spamscanner 7.0.12 → 7.0.14

package/dist/cjs/index.cjs

@@ -6358,8 +6358,20 @@ function* attributesOf(html2) {
     TAG_START.lastIndex = Math.max(i, match.index + 1);
   }
 }
+function isCut(value) {
+  if (value.length <= MAX_VALUE2) {
+    return false;
+  }
+  let references = 0;
+  for (let index = value.indexOf("&"); index !== -1; index = value.indexOf("&", index + 1)) {
+    if (++references > MAX_REFERENCES) {
+      return true;
+    }
+  }
+  return false;
+}
 function linksOf(name, value, { add, embed, cut }) {
-  if (value.length > MAX_VALUE2) {
+  if (isCut(value)) {
     cut();
     value = value.slice(0, MAX_VALUE2);
   }
@@ -6772,14 +6784,27 @@ function quotedPrintableValues(text) {
   }
   return out.join("\n");
 }
-function shownText(text) {
+function hasQuotedPrintable(text) {
+  const unfolded = text.replaceAll(FOLD, "");
+  if (!/quoted-printable/i.test(unfolded)) {
+    return false;
+  }
+  return unfolded.split(LINE_BREAK).some((line) => {
+    const colon = valueColon(line);
+    return colon !== -1 && QUOTED_PRINTABLE.test(line.slice(0, colon));
+  });
+}
+function shownText(text, full = true) {
   const unfolded = text.replaceAll(FOLD, "");
   const shown = /* @__PURE__ */ new Set([text, readEscapes(unfolded)]);
-  const decoded = quotedPrintableValues(unfolded);
-  if (decoded !== unfolded) {
-    shown.add(readEscapes(decoded));
-    if (unfolded !== text) {
-      shown.add(quotedPrintableValues(text));
+  let decoded = unfolded;
+  if (full) {
+    decoded = quotedPrintableValues(unfolded);
+    if (decoded !== unfolded) {
+      shown.add(readEscapes(decoded));
+      if (unfolded !== text) {
+        shown.add(quotedPrintableValues(text));
+      }
     }
   }
   if (/\\[^nN,;\\]/.test(decoded)) {
@@ -6811,40 +6836,50 @@ function htmlDescriptions(text) {
   }
   return html2.join("\n");
 }
-function withoutBinaryValues(text) {
+function withoutBinaryValues(text, limit = Number.POSITIVE_INFINITY) {
   if (!/base64|binary|encoding\s*=\s*"?b|;\s*b\s*[;:]/i.test(text)) {
     return text;
   }
   const lines2 = text.split(LINE_BREAK);
   const out = [];
+  let length = 0;
+  const push = (line) => {
+    out.push(line);
+    length += line.length + 1;
+  };
   for (let i = 0; i < lines2.length; i++) {
+    if (length > limit) {
+      break;
+    }
     const line = lines2[i];
     const colon = valueColon(line);
     if (colon === -1 || !BINARY.test(line.slice(0, colon))) {
-      out.push(line);
+      push(line);
       continue;
     }
-    const value = [line.slice(colon + 1)];
+    let base64 = /^[\w+/=\s]*$/.test(line.slice(colon + 1));
     let next = i + 1;
     while (next < lines2.length && (lines2[next].startsWith(" ") || lines2[next].startsWith("	"))) {
-      value.push(lines2[next++]);
+      base64 &&= /^[\w+/=\s]*$/.test(lines2[next]);
+      next++;
     }
-    if (!value.every((part) => /^[\w+/=\s]*$/.test(part))) {
+    if (!base64) {
       for (let index = i; index < next; index++) {
-        out.push(lines2[index]);
+        push(lines2[index]);
       }
       i = next - 1;
       continue;
     }
     while (next < lines2.length && lines2[next] !== "" && /^[\w+/=]+$/.test(lines2[next])) {
-      value.push(lines2[next++]);
+      next++;
     }
+    const end = next;
     if (next < lines2.length && lines2[next] === "") {
       next++;
     }
-    i = next - 1;
     const name = line.slice(0, colon).split(";")[0].split(".").pop().trim().toLowerCase();
-    out.push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + import_node_buffer7.Buffer.from(value.join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    push(MEDIA_PROPERTIES.has(name) ? line.slice(0, colon + 1) : line.slice(0, colon + 1) + import_node_buffer7.Buffer.from([line.slice(colon + 1), ...lines2.slice(i + 1, end)].join("").replaceAll(/\s/g, ""), "base64").toString("utf8"));
