spamscanner 7.0.2 → 7.0.3

package/dist/cjs/index.cjs

@@ -2172,7 +2172,7 @@ function sniff(buffer) {
   const at = (offset, bytes) => buffer.length >= offset + bytes.length && bytes.every((byte, i) => buffer[offset + i] === byte);
   const ascii = (offset, text) => at(offset, [...import_node_buffer.Buffer.from(text, "latin1")]);
   const result = (type, executable = false) => ({ type, executable, archive: ARCHIVE_TYPES.has(type) });
-  if (ascii(0, "MZ")) {
+  if (ascii(0, "MZ") && buffer.length >= 64 && at(buffer.readUInt32LE(60), [80, 69, 0, 0])) {
     return result("exe", true);
   }
   if (at(0, [127, 69, 76, 70])) {
@@ -2351,10 +2351,11 @@ function inspectAttachments(attachments = []) {
     if (parts.length >= 3 && EXECUTABLE_EXTENSIONS.has(extension) && DOCUMENT_EXTENSIONS.has(parts.at(-2))) {
       add("double_extension", `Attachment "${name}" has a document extension followed by a program extension`, { extension });
     }
-    if (EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension)) {
+    const byName = EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension);
+    if (detected?.executable && (detected.type !== "script" || !byName)) {
+      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension && extension !== detected.type ? ` but is named .${extension}` : ""}`, { extension: detected.type });
+    } else if (byName) {
       add("executable", `Attachment "${name}" is a file type that runs code (.${extension})`, { extension });
-    } else if (detected?.executable) {
-      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension ? ` but is named .${extension}` : ""}`, { extension: detected.type });
     }
     if (!content) {
       if (MACRO_EXTENSIONS.has(extension)) {
@@ -5441,7 +5442,7 @@ var init_package = __esm({
     package_default = {
       name: "spamscanner",
       description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-      version: "7.0.2",
+      version: "7.0.3",
       author: "Forward Email (https://forwardemail.net)",
       bin: {
         spamscanner: "./dist/esm/cli.js"
@@ -7235,7 +7236,7 @@ var init_src = __esm({
             message: `Link domain ${value} is listed in ${zone}`
           }));
         }
-        return { phishing, homographs };
+        return { phishing, homographs, uncheckedHosts: seenHosts.size - checked.length };
       }
       async scanViruses(mail, config) {
         const settings = config.clamav === true ? {} : config.clamav;
@@ -7422,6 +7423,8 @@ ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLengt
             // Grouped as in earlier versions.
             executables: attachments.filter((item) => ["executable", "disguised_executable", "double_extension", "rtl_override", "executable_in_archive"].includes(item.type)),
             macros: attachments.filter((item) => ["macro", "pdf_active", "rtf_object"].includes(item.type)),
+            // Link hosts beyond phishing.maxHosts, which were not looked up.
+            uncheckedHosts: links.uncheckedHosts,
             idnHomographAttack: {
               detected: links.homographs.length > 0,
               domains: links.homographs,