email-bounce-parser 1.0.22 → 2.0.0

package/README.md

@@ -10,7 +10,7 @@ Parses bounce emails and extracts details.
 
 <table>
 <tr>
-<td align="center"><a href="https://crisp.chat/"><img src="https://crisp.chat/favicon-256x256.png" height="64" /></a></td>
+<td align="center"><a href="https://crisp.chat/"><img src="https://crisp.chat/favicons/favicon-256x256.png" height="64" /></a></td>
 </tr>
 <tr>
 <td align="center">Crisp</td>
@@ -24,6 +24,10 @@ _👋 You use this library and you want to be listed there? [Contact us](https:/
 This library is used at [Crisp](https://crisp.chat/) everyday to parse bounce emails.
 It supports most variations of bounce emails (Postfix, Dovecat, Gmail, Outlook).
 
+## ReDoS Protection
+
+This library has no native dependency. Its patterns are written to run in linear time on the native JavaScript `RegExp` engine, which protects against [ReDoS](https://en.wikipedia.org/wiki/ReDoS) on crafted emails.
+
 ## Usage
 
 ```js

package/lib/parser.js

@@ -1,7 +1,6 @@
 "use strict";
 
 
-var RE2                         = require("re2");
 var { loopRegexes, trimString } = require("./utils");
 
 var ERROR_CODES_TYPES = {
@@ -48,7 +47,12 @@ var ERROR_CODES_TYPES = {
   "555 5.5.2"  : "syntax_error"
 };
 
+// Notice: patterns must stay linear on backtracking engines: no nested or \
+//   adjacent unbounded quantifiers, and every scan is either bounded, or \
+//   stopped by a character that also starts the pattern (so that repeated \
+//   starts never rescan the same text)
 var REGEXES = {
+  line_break_single : /(?<!\n)\n(?!\n)/gm,
   line_break_double : /(\n\n)/gm,
   carriage_return : /\r\n/gm,
   byte_order_mark : /\uFEFF/gm,
@@ -74,9 +78,9 @@ var REGEXES = {
   email_server : [
     /host (\S+)\[([\d\.]+)\](?:\:(\d+)\:)? (?:said|refused to talk)/m,
     /^(\S+) rejected your message/m,
-    /\: connect to (.+)\[(.+)\](?:\:(\d+)\:)?/m, // "connect to acme.com[132.145.223.95]:25:"
+    /\: connect to ([^:\[\n\r\u2028\u2029]+)\[([^\[\]\n\r\u2028\u2029]+)\](?:\:(\d+)\:)?/m, // "connect to acme.com[132.145.223.95]:25:"
     /Name service error for name\=(\S+)\s/m,
-    /RCPT TO\:\<(.+?)\>/m,
+    /RCPT TO\:\<([^<>\n\r\u2028\u2029]+)\>/m,
     /Message rejected by\:\s+([\S\.]+?)$/m, // Outlook error
     /from (\S+) \[([\d\.]+)\](?:\:(\d+)\:)?/m,
     /conversation with (\S+)\[([\d\.]+)\](?:\:(\d+)\:)? timed out/m,
@@ -85,11 +89,11 @@ var REGEXES = {
   ],
 
   error : [
-    /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+) \(in reply to/,
+    /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.{1,1000}) \(in reply to/,
     /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?)-(.+)/,
     /(\d{3}\-\'\d\.\d\.\d{1,3}) (.+)/,
-    /LMTP error after .+?\:\<.+?\>\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) <.+?\>(.+)$/m,
-    /remote server returned \'(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)\'/i,
+    /LMTP error after [^:<\n\r\u2028\u2029]{1,40}\:\<[^<>\n\r\u2028\u2029]{1,320}\>\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) <[^<>\n\r\u2028\u2029]{1,320}\>(.+)$/m,
+    /remote server returned \'(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.{1,1000})\'/i,
     /The response from the remote server was:\s(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/,
     /refused to talk to me\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/,
     /(?:error|reason)\:\s*?(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/i,
@@ -98,13 +102,13 @@ var REGEXES = {
   ],
 
   error_lax : [
-    /^(?:\<.+?\> \(expanded from \<.+?\>\)\:)(.+)/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
-    /^(?:\<.+?\>\:)(.+)/m, // "<john@acme.com>: Domain name not found"
