@bobfrankston/rmfmail 1.2.281 → 1.2.282

package/.commitmsg

@@ -1,63 +1,62 @@
-Say when a message is forged
-
-Two phishes arrived on 2026-08-25 and mailx rendered both without a word of
-warning ("this is an attack — could you do a better job of identifying it as
-bogus?"). They carried, in the message itself:
-
-  X-Spam-Flag: YES                       <- Bob's own server, score 6.7/4.5
-  Authentication-Results: ... spf=fail
-  From: bobip@bobf.frankston.com         <- his own alias, forged
-  Return-Path: <3EDTkWNvbY@visionsurveysqld.com.au>
-  <area coords="0,0,10000,10000" href="http://.../redirect.php?newurl=...">
-
-Not one of those headers was read anywhere in the codebase — no X-Spam-*, no
-Authentication-Results, nothing. The one impersonation check that existed
-(displayNameClaimsOtherAddress) needs a display name, and these had none. Worse,
-the card was a cid: image, so hasRemoteContent was false and even the
-remote-content banner stayed away: the message displayed clean.
-
-The whole visible card was one hidden link. sanitizeHtml stripped their forms
-and inputs and left <area> untouched, so the trap was live in the reader —
-every pixel of the picture pointed at an open redirector on a real French
-company's site, which forwarded to a throwaway host with the victim's own
-address base64'd into the fragment so the landing page could prefill it.
-
-packages/mailx-types/trust.ts — assessMessageTrust, four checks, all evidence
-rather than scoring:
-
-  server-spam-verdict   The receiving server already decided. Free, and it was
-                        being thrown away. Only a POSITIVE verdict is trusted:
-                        anyone can inject X-Spam-Flag: NO into mail they send,
-                        and honouring that would hand attackers an off switch.
-                        A forged YES only flags the forger.
-  self-spoof            From is one of your own addresses AND authentication
-                        explicitly failed. Either half alone is ordinary —
-                        people mail themselves notes, forwarded mail fails SPF.
-                        Together they are not. Own addresses come from the
-                        recipient allowlist plus Delivered-To, so an alias
-                        never added to the allowlist is still covered.
-  hidden-link-overlay   An <area> hotspot bigger than any real image. Runs on
-                        the RAW html, before the sanitizer disarms it.
-  redirector-link       A link whose query carries another absolute URL. Names
-                        the ENDPOINT — a reader can't URL-decode a query string.
-
-Deliberately absent: bare SPF failure on mail not claiming to be you.
-Forwarded mail fails SPF constantly, and flagging it would be the cry-wolf
-banner this is trying not to be. Ordinary mail returns nothing at all — no
-"looks fine" reassurance, which would be a claim this cannot support.
-
-sanitizeHtml now also disarms image maps outright (<map> and usemap=).
-Unconditional rather than size-gated: image maps have no legitimate use in
-mail, so there is no threshold to tune and nothing to slip past by choosing a
-smaller rectangle. The image still renders; only its hidden clickability goes,
-and the banner explains why it stopped responding.
-
-The banner is its own element above the body, not part of the remote-content
-one — the two are independent, as the cid: case proved — and it never
-collapses. A reader who must expand a dropdown to learn a message is forged has
-already been asked to trust it. Each finding shows its evidence so it can be
-checked rather than believed.
-
-tests/trust.test.ts pins both phishes and, as importantly, the negative cases:
-a self-sent note with no auth headers, SPF failure on mail not claiming to be
