@bobfrankston/rmfmail 1.2.280 → 1.2.282

package/.commitmsg

@@ -1,19 +1,62 @@
-About: show the bundled editor version
-
-CORRECTION to 1.2.279. That release added the resolved tinymce / tinymce-i18n
-versions to build-tinymce.js's console output, on the claim that this put the
-answer in the build transcript every publish archives. It does not:
-npmglobalize swallows a sub-build's stdout and reports only "✓ Build
-succeeded", so the line never reaches c:\temp\rebuild\. The echo is still
-correct when the script is run directly, but the build log is not where this
-question gets answered.
-
-About… now carries an "Editor bundle" row — "TinyMCE 8.8.2 · 61 languages" —
-read at display time from client/lib/tinymce/package.json and langs/index.json,
-the same tree the editor loads from, so it cannot drift from what is actually
-running. That answers it on the machine showing the symptom, which is where it
-matters, rather than requiring a checkout of the matching tag.
-
-Why this keeps mattering: both specs are caret ranges, so the resolved version
-moves whenever npm re-resolves the tree — tinymce sat at 8.6.0 for weeks under
-a ^8.5.0 spec with nothing to notice.
+Catch the spam that scores under the threshold
+
+A sextortion mail arrived that none of yesterday's checks caught ("yet this
+spam got through"). SpamAssassin scored it 2.7 against a 4.5 threshold and
+delivered it, so server-spam-verdict correctly stayed silent — the server said
+no. Three independent proofs of forgery were sitting in the message anyway.
+
+spf=none now counts as "not authenticated" for self-claimed mail, not just
+fail. bobf.frankston.com publishes no SPF record, so nothing sent as that
+domain can ever FAIL — only come back none. Treating none as neutral left the
+least-protected domain the least defended, which is backwards. Checked against
+the real store before changing it, 50,000 messages scanned:
+
+  From at one of Bob's domains          10,338
+    no Authentication-Results           10,034   <- his own mail, still ignored
+    spf=pass                               243   <- still ignored
+    spf=fail / softfail                     33
+    spf=none                                18   <- nearly all spam
+
+The 18 were "Settle your debt", "AAA Final notice", "McAfee Protection Plan
+Ended" and similar. Legitimate self-mail sits in the no-header group: it never
+crossed a trust boundary, so there is no Authentication-Results to read, and
+that case is untouched. An explicit spf/dkim/dmarc=pass still silences the
+check.
+
+relay-auth-mismatch — Bob's own catch: "note that the origin is different than
+the from domain in antiabuse and in source-auth".
+
+  From:          universe@bobf.frankston.com
+  X-Source-Auth: admin@calebjross.com
+  X-Source-Cap:  (base64) calebjro;calebjro;box2202.bluehost.com
+  Message-ID:    <...@calebjross.com>
+
+A Bluehost cPanel account belonging to an unrelated domain authenticated and
+sent mail wearing his address. That stamp is written by the RELAY, downstream
+of whoever submitted the message, so a forger cannot remove or edit it — which
+makes the disagreement about as close to proof as mail headers get. Compared at
+the registrable-domain level, since a host legitimately sending for a domain
+authenticates as some account AT that domain and the local part varies for
+ordinary reasons. Covers the cPanel/Exim, Postfix and Communigate spellings.
+
+zero-width-obfuscation — the body had ~1380 zero-width characters stuffed
+between letters, so "i regret to inform you" reached every word-matching filter
+as gibberish while rendering as clean prose. SpamAssassin saw it
+(UNICODE_OBFU_ZW_MANY) and still totalled only 2.7. Counted only BETWEEN TWO
+LATIN LETTERS, which is what obfuscation looks like and what the legitimate
+uses are not: an emoji ZWJ joins pictographs, Arabic and Indic ZWNJ sit between
+their own scripts' letters. The occurrence count guards against a stray
+character surviving a copy-paste; it is a sanity bound, not a sensitivity dial.
+
+The score itself is now always visible — a chip above the body reading "spam
+score 2.7 of 4.5" ("should we have a flag ... with the spam assassin number and
+a color code?"). Separate from the findings on purpose: a finding is an
+accusation and fires only on evidence, this is a measurement. Colour is a
+PROPORTION of the server's own threshold — red once flagged, amber past halfway
+to its line, quiet below — so it follows if the server's threshold changes
+rather than hardcoding a number. Viewer only for now; the message-list row
+would need the score stored at sync time.
+
+tests/trust.test.ts covers all three, and the negative cases with them: spf=pass
+and no-header both silent, a relay identity at the same organisation, an emoji
+ZWJ family sequence, and a stray zero-width character from a paste.

package/client/android-bootstrap.bundle.js

@@ -2199,6 +2199,215 @@ var init_contact_rules = __esm({
   }
 });
 
