@bobfrankston/rmfmail 1.2.281 → 1.2.283

package/.commitmsg

@@ -1,63 +1,17 @@
-Say when a message is forged
-
-Two phishes arrived on 2026-08-25 and mailx rendered both without a word of
-warning ("this is an attack — could you do a better job of identifying it as
-bogus?"). They carried, in the message itself:
-
-  X-Spam-Flag: YES                       <- Bob's own server, score 6.7/4.5
-  Authentication-Results: ... spf=fail
-  From: bobip@bobf.frankston.com         <- his own alias, forged
-  Return-Path: <3EDTkWNvbY@visionsurveysqld.com.au>
-  <area coords="0,0,10000,10000" href="http://.../redirect.php?newurl=...">
-
-Not one of those headers was read anywhere in the codebase — no X-Spam-*, no
-Authentication-Results, nothing. The one impersonation check that existed
-(displayNameClaimsOtherAddress) needs a display name, and these had none. Worse,
-the card was a cid: image, so hasRemoteContent was false and even the
-remote-content banner stayed away: the message displayed clean.
-
-The whole visible card was one hidden link. sanitizeHtml stripped their forms
-and inputs and left <area> untouched, so the trap was live in the reader —
-every pixel of the picture pointed at an open redirector on a real French
-company's site, which forwarded to a throwaway host with the victim's own
-address base64'd into the fragment so the landing page could prefill it.
-
-packages/mailx-types/trust.ts — assessMessageTrust, four checks, all evidence
-rather than scoring:
-
-  server-spam-verdict   The receiving server already decided. Free, and it was
-                        being thrown away. Only a POSITIVE verdict is trusted:
-                        anyone can inject X-Spam-Flag: NO into mail they send,
-                        and honouring that would hand attackers an off switch.
-                        A forged YES only flags the forger.
-  self-spoof            From is one of your own addresses AND authentication
-                        explicitly failed. Either half alone is ordinary —
-                        people mail themselves notes, forwarded mail fails SPF.
-                        Together they are not. Own addresses come from the
-                        recipient allowlist plus Delivered-To, so an alias
-                        never added to the allowlist is still covered.
-  hidden-link-overlay   An <area> hotspot bigger than any real image. Runs on
-                        the RAW html, before the sanitizer disarms it.
-  redirector-link       A link whose query carries another absolute URL. Names
-                        the ENDPOINT — a reader can't URL-decode a query string.
-
-Deliberately absent: bare SPF failure on mail not claiming to be you.
-Forwarded mail fails SPF constantly, and flagging it would be the cry-wolf
-banner this is trying not to be. Ordinary mail returns nothing at all — no
-"looks fine" reassurance, which would be a claim this cannot support.
-
-sanitizeHtml now also disarms image maps outright (<map> and usemap=).
-Unconditional rather than size-gated: image maps have no legitimate use in
-mail, so there is no threshold to tune and nothing to slip past by choosing a
-smaller rectangle. The image still renders; only its hidden clickability goes,
-and the banner explains why it stopped responding.
-
-The banner is its own element above the body, not part of the remote-content
-one — the two are independent, as the cid: case proved — and it never
-collapses. A reader who must expand a dropdown to learn a message is forged has
-already been asked to trust it. Each finding shows its evidence so it can be
-checked rather than believed.
-
-tests/trust.test.ts pins both phishes and, as importantly, the negative cases:
-a self-sent note with no auth headers, SPF failure on mail not claiming to be
-you, a modest image map, a same-site return-path parameter, and ordinary mail.
+Show the spam score only when it means something
+
+"Only show the spam score if it is high and likely." The first cut put a chip on
+every message that carried a score, which is nearly all of them — a badge that
+is always there carries no information and turns into furniture the eye stops
+reading, which is the same failure mode the findings themselves are built to
+avoid.
+
+The chip now renders only at or above halfway to the server's own threshold.
+That floor is a proportion, not a constant, so it follows if the threshold
+changes. Halfway is where "did not quite trip the wire" stops meaning the same
+thing as "clean": the sextortion mail scored 2.7 against 4.5 and was delivered
+unflagged, so showing only what the server flagged would miss precisely the
+case worth showing. Two levels remain — flagged, and past halfway — because
+anything quieter no longer renders.
+
+Findings are unaffected: they never depended on the score.

package/client/android-bootstrap.bundle.js

@@ -2248,13 +2248,25 @@ function selfSpoof(input) {
   if (!own.has(from))
     return null;
   const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
+  if (!auth)
+    return null;
   const failed = [
     /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
     /\bdkim=(fail|permerror)\b/i.test(auth) ? "DKIM" : "",
     /\bdmarc=(fail|permerror)\b/i.test(auth) ? "DMARC" : ""
   ].filter(Boolean);
-  if (!failed.length)
-    return null;
+  if (!failed.length) {
+    if (/\b(spf|dkim|dmarc)=pass\b/i.test(auth))
+      return null;
+    const envelopeAddr = bare(header(input.headerLines, "return-path"));
+    const note = envelopeAddr && envelopeAddr !== from ? `; envelope sender ${envelopeAddr}` : "";
+    return {
+      id: "self-spoof",
+      severity: "danger",
+      text: `This claims to be from your own address, ${from}, and nothing proves it came from your account.`,
+      detail: `no SPF, DKIM or DMARC result to check against${note} \u2014 your domain publishes no SPF record, so forgery cannot be detected by the sending side`
+    };
+  }
   const envelope = bare(header(input.headerLines, "return-path"));
   const envelopeNote = envelope && envelope !== from ? `; actually sent by ${envelope}` : "";
   return {
@@ -2326,17 +2338,73 @@ function assessMessageTrust(input) {
   const findings = [
     serverSpamVerdict(input.headerLines),
     selfSpoof(input),
+    relayAuthMismatch(input),
+    zeroWidthObfuscation(input.bodyText || ""),
     hiddenLinkOverlay(input.bodyHtml || ""),
     redirectorLink(input.bodyHtml || "")
   ].filter(Boolean);
   const rank = { danger: 0, caution: 1 };
   return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
 }
-var OVERLAY_MIN_EDGE_PX;
+function relayAuthMismatch(input) {
+  const from = bare(input.fromAddress);
+  const fromDomain = from.split("@")[1] || "";
+  if (!fromDomain)
+    return null;
+  for (const name of RELAY_IDENTITY_HEADERS) {
+    const stamped = bare(header(input.headerLines, name));
+    const stampedDomain = stamped.split("@")[1] || "";
+    if (!stampedDomain || stampedDomain === fromDomain)
+      continue;
+    if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain))
+      continue;
+    return {
+      id: "relay-auth-mismatch",
+      severity: "danger",
+      text: `The account that actually sent this belongs to someone else: ${stampedDomain}, not ${fromDomain}.`,
+      detail: `the sending server recorded ${stamped} as the authenticated sender, while the message claims to be from ${from}`
+    };
+  }
+  return null;
+}
+function zeroWidthObfuscation(bodyText) {
+  if (!bodyText)
+    return null;
+  const between = bodyText.match(/[A-Za-z][​‌‍][A-Za-z]/g);
+  const count = between ? between.length : 0;
+  if (count < ZERO_WIDTH_MIN_OCCURRENCES)
+    return null;
+  return {
+    id: "zero-width-obfuscation",
+    severity: "danger",
+    text: "The words in this message are stuffed with invisible characters to get past spam filters.",
+    detail: `${count} zero-width characters hidden inside words \u2014 legitimate mail has no reason to do this`
+  };
+}
+function spamScoreOf(headerLines) {
+  const status = header(headerLines, "x-spam-status");
+  if (!status)
+    return null;
+  const score = Number(status.match(/score=([-\d.]+)/)?.[1]);
+  const threshold = Number(status.match(/required=([-\d.]+)/)?.[1]);
+  if (!Number.isFinite(score) || !Number.isFinite(threshold))
+    return null;
+  return { score, threshold, flagged: /^yes/i.test(status) };
+}
+var OVERLAY_MIN_EDGE_PX, RELAY_IDENTITY_HEADERS, ZERO_WIDTH_MIN_OCCURRENCES;
 var init_trust = __esm({
   "packages/mailx-types/trust.js"() {
     "use strict";
     OVERLAY_MIN_EDGE_PX = 2e3;
+    RELAY_IDENTITY_HEADERS = [
+      "x-source-auth",
+      // cPanel / Exim (Bluehost, HostGator, most shared hosts)
+      "x-authenticated-sender",
+      // Postfix / Communigate
+      "x-auth-id",
+      "x-authenticated-user"
+    ];
+    ZERO_WIDTH_MIN_OCCURRENCES = 12;
   }
 });
 
@@ -2739,6 +2807,7 @@ __export(mailx_types_exports, {
   setDraft: () => setDraft,
   setFlagged: () => setFlagged,
   setSeen: () => setSeen,
+  spamScoreOf: () => spamScoreOf,
   splitRecipients: () => splitRecipients,
   toggleFlagged: () => toggleFlagged,
   toggleSeen: () => toggleSeen