haraka-plugin-karma 2.5.0 → 2.5.1

package/CHANGELOG.md

@@ -4,7 +4,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
 ### Unreleased
 
-### [2.5.0] - 2026-05-17
+### [2.5.1] - 2026-05-24
+
+- fix: guard pubsub JSON.parse and validate payload shape in check_result
+- fix: guard new RegExp() in check_result_match against invalid config
+- fix: results_init fast-path now calls next() when notes.redis exists
+- fix: preserve originating plugin on awards so AUTH repeat-scoring works
+- fix: check_result_length measures collection length per karma.ini docs
+- fix: detect empty hGetAll ({}) in ip_history_from_redis and check_asn (node-redis v4)
+- docs: README threshold wording matches deny boundary
+
+### [2.5.0] - 2026-05-24
 
 - dep(address-rfc2821): -> @haraka/email-address
 
@@ -184,3 +194,4 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/).
 [2.4.0]: https://github.com/haraka/haraka-plugin-karma/releases/tag/v2.4.0
 [2.4.1]: https://github.com/haraka/haraka-plugin-karma/releases/tag/v2.4.1
 [2.5.0]: https://github.com/haraka/haraka-plugin-karma/releases/tag/v2.5.0
+[2.5.1]: https://github.com/haraka/haraka-plugin-karma/releases/tag/v2.5.1

package/README.md

@@ -20,7 +20,7 @@ In order to score a plugins results, plugins must save their results to the [Res
 
 ## How Karma Works
 
-Karma takes a holistic view of **connections**. During the connection, karma collects these results and applies the [result_awards](#awards) defined in `karma.ini`. Once a connection/message exceeds the threshold.negative score (default: -8), karma rejects it at the next [deny]hook.
+Karma takes a holistic view of **connections**. During the connection, karma collects these results and applies the [result_awards](#awards) defined in `karma.ini`. Once a connection/message reaches the threshold.negative score (default: -8), karma rejects it at the next [deny]hook.
 
 The scoring mechanism is not dissimilar to [SpamAssassin][sa-url], but Karma has some particular advantages:
 
@@ -51,7 +51,7 @@ Karma performs checks early and often, maximizing the penality it can exact upon
 
 ### Deny / Reject
 
-When connections become worse than [thresholds]negative, they are denied during the next [deny]hook.
+When a connection's score reaches [thresholds]negative (equal or lower), it is denied during the next [deny]hook.
 
 ### History
 

package/index.js

@@ -101,7 +101,7 @@ exports.results_init = async function (next, connection) {
 
   if (connection.notes.redis) {
     connection.logdebug(this, `redis already subscribed`)
-    return // another plugin has already called this.
+    return next() // another plugin has already called this.
   }
 
   connection.notes.redis = redis.createClient(this.redisCfg.pubsub)
@@ -134,7 +134,15 @@ exports.preparse_result_awards = function () {
 
     if (!ra[pi_name][prop]) ra[pi_name][prop] = []
 
-    ra[pi_name][prop].push({ id: anum, operator, value, award, reason, resolv })
+    ra[pi_name][prop].push({
+      id: anum,
+      plugin: pi_name,
+      operator,
+      value,
+      award,
+      reason,
+      resolv,
+    })
   }
 }
 
@@ -142,8 +150,17 @@ exports.check_result = function (connection, message) {
   // {"plugin":"karma","result":{"fail":"spamassassin.hits"}}
   // {"plugin":"geoip","result":{"country":"CN"}}
 
-  const m = JSON.parse(message)
-  if (m?.result?.asn) {
+  let m
+  try {
+    m = JSON.parse(message)
+  } catch (err) {
+    connection.logerror(this, `invalid pubsub payload: ${err.message}`)
+    return
+  }
+  if (!m || typeof m !== 'object' || typeof m.plugin !== 'string') return
+  if (!m.result || typeof m.result !== 'object') return
+
+  if (m.result.asn) {
     this.check_result_asn(m.result.asn, connection)
   }
   if (!this.result_awards[m.plugin]) return // no awards for plugin
@@ -247,7 +264,13 @@ exports.check_result_equal = function (thisResult, thisAward, conn) {
 }
 
 exports.check_result_match = function (thisResult, thisAward, conn) {
-  const re = new RegExp(thisAward.value, 'i')
+  let re
+  try {
+    re = new RegExp(thisAward.value, 'i')
+  } catch {
+    conn.results.add(this, { err: `invalid regex: ${thisAward.value}` })
+    return
+  }
 
   for (const element of thisResult) {
     if (!re.test(element)) continue
@@ -259,29 +282,31 @@ exports.check_result_match = function (thisResult, thisAward, conn) {
 }
 
 exports.check_result_length = function (thisResult, thisAward, conn) {
-  for (const element of thisResult) {
-    const [operator, qty] = thisAward.value.split(/\s+/)
+  const [operator, qty] = thisAward.value.split(/\s+/)
+  const len = thisResult.length
+  const threshold = parseFloat(qty)
+
+  switch (operator) {
+    case 'eq':
+    case 'equal':
+    case 'equals':
+      if (len !== threshold) return
+      break
+    case 'gt':
+      if (len <= threshold) return
+      break
+    case 'lt':
+      if (len >= threshold) return
+      break
+    default:
+      conn.results.add(this, { err: `invalid operator: ${operator}` })
+      return
+  }
 
-    switch (operator) {
-      case 'eq':
-      case 'equal':
-      case 'equals':
-        if (parseInt(element, 10) != parseInt(qty, 10)) continue
-        break
-      case 'gt':
-        if (parseInt(element, 10) <= parseInt(qty, 10)) continue
-        break
-      case 'lt':
-        if (parseInt(element, 10) >= parseInt(qty, 10)) continue
-        break
-      default:
-        conn.results.add(this, { err: `invalid operator: ${operator}` })
-        continue
-    }
+  if (conn.results.has('karma', 'awards', thisAward.id)) return
 
-    conn.results.incr(this, { score: thisAward.award })
-    conn.results.push(this, { awards: thisAward.id })
-  }
+  conn.results.incr(this, { score: thisAward.award })
+  conn.results.push(this, { awards: thisAward.id })
 }
 
 exports.check_result_exists = function (thisResult, thisAward, conn) {
@@ -577,7 +602,7 @@ exports.ip_history_from_redis = async function (next, connection) {
   try {
     const dbr = await this.db.hGetAll(dbkey)
 
-    if (dbr === null) {
+    if (!dbr || Object.keys(dbr).length === 0) {
       this.init_ip(dbkey, connection.remote.ip, expire)
       return next()
     }
@@ -982,7 +1007,7 @@ exports.check_asn = async function (connection, asnkey) {
   try {
     const res = await this.db.hGetAll(asnkey)
 
-    if (res === null) {
+    if (!res || Object.keys(res).length === 0) {
       const expire = (this.cfg.redis.expire_days || 60) * 86400 // days
       this.init_asn(asnkey, expire)
       return

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "haraka-plugin-karma",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "A heuristics scoring and reputation engine for SMTP connections",
   "main": "index.js",
   "files": [