spamscanner 7.0.7 → 7.0.8

package/dist/esm/index.js

@@ -2116,6 +2116,9 @@ function unwrapLink(address2) {
   }
   for (let depth = 0; depth < 3; depth++) {
     const target = gatewayTarget(url);
+    if (!target) {
+      break;
+    }
     let next;
     try {
       next = new URL(target);
@@ -3947,24 +3950,38 @@ async function parseWithin(raw, parse = parseMessage, deadline = Date.now() + PA
     }
   }
 }
-async function expandAttachments(attachments = [], errors = [], parse = parseMessage) {
+async function expandAttachments(attachments = [], errors = [], parse = parseMessage, unopened = []) {
   const all = [];
   const deadline = Date.now() + PARSE_TIMEOUT;
   let budget = MAX_NESTED_BYTES;
   let nested = 0;
+  let tooMany = false;
   const visit = async (list, prefix, depth) => {
     for (const attachment of list) {
       if (prefix) {
         if (nested >= MAX_ATTACHMENTS) {
+          if (!tooMany) {
+            tooMany = true;
+            unopened.push({ filename: prefix, reason: `more than ${MAX_ATTACHMENTS} attachments in attached messages` });
+          }
           return;
         }
         nested++;
       }
       const name = attachment.filename || (prefix ? "unnamed attachment" : "");
+      const filename = prefix ? `${prefix}/${name}` : name || "attached message";
       all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
       const { content } = attachment;
       const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
-      if (attached && depth < MAX_NESTED_DEPTH && Buffer2.isBuffer(content) && content.length <= budget) {
+      if (attached && Buffer2.isBuffer(content) && depth >= MAX_NESTED_DEPTH) {
+        unopened.push({ filename, reason: `nested more than ${MAX_NESTED_DEPTH} deep` });
+        continue;
+      }
+      if (attached && Buffer2.isBuffer(content) && content.length > budget) {
+        unopened.push({ filename, reason: `past ${MAX_NESTED_BYTES / 1024 / 1024} MB of attached messages` });
+        continue;
+      }
+      if (attached && Buffer2.isBuffer(content)) {
         budget -= content.length;
         let inner;
         try {
@@ -7031,7 +7048,7 @@ function scoreResults(results, options) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.7",
+  version: "7.0.8",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"
@@ -8833,14 +8850,16 @@ var SpamScanner = class {
    * a header field ("Name: value", or an mbox "From " line) is read as the
    * body of a message with no header, so its text is the input; other
    * input mailparser cannot read gives a message with no text. Other errors
-   * are thrown.
+   * are thrown. `error` is the parser's limit the message exceeds, so that
+   * only its first parts were read (as scan() reports it, see parseError),
+   * or null.
    * @param {Buffer|string|Uint8Array|AsyncIterable} source
-   * @returns {Promise<{raw: Buffer, mail: object}>}
+   * @returns {Promise<{raw: Buffer, mail: object, error: string|null}>}
    */
   async parse(source) {
     const raw = await toBuffer(source);
-    const { mail } = await parseWithin(withHeader(raw));
-    return { raw, mail };
+    const { mail, error } = await parseWithin(withHeader(raw));
+    return { raw, mail, error: error ?? null };
   }
   /**
    * Classifier features of a parsed message.
@@ -9200,7 +9219,8 @@ ${visibleText(html.slice(0, config.maxLength * 2)).text}`, { maxLength: config.m
       mixed: Math.max(plainObfuscation.mixed, shownObfuscation.mixed),
       styled: plainObfuscation.styled || shownObfuscation.styled
     };
-    const attached = await expandAttachments(mail.attachments, parseErrors);
+    const unopened = [];
+    const attached = await expandAttachments(mail.attachments, parseErrors, void 0, unopened);
     const attachments = config.attachments === false ? [] : inspectAttachments(attached).filter((item) => config.macros !== false || !["macro", "pdf_active", "rtf_object"].includes(item.type)).map((item) => finding(item));
     const [links, authentication, checkedReputation, dnsbl, virusScan, toxicity, nsfw] = await Promise.all([
       this.checkLinks(checkedLinks, config, extracted.hosts, fromDomain(mail)),
@@ -9321,6 +9341,13 @@ ${visibleText(html.slice(0, config.maxLength * 2)).text}`, { maxLength: config.m
         // scanned, as {filename, reason}: the same on every try, so not a
         // failure.
         virusScanSkipped: virusScan.skipped,
+        // Attached messages not opened, past the limits attached messages
+        // are read within (nested more than three deep, more than 100
+        // attachments in them, or more than 25 MB of them), as
+        // {filename, reason}: their attachments were not inspected. Not
+        // scored (forwarded messages can be nested so), for a caller that
+        // needs a message read whole, e.g. to block what it carries.
+        unopenedAttachments: unopened,
         // Whether the message has more text than phishing.maxLength, whose
         // links were not read.
         linksTruncated,
@@ -9369,6 +9396,7 @@ export {
   scoreResults,
   segmentWords,
   spamHeaders,
-  train
+  train,
+  unwrapLink
 };
 //# sourceMappingURL=index.js.map