spamscanner 7.0.2 → 7.0.3

package/dist/esm/cli.js

@@ -3213,7 +3213,7 @@ function summarizeAuth(auth) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.2",
+  version: "7.0.3",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"
@@ -4721,7 +4721,7 @@ function sniff(buffer) {
   const at = (offset, bytes) => buffer.length >= offset + bytes.length && bytes.every((byte, i) => buffer[offset + i] === byte);
   const ascii = (offset, text) => at(offset, [...Buffer10.from(text, "latin1")]);
   const result = (type, executable = false) => ({ type, executable, archive: ARCHIVE_TYPES.has(type) });
-  if (ascii(0, "MZ")) {
+  if (ascii(0, "MZ") && buffer.length >= 64 && at(buffer.readUInt32LE(60), [80, 69, 0, 0])) {
     return result("exe", true);
   }
   if (at(0, [127, 69, 76, 70])) {
@@ -4907,10 +4907,11 @@ function inspectAttachments(attachments = []) {
     if (parts.length >= 3 && EXECUTABLE_EXTENSIONS.has(extension) && DOCUMENT_EXTENSIONS.has(parts.at(-2))) {
       add("double_extension", `Attachment "${name}" has a document extension followed by a program extension`, { extension });
     }
-    if (EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension)) {
+    const byName = EXECUTABLE_EXTENSIONS.has(extension) && !MACRO_EXTENSIONS.has(extension);
+    if (detected?.executable && (detected.type !== "script" || !byName)) {
+      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension && extension !== detected.type ? ` but is named .${extension}` : ""}`, { extension: detected.type });
+    } else if (byName) {
       add("executable", `Attachment "${name}" is a file type that runs code (.${extension})`, { extension });
-    } else if (detected?.executable) {
-      add(extension && !EXECUTABLE_EXTENSIONS.has(extension) ? "disguised_executable" : "executable", `Attachment "${name}" contains a program (${detected.type})${extension ? ` but is named .${extension}` : ""}`, { extension: detected.type });
     }
     if (!content) {
       if (MACRO_EXTENSIONS.has(extension)) {
@@ -6548,7 +6549,7 @@ var SpamScanner = class {
         message: `Link domain ${value} is listed in ${zone}`
       }));
     }
-    return { phishing, homographs };
+    return { phishing, homographs, uncheckedHosts: seenHosts.size - checked.length };
   }
   async scanViruses(mail, config) {
     const settings = config.clamav === true ? {} : config.clamav;
@@ -6735,6 +6736,8 @@ ${typeof mail.text === "string" ? mail.text : ""}`, { maxLength: config.maxLengt
         // Grouped as in earlier versions.
         executables: attachments.filter((item) => ["executable", "disguised_executable", "double_extension", "rtl_override", "executable_in_archive"].includes(item.type)),
         macros: attachments.filter((item) => ["macro", "pdf_active", "rtf_object"].includes(item.type)),
+        // Link hosts beyond phishing.maxHosts, which were not looked up.
+        uncheckedHosts: links.uncheckedHosts,
         idnHomographAttack: {
           detected: links.homographs.length > 0,
           domains: links.homographs,