+    /^(?:\<[^<>\n\r\u2028\u2029]+\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:)(.+)/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
+    /^(?:\<[^<>\n\r\u2028\u2029]+\>\:)(.+)/m, // "<john@acme.com>: Domain name not found"
   ],
 
   error_label_cleanup_recipient : [
-    /^\<.+?\> \(expanded from \<.+?\>\)\:/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
-    /^\<.+?\>\:/m, // "<john@acme.com>: Domain name not found"
+    /^\<[^<>\n\r\u2028\u2029]+\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
+    /^\<[^<>\n\r\u2028\u2029]+\>\:/m, // "<john@acme.com>: Domain name not found"
   ],
 
   error_label_cleanup_command : [
@@ -112,16 +116,16 @@ var REGEXES = {
   ],
 
   recipient : [
-    /the following addresses had permanent fatal errors (?:.*?)\s\<(.+?)\>/i,
-    /there was a temporary problem (?:while )?delivering your message to (.+?). Gmail will retry/i,
-    /the following message to \<(.+?)\> was undeliverable/i,
+    /the following addresses had permanent fatal errors [^<\n\r\u2028\u2029]{0,200}\s\<([^<>\n\r\u2028\u2029]+)\>/i,
+    /there was a temporary problem (?:while )?delivering your message to (.{1,320}?). Gmail will retry/i,
+    /the following message to \<([^<>\n\r\u2028\u2029]+)\> was undeliverable/i,
     /to the following addresses:\s*(.+)/i,
     /^your message wasn't delivered to (.+?)\s/mi, // "Your message wasn't delivered to john@acme.com"
     /^your message to (.+?) couldn\'t/mi, // "Your message to john@acme.com couldn't"
-    /^(.+?)\s?(?:\s\(.*?\))?\n?\s*[\[|<]mailto\:(.+?)[\]|>]/mi, // "john@acme.com<mailto:john@acme.com>" or "john@acme.com[mailto:john@acme.com]" or "john@acme.com (john@acme.com)<mailto:john@acme.com>"
-    /^\<(.+?)\>:/m,
-    /\<(.+?)\> \(expanded from \<.+?\>\)\:/, // "<john@acme.com> (expanded from <john@digiflex.com>): "
-    /\<(.+?)\>:/ // "<john@acme.com>:"
+    /^((?:\S+?[^\S\n\r\u2028\u2029]+)*?\S+?)(?:[^\S\n\r\u2028\u2029]+\([^()\n\r\u2028\u2029]*\))?\s*[\[|<]mailto\:([^\[\]|<>\n\r\u2028\u2029]+)[\]|>]/mi, // "john@acme.com<mailto:john@acme.com>" or "john@acme.com[mailto:john@acme.com]" or "john@acme.com (john@acme.com)<mailto:john@acme.com>"
+    /^\<([^<>\n\r\u2028\u2029]+)\>:/m,
+    /\<([^<>\n\r\u2028\u2029]+)\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:/, // "<john@acme.com> (expanded from <john@digiflex.com>): "
+    /\<([^<>\n\r\u2028\u2029]+)\>:/ // "<john@acme.com>:"
   ],
 
   temporary_safe : /(temporary|temporarily)/i,
@@ -134,8 +138,8 @@ var REGEXES = {
       /(no such (?:account|user|mailbox|recipient))/i,
       /((?:terminated|disabled|inactive|not found|unavailable|invalid) (?:account|user|mailbox|recipient))/i,
       /(do(e)?sn\'t exist)/i, // Some Chinese SMTP return "dosn't" instead of "doesn't"
-      /(user (?:.+?) does not exist)/i,
-      /((?:account|user|mailbox|recipient) (?:.+@.+ )?(?:is )?(?:terminated|disabled|inactive|not found|unavailable|invalid|rejected))/i
+      /(user (?:.{1,320}?) does not exist)/i,
+      /((?:account|user|mailbox|recipient) (?:[^@\n\r\u2028\u2029]{1,100}@[^\n\r\u2028\u2029]{1,200}? )?(?:is )?(?:terminated|disabled|inactive|not found|unavailable|invalid|rejected))/i
     ],
 
     server_unknown : [
@@ -174,7 +178,7 @@ class Parser {
    * Constructor
    */
   constructor() {
-    this.__regexes = this.__initRegexes(REGEXES);
+    this.__regexes = REGEXES;
   }
 
 
@@ -248,37 +252,6 @@ class Parser {
   }
 
 
-  /**
-   * Initializes regexes
-   * @private
-   * @param  {object} obj
-   * @return {object} Regexes
-   */
-  __initRegexes(obj) {
-    var _regexes = {};
-
-    for (var _key in obj) {
-      var _entry = obj[_key];
-
-      if (Array.isArray(_entry)) {
