@bobfrankston/rmfmail 1.2.280 → 1.2.281

package/.commitmsg

@@ -1,19 +1,63 @@
-About: show the bundled editor version
-
-CORRECTION to 1.2.279. That release added the resolved tinymce / tinymce-i18n
-versions to build-tinymce.js's console output, on the claim that this put the
-answer in the build transcript every publish archives. It does not:
-npmglobalize swallows a sub-build's stdout and reports only "✓ Build
-succeeded", so the line never reaches c:\temp\rebuild\. The echo is still
-correct when the script is run directly, but the build log is not where this
-question gets answered.
-
-About… now carries an "Editor bundle" row — "TinyMCE 8.8.2 · 61 languages" —
-read at display time from client/lib/tinymce/package.json and langs/index.json,
-the same tree the editor loads from, so it cannot drift from what is actually
-running. That answers it on the machine showing the symptom, which is where it
-matters, rather than requiring a checkout of the matching tag.
-
-Why this keeps mattering: both specs are caret ranges, so the resolved version
-moves whenever npm re-resolves the tree — tinymce sat at 8.6.0 for weeks under
-a ^8.5.0 spec with nothing to notice.
+Say when a message is forged
+
+Two phishes arrived on 2026-08-25 and mailx rendered both without a word of
+warning ("this is an attack — could you do a better job of identifying it as
+bogus?"). They carried, in the message itself:
+
+  X-Spam-Flag: YES                       <- Bob's own server, score 6.7/4.5
+  Authentication-Results: ... spf=fail
+  From: bobip@bobf.frankston.com         <- his own alias, forged
+  Return-Path: <3EDTkWNvbY@visionsurveysqld.com.au>
+  <area coords="0,0,10000,10000" href="http://.../redirect.php?newurl=...">
+
+Not one of those headers was read anywhere in the codebase — no X-Spam-*, no
+Authentication-Results, nothing. The one impersonation check that existed
+(displayNameClaimsOtherAddress) needs a display name, and these had none. Worse,
+the card was a cid: image, so hasRemoteContent was false and even the
+remote-content banner stayed away: the message displayed clean.
+
+The whole visible card was one hidden link. sanitizeHtml stripped their forms
+and inputs and left <area> untouched, so the trap was live in the reader —
+every pixel of the picture pointed at an open redirector on a real French
+company's site, which forwarded to a throwaway host with the victim's own
+address base64'd into the fragment so the landing page could prefill it.
+
+packages/mailx-types/trust.ts — assessMessageTrust, four checks, all evidence
+rather than scoring:
+
+  server-spam-verdict   The receiving server already decided. Free, and it was
+                        being thrown away. Only a POSITIVE verdict is trusted:
+                        anyone can inject X-Spam-Flag: NO into mail they send,
+                        and honouring that would hand attackers an off switch.
+                        A forged YES only flags the forger.
+  self-spoof            From is one of your own addresses AND authentication
+                        explicitly failed. Either half alone is ordinary —
+                        people mail themselves notes, forwarded mail fails SPF.
+                        Together they are not. Own addresses come from the
+                        recipient allowlist plus Delivered-To, so an alias
+                        never added to the allowlist is still covered.
+  hidden-link-overlay   An <area> hotspot bigger than any real image. Runs on
+                        the RAW html, before the sanitizer disarms it.
+  redirector-link       A link whose query carries another absolute URL. Names
+                        the ENDPOINT — a reader can't URL-decode a query string.
+
+Deliberately absent: bare SPF failure on mail not claiming to be you.
+Forwarded mail fails SPF constantly, and flagging it would be the cry-wolf
+banner this is trying not to be. Ordinary mail returns nothing at all — no
+"looks fine" reassurance, which would be a claim this cannot support.
+
+sanitizeHtml now also disarms image maps outright (<map> and usemap=).
+Unconditional rather than size-gated: image maps have no legitimate use in
+mail, so there is no threshold to tune and nothing to slip past by choosing a
+smaller rectangle. The image still renders; only its hidden clickability goes,
+and the banner explains why it stopped responding.
+
+The banner is its own element above the body, not part of the remote-content
+one — the two are independent, as the cid: case proved — and it never
+collapses. A reader who must expand a dropdown to learn a message is forged has
+already been asked to trust it. Each finding shows its evidence so it can be
+checked rather than believed.
+
+tests/trust.test.ts pins both phishes and, as importantly, the negative cases:
+a self-sent note with no auth headers, SPF failure on mail not claiming to be
+you, a modest image map, a same-site return-path parameter, and ordinary mail.

package/client/android-bootstrap.bundle.js

@@ -2199,6 +2199,147 @@ var init_contact_rules = __esm({
   }
 });
 
