search

RvanVeenendaal / Spreadsheet-Complexity-Analyser

This software (prototype) extracts values of Excel spreadsheet properties and calculates a tentative spreadsheet complexity assessment based on threshold values.
12 stars 0 forks source link

Use Apache POI POIFS VBAMacroReader for macro detection #12

Open RvanVeenendaal opened 5 years ago

RvanVeenendaal commented 5 years ago

Macro detection in the SCA is only tentative, because all we do is check is a VBA module is present. If present, there does not have to be a macro in there. Using the Apache POI POIFS VBAMacroReader could improve the certainty of the macro detection.

RvanVeenendaal commented 5 years ago

Am testing version with VBAMacroReader. Problem reading macros with VBAMacroReader is that any macro module is read as a macro, even if it does not contain code but only metadata as in _Attribute VB_Name = "Blad2" Investigating : Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}" Investigating : Attribute VB_GlobalNameSpace = False Investigating : Attribute VB_Creatable = False Investigating : Attribute VB_PredeclaredId = True Investigating : Attribute VB_Exposed = True Investigating : Attribute VB_TemplateDerived = False Investigating : Attribute VBCustomizable = True A possible solution is to look for macro module lines that don't start with the metadata key 'Attribute'. These lines are very likely to contain actual VBA code. Counting macro modules that hava those non-Attribute line contents seems to be an improvement. Further testing required.