spamscanner 7.0.8 → 7.0.10

package/dist/esm/index.js

@@ -2102,11 +2102,12 @@ function gatewayTarget(url) {
   }
   if (host === "urldefense.com" && url.pathname.startsWith("/v3/__")) {
     const rest = url.href.slice(url.href.indexOf("/v3/__") + 6);
-    const end = rest.indexOf("__;");
+    const end = rest.lastIndexOf("__;");
     return end === -1 ? null : rest.slice(0, end);
   }
   return null;
 }
+var MAX_GATEWAYS = 16;
 function unwrapLink(address2) {
   let url;
   try {
@@ -2114,7 +2115,7 @@ function unwrapLink(address2) {
   } catch {
     return null;
   }
-  for (let depth = 0; depth < 3; depth++) {
+  for (let depth = 0; depth < MAX_GATEWAYS; depth++) {
     const target = gatewayTarget(url);
     if (!target) {
       break;
@@ -3233,6 +3234,7 @@ var MACRO_EXTENSIONS = /* @__PURE__ */ new Set(["docm", "dotm", "xlsm", "xltm",
 var DOCUMENT_EXTENSIONS = /* @__PURE__ */ new Set(["pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "txt", "rtf", "jpg", "jpeg", "png", "gif", "zip", "csv", "odt", "ods", "html", "htm", "mp3", "mp4", "mov", "wav", "eml", "msg", "xml", "json"]);
 var TEMPORARY_EXTENSIONS = /* @__PURE__ */ new Set(["tmp"]);
 var BIDI_CONTROLS = characterClass([[8234, 8238], [8294, 8297]], "u");
+var ALL_BIDI_CONTROLS = characterClass([[8234, 8238], [8294, 8297]], "gu");
 var ARCHIVE_TYPES = /* @__PURE__ */ new Set(["zip", "rar", "7z", "gz", "bz2", "xz", "cab", "iso", "tar", "zst", "lzh", "ace", "arj"]);
 function sniff(buffer) {
   if (!Buffer.isBuffer(buffer) || buffer.length < 4) {
@@ -3416,7 +3418,16 @@ function shorten(name, max = 100) {
   return characters.length <= max ? name : `${characters.slice(0, max - 41).join("")}\u2026${characters.slice(-40).join("")}`;
 }
 function extensionOf(name) {
-  const base = trimEndOf(String(name).toLowerCase().split(/[/\\]/).pop(), ". ");
+  const base = trimEndOf(String(name).toLowerCase().replace(ALL_BIDI_CONTROLS, "").split(/[/\\]/).pop(), ". ");
+  const whole = lastExtension(base);
+  const file = base.replace(/^[a-z]:/, "");
+  const colon = file.indexOf(":");
+  if (colon !== -1 && /^(?::?\$data)?$/.test(file.slice(colon + 1))) {
+    return lastExtension(trimEndOf(file.slice(0, colon), ". "));
+  }
+  return whole;
+}
+function lastExtension(base) {
   const dot = base.lastIndexOf(".");
   return dot === -1 ? "" : base.slice(dot + 1).trim();
 }
@@ -3432,8 +3443,13 @@ function oleHasMacros(buffer) {
   return false;
 }
 var PDF_ACTIVE = linear(String.raw`\/(?:JavaScript|JS|Launch)\b`);
-var PDF_ESCAPED_NAME = /\/[^\s/<>[\]()%{}]*#[\dA-Fa-f]{2}[^\s/<>[\]()%{}]*/g;
-var decodePdfNames = (text) => text.replaceAll(PDF_ESCAPED_NAME, (name) => name.replaceAll(/#([\dA-Fa-f]{2})/g, (_, hex) => String.fromCodePoint(Number.parseInt(hex, 16))));
+var escaped = (character) => {
+  const hex = character.codePointAt(0).toString(16);
+  return `(?:${character}|#${hex[0]}[${hex[1].toLowerCase()}${hex[1].toUpperCase()}])`;
+};
+var WORD_ESCAPE = String.raw`#(?:3\d|4[1-9a-fA-F]|5[\daA]|5[fF]|6[1-9a-fA-F]|7[\daA])`;
+var PDF_ACTIVE_ESCAPED = new RegExp(`/(?:${["JavaScript", "JS", "Launch"].map((name) => [...name].map((character) => escaped(character)).join("")).join("|")})(?![\\w]|${WORD_ESCAPE})`);
+var pdfActive = (text) => PDF_ACTIVE.test(text) || PDF_ACTIVE_ESCAPED.test(text);
 function inspectAttachments(attachments = []) {
   const findings = [];
   for (const attachment of attachments) {
@@ -3491,7 +3507,7 @@ function inspectAttachments(attachments = []) {
         add("macro", `Attachment "${name}" is an Office document with a VBA macro project`, { extension });
       }
     } else if (detected?.type === "pdf" || extension === "pdf") {
-      if (PDF_ACTIVE.test(decodePdfNames(content.toString("latin1")))) {
+      if (pdfActive(content.toString("latin1"))) {
         add("pdf_active", `PDF "${name}" contains JavaScript or a launch action`, { extension: "pdf" });
       }
     } else if (detected?.type === "rtf" && /\\object\b|\\objdata\b|\\objupdate\b/.test(content.toString("latin1"))) {
@@ -3539,7 +3555,7 @@ function boundAddressField(line, room) {
   const limit = Math.min(line.length, MAX_ADDRESS_FIELD, room);
   let end = start;
   let expecting = "";
-  let escaped = false;
+  let escaped2 = false;
   let separators = 0;
   let groups = 0;
   let index = start;
@@ -3548,8 +3564,8 @@ function boundAddressField(line, room) {
     if ((chr === "," || chr === ";") && ++separators > MAX_ADDRESS_SEPARATORS) {
       break;
     }
-    if (escaped) {
-      escaped = false;
+    if (escaped2) {
+      escaped2 = false;
     } else if (expecting !== "" && chr === expecting) {
       expecting = "";
       end = chr === ";" ? index + 1 : end;
@@ -3557,7 +3573,7 @@ function boundAddressField(line, room) