spamscanner 7.0.12 → 7.0.13

package/dist/esm/index.js

@@ -5695,8 +5695,8 @@ var MAX_EMBEDDED_LENGTH = 10 * 1024 * 1024;
 var MAX_ATTACHED = 100;
 var MAX_ATTACHED_BYTES = 50 * 1024 * 1024;
 var MAX_READ_TIME = 5e3;
-var MAX_CARD_BYTES = 4 * 1024 * 1024;
 var MAX_SHOWN_BYTES = 1024 * 1024;
+var MAX_CARD_TEXT = 8 * 1024 * 1024;
 function isHostCode2(code) {
   return code >= 97 && code <= 122 || code >= 65 && code <= 90 || code >= 48 && code <= 57 || code === 45 || code === 46;
 }
@@ -5816,9 +5816,22 @@ function* attributesOf(html) {
   }
 }
 var MAX_VALUE2 = 1024 * 1024;
+var MAX_REFERENCES = 64 * 1024;
+function isCut(value) {
+  if (value.length <= MAX_VALUE2) {
+    return false;
+  }
+  let references = 0;
+  for (let index = value.indexOf("&"); index !== -1; index = value.indexOf("&", index + 1)) {
+    if (++references > MAX_REFERENCES) {
+      return true;
+    }
+  }
+  return false;
+}
 var LONG_VALUE = 64 * 1024;
 function linksOf(name, value, { add, embed, cut }) {
-  if (value.length > MAX_VALUE2) {
+  if (isCut(value)) {
     cut();
     value = value.slice(0, MAX_VALUE2);
   }
@@ -6241,14 +6254,27 @@ function quotedPrintableValues(text) {
   }
   return out.join("\n");
 }
-function shownText(text) {
+function hasQuotedPrintable(text) {
+  const unfolded = text.replaceAll(FOLD, "");
+  if (!/quoted-printable/i.test(unfolded)) {
+    return false;
+  }
+  return unfolded.split(LINE_BREAK).some((line) => {
+    const colon = valueColon(line);
+    return colon !== -1 && QUOTED_PRINTABLE.test(line.slice(0, colon));
+  });
+}
+function shownText(text, full = true) {
   const unfolded = text.replaceAll(FOLD, "");
   const shown = /* @__PURE__ */ new Set([text, readEscapes(unfolded)]);
-  const decoded = quotedPrintableValues(unfolded);
-  if (decoded !== unfolded) {
-    shown.add(readEscapes(decoded));
-    if (unfolded !== text) {
-      shown.add(quotedPrintableValues(text));
+  let decoded = unfolded;
+  if (full) {
+    decoded = quotedPrintableValues(unfolded);
+    if (decoded !== unfolded) {
+      shown.add(readEscapes(decoded));
+      if (unfolded !== text) {
+        shown.add(quotedPrintableValues(text));
+      }
     }
   }
   if (/\\[^nN,;\\]/.test(decoded)) {
@@ -6281,40 +6307,50 @@ function htmlDescriptions(text) {
   return html.join("\n");
 }
 var BINARY = /;\s*(?:(?:encoding\s*=\s*)?"?(?:b|base64)"?|value\s*=\s*"?binary"?)\s*(?:;|$)/i;
-function withoutBinaryValues(text) {
+function withoutBinaryValues(text, limit = Number.POSITIVE_INFINITY) {
   if (!/base64|binary|encoding\s*=\s*"?b|;\s*b\s*[;:]/i.test(text)) {
     return text;
   }
   const lines2 = text.split(LINE_BREAK);
   const out = [];
+  let length = 0;
+  const push = (line) => {
+    out.push(line);
+    length += line.length + 1;
+  };
   for (let i = 0; i < lines2.length; i++) {
+    if (length > limit) {
+      break;
+    }
     const line = lines2[i];
     const colon = valueColon(line);
     if (colon === -1 || !BINARY.test(line.slice(0, colon))) {
-      out.push(line);
+      push(line);
       continue;
     }
-    const value = [line.slice(colon + 1)];
+    let base64 = /^[\w+/=\s]*$/.test(line.slice(colon + 1));
     let next = i + 1;
     while (next < lines2.length && (lines2[next].startsWith(" ") || lines2[next].startsWith("	"))) {
-      value.push(lines2[next++]);
+      base64 &&= /^[\w+/=\s]*$/.test(lines2[next]);
+      next++;
     }
-    if (!value.every((part) => /^[\w+/=\s]*$/.test(part))) {
+    if (!base64) {
       for (let index = i; index < next; index++) {
-        out.push(lines2[index]);
+        push(lines2[index]);
       }
       i = next - 1;
       continue;
     }
     while (next < lines2.length && lines2[next] !== "" && /^[\w+/=]+$/.test(lines2[next])) {
-      value.push(lines2[next++]);
+      next++;
     }
+    const end = next;
     if (next < lines2.length && lines2[next] === "") {
       next++;
     }
-    i = next - 1;
     const name = line.slice(0, colon).split(";")[0].split(".").pop().trim().toLowerCase();
-    out.push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + Buffer7.from(value.join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + Buffer7.from([line.slice(colon + 1), ...lines2.slice(i + 1, end)].join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    i = next - 1;
   }
   return out.join("\n");
 }
@@ -6399,16 +6435,20 @@ function* documentsOf(attachments, state, late) {
       yield { text };
       continue;
     }
-    let readable = withoutBinaryValues(text.length > MAX_CARD_BYTES ? text.slice(0, MAX_CARD_BYTES) : text);
-    if (text.length > MAX_CARD_BYTES || readable.length > MAX_SHOWN_BYTES) {
+    let readable = withoutBinaryValues(text, MAX_CARD_TEXT);
+    if (readable.length > MAX_CARD_TEXT) {
+      state.tooComplex = true;
+      readable = readable.slice(0, MAX_CARD_TEXT);
+    }
+    const full = readable.length <= MAX_SHOWN_BYTES;
+    if (!full && hasQuotedPrintable(readable)) {
       state.tooComplex = true;
-      readable = readable.slice(0, MAX_SHOWN_BYTES);
     }
     if (late()) {
       state.incomplete = true;
       return;
     }
-    yield { text: shownText(readable) };
+    yield { text: shownText(readable, full) };
     if (late()) {
       state.incomplete = true;
       return;
@@ -6597,10 +6637,11 @@ function carriedLinkHosts(mail, {
         if (done() || spend(link.length)) {
           break;
         }
-        if (link.length > MAX_VALUE2) {
+        const cut = isCut(link);
+        if (cut) {
           state.tooComplex = true;
         }
-        add(decodeEntities(link.slice(0, MAX_VALUE2), { attribute: true }));
+        add(decodeEntities(cut ? link.slice(0, MAX_VALUE2) : link, { attribute: true }));
       }
     }
     for (const chunk2 of chunksOf(text)) {
@@ -8278,7 +8319,7 @@ function scoreResults(results, options) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.12",
+  version: "7.0.13",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"