-you, a modest image map, a same-site return-path parameter, and ordinary mail.
+Catch the spam that scores under the threshold
+
+A sextortion mail arrived that none of yesterday's checks caught ("yet this
+spam got through"). SpamAssassin scored it 2.7 against a 4.5 threshold and
+delivered it, so server-spam-verdict correctly stayed silent — the server said
+no. Three independent proofs of forgery were sitting in the message anyway.
+
+spf=none now counts as "not authenticated" for self-claimed mail, not just
+fail. bobf.frankston.com publishes no SPF record, so nothing sent as that
+domain can ever FAIL — only come back none. Treating none as neutral left the
+least-protected domain the least defended, which is backwards. Checked against
+the real store before changing it, 50,000 messages scanned:
+
+  From at one of Bob's domains          10,338
+    no Authentication-Results           10,034   <- his own mail, still ignored
+    spf=pass                               243   <- still ignored
+    spf=fail / softfail                     33
+    spf=none                                18   <- nearly all spam
+
+The 18 were "Settle your debt", "AAA Final notice", "McAfee Protection Plan
+Ended" and similar. Legitimate self-mail sits in the no-header group: it never
+crossed a trust boundary, so there is no Authentication-Results to read, and
+that case is untouched. An explicit spf/dkim/dmarc=pass still silences the
+check.
+
+relay-auth-mismatch — Bob's own catch: "note that the origin is different than
+the from domain in antiabuse and in source-auth".
+
+  From:          universe@bobf.frankston.com
+  X-Source-Auth: admin@calebjross.com
+  X-Source-Cap:  (base64) calebjro;calebjro;box2202.bluehost.com
+  Message-ID:    <...@calebjross.com>
+
+A Bluehost cPanel account belonging to an unrelated domain authenticated and
+sent mail wearing his address. That stamp is written by the RELAY, downstream
+of whoever submitted the message, so a forger cannot remove or edit it — which
+makes the disagreement about as close to proof as mail headers get. Compared at
+the registrable-domain level, since a host legitimately sending for a domain
+authenticates as some account AT that domain and the local part varies for
+ordinary reasons. Covers the cPanel/Exim, Postfix and Communigate spellings.
+
+zero-width-obfuscation — the body had ~1380 zero-width characters stuffed
+between letters, so "i regret to inform you" reached every word-matching filter
+as gibberish while rendering as clean prose. SpamAssassin saw it
+(UNICODE_OBFU_ZW_MANY) and still totalled only 2.7. Counted only BETWEEN TWO
+LATIN LETTERS, which is what obfuscation looks like and what the legitimate
+uses are not: an emoji ZWJ joins pictographs, Arabic and Indic ZWNJ sit between
+their own scripts' letters. The occurrence count guards against a stray
+character surviving a copy-paste; it is a sanity bound, not a sensitivity dial.
+
+The score itself is now always visible — a chip above the body reading "spam
+score 2.7 of 4.5" ("should we have a flag ... with the spam assassin number and
+a color code?"). Separate from the findings on purpose: a finding is an
+accusation and fires only on evidence, this is a measurement. Colour is a
+PROPORTION of the server's own threshold — red once flagged, amber past halfway
+to its line, quiet below — so it follows if the server's threshold changes
+rather than hardcoding a number. Viewer only for now; the message-list row
+would need the score stored at sync time.
+
+tests/trust.test.ts covers all three, and the negative cases with them: spf=pass
+and no-header both silent, a relay identity at the same organisation, an emoji
+ZWJ family sequence, and a stray zero-width character from a paste.

