@remit/mailbox-service 0.0.62 → 0.0.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/mailbox-service",
-  "version": "0.0.62",
+  "version": "0.0.63",
   "type": "module",
   "main": "src/index.ts",
   "types": "src/index.ts",

package/src/heuristics/senderMismatch.test.ts

@@ -71,7 +71,7 @@ describe("classifyDisplayNameCorrespondence", () => {
 		);
 	});
 
-	it("claims nothing when the display name is the address itself", () => {
+	it("claims nothing when the display name is an address at the sending domain", () => {
 		assert.equal(
 			classifyDisplayNameCorrespondence(
 				"billing@serviceupdatebank.atlassian.net",
@@ -81,6 +81,60 @@ describe("classifyDisplayNameCorrespondence", () => {
 		);
 	});
 
+	it("claims nothing when the display name spells the envelope address itself", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence("matthijs@ischen.nl", "ischen.nl"),
+			DisplayNameCorrespondence.NoClaim,
+		);
+	});
+
+	it("claims nothing when the display name is an address on a sibling subdomain", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"noreply@example.co.uk",
+				"mail.example.co.uk",
+			),
+			DisplayNameCorrespondence.NoClaim,
+		);
+	});
+
+	it("is a foreign address when the display name spells an address over another domain", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"matthijs@ischen.nl",
+				"secresaludguaviare.gov.co",
+			),
+			DisplayNameCorrespondence.ForeignAddress,
+		);
+	});
+
+	it("is a foreign address when the spelled-out address is decorated with a name", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"Matthijs (matthijs@ischen.nl)",
+				"secresaludguaviare.gov.co",
+			),
+			DisplayNameCorrespondence.ForeignAddress,
+		);
+	});
+
+	it("compares an at sign that spells no address as an ordinary name", () => {
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"Support @ InfoMedics",
+				"infomedics.nl",
+			),
+			DisplayNameCorrespondence.Corresponds,
+		);
+		assert.equal(
+			classifyDisplayNameCorrespondence(
+				"Support @ InfoMedics",
+				"serviceupdatebank.atlassian.net",
+			),
+			DisplayNameCorrespondence.Unrelated,
+		);
+	});
+
 	it("does not read the public suffix as a match for a brand containing it", () => {
 		assert.equal(
 			classifyDisplayNameCorrespondence("Netflix", "mailer.example.net"),
@@ -213,6 +267,25 @@ describe("extractSenderMismatch", () => {
 		);
 	});
 
+	it("flags a display name spelling the recipient's own address over a foreign domain", async () => {
+		const parsed = await parse([
+			"From: matthijs@ischen.nl <aramirez@secresaludguaviare.gov.co>",
+			"To: matthijs@ischen.nl",
+			"Subject: Re: factura",
+			"X-HalOne-Spam-Probability: 1",
+			"",
+			"hola",
+		]);
+		assert.equal(
+			extractSenderMismatch(parsed, {
+				fromDomain: "secresaludguaviare.gov.co",
+				spamClassified: true,
+				bulkSender: false,
+			}).displayNameCorrespondence,
+			DisplayNameCorrespondence.ForeignAddress,
+		);
+	});
+
 	it("leaves the display name uncompared for a bulk sender", async () => {
 		const parsed = await parse([
 			"From: Dutch Cycling Weekly <bounce-9f2@mailer.esp.example>",

package/src/heuristics/senderMismatch.ts

@@ -76,6 +76,22 @@ const editDistance = (a: string, b: string): number => {
 	return previous[b.length];
 };
 
+const ADDRESS_SHAPE = /[^\s<>@,;:"]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)/i;
+
+const registrableDomain = (host: string): string =>
+	getDomain(host) ?? host.toLowerCase();
+
+/**
+ * The registrable domain of the address a display name spells out, or
+ * `undefined` when it holds an `@` without an address behind it — `Bob @ Acme`
+ * asserts no address and is left to the ordinary comparison.
+ */
+const claimedAddressDomain = (displayName: string): string | undefined => {
+	const host = ADDRESS_SHAPE.exec(displayName)?.[1];
+	if (host === undefined) return undefined;
+	return registrableDomain(host);
+};
+
 /**
  * The distance a name of this length may be from a domain label and still be
  * read as an imitation of it. Tight on purpose: an unrelated brand name and an
@@ -109,14 +125,27 @@ const lookalikeThreshold = (length: number): number => {
  * A bounded edit distance is the secondary test, and only reaches names that
  * nearly match a label — `InfoMedics` against `1nfomedics.nl`. It cannot promote
  * an unrelated name on its own.
+ *
+ * A name that spells out an address is decided before any of that. Over the
+ * sending domain it claims nothing — `billing@` shown over
+ * `serviceupdatebank.atlassian.net` names the same party the envelope does.
+ * Over any other registrable domain it is the strongest non-correspondence
+ * signal there is: the message asserts, in the one field the recipient reads,
+ * that it comes from an address that cannot have sent it.
  */
 export const classifyDisplayNameCorrespondence = (
 	displayName: string | undefined,
 	fromDomain: string,
 ): CorrespondenceValue => {
 	const raw = (displayName ?? "").trim();
-	if (raw === "" || raw.includes("@")) {
-		return DisplayNameCorrespondence.NoClaim;
+	if (raw === "") return DisplayNameCorrespondence.NoClaim;
+
+	const claimed = claimedAddressDomain(raw);
+	if (claimed !== undefined) {
+		if (claimed === registrableDomain(fromDomain)) {
+			return DisplayNameCorrespondence.NoClaim;
+		}
+		return DisplayNameCorrespondence.ForeignAddress;
 	}
 
 	const name = normalize(raw);