part.name) + ". " + bits.join("; ") + ".", part.name);
}
var comments = all(doc, "comment").filter(function (el) { return attr(el, "author") || textOf(el); });
if (comments.length && /comment/i.test(part.name)) {
- var lines = comments.slice(0, 8).map(function (el) {
+ add("leak", "Comments", comments.length + " comment" + (comments.length === 1 ? "" : "s") + " in " + esc(part.name) + ". " + comments.slice(0, 8).map(function (el) {
return esc(attr(el, "author") || "unknown") + ": “" + esc(textOf(el).slice(0, 160)) + "”";
- });
- add("leak", "Comments", comments.length + " comment" + (comments.length === 1 ? "" : "s") + " in " + esc(part.name) + ". " + lines.join(" · "), part.name);
+ }).join(" · "), part.name);
}
if (/people\.xml$/i.test(part.name)) {
var people = all(doc, "person");
- if (people.length) {
- add("leak", "People", people.length + " person record" + (people.length === 1 ? "" : "s") + " in people.xml: " + esc(people.map(function (el) { return attr(el, "author") || textOf(el); }).filter(Boolean).join(", ")) + ".", part.name);
- }
+ if (people.length) add("leak", "People", people.length + " person record" + (people.length === 1 ? "" : "s") + " in people.xml: " + esc(people.map(function (el) { return attr(el, "author") || textOf(el); }).filter(Boolean).join(", ")) + ".", part.name);
}
if (/workbook\.xml$/i.test(part.name)) {
- var hidden = all(doc, "sheet").filter(function (el) {
- var st = (attr(el, "state") || "").toLowerCase();
- return st === "hidden" || st === "veryhidden";
- });
- if (hidden.length) {
- add("leak", "Hidden sheets", hidden.map(function (el) {
- return esc(attr(el, "name") || "(unnamed)") + " (" + esc(attr(el, "state")) + ")";
- }).join(", ") + " — still in the workbook, just not on the tab bar.", part.name);
- }
+ var hidden = all(doc, "sheet").filter(function (el) { var st = (attr(el, "state") || "").toLowerCase(); return st === "hidden" || st === "veryhidden"; });
+ if (hidden.length) add("leak", "Hidden sheets", hidden.map(function (el) { return esc(attr(el, "name") || "(unnamed)") + " (" + esc(attr(el, "state")) + ")"; }).join(", ") + " — still in the workbook, just not on the tab bar.", part.name);
}
if (/presentation\.xml$/i.test(part.name)) {
var sld = all(doc, "sldId").filter(function (el) { return attr(el, "show") === "0"; });
@@ -925,9 +797,7 @@
pkg.parts.forEach(function (part) {
if (part.dir) return;
var lower = part.name.toLowerCase();
- if (/thumbnail/.test(lower)) {
- add("leak", "Thumbnail", "Embedded thumbnail preview at " + esc(part.name) + " (" + part.size + " bytes). Recipients can open it without Word.", part.name);
- }
+ if (/thumbnail/.test(lower)) add("leak", "Thumbnail", "Embedded thumbnail preview at " + esc(part.name) + " (" + part.size + " bytes). Recipients can open it without Word.", part.name);
if (/\.jpe?g$/.test(lower)) {
var exif = readExif(part.bytes);
if (exif.length) add("leak", "EXIF", esc(part.name) + " carries " + exif.map(function (t) { return esc(t.tag) + "=" + esc(t.value); }).join(", ") + ".", part.name);
@@ -937,7 +807,6 @@
if (pngText.length) add("warn", "PNG text", esc(part.name) + ": " + pngText.map(function (t) { return esc(t.key) + "=" + esc(t.value); }).join(", ") + ".", part.name);
}
});
-
if (!findings.some(function (f) { return f.sev === "leak"; })) {
add("ok", "No leak flags", "Nothing in the handled parts matched author names, tracked changes, comments, people, thumbnails, EXIF, PNG text, or hidden sheets/slides. Unhandled parts are still listed in the diagram.");
}
@@ -954,9 +823,8 @@
if (known) return known;
if (/\.rels$/i.test(part.name)) return { title: "Relationships part", spec: "ECMA-376 Part 2, §9.2", note: "Points from one part to another (styles, comments, images, the thumbnail). A thumbnail relationship here is how Explorer finds the preview.", send: "careful" };
if (/media\//i.test(part.name)) return { title: "Embedded media", spec: "ECMA-376 Part 1, §15.2.14", note: "A binary file stored inside the package. Images can carry EXIF or PNG text even when the slide looks clean.", send: "careful" };
- return { title: "Unhandled part", spec: "", note: "This page lists the part because it is in the ZIP central directory, but it does not interpret this vocabulary. The bytes are shown as-is.", send: "careful" };
+ return { title: "Unhandled part", spec: "", note: "Listed because it is in the ZIP central directory. This page does not interpret this vocabulary; the bytes are shown as-is.", send: "careful" };
}
-
function verdictLabel(send, flagged) {
if (flagged === "leak" || send === "no") return { cls: "no", text: "Not safe to send as-is" };
if (flagged === "warn" || send === "careful") return { cls: "careful", text: "Check before you send" };
@@ -990,18 +858,14 @@
treeEl.innerHTML = "" + pkg.parts.length + " central-directory entries, shown verbatim. Red marks a part the leak report cited.
" + walk(root);
var buttons = treeEl.querySelectorAll(".part");
for (var i = 0; i < buttons.length; i++) {
- buttons[i].addEventListener("click", function (ev) {
- showPart(pkg, flags, Number(ev.currentTarget.getAttribute("data-index")));
- });
+ buttons[i].addEventListener("click", function (ev) { showPart(pkg, flags, Number(ev.currentTarget.getAttribute("data-index"))); });
}
}
-
function renderReport(findings) {
reportEl.innerHTML = "" + findings.map(function (f) {
return "
" + esc(f.label) + "" + f.html + "
";
}).join("") + "