mailauth 7.1.1 → 7.3.0

package/lib/bimi/index.js

@@ -3,18 +3,26 @@
 const { Buffer } = require('node:buffer');
 const crypto = require('node:crypto');
 const dns = require('node:dns');
-const { formatAuthHeaderRow, parseDkimHeaders, parseTagList, formatDomain, getAlignment } = require('../tools');
+const net = require('node:net');
+const zlib = require('node:zlib');
+const { formatAuthHeaderRow, parseTagList, formatDomain, getAlignment, createError } = require('../tools');
 const Joi = require('joi');
 const libmime = require('libmime');
-const addressparser = require('nodemailer/lib/addressparser');
 const getDmarcRecord = require('../dmarc/get-dmarc-record');
 const { parseDmarcRecord } = getDmarcRecord;
+const { parseFromHeader } = require('../dmarc/author-domain');
 //const packageData = require('../../package.json');
 const httpsSchema = Joi.string().uri({
     scheme: ['https']
 });
 
 const FETCH_TIMEOUT = 5 * 1000;
+// overall time limit for a download, including redirects and the response body
+const DOWNLOAD_TIMEOUT = 30 * 1000;
+const MAX_REDIRECTS = 3;
+// SVG Tiny PS 2.4: an Indicator SHOULD NOT exceed 32 kilobytes, uncompressed
+const MAX_LOGO_SIZE = 64 * 1024;
+const MAX_EVIDENCE_SIZE = 256 * 1024;
 
 const { fetch: fetchCmd, Agent } = require('undici');
 const fetchAgent = new Agent({
@@ -23,12 +31,50 @@ const fetchAgent = new Agent({
 
 const { vmc } = require('@postalsys/vmc');
 const { validateSvg } = require('./validate-svg');
+const { SELECTOR } = require('../dkim/syntax');
 
 // Records that do not start with a "v=" tag for the current version are discarded (7.2 steps 4 and 7)
 const BIMI_VERSION_RE = /^v[ \t]*=[ \t]*BIMI1[ \t]*(?:;|$)/i;
+// 4.3: the value of v= MUST match precisely
+const BIMI_VERSION_STRICT_RE = /^v[ \t]*=[ \t]*BIMI1[ \t]*(?:;|$)/;
+
+// Tags of the Assertion Record (4.3), used to report capitalization errors
+const KNOWN_TAGS = new Set(['v', 'l', 'a', 'lps', 'avp']);
+
+// 4.3.2: only SVG and SVGZ are acceptable, a URI ending with another image format suffix is an error
+const OTHER_IMAGE_SUFFIX_RE = /\.(?:png|apng|jpe?g|jfif|gif|bmp|webp|ico|tiff?|heic|heif|avif|jxl)$/i;
 
 const POLICY_VALUES = new Set(['none', 'quarantine', 'reject']);
 
+// 4.3: avp= values, any other value is ignored and not added to headers
+const AVATAR_PREFERENCES = new Set(['personal', 'brand']);
+
+// Checks that a URL is an HTTPS URL with a fully qualified domain name (4.3): IP literals,
+// single-label names and localhost are not allowed
+const isValidHttpsUrl = value => {
+    if (httpsSchema.validate(value).error) {
+        return false;
+    }
+    let url;
+    try {
+        url = new URL(value);
+    } catch (err) {
+        return false;
+    }
+    let hostname = url.hostname
+        .replace(/^\[|\]$/g, '')
+        .replace(/\.$/, '')
+        .toLowerCase();
+    if (url.protocol !== 'https:' || !hostname || net.isIP(hostname) || !hostname.includes('.')) {
+        return false;
+    }
+    // URL parsing already turns numeric hosts like "https://2130706433/" into IPv4 addresses
+    if (/^[0-9.]+$/.test(hostname) || hostname === 'localhost' || hostname.endsWith('.localhost')) {
+        return false;
+    }
+    return true;
+};
+
 // Returns the reason a DMARC record does not meet the policy requirements of
 // draft-brand-indicators-for-message-identification 7.1 steps 7 to 9, or false if it does
 const checkDmarcRecord = record => {
@@ -47,19 +93,77 @@ const checkDmarcRecord = record => {
 
 // Parses a BIMI Assertion Record, which uses the DKIM tag-list syntax (4.3, RFC 6376 3.2). The
 // values are the strings of the tag list: the parsed map of parseTagList would turn an empty "l="
-// into the number 0. Tag names are case-folded and the last duplicate wins, as before.
-const parseAssertionRecord = record => {
+// into the number 0. By default tag names are case-folded and the last duplicate wins. In strict
+// mode tag names are case-sensitive and syntax errors such as duplicate tags are reported.
+const parseAssertionRecord = (record, strict, warnings) => {
     let tags = {};
-    for (let tag of parseTagList(record).tags) {
-        let name = tag.name.trim().toLowerCase();
+    let { tags: tagList, syntaxErrors } = parseTagList(record);
+    for (let tag of tagList) {
+        let name = tag.name.trim();
+        if (!strict) {
+            if (name !== name.toLowerCase() && KNOWN_TAGS.has(name.toLowerCase())) {
+                warnings.push('record-tag-case');
+            }
+            name = name.toLowerCase();
+        }
         if (name) {
             tags[name] = tag.value;
         }
     }
-    return tags;
+    if (syntaxErrors.length && !strict) {
+        warnings.push('record-syntax');
+    }
+    return { tags, syntaxErrors };
 };
 
-// Counts the addresses in the From header fields, including members of a group
+// 4.4: selector = sub-domain *( "." sub-domain ), sub-domain from RFC 5321, the same grammar as
+// the DKIM selector. The lax variant allows labels with underscores, as DKIM selectors sometimes have
+const LAX_LABEL = '[A-Za-z0-9_](?:[A-Za-z0-9_-]{0,61}[A-Za-z0-9_])?';
+const LAX_SELECTOR_RE = new RegExp(`^${LAX_LABEL}(?:\\.${LAX_LABEL})*$`);
+
+// Returns the selector of a BIMI-Selector header (5.1), or false if the header has to be ignored
+const parseSelectorHeader = (line, strict, warnings) => {
+    // the header field value, with or without the field name in front of it
+    let value = (line || '').toString().replace(/^\s*bimi-selector\s*:/i, '');
+    let { tags, syntaxErrors } = parseTagList(value);
+    if (syntaxErrors.length) {
+        if (strict) {
+            return false;
+        }
+        warnings.push('selector-syntax');
+    }
+
+    let values = {};
+    for (let tag of tags) {
+        let name = strict ? tag.name : tag.name.toLowerCase();
+        values[name] = tag.value;
+    }
+
+    // the version MUST match precisely and be the first tag
+    let version = values.v;
+    if (strict ? tags[0]?.name !== 'v' || version !== 'BIMI1' : version?.toLowerCase() !== 'bimi1') {
+        return false;
+    }
+    if (version !== 'BIMI1') {
+        warnings.push('selector-version-case');
+    }
+    if (tags[0]?.name.toLowerCase() !== 'v') {
+        warnings.push('selector-syntax');
+    }
+
+    let selector = (values.s || '').trim();
+    if (SELECTOR.test(selector)) {
+        return selector;
+    }
+    if (!strict && LAX_SELECTOR_RE.test(selector)) {
+        warnings.push('selector-syntax');
+        return selector;
+    }
+    return false;
+};
+
+// Counts the addresses in the From header fields, including members of a group. The From header
+// field is parsed the same way as for the DMARC check
 const countFromAddresses = headerRows => {
     let fromRows = headerRows.filter(row => row.key === 'from');
     if (fromRows.length > 1) {
@@ -69,10 +173,7 @@ const countFromAddresses = headerRows => {
     for (let row of fromRows) {
         let value = (row.line || '').toString();
         let splitterPos = value.indexOf(':');
-        let list = addressparser((splitterPos >= 0 ? value.substr(splitterPos + 1) : value).trim());
-        for (let entry of list) {
-            count += Array.isArray(entry.group) ? entry.group.length : 1;
-        }
+        count += parseFromHeader(splitterPos >= 0 ? value.substr(splitterPos + 1) : value).addresses.length;
     }
     return count;
 };
@@ -89,6 +190,8 @@ const lookup = async data => {
     }
 
     let response = { status: { header: {} } };
+    // syntax deviations that were accepted because strict is not set
+    let warnings = [];
 
     const finish = (result, comment) => {
         response.status.result = result;
@@ -96,6 +199,9 @@ const lookup = async data => {
             response.status.comment = comment;
         }
         response.info = formatAuthHeaderRow('bimi', response.status, { strict });
+        if (warnings.length) {
+            response.warnings = Array.from(new Set(warnings));
+        }
         return response;
     };
 
@@ -167,24 +273,16 @@ const lookup = async data => {
 
     let selector;
 
-    let bimiSelectorHeader;
-    for (let row of headerRows) {
-        if (['bimi-selector'].includes(row.key)) {
-            if (bimiSelectorHeader) {
-                // already found one
-                return finish('fail', 'multiple BIMI-Selector headers');
-            }
-
-            bimiSelectorHeader = parseDkimHeaders(row.line);
-            if (bimiSelectorHeader?.parsed?.v?.value?.toLowerCase() !== 'bimi1') {
-                return finish('fail', 'missing bimi version in selector header');
-            }
-
-            selector = bimiSelectorHeader?.parsed?.s?.value;
-        }
+    let selectorRows = headerRows.filter(row => row.key === 'bimi-selector');
+    if (selectorRows.length > 1) {
+        return finish('fail', 'multiple BIMI-Selector headers');
+    }
+    if (selectorRows.length) {
+        // 5.1 and 7.2 step 2: a header without a valid version or selector is ignored
+        selector = parseSelectorHeader(selectorRows[0].line, strict, warnings);
     }
 
-    selector = selector?.trim() || 'default';
+    selector = selector || 'default';
 
     // 7.2 steps 3 and 6: the selector at the Author Domain, then the same selector at the
     // Organizational Domain. A custom selector does not fall back to "default".
@@ -210,7 +308,7 @@ const lookup = async data => {
         let records = []
             .concat(txt || [])
             .map(row => (Array.isArray(row) ? row.join('') : String(row)).trim())
-            .filter(row => BIMI_VERSION_RE.test(row));
+            .filter(row => (strict ? BIMI_VERSION_STRICT_RE : BIMI_VERSION_RE).test(row));
 
         if (records.length === 1) {
             record = records[0];
@@ -228,11 +326,20 @@ const lookup = async data => {
         return finish('none');
     }
 
-    let recordData = parseAssertionRecord(record);
+    if (!BIMI_VERSION_STRICT_RE.test(record)) {
+        warnings.push('record-version-case');
+    }
+
+    let { tags: recordData, syntaxErrors } = parseAssertionRecord(record, strict, warnings);
     if (recordData.v?.toLowerCase() !== 'bimi1') {
         return finish('fail', 'missing bimi version in dns record');
     }
 
+    // 4.3: Assertion Records are defined precisely, receivers MUST NOT fix syntax or capitalization errors
+    if (strict && syntaxErrors.length) {
+        return finish('fail', 'invalid syntax in dns record');
+    }
+
     let location = recordData.l;
     let authority = recordData.a;
 
@@ -246,19 +353,34 @@ const lookup = async data => {
         return finish('fail', 'missing location value in dns record');
     }
 
-    let locationValidation = httpsSchema.validate(location);
-    if (locationValidation.error) {
+    if (!isValidHttpsUrl(location)) {
         return finish('fail', 'invalid location value in dns record');
     }
 
-    if (authority) {
-        let authorityValidation = httpsSchema.validate(authority);
-        if (authorityValidation.error) {
-            return finish('fail', 'invalid authority value in dns record');
+    if (authority && !isValidHttpsUrl(authority)) {
+        return finish('fail', 'invalid authority value in dns record');
+    }
+
+    // 4.3: a single URI, commas within a URI MUST be encoded
+    for (let [value, comment] of [
+        [location, 'invalid location value in dns record'],
+        [authority, 'invalid authority value in dns record']
+    ]) {
+        if (value && value.includes(',')) {
+            if (strict) {
+                return finish('fail', comment);
+            }
+            warnings.push('uri-comma');
         }
     }
 
-    response.status.result = 'pass';
+    // 4.3.2: an l= URI that ends with another image format suffix is a permanent error
+    if (OTHER_IMAGE_SUFFIX_RE.test(new URL(location).pathname)) {
+        if (strict) {
+            return finish('fail', 'unsupported image format in location value');
+        }
+        warnings.push('location-format');
+    }
 
     response.location = location;
 
@@ -269,16 +391,43 @@ const lookup = async data => {
         response.status.policy = { authority: 'none', 'authority-uri': authority }; // VMC has not been actually checked here yet, so authority is none
     }
 
-    if (recordData.p) {
-        response.preference = recordData.p;
+    if (AVATAR_PREFERENCES.has(recordData.avp)) {
+        response.preference = recordData.avp;
     }
 
-    response.info = formatAuthHeaderRow('bimi', response.status, { strict });
-    return response;
+    return finish('pass');
+};
+
+const tooLarge = maxSize => createError(`File is larger than ${maxSize} bytes`, 'FILE_TOO_LARGE');
+
+// Reads a response body, stops at maxSize bytes (7.6 step 1 allows a retrieval limit)
+const readBody = async (res, maxSize) => {
+    if (Number(res.headers.get('content-length')) > maxSize) {
+        await res.body?.cancel().catch(() => false);
+        throw tooLarge(maxSize);
+    }
+    let chunks = [];
+    let size = 0;
+    if (res.body) {
+        // leaving the loop early cancels the stream
+        for await (let chunk of res.body) {
+            size += chunk.length;
+            if (size > maxSize) {
+                throw tooLarge(maxSize);
+            }
+            chunks.push(Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+        }
+    }
+    return Buffer.concat(chunks, size);
 };
 
-const downloadPromise = async (url, cachedFile) => {
+const getSizeOption = (value, defaultValue) => (typeof value === 'number' && value > 0 ? value : defaultValue);
+
+const downloadPromise = async (url, cachedFile, maxSize, opts) => {
     if (cachedFile) {
+        if (cachedFile.length > maxSize) {
+            throw tooLarge(maxSize);
+        }
         return cachedFile;
     }
 
@@ -286,22 +435,74 @@ const downloadPromise = async (url, cachedFile) => {
         return false;
     }
 
-    let res = await fetchCmd(url, {
-        headers: {
-            // Comment: AKAMAI does some strange UA based filtering that messes up the request
-            // 'User-Agent': `mailauth/${packageData.version} (+${packageData.homepage}`
-        },
-        dispatcher: fetchAgent
-    });
+    let timeout = getSizeOption(opts.timeout, DOWNLOAD_TIMEOUT);
+    let signal = AbortSignal.timeout(timeout);
+
+    try {
+        // Redirects are followed manually, each target has to be a valid HTTPS URL (7.5 step 1)
+        for (let redirects = 0; ; redirects++) {
+            if (!isValidHttpsUrl(url)) {
+                throw createError('Download URL must be an HTTPS URL with a domain name', 'INVALID_URL', { details: { url } });
+            }
+
+            let res = await fetchCmd(url, {
+                headers: {
+                    // Comment: AKAMAI does some strange UA based filtering that messes up the request
+                    // 'User-Agent': `mailauth/${packageData.version} (+${packageData.homepage}`
+                },
+                redirect: 'manual',
+                signal,
+                dispatcher: opts.dispatcher || fetchAgent
+            });
+
+            if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+                await res.body?.cancel().catch(() => false);
+                let target;
+                try {
+                    target = new URL(res.headers.get('location'), url).href;
+                } catch (err) {
+                    target = res.headers.get('location');
+                }
+                if (redirects >= MAX_REDIRECTS || !isValidHttpsUrl(target)) {
+                    throw createError(
+                        redirects >= MAX_REDIRECTS ? 'Too many redirects' : 'Redirect target must be an HTTPS URL with a domain name',
+                        'HTTP_REDIRECT_NOT_ALLOWED',
+                        { redirect: target }
+                    );
+                }
+                url = target;
+                continue;
+            }
 
-    if (!res.ok) {
-        let error = new Error(`Request failed with status ${res.status}`);
-        error.code = 'HTTP_REQUEST_FAILED';
-        throw error;
+            if (!res.ok) {
+                await res.body?.cancel().catch(() => false);
+                throw createError(`Request failed with status ${res.status}`, 'HTTP_REQUEST_FAILED');
+            }
+
+            return await readBody(res, maxSize);
+        }
+    } catch (err) {
+        // DOMException codes are numbers
+        if (signal.aborted && typeof err.code !== 'string') {
+            throw createError(`Request timed out after ${timeout} ms`, 'HTTP_REQUEST_TIMEOUT');
+        }
+        throw err;
     }
+};
 
-    const arrayBufferValue = await res.arrayBuffer();
-    return Buffer.from(arrayBufferValue);
+// Returns the SVG document of a downloaded Indicator. An SVGZ file is uncompressed (5.3, 7.10).
+const getIndicatorSvg = (data, maxSize) => {
+    if (data.length >= 2 && data[0] === 0x1f && data[1] === 0x8b) {
+        try {
+            return zlib.gunzipSync(data, { maxOutputLength: maxSize });
+        } catch (err) {
+            if (err.code === 'ERR_BUFFER_TOO_LARGE') {
+                throw tooLarge(maxSize);
+            }
+            throw createError('Invalid SVGZ file', 'INVALID_SVGZ_FILE');
+        }
+    }
+    return data;
 };
 
 const validateVMC = async (bimiData, opts) => {
@@ -315,8 +516,11 @@ const validateVMC = async (bimiData, opts) => {
 
     let promises = [];
 
