email-bounce-parser 1.1.1 → 2.0.0

package/README.md

@@ -24,21 +24,9 @@ _👋 You use this library and you want to be listed there? [Contact us](https:/
 This library is used at [Crisp](https://crisp.chat/) everyday to parse bounce emails.
 It supports most variations of bounce emails (Postfix, Dovecat, Gmail, Outlook).
 
-## RE2 Support
+## ReDoS Protection
 
-This library uses the [RE2](https://github.com/uhop/node-re2) regex engine when available for better performance and [ReDoS](https://en.wikipedia.org/wiki/ReDoS) protection. It automatically falls back to native JavaScript `RegExp` if RE2 is unavailable or fails to load.
-
-RE2 is an optional dependency. To use it, install it alongside this library:
-
-```bash
-npm install re2
-```
-
-After a Node.js upgrade, you may need to rebuild RE2:
-
-```bash
-npm rebuild re2
-```
+This library has no native dependency. Its patterns are written to run in linear time on the native JavaScript `RegExp` engine, which protects against [ReDoS](https://en.wikipedia.org/wiki/ReDoS) on crafted emails.
 
 ## Usage
 

package/lib/parser.js

@@ -1,7 +1,7 @@
 "use strict";
 
 
-var { buildSafeRegExp, loopRegexes, trimString } = require("./utils");
+var { loopRegexes, trimString } = require("./utils");
 
 var ERROR_CODES_TYPES = {
   "421"        : "service_not_available",
@@ -47,7 +47,12 @@ var ERROR_CODES_TYPES = {
   "555 5.5.2"  : "syntax_error"
 };
 
+// Notice: patterns must stay linear on backtracking engines: no nested or \
+//   adjacent unbounded quantifiers, and every scan is either bounded, or \
+//   stopped by a character that also starts the pattern (so that repeated \
+//   starts never rescan the same text)
 var REGEXES = {
+  line_break_single : /(?<!\n)\n(?!\n)/gm,
   line_break_double : /(\n\n)/gm,
   carriage_return : /\r\n/gm,
   byte_order_mark : /\uFEFF/gm,
@@ -73,9 +78,9 @@ var REGEXES = {
   email_server : [
     /host (\S+)\[([\d\.]+)\](?:\:(\d+)\:)? (?:said|refused to talk)/m,
     /^(\S+) rejected your message/m,
-    /\: connect to (.+)\[(.+)\](?:\:(\d+)\:)?/m, // "connect to acme.com[132.145.223.95]:25:"
+    /\: connect to ([^:\[\n\r\u2028\u2029]+)\[([^\[\]\n\r\u2028\u2029]+)\](?:\:(\d+)\:)?/m, // "connect to acme.com[132.145.223.95]:25:"
     /Name service error for name\=(\S+)\s/m,
-    /RCPT TO\:\<(.+?)\>/m,
+    /RCPT TO\:\<([^<>\n\r\u2028\u2029]+)\>/m,
     /Message rejected by\:\s+([\S\.]+?)$/m, // Outlook error
     /from (\S+) \[([\d\.]+)\](?:\:(\d+)\:)?/m,
     /conversation with (\S+)\[([\d\.]+)\](?:\:(\d+)\:)? timed out/m,
@@ -84,11 +89,11 @@ var REGEXES = {
   ],
 
   error : [
-    /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+) \(in reply to/,
+    /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.{1,1000}) \(in reply to/,
     /said\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?)-(.+)/,
     /(\d{3}\-\'\d\.\d\.\d{1,3}) (.+)/,
-    /LMTP error after .+?\:\<.+?\>\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) <.+?\>(.+)$/m,
-    /remote server returned \'(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)\'/i,
+    /LMTP error after [^:<\n\r\u2028\u2029]{1,40}\:\<[^<>\n\r\u2028\u2029]{1,320}\>\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) <[^<>\n\r\u2028\u2029]{1,320}\>(.+)$/m,
+    /remote server returned \'(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.{1,1000})\'/i,
     /The response from the remote server was:\s(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/,
     /refused to talk to me\: (\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/,
     /(?:error|reason)\:\s*?(\d{3}(?:[\s\-\#\']{1,2}\d\.\d\.\d{1,3})?) (.+)/i,
@@ -97,13 +102,13 @@ var REGEXES = {
   ],
 
   error_lax : [
-    /^(?:\<.+?\> \(expanded from \<.+?\>\)\:)(.+)/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
-    /^(?:\<.+?\>\:)(.+)/m, // "<john@acme.com>: Domain name not found"
+    /^(?:\<[^<>\n\r\u2028\u2029]+\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:)(.+)/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
+    /^(?:\<[^<>\n\r\u2028\u2029]+\>\:)(.+)/m, // "<john@acme.com>: Domain name not found"
   ],
 
