@bobfrankston/rmfmail 1.2.298 → 1.2.300

package/packages/mailx-types/trust.ts

@@ -98,6 +98,20 @@ function bare(addr: string): string {
     return (m ? m[0] : addr || "").toLowerCase().replace(/[.,;]+$/, "");
 }
 
+/** Do two hostnames belong to the same organisation?
+ *
+ *  Equality or a sub/parent-domain relation, never "the last two labels
+ *  match": that would make paypal.co.uk and evil.co.uk relatives, which is
+ *  the case this whole file exists to catch. A subdomain relationship cannot
+ *  be forged across organisations, so it is safe in the other direction.
+ *  Same test displayNameClaimsOtherAddress uses on addresses. */
+function sameOrg(a: string, b: string): boolean {
+    const x = (a || "").toLowerCase();
+    const y = (b || "").toLowerCase();
+    if (!x || !y) return false;
+    return x === y || x.endsWith("." + y) || y.endsWith("." + x);
+}
+
 /**
  * What SpamAssassin's rules are evidence OF — which is not what its score is.
  *
@@ -311,6 +325,11 @@ interface ServerSpamAnalysis {
     provedBy: "dmarc" | "dkim" | "trusted" | "";
     provedDomain: string;
     provedPolicy: string;
+    /** Every rule that SCORED is a bulk-mail or blocklist test — nothing that
+     *  pushed this message up is about its content or its sender. Computed,
+     *  not inferred from `kind`: `kind` is the WORST class present, so it says
+     *  nothing about the rules underneath it. */
+    bulkOnly: boolean;
     /** The reader's own trained filter put this at 0-1% spam. */
     bayesHam: boolean;
     /** Authentication the receiving server saw fail, by name: "SPF", "DKIM",
@@ -373,6 +392,17 @@ function analyzeServerSpam(input: TrustInput): ServerSpamAnalysis {
     const unknownCouldFlagAlone = !unknown.length ? false
         : !Number.isFinite(unknownWeight) || !Number.isFinite(threshold) ? true
         : unknownWeight >= threshold;
+    // What the chip may claim about the rule set. "Every rule that scored is a
+    // bulk-mail test" is a statement about ALL of them, so it has to be
+    // checked against all of them — deriving it from `proved` (which says
+    // nothing about the rules) or from `kind` (the worst class, which says
+    // nothing about the rest) asserts something the code never looked at.
+    // The Altis Hotels welcome mail, 2026-09-03 (Bob: "marked as spam but is
+    // valid"): DMARC-proved, so the chip said "scored by bulk-mail or
+    // blocklist rules" — with 3.2 of its 8.3 coming from KAM_ACCOUNTPHISH,
+    // which is neither, listed directly underneath.
+    const bulkOnly = rules.every(r => !scored(r) || r.cls === "bulk" || r.cls === "neutral");
+
     const kind = (dmarc.authFailures.length || present("forgery")) ? "forgery"
         : present("association") ? "association"
         : unknownCouldFlagAlone ? "unclassified"
@@ -413,7 +443,7 @@ function analyzeServerSpam(input: TrustInput): ServerSpamAnalysis {
 
     return {
         score, threshold, flagged, rules, kind,
-        proved: !!provedBy, provedBy,
+        proved: !!provedBy, provedBy, bulkOnly,
         provedDomain: dmarc.domain || fromDomain, provedPolicy: dmarc.policy,
         bayesHam: rules.some(r => r.name === "BAYES_00" || r.name === "BAYES_01"),
         authFailures: dmarc.authFailures,
@@ -500,11 +530,19 @@ function serverSpamVerdict(input: TrustInput): TrustFinding {
             detail: `${provedNote(a)} ${numbers}${why}${bayes}`,
         };
 
+    // Same discipline as the chip: "nothing that scored tests who sent it" is
+    // a claim about every rule, so it is made only when every rule was
+    // actually looked at and classified. `kind === "bulk"` does not establish
+    // that — an unclassified rule that could not have flagged the message on
+    // its own leaves the kind at bulk while remaining, by definition, a rule
+    // this file cannot say anything about.
     if (a.kind === "bulk")
         return {
             id: "server-spam-verdict",
             severity: "info",
-            text: "Your mail server rates this bulk mail — nothing that scored tests who sent it.",
+            text: a.bulkOnly
+                ? "Your mail server rates this bulk mail — nothing that scored tests who sent it."
+                : "Your mail server rates this bulk mail.",
             detail: `${numbers}${why}${bayes}`,
         };
 
@@ -624,6 +662,22 @@ function hiddenLinkOverlay(bodyHtml: string): TrustFinding {
     return null;
 }
 