-        _regexes[_key] = [];
-
-        for (var _i = 0; _i < _entry.length; _i++) {
-          _regexes[_key].push(
-            new RE2(_entry[_i])
-          );
-        }
-      } else if (typeof _entry === "object" && Object.keys(_entry).length > 0) {
-        _regexes[_key] = this.__initRegexes(_entry);
-      } else {
-        _regexes[_key] = new RE2(_entry);
-      }
-    }
-
-    return _regexes;
-  }
-
-
   /**
    * Parses the bounce error
    * @private
@@ -316,7 +289,7 @@ class Parser {
     // In cases where the bounce is detected as permanent, or the \
     //   temporary / permanent status is still unclear, run additional detection
     if (_permanent === true || (_temporary === false && _permanent === false)) {
-      var _match = this.__regexes.temporary_safe.match(str);
+      var _match = str.match(this.__regexes.temporary_safe);
 
       if (_match && _match.length > 1) {
         _temporary = true;
@@ -415,14 +388,14 @@ class Parser {
     }
 
     // Check if blocked
-    var _blocked_match = this.__regexes.blocked.match(str);
+    var _blocked_match = str.match(this.__regexes.blocked);
 
     if (_blocked_match && _blocked_match.length > 1) {
       _blocked = true;
     }
 
     // Check if spam
-    var _spam_match = this.__regexes.spam.match(str);
+    var _spam_match = str.match(this.__regexes.spam);
 
     if (_spam_match && _spam_match.length > 1) {
       _spam = true;
@@ -555,8 +528,7 @@ class Parser {
     _str = _str.replace(this.__regexes.line_break_double_indent_single, "\n\n");
 
     // Replace single Line-break with regular space
-    // TODO: re2 doesn't support lookbehinds, so for now we use a pure-JS regex
-    _str = _str.replace(/(?<!\n)\n(?!\n)/gm, " ");
+    _str = _str.replace(this.__regexes.line_break_single, " ");
 
     // Replace long indent with double Line-break
     _str = _str.replace(this.__regexes.indent_long, "\n\n");

package/lib/utils.js

@@ -1,11 +1,5 @@
 "use strict";
 
-/**************************************************************************
- * IMPORTS
- ***************************************************************************/
-
-var RE2 = require("re2");
-
 /**************************************************************************
  * FUNCTIONS
  ***************************************************************************/
@@ -29,14 +23,15 @@ var loopRegexes = function(
   for (var _i = 0; _i < regexes.length; _i++) {
     var _regex = regexes[_i];
 
-    if (typeof regexes[_i] === "string") {
-      // Build the regex
-      _regex = new RE2(regexes[_i]);
-    }
+    var _currentMatch;
 
-    var _currentMatch = (
-      _regex[mode](str || "", mode === "replace" ? "" : undefined)
-    );
+    if (mode === "replace") {
+      _currentMatch = (str || "").replace(_regex, "");
+    } else if (mode === "split") {
+      _currentMatch = (str || "").split(_regex);
+    } else {
+      _currentMatch = (str || "").match(_regex);
+    }
 
     if (mode === "replace") {
       _match = _currentMatch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "email-bounce-parser",
-  "version": "1.0.22",
+  "version": "2.0.0",
   "description": "Parses bounce emails and extract errors",
   "author": "Eliott Vincent <eliott@crisp.chat>",
   "main": "lib/index.js",
@@ -14,17 +14,15 @@
   },
   "engineStrict": true,
   "engines": {
-    "node": ">=14.18.0"
+    "node": ">= 22.0.0"
   },
   "scripts": {
-    "test": "nodeunit ./test/index.js"
+    "unit": "nodeunit ./test/index.js",
+    "test": "npm run unit"
   },
   "devDependencies": {
     "nodeunit-x": "0.15.0"
   },
-  "dependencies": {
-    "re2": "1.20.7"
-  },
   "keywords": [
     "parser",
     "mail",