   error_label_cleanup_recipient : [
-    /^\<.+?\> \(expanded from \<.+?\>\)\:/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
-    /^\<.+?\>\:/m, // "<john@acme.com>: Domain name not found"
+    /^\<[^<>\n\r\u2028\u2029]+\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:/m, // "<john@acme.com> (expanded from <john@digiflex.com>):  Domain name not found"
+    /^\<[^<>\n\r\u2028\u2029]+\>\:/m, // "<john@acme.com>: Domain name not found"
   ],
 
   error_label_cleanup_command : [
@@ -111,16 +116,16 @@ var REGEXES = {
   ],
 
   recipient : [
-    /the following addresses had permanent fatal errors (?:.*?)\s\<(.+?)\>/i,
-    /there was a temporary problem (?:while )?delivering your message to (.+?). Gmail will retry/i,
-    /the following message to \<(.+?)\> was undeliverable/i,
+    /the following addresses had permanent fatal errors [^<\n\r\u2028\u2029]{0,200}\s\<([^<>\n\r\u2028\u2029]+)\>/i,
+    /there was a temporary problem (?:while )?delivering your message to (.{1,320}?). Gmail will retry/i,
+    /the following message to \<([^<>\n\r\u2028\u2029]+)\> was undeliverable/i,
     /to the following addresses:\s*(.+)/i,
     /^your message wasn't delivered to (.+?)\s/mi, // "Your message wasn't delivered to john@acme.com"
     /^your message to (.+?) couldn\'t/mi, // "Your message to john@acme.com couldn't"
-    /^(.+?)\s?(?:\s\(.*?\))?\n?\s*[\[|<]mailto\:(.+?)[\]|>]/mi, // "john@acme.com<mailto:john@acme.com>" or "john@acme.com[mailto:john@acme.com]" or "john@acme.com (john@acme.com)<mailto:john@acme.com>"
-    /^\<(.+?)\>:/m,
-    /\<(.+?)\> \(expanded from \<.+?\>\)\:/, // "<john@acme.com> (expanded from <john@digiflex.com>): "
-    /\<(.+?)\>:/ // "<john@acme.com>:"
+    /^((?:\S+?[^\S\n\r\u2028\u2029]+)*?\S+?)(?:[^\S\n\r\u2028\u2029]+\([^()\n\r\u2028\u2029]*\))?\s*[\[|<]mailto\:([^\[\]|<>\n\r\u2028\u2029]+)[\]|>]/mi, // "john@acme.com<mailto:john@acme.com>" or "john@acme.com[mailto:john@acme.com]" or "john@acme.com (john@acme.com)<mailto:john@acme.com>"
+    /^\<([^<>\n\r\u2028\u2029]+)\>:/m,
+    /\<([^<>\n\r\u2028\u2029]+)\> \(expanded from \<[^<>\n\r\u2028\u2029]+\>\)\:/, // "<john@acme.com> (expanded from <john@digiflex.com>): "
+    /\<([^<>\n\r\u2028\u2029]+)\>:/ // "<john@acme.com>:"
   ],
 
   temporary_safe : /(temporary|temporarily)/i,
@@ -133,8 +138,8 @@ var REGEXES = {
       /(no such (?:account|user|mailbox|recipient))/i,
       /((?:terminated|disabled|inactive|not found|unavailable|invalid) (?:account|user|mailbox|recipient))/i,
       /(do(e)?sn\'t exist)/i, // Some Chinese SMTP return "dosn't" instead of "doesn't"
-      /(user (?:.+?) does not exist)/i,
-      /((?:account|user|mailbox|recipient) (?:.+@.+ )?(?:is )?(?:terminated|disabled|inactive|not found|unavailable|invalid|rejected))/i
+      /(user (?:.{1,320}?) does not exist)/i,
+      /((?:account|user|mailbox|recipient) (?:[^@\n\r\u2028\u2029]{1,100}@[^\n\r\u2028\u2029]{1,200}? )?(?:is )?(?:terminated|disabled|inactive|not found|unavailable|invalid|rejected))/i
     ],
 
     server_unknown : [
@@ -173,7 +178,7 @@ class Parser {
    * Constructor
    */
   constructor() {
-    this.__regexes = this.__initRegexes(REGEXES);
+    this.__regexes = REGEXES;
   }
 