+// packages/mailx-types/trust.js
+function header(lines, name) {
+  const want = name.toLowerCase();
+  for (const h of lines) {
+    if ((h.key || "").toLowerCase() !== want)
+      continue;
+    const colon = h.line.indexOf(":");
+    return colon < 0 ? "" : h.line.slice(colon + 1).trim();
+  }
+  return "";
+}
+function headerAll(lines, name) {
+  const want = name.toLowerCase();
+  const out = [];
+  for (const h of lines) {
+    if ((h.key || "").toLowerCase() !== want)
+      continue;
+    const colon = h.line.indexOf(":");
+    if (colon >= 0)
+      out.push(h.line.slice(colon + 1).trim());
+  }
+  return out;
+}
+function bare(addr) {
+  const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
+  return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
+}
+function serverSpamVerdict(lines) {
+  const flag = header(lines, "x-spam-flag");
+  const status = header(lines, "x-spam-status");
+  if (!/^yes/i.test(flag) && !/^yes/i.test(status))
+    return null;
+  const score = status.match(/score=([-\d.]+)/)?.[1];
+  const required = status.match(/required=([-\d.]+)/)?.[1];
+  return {
+    id: "server-spam-verdict",
+    severity: "danger",
+    text: "Your mail server classified this as spam before delivering it.",
+    detail: score && required ? `SpamAssassin score ${score}, threshold ${required}` : status || flag || "X-Spam-Flag: YES"
+  };
+}
+function selfSpoof(input) {
+  const from = bare(input.fromAddress);
+  if (!from)
+    return null;
+  const own = new Set(input.ownAddresses.map(bare).filter(Boolean));
+  if (!own.has(from))
+    return null;
+  const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+  const failed = [
+    /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
+    /\bdkim=(fail|permerror)\b/i.test(auth) ? "DKIM" : "",
+    /\bdmarc=(fail|permerror)\b/i.test(auth) ? "DMARC" : ""
+  ].filter(Boolean);
+  if (!failed.length)
+    return null;
+  const envelope = bare(header(input.headerLines, "return-path"));
+  const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
+  return {
+    id: "self-spoof",
+    severity: "danger",
+    text: `This claims to be from your own address, ${from}, but it did not come from your account.`,
+    detail: `${failed.join(" and ")} authentication failed${envelopeNote}`
+  };
+}
+function hiddenLinkOverlay(bodyHtml) {
+  for (const m of bodyHtml.matchAll(/<area\b[^>]*>/gi)) {
+    const tag = m[0];
+    const href = tag.match(/href\s*=\s*["']([^"']+)["']/i)?.[1];
+    if (!href)
+      continue;
+    const coords = (tag.match(/coords\s*=\s*["']([^"']+)["']/i)?.[1] || "").split(/[,\s]+/).map(Number).filter((n) => Number.isFinite(n));
+    if (coords.length < 4)
+      continue;
+    const width = Math.abs(coords[2] - coords[0]);
+    const height = Math.abs(coords[3] - coords[1]);
+    if (width < OVERLAY_MIN_EDGE_PX || height < OVERLAY_MIN_EDGE_PX)
+      continue;
+    let host = href;
+    try {
+      host = new URL(href).hostname;
+    } catch {
+    }
+    return {
+      id: "hidden-link-overlay",
+      severity: "danger",
+      text: "The picture in this message is one large hidden link \u2014 clicking anywhere on it goes to the same place.",
+      detail: `${width}x${height} clickable area over the image, pointing at ${host}`
+    };
+  }
+  return null;
+}
+function redirectorLink(bodyHtml) {
+  for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
+    let url;
+    try {
+      url = new URL(m[1]);
+    } catch {
+      continue;
+    }
+    if (!/^https?:$/.test(url.protocol))
+      continue;
+    for (const [, value] of url.searchParams) {
+      let target;
+      try {
+        target = new URL(value);
+      } catch {
+        continue;
+      }
+      if (!/^https?:$/.test(target.protocol))
+        continue;
+      if (target.hostname === url.hostname)
+        continue;
+      return {
+        id: "redirector-link",
+        severity: "caution",
+        text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
+        detail: `${url.hostname} -> ${target.hostname}`
+      };
+    }
+  }
+  return null;
+}
+function assessMessageTrust(input) {
+  const findings = [
+    serverSpamVerdict(input.headerLines),
+    selfSpoof(input),
+    hiddenLinkOverlay(input.bodyHtml || ""),
+    redirectorLink(input.bodyHtml || "")
+  ].filter(Boolean);
+  const rank = { danger: 0, caution: 1 };
+  return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
+}
+var OVERLAY_MIN_EDGE_PX;
+var init_trust = __esm({
+  "packages/mailx-types/trust.js"() {
+    "use strict";
+    OVERLAY_MIN_EDGE_PX = 2e3;
+  }
+});
+
 // packages/mailx-types/contacts-config.js
 function parseContactsConfig(raw) {
   if (!raw)
@@ -2570,6 +2711,7 @@ __export(mailx_types_exports, {
   addContactsDenylistEntry: () => addContactsDenylistEntry,
   addContactsPreferredEntry: () => addContactsPreferredEntry,
   answeredOf: () => answeredOf,
+  assessMessageTrust: () => assessMessageTrust,
   buildMimeMessage: () => buildMimeMessage,
   deletedOf: () => deletedOf,
   displayNameClaimsOtherAddress: () => displayNameClaimsOtherAddress,
@@ -2636,6 +2778,8 @@ function sanitizeHtml(html) {
   clean = clean.replace(/<select\b[^>]*>[\s\S]*?<\/select>/gi, "[blocked: select]");
   clean = clean.replace(/<button\b[^>]*>([\s\S]*?)<\/button>/gi, "$1");
   clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
+  clean = clean.replace(/<map\b[^>]*>[\s\S]*?<\/map>/gi, "");
+  clean = clean.replace(/\s+usemap\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "");
   return { html: clean, hasRemoteContent };
 }
 function encodeHeaderWord(text) {
@@ -3061,6 +3205,7 @@ var init_mailx_types = __esm({
   "packages/mailx-types/index.js"() {
     "use strict";
     init_contact_rules();
+    init_trust();
     init_contacts_config();
     init_groups();
     init_reminder_state();