package/client/android-bootstrap.bundle.js

@@ -2248,13 +2248,25 @@ function selfSpoof(input) {
   if (!own.has(from))
     return null;
   const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+  if (!auth)
+    return null;
   const failed = [
     /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
     /\bdkim=(fail|permerror)\b/i.test(auth) ? "DKIM" : "",
     /\bdmarc=(fail|permerror)\b/i.test(auth) ? "DMARC" : ""
   ].filter(Boolean);
-  if (!failed.length)
-    return null;
+  if (!failed.length) {
+    if (/\b(spf|dkim|dmarc)=pass\b/i.test(auth))
+      return null;
+    const envelopeAddr = bare(header(input.headerLines, "return-path"));
+    const note = envelopeAddr && envelopeAddr !== from ? `; envelope sender ${envelopeAddr}` : "";
+    return {
+      id: "self-spoof",
+      severity: "danger",
+      text: `This claims to be from your own address, ${from}, and nothing proves it came from your account.`,
+      detail: `no SPF, DKIM or DMARC result to check against${note} \u2014 your domain publishes no SPF record, so forgery cannot be detected by the sending side`
+    };
+  }
   const envelope = bare(header(input.headerLines, "return-path"));
   const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
   return {
@@ -2326,17 +2338,73 @@ function assessMessageTrust(input) {
   const findings = [
     serverSpamVerdict(input.headerLines),
     selfSpoof(input),
+    relayAuthMismatch(input),
+    zeroWidthObfuscation(input.bodyText || ""),
     hiddenLinkOverlay(input.bodyHtml || ""),
     redirectorLink(input.bodyHtml || "")
   ].filter(Boolean);
   const rank = { danger: 0, caution: 1 };
   return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
 }
-var OVERLAY_MIN_EDGE_PX;
+function relayAuthMismatch(input) {
+  const from = bare(input.fromAddress);
+  const fromDomain = from.split("@")[1] || "";
+  if (!fromDomain)
+    return null;
+  for (const name of RELAY_IDENTITY_HEADERS) {
+    const stamped = bare(header(input.headerLines, name));
+    const stampedDomain = stamped.split("@")[1] || "";
+    if (!stampedDomain || stampedDomain === fromDomain)
+      continue;
+    if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain))
+      continue;
+    return {
+      id: "relay-auth-mismatch",
+      severity: "danger",
+      text: `The account that actually sent this belongs to someone else: ${stampedDomain}, not ${fromDomain}.`,
+      detail: `the sending server recorded ${stamped} as the authenticated sender, while the message claims to be from ${from}`
+    };
+  }
+  return null;
+}
+function zeroWidthObfuscation(bodyText) {
+  if (!bodyText)
+    return null;
+  const between = bodyText.match(/[A-Za-z][​‌‍][A-Za-z]/g);
+  const count = between ? between.length : 0;
+  if (count < ZERO_WIDTH_MIN_OCCURRENCES)
+    return null;
+  return {
+    id: "zero-width-obfuscation",
+    severity: "danger",
+    text: "The words in this message are stuffed with invisible characters to get past spam filters.",
+    detail: `${count} zero-width characters hidden inside words \u2014 legitimate mail has no reason to do this`
+  };
+}
+function spamScoreOf(headerLines) {
+  const status = header(headerLines, "x-spam-status");
+  if (!status)
+    return null;
+  const score = Number(status.match(/score=([-\d.]+)/)?.[1]);
+  const threshold = Number(status.match(/required=([-\d.]+)/)?.[1]);
+  if (!Number.isFinite(score) || !Number.isFinite(threshold))
+    return null;
+  return { score, threshold, flagged: /^yes/i.test(status) };
+}
+var OVERLAY_MIN_EDGE_PX, RELAY_IDENTITY_HEADERS, ZERO_WIDTH_MIN_OCCURRENCES;
 var init_trust = __esm({
   "packages/mailx-types/trust.js"() {
     "use strict";
     OVERLAY_MIN_EDGE_PX = 2e3;
+    RELAY_IDENTITY_HEADERS = [
+      "x-source-auth",
+      // cPanel / Exim (Bluehost, HostGator, most shared hosts)
+      "x-authenticated-sender",
+      // Postfix / Communigate
+      "x-auth-id",
+      "x-authenticated-user"
+    ];
+    ZERO_WIDTH_MIN_OCCURRENCES = 12;
   }
 });
 
@@ -2739,6 +2807,7 @@ __export(mailx_types_exports, {
   setDraft: () => setDraft,
   setFlagged: () => setFlagged,
   setSeen: () => setSeen,
+  spamScoreOf: () => spamScoreOf,
   splitRecipients: () => splitRecipients,
   toggleFlagged: () => toggleFlagged,
   toggleSeen: () => toggleSeen