+/** The domain the receiving server proved the From line for — "" when nothing
+ *  did. One place answers "is this sender who they say they are", so the
+ *  banner, the chip and the link checks can never disagree about it.
+ *
+ *  dmarcProof is asked first because it needs no SpamAssassin: an
+ *  Authentication-Results header alone is enough, which is what mail arriving
+ *  through the Gmail API carries. analyzeServerSpam adds the two proofs
+ *  SpamAssassin states in its own rule list instead (DKIM_VALID_AU,
+ *  ALL_TRUSTED) and returns null when the server ran no filter at all. */
+function provedSenderDomain(input: TrustInput): string {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain) return "";
+    if (dmarcProof(input).pass) return fromDomain;
+    return analyzeServerSpam(input)?.proved ? fromDomain : "";
+}
+
 /**
  * Does a link route through a redirector carrying its real destination in the
  * query string?
@@ -633,17 +687,40 @@ function hiddenLinkOverlay(bodyHtml: string): TrustFinding {
  * whose redirect script was left open, and the destination appears only
  * percent-encoded inside a parameter. Reporting the ENDPOINT is the point — a
  * reader cannot be expected to URL-decode a query string.
+ *
+ * Laundering needs a SECOND PARTY — someone whose reputation is being spent
+ * without their consent. Two ways a link has none, both checked below, and
+ * neither of them a threshold:
+ *
+ *   1. The redirector and the destination are the same organisation. A site
+ *      bouncing through its own hostnames is routing, not hiding.
+ *   2. The redirector IS the proved sender. Google's account-security notice
+ *      (2026-09-02, Bob: "this is valid") links through
+ *      `accounts.google.com/AccountChooser?continue=https://myaccount.google.com/…`
+ *      — two hostnames that are neither equal nor sub/parent of each other,
+ *      so rule 1 alone does not save it. But the receiving server recorded
+ *      `dmarc=pass header.from=accounts.google.com`: the host in the visible
+ *      link belongs to the party that provably sent the mail, spending its
+ *      own reputation. That the sender might itself be malicious is a
+ *      different question than the one this check asks.
+ *
+ * The proof has to come from the topmost Authentication-Results, which the
+ * sender cannot write — otherwise the escape is a switch a forger flips by
+ * typing a domain into From. No proof means the check stays on.
  */
-function redirectorLink(bodyHtml: string): TrustFinding {
+function redirectorLink(input: TrustInput): TrustFinding {
+    const bodyHtml = input.bodyHtml || "";
+    const senderDomain = provedSenderDomain(input);
     for (const m of bodyHtml.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
         let url: URL;
         try { url = new URL(m[1]); } catch { continue; }
         if (!/^https?:$/.test(url.protocol)) continue;
+        if (senderDomain && sameOrg(url.hostname, senderDomain)) continue;  // the sender's own host
         for (const [, value] of url.searchParams) {
             let target: URL;
             try { target = new URL(value); } catch { continue; }
             if (!/^https?:$/.test(target.protocol)) continue;
-            if (target.hostname === url.hostname) continue;   // same-site, not laundering
+            if (sameOrg(target.hostname, url.hostname)) continue;   // same site, not laundering
             return {
                 id: "redirector-link",
                 severity: "caution",
@@ -669,7 +746,7 @@ export function assessMessageTrust(input: TrustInput): TrustFinding[] {
         relayAuthMismatch(input),
         zeroWidthObfuscation(input.bodyText || ""),
         hiddenLinkOverlay(input.bodyHtml || ""),
-        redirectorLink(input.bodyHtml || ""),
+        redirectorLink(input),
     ].filter(Boolean);
     const rank = { danger: 0, caution: 1, info: 2 };
     return findings.sort((a, b) => rank[a.severity] - rank[b.severity]);
@@ -714,10 +791,9 @@ function relayAuthMismatch(input: TrustInput): TrustFinding {
     for (const name of RELAY_IDENTITY_HEADERS) {
         const stamped = bare(header(input.headerLines, name));
         const stampedDomain = stamped.split("@")[1] || "";
-        if (!stampedDomain || stampedDomain === fromDomain) continue;
         // Sub/parent-domain is the same organisation — mail.example.com
         // sending for example.com is ordinary. Cross-organisation is not.
-        if (stampedDomain.endsWith("." + fromDomain) || fromDomain.endsWith("." + stampedDomain)) continue;
+        if (!stampedDomain || sameOrg(stampedDomain, fromDomain)) continue;
         return {
             id: "relay-auth-mismatch",
             severity: "danger",
@@ -795,6 +871,10 @@ export interface SpamScore {
      *  may not exist (Bob's own mail carries no Authentication-Results at
      *  all). */
     provedBy: "dmarc" | "dkim" | "trusted" | "";
+    /** Every rule that scored is a bulk-mail or blocklist test. The chip's
+     *  tooltip may say so ONLY when this is true — it is a claim about all of
+     *  the rules, and the reader can read them underneath it. */
+    bulkOnly: boolean;
     /** Top scoring rules, named — "6.0 URIBL_SBL (Contains an URL's NS IP
      *  listed in the Spamhaus SBL blocklist)". A number alone is unactionable;
      *  this can be judged in a second. */
@@ -814,6 +894,7 @@ export function spamScoreOf(input: TrustInput): SpamScore {
         kind: a.kind,
         proved: a.proved,
         provedBy: a.provedBy,
+        bulkOnly: a.bulkOnly,
         trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
     };