+// packages/mailx-types/trust.js
+function header(lines, name) {
+  const want = name.toLowerCase();
+  for (const h of lines) {
+    if ((h.key || "").toLowerCase() !== want)
+      continue;
+    const colon = h.line.indexOf(":");
+    return colon < 0 ? "" : h.line.slice(colon + 1).trim();
+  }
+  return "";
+}
+function headerAll(lines, name) {
+  const want = name.toLowerCase();
+  const out = [];
+  for (const h of lines) {
+    if ((h.key || "").toLowerCase() !== want)
+      continue;
+    const colon = h.line.indexOf(":");
+    if (colon >= 0)
+      out.push(h.line.slice(colon + 1).trim());
+  }
+  return out;
+}
+function bare(addr) {
+  const m = (addr || "").match(/[^\s<>,;]+@[^\s<>,;]+/);
+  return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
+}
+function serverSpamVerdict(lines) {
+  const flag = header(lines, "x-spam-flag");
+  const status = header(lines, "x-spam-status");
+  if (!/^yes/i.test(flag) && !/^yes/i.test(status))
+    return null;
+  const score = status.match(/score=([-\d.]+)/)?.[1];
+  const required = status.match(/required=([-\d.]+)/)?.[1];
+  return {
+    id: "server-spam-verdict",
+    severity: "danger",
+    text: "Your mail server classified this as spam before delivering it.",
+    detail: score && required ? `SpamAssassin score ${score}, threshold ${required}` : status || flag || "X-Spam-Flag: YES"
+  };
+}
+function selfSpoof(input) {
+  const from = bare(input.fromAddress);
+  if (!from)
+    return null;
+  const own = new Set(input.ownAddresses.map(bare).filter(Boolean));
+  if (!own.has(from))
+    return null;
+  const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+  if (!auth)
+    return null;
+  const failed = [
+    /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
+    /\bdkim=(fail|permerror)\b/i.test(auth) ? "DKIM" : "",
+    /\bdmarc=(fail|permerror)\b/i.test(auth) ? "DMARC" : ""
+  ].filter(Boolean);
+  if (!failed.length) {
+    if (/\b(spf|dkim|dmarc)=pass\b/i.test(auth))
+      return null;
+    const envelopeAddr = bare(header(input.headerLines, "return-path"));
+    const note = envelopeAddr && envelopeAddr !== from ? `; envelope sender ${envelopeAddr}` : "";
+    return {
+      id: "self-spoof",
+      severity: "danger",
+      text: `This claims to be from your own address, ${from}, and nothing proves it came from your account.`,
+      detail: `no SPF, DKIM or DMARC result to check against${note} \u2014 your domain publishes no SPF record, so forgery cannot be detected by the sending side`
+    };
+  }
+  const envelope = bare(header(input.headerLines, "return-path"));
+  const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
+  return {
+    id: "self-spoof",
+    severity: "danger",
+    text: `This claims to be from your own address, ${from}, but it did not come from your account.`,
+    detail: `${failed.join(" and ")} authentication failed${envelopeNote}`
+  };
+}
+function hiddenLinkOverlay(bodyHtml) {
+  for (const m of bodyHtml.matchAll(/<area\b[^>]*>/gi)) {
+    const tag = m[0];
+    const href = tag.match(/href\s*=\s*["']([^"']+)["']/i)?.[1];
+    if (!href)
+      continue;
+    const coords = (tag.match(/coords\s*=\s*["']([^"']+)["']/i)?.[1] || "").split(/[,\s]+/).map(Number).filter((n) => Number.isFinite(n));
+    if (coords.length < 4)
+      continue;
+    const width = Math.abs(coords[2] - coords[0]);
+    const height = Math.abs(coords[3] - coords[1]);
+    if (width < OVERLAY_MIN_EDGE_PX || height < OVERLAY_MIN_EDGE_PX)
+      continue;
+    let host = href;
+    try {
+      host = new URL(href).hostname;
+    } catch {
+    }
+    return {
+      id: "hidden-link-overlay",
+      severity: "danger",
+      text: "The picture in this message is one large hidden link \u2014 clicking anywhere on it goes to the same place.",
+      detail: `${width}x${height} clickable area over the image, pointing at ${host}`
+    };
+  }
+  return null;
+}
+function redirectorLink(bodyHtml) {
+  for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
+    let url;
+    try {
+      url = new URL(m[1]);
+    } catch {
+      continue;
+    }
+    if (!/^https?:$/.test(url.protocol))
+      continue;
+    for (const [, value] of url.searchParams) {
+      let target;
+      try {
+        target = new URL(value);
+      } catch {
+        continue;
+      }
+      if (!/^https?:$/.test(target.protocol))
+        continue;
+      if (target.hostname === url.hostname)
+        continue;
+      return {
+        id: "redirector-link",