-    promises.push(downloadPromise(bimiData.location, bimiData.locationPath));
-    promises.push(downloadPromise(bimiData.authority, bimiData.authorityPath));
+    let maxLogoSize = getSizeOption(opts.maxLogoSize, MAX_LOGO_SIZE);
+    let maxEvidenceSize = getSizeOption(opts.maxEvidenceSize, MAX_EVIDENCE_SIZE);
+
+    promises.push(downloadPromise(bimiData.location, bimiData.locationPath, maxLogoSize, opts));
+    promises.push(downloadPromise(bimiData.authority, bimiData.authorityPath, maxEvidenceSize, opts));
 
     if (!promises.length) {
         return false;
@@ -326,6 +530,11 @@ const validateVMC = async (bimiData, opts) => {
         await Promise.allSettled(promises);
 
     let result = {};
+    // profile deviations of the logo files that were accepted because strict is not set
+    let warnings = [];
+    let svgOpts = { strict: !!opts.strict, warnings };
+    // the uncompressed l= logo, once it passed validation
+    let validatedLogo = null;
     if (locationValue || locationError) {
         result.location = {
             url: bimiData.location,
@@ -344,7 +553,25 @@ const validateVMC = async (bimiData, opts) => {
         }
 
         if (result.location.success) {
-            result.location.logoFile = locationValue.toString('base64');
+            // 7.6: the Indicator is validated whether or not an evidence document vouches for it
+            try {
+                let svg = getIndicatorSvg(locationValue, maxLogoSize);
+                validateSvg(svg, svgOpts);
+                validatedLogo = svg;
+                result.location.logoFile = svg.toString('base64');
+            } catch (err) {
+                result.location.success = false;
+                if (err.code === 'FILE_TOO_LARGE') {
+                    // an SVGZ file that is too large when uncompressed
+                    result.location.error = { message: err.message, code: err.code };
+                } else {
+                    result.location.error = {
+                        message: 'Logo SVG validation failed',
+                        details: Object.assign({ message: err.message }, err.details ? { details: err.details } : {}, err.code ? { code: err.code } : {}),
+                        code: 'SVG_VALIDATION_FAILED'
+                    };
+                }
+            }
         }
     }
 
@@ -370,45 +597,33 @@ const validateVMC = async (bimiData, opts) => {
                 let vmcData = await vmc(authorityValue, opts);
 
                 if (!vmcData.logoFile) {
-                    let error = new Error('VMC does not contain a log file');
-                    error.code = 'MISSING_VMC_LOGO';
-                    throw error;
+                    throw createError('VMC does not contain a log file', 'MISSING_VMC_LOGO');
                 }
 
                 if (vmcData?.mediaType?.toLowerCase() !== 'image/svg+xml') {
-                    let error = new Error('Invalid media type for the logo file');
-                    error.details = {
-                        mediaType: vmcData.mediaType
-                    };
-                    error.code = 'INVALID_MEDIATYPE';
-                    throw error;
+                    throw createError('Invalid media type for the logo file', 'INVALID_MEDIATYPE', { details: { mediaType: vmcData.mediaType } });
                 }
 
                 if (!vmcData.validHash) {
-                    let error = new Error('VMC hash does not match logo file');
-                    error.details = {
-                        hashAlgo: vmcData.hashAlgo,
-                        hashValue: vmcData.hashValue,
-                        logoFile: vmcData.logoFile
-                    };
-                    error.code = 'INVALID_LOGO_HASH';
-                    throw error;
+                    throw createError('VMC hash does not match logo file', 'INVALID_LOGO_HASH', {
+                        details: {
+                            hashAlgo: vmcData.hashAlgo,
+                            hashValue: vmcData.hashValue,
+                            logoFile: vmcData.logoFile
+                        }
+                    });
                 }
 