+    i = next - 1;
   }
   return out.join("\n");
 }
@@ -6924,16 +6959,20 @@ function* documentsOf(attachments, state, late) {
       yield { text };
       continue;
     }
-    let readable = withoutBinaryValues(text.length > MAX_CARD_BYTES ? text.slice(0, MAX_CARD_BYTES) : text);
-    if (text.length > MAX_CARD_BYTES || readable.length > MAX_SHOWN_BYTES) {
+    let readable = withoutBinaryValues(text, MAX_CARD_TEXT);
+    if (readable.length > MAX_CARD_TEXT) {
+      state.tooComplex = true;
+      readable = readable.slice(0, MAX_CARD_TEXT);
+    }
+    const full = readable.length <= MAX_SHOWN_BYTES;
+    if (!full && hasQuotedPrintable(readable)) {
       state.tooComplex = true;
-      readable = readable.slice(0, MAX_SHOWN_BYTES);
     }
     if (late()) {
       state.incomplete = true;
       return;
     }
-    yield { text: shownText(readable) };
+    yield { text: shownText(readable, full) };
     if (late()) {
       state.incomplete = true;
       return;
@@ -7121,10 +7160,11 @@ function carriedLinkHosts(mail, {
         if (done() || spend(link.length)) {
           break;
         }
-        if (link.length > MAX_VALUE2) {
+        const cut = isCut(link);
+        if (cut) {
           state.tooComplex = true;
         }
-        add(decodeEntities(link.slice(0, MAX_VALUE2), { attribute: true }));
+        add(decodeEntities(cut ? link.slice(0, MAX_VALUE2) : link, { attribute: true }));
       }
     }
     for (const chunk2 of chunksOf(text)) {
@@ -7159,7 +7199,7 @@ function carriedLinkHosts(mail, {
     incomplete: state.incomplete
   };
 }
-var import_node_buffer7, import_node_net4, import_tldts4, LINK_ATTRIBUTES, TAG_START, URL_START, CSS_URL, CSS_IMPORT, LENIENT, IN_WORD2, NAMESPACES, MAX_HOST, MAX_SEEN, TRAILING, DECODE_CHUNK, CHUNK_OVERLAP, MAX_EMBED_DEPTH, MAX_EMBEDDED, MAX_EMBEDDED_LENGTH, MAX_ATTACHED, MAX_ATTACHED_BYTES, MAX_READ_TIME, MAX_CARD_BYTES, MAX_SHOWN_BYTES, MAX_VALUE2, LONG_VALUE, MAX_LENIENT_VALUE, UNQUOTED_END, UTF16LE, UTF16BE, DATA_DOCUMENT, LINE_BREAK, FOLD, QUOTED_PRINTABLE, MEDIA_PROPERTIES, HTML_PROPERTIES, BINARY, HTML_TYPES, HTML_EXTENSIONS, CARD_TYPES, CARD_EXTENSIONS, MESSAGE_TYPES, LATE_EVERY;
+var import_node_buffer7, import_node_net4, import_tldts4, LINK_ATTRIBUTES, TAG_START, URL_START, CSS_URL, CSS_IMPORT, LENIENT, IN_WORD2, NAMESPACES, MAX_HOST, MAX_SEEN, TRAILING, DECODE_CHUNK, CHUNK_OVERLAP, MAX_EMBED_DEPTH, MAX_EMBEDDED, MAX_EMBEDDED_LENGTH, MAX_ATTACHED, MAX_ATTACHED_BYTES, MAX_READ_TIME, MAX_SHOWN_BYTES, MAX_CARD_TEXT, MAX_VALUE2, MAX_REFERENCES, LONG_VALUE, MAX_LENIENT_VALUE, UNQUOTED_END, UTF16LE, UTF16BE, DATA_DOCUMENT, LINE_BREAK, FOLD, QUOTED_PRINTABLE, MEDIA_PROPERTIES, HTML_PROPERTIES, BINARY, HTML_TYPES, HTML_EXTENSIONS, CARD_TYPES, CARD_EXTENSIONS, MESSAGE_TYPES, LATE_EVERY;
 var init_links = __esm({
   "src/links.js"() {
     import_node_buffer7 = require("node:buffer");
@@ -7206,9 +7246,10 @@ var init_links = __esm({
     MAX_ATTACHED = 100;
     MAX_ATTACHED_BYTES = 50 * 1024 * 1024;
     MAX_READ_TIME = 5e3;
-    MAX_CARD_BYTES = 4 * 1024 * 1024;
     MAX_SHOWN_BYTES = 1024 * 1024;
+    MAX_CARD_TEXT = 8 * 1024 * 1024;
     MAX_VALUE2 = 1024 * 1024;
+    MAX_REFERENCES = 64 * 1024;
     LONG_VALUE = 64 * 1024;
     MAX_LENIENT_VALUE = 4096;
     UNQUOTED_END = /* @__PURE__ */ new Set(["<", ">", '"', "'", "`", "="]);
@@ -8891,7 +8932,7 @@ var init_package = __esm({
     package_default = {
       name: "spamscanner",
       description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-      version: "7.0.12",
+      version: "7.0.14",
       author: "Forward Email (https://forwardemail.net)",
       bin: {
         spamscanner: "./dist/esm/cli.js"