 
@@ -247,37 +252,6 @@ class Parser {
   }
 
 
-  /**
-   * Initializes regexes
-   * @private
-   * @param  {object} obj
-   * @return {object} Regexes
-   */
-  __initRegexes(obj) {
-    var _regexes = {};
-
-    for (var _key in obj) {
-      var _entry = obj[_key];
-
-      if (Array.isArray(_entry)) {
-        _regexes[_key] = [];
-
-        for (var _i = 0; _i < _entry.length; _i++) {
-          _regexes[_key].push(
-            buildSafeRegExp(_entry[_i])
-          );
-        }
-      } else if (typeof _entry === "object" && Object.keys(_entry).length > 0) {
-        _regexes[_key] = this.__initRegexes(_entry);
-      } else {
-        _regexes[_key] = buildSafeRegExp(_entry);
-      }
-    }
-
-    return _regexes;
-  }
-
-
   /**
    * Parses the bounce error
    * @private
@@ -554,8 +528,7 @@ class Parser {
     _str = _str.replace(this.__regexes.line_break_double_indent_single, "\n\n");
 
     // Replace single Line-break with regular space
-    // TODO: re2 doesn't support lookbehinds, so for now we use a pure-JS regex
-    _str = _str.replace(/(?<!\n)\n(?!\n)/gm, " ");
+    _str = _str.replace(this.__regexes.line_break_single, " ");
 
     // Replace long indent with double Line-break
     _str = _str.replace(this.__regexes.indent_long, "\n\n");

package/lib/utils.js

@@ -1,48 +1,9 @@
 "use strict";
 
-/**************************************************************************
- * IMPORTS
- ***************************************************************************/
-
-/**************************************************************************
- * INSTANCES
- ***************************************************************************/
-
-var RE2Engine = detectRE2();
-
 /**************************************************************************
  * FUNCTIONS
  ***************************************************************************/
 
-/**
- * Detects whether the RE2 engine is available
- * @private
- * @return {function|null} The RE2 engine, or null if unavailable
- */
-function detectRE2() {
-  // Notice: RE2 can be explicitly disabled, to test the RegExp fallback
-  if (process.env.EMAIL_BOUNCE_PARSER_DISABLE_RE2) {
-    return null;
-  }
-
-  try {
-    return require("re2");
-  } catch (error) {
-    return null;
-  }
-}
-
-/**
- * Builds a safe regular expression (RE2 when available, RegExp otherwise)
- * @public
- * @param  {string|RegExp} source
- * @return {RegExp}        The regular expression
- */
-var buildSafeRegExp = function(source) {
-  return (RE2Engine !== null) ? new RE2Engine(source) : new RegExp(source);
-}
-
-
 /**
  * Executes multiple regular expressions until one succeeds
  * @public
@@ -62,12 +23,6 @@ var loopRegexes = function(
   for (var _i = 0; _i < regexes.length; _i++) {
     var _regex = regexes[_i];
 
-    if (typeof regexes[_i] === "string") {
-      // Build the regex
-      _regex = buildSafeRegExp(regexes[_i]);
-    }
-
-    // Notice: call String methods, as they support both RE2 and RegExp
     var _currentMatch;
 
     if (mode === "replace") {
@@ -138,12 +93,10 @@ var trimString = function(str) {
  * EXPORTS
  ***************************************************************************/
 
-exports.buildSafeRegExp = buildSafeRegExp;
-exports.loopRegexes     = loopRegexes;
-exports.trimString      = trimString;
+exports.loopRegexes = loopRegexes;
+exports.trimString  = trimString;
 
 exports.default = {
-  buildSafeRegExp : buildSafeRegExp,
-  loopRegexes     : loopRegexes,
-  trimString      : trimString
+  loopRegexes : loopRegexes,
+  trimString  : trimString
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "email-bounce-parser",
-  "version": "1.1.1",
+  "version": "2.0.0",
   "description": "Parses bounce emails and extract errors",
   "author": "Eliott Vincent <eliott@crisp.chat>",
   "main": "lib/index.js",
@@ -18,23 +18,10 @@
   },
   "scripts": {
     "unit": "nodeunit ./test/index.js",
-    "unit:regexp": "EMAIL_BOUNCE_PARSER_DISABLE_RE2=1 npm run unit",
-    "test": "npm run unit && npm run unit:regexp"
+    "test": "npm run unit"
   },
   "devDependencies": {
-    "nodeunit-x": "0.15.0",
-    "re2": "1.27.0"
-  },
-  "peerDependencies": {
-    "re2": "1.x"
-  },
-  "peerDependenciesMeta": {
-    "re2": {
-      "optional": true
-    }
-  },
-  "allowScripts": {
-    "re2@1.27.0": true
+    "nodeunit-x": "0.15.0"
   },
   "keywords": [
     "parser",