-                // throws on invalid logo file
-                try {
-                    validateSvg(Buffer.from(vmcData.logoFile, 'base64'));
-                } catch (err) {
-                    let error = new Error('VMC logo SVG validation failed');
-                    error.details = Object.assign(
-                        {
-                            message: err.message
-                        },
-                        error.details || {},
-                        err.code ? { code: err.code } : {}
-                    );
-                    error.code = 'SVG_VALIDATION_FAILED';
-                    throw error;
+                // throws on invalid logo file. The same bytes as the l= logo were validated already
+                let vmcLogo = Buffer.from(vmcData.logoFile, 'base64');
+                if (!validatedLogo || !vmcLogo.equals(validatedLogo)) {
+                    try {
+                        validateSvg(vmcLogo, svgOpts);
+                    } catch (err) {
+                        throw createError('VMC logo SVG validation failed', 'SVG_VALIDATION_FAILED', {
+                            details: Object.assign({ message: err.message }, err.code ? { code: err.code } : {})
+                        });
+                    }
                 }
 
                 if (d) {
@@ -435,14 +650,13 @@ const validateVMC = async (bimiData, opts) => {
                     }
 
                     if (!domainVerified) {
-                        let error = new Error('Domain can not be verified');
-                        error.details = {
-                            subjectAltName: vmcData?.certificate?.subjectAltName,
-                            selector,
-                            d
-                        };
-                        error.code = 'VMC_DOMAIN_MISMATCH';
-                        throw error;
+                        throw createError('Domain can not be verified', 'VMC_DOMAIN_MISMATCH', {
+                            details: {
+                                subjectAltName: vmcData?.certificate?.subjectAltName,
+                                selector,
+                                d
+                            }
+                        });
                     } else {
                         result.authority.domainVerified = true;
                     }
@@ -482,19 +696,65 @@ const validateVMC = async (bimiData, opts) => {
         }
     }
 
-    // Generate headers when validation succeeds
+    // 7.9: with an evidence document, the Indicator from l= must be identical to the one in the document
+    let evidenceVerified = !!(result.authority?.success && result.authority.hashMatch === true);
+
+    // Header values come from the Assertion Record, where a tag value can not contain ";" or whitespace
+    const isHeaderSafeUrl = value => isValidHttpsUrl(value) && /^[\x21-\x3a\x3c-\x7e]+$/.test(value);
+
+    // Generate headers when validation succeeds (7.9 to 7.11)
     let canGenerateHeaders =
-        result.location?.success && result.location?.logoFile && (!result.authority || (result.authority.success && result.authority.hashMatch !== false));
+        result.location?.success && result.location?.logoFile && (!result.authority || evidenceVerified) && isHeaderSafeUrl(bimiData.location);
 
     if (canGenerateHeaders) {
+        let locationHeader = `BIMI-Location: v=BIMI1; l=${bimiData.location}`;
+        if (evidenceVerified && isHeaderSafeUrl(bimiData.authority)) {
+            // 5.2: a= is required when the evidence document was verified
+            locationHeader += `; a=${bimiData.authority}`;
+        }
+
         result.headers = {
             indicator: libmime.foldLines(`BIMI-Indicator: ${result.location.logoFile}`, 160),
-            location: `BIMI-Location: v=BIMI1; l=${bimiData.location}`
+            location: locationHeader
         };
 
-        if (bimiData.preference) {
-            result.headers.preference = `BIMI-Logo-Preference: ${bimiData.preference}`;
+        // 5.4 and 7.11: the header is not added for an invalid value
+        if (AVATAR_PREFERENCES.has(bimiData.preference)) {
+            result.headers.preference = `BIMI-Logo-Preference: avp=${bimiData.preference}`;
+        }
+    }
+
+    // 7.7: the Authentication-Results entry of bimi() only covers record discovery. Update it with the
+    // results of Indicator and evidence validation.
+    if (bimiData.status?.result === 'pass') {
+        let status = Object.assign({}, bimiData.status, { header: Object.assign({}, bimiData.status.header) });
+        delete status.comment;
+
+        if (result.authority) {
+            // policy.authority is "pass" or "fail" once the evidence document was checked
+            status.policy = Object.assign({}, status.policy, { authority: evidenceVerified ? 'pass' : 'fail', 'authority-uri': bimiData.authority });
+        }
+
+        let comment;
+        if (!result.location?.success) {
+            comment = result.location?.error?.code === 'SVG_VALIDATION_FAILED' ? 'invalid SVG indicator' : 'failed to retrieve indicator';
+        } else if (result.authority && !result.authority.success) {
+            comment = 'evidence document validation failed';
+        } else if (result.authority && !evidenceVerified) {
+            comment = 'indicator does not match evidence document';
         }
+
+        if (comment) {
+            status.result = 'fail';
+            status.comment = comment;
+        }
+
+        result.status = status;
+        result.info = formatAuthHeaderRow('bimi', status, { strict: !!opts.strict });
+    }
+
+    if (warnings.length) {
+        result.warnings = warnings;
     }
 
     return result;