+        severity: "caution",
+        text: `A link hides where it goes: it passes through ${url.hostname} and ends at ${target.hostname}.`,
+        detail: `${url.hostname} -> ${target.hostname}`
+      };
+    }
+  }
+  return null;
+}
+function assessMessageTrust(input) {
+  const findings = [
+    serverSpamVerdict(input.headerLines),
+    selfSpoof(input),
+    relayAuthMismatch(input),
+    zeroWidthObfuscation(input.bodyText || ""),
+    hiddenLinkOverlay(input.bodyHtml || ""),
+    redirectorLink(input.bodyHtml || "")
+  ].filter(Boolean);
+  const rank = { danger: 0, caution: 1 };
+  return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
+}
+function relayAuthMismatch(input) {
+  const from = bare(input.fromAddress);
+  const fromDomain = from.split("@")[1] || "";
+  if (!fromDomain)
+    return null;
+  for (const name of RELAY_IDENTITY_HEADERS) {
+    const stamped = bare(header(input.headerLines, name));
+    const stampedDomain = stamped.split("@")[1] || "";
+    if (!stampedDomain || stampedDomain === fromDomain)
+      continue;
+    if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain))
+      continue;
+    return {
+      id: "relay-auth-mismatch",
+      severity: "danger",
+      text: `The account that actually sent this belongs to someone else: ${stampedDomain}, not ${fromDomain}.`,
+      detail: `the sending server recorded ${stamped} as the authenticated sender, while the message claims to be from ${from}`
+    };
+  }
+  return null;
+}
+function zeroWidthObfuscation(bodyText) {
+  if (!bodyText)
+    return null;
+  const between = bodyText.match(/[A-Za-z][​‌‍][A-Za-z]/g);
+  const count = between ? between.length : 0;
+  if (count < ZERO_WIDTH_MIN_OCCURRENCES)
+    return null;
+  return {
+    id: "zero-width-obfuscation",
+    severity: "danger",
+    text: "The words in this message are stuffed with invisible characters to get past spam filters.",
+    detail: `${count} zero-width characters hidden inside words \u2014 legitimate mail has no reason to do this`
+  };
+}
+function spamScoreOf(headerLines) {
+  const status = header(headerLines, "x-spam-status");
+  if (!status)
+    return null;
+  const score = Number(status.match(/score=([-\d.]+)/)?.[1]);
+  const threshold = Number(status.match(/required=([-\d.]+)/)?.[1]);
+  if (!Number.isFinite(score) || !Number.isFinite(threshold))
+    return null;
+  return { score, threshold, flagged: /^yes/i.test(status) };
+}
+var OVERLAY_MIN_EDGE_PX, RELAY_IDENTITY_HEADERS, ZERO_WIDTH_MIN_OCCURRENCES;
+var init_trust = __esm({
+  "packages/mailx-types/trust.js"() {
+    "use strict";
+    OVERLAY_MIN_EDGE_PX = 2e3;
+    RELAY_IDENTITY_HEADERS = [
+      "x-source-auth",
+      // cPanel / Exim (Bluehost, HostGator, most shared hosts)
+      "x-authenticated-sender",
+      // Postfix / Communigate
+      "x-auth-id",
+      "x-authenticated-user"
+    ];
+    ZERO_WIDTH_MIN_OCCURRENCES = 12;
+  }
+});
+
 // packages/mailx-types/contacts-config.js
 function parseContactsConfig(raw) {
   if (!raw)
@@ -2570,6 +2779,7 @@ __export(mailx_types_exports, {
   addContactsDenylistEntry: () => addContactsDenylistEntry,
   addContactsPreferredEntry: () => addContactsPreferredEntry,
   answeredOf: () => answeredOf,
+  assessMessageTrust: () => assessMessageTrust,
   buildMimeMessage: () => buildMimeMessage,
   deletedOf: () => deletedOf,
   displayNameClaimsOtherAddress: () => displayNameClaimsOtherAddress,
@@ -2597,6 +2807,7 @@ __export(mailx_types_exports, {
   setDraft: () => setDraft,
   setFlagged: () => setFlagged,
   setSeen: () => setSeen,
+  spamScoreOf: () => spamScoreOf,
   splitRecipients: () => splitRecipients,
   toggleFlagged: () => toggleFlagged,
   toggleSeen: () => toggleSeen
@@ -2636,6 +2847,8 @@ function sanitizeHtml(html) {
   clean = clean.replace(/<select\b[^>]*>[\s\S]*?<\/select>/gi, "[blocked: select]");
   clean = clean.replace(/<button\b[^>]*>([\s\S]*?)<\/button>/gi, "$1");
   clean = clean.replace(/<iframe\b[^>]*>[\s\S]*?<\/iframe>/gi, "");
+  clean = clean.replace(/<map\b[^>]*>[\s\S]*?<\/map>/gi, "");
+  clean = clean.replace(/\s+usemap\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "");
   return { html: clean, hasRemoteContent };
 }
 function encodeHeaderWord(text) {
@@ -3061,6 +3274,7 @@ var init_mailx_types = __esm({
   "packages/mailx-types/index.js"() {
     "use strict";
     init_contact_rules();
+    init_trust();
     init_contacts_config();
     init_groups();
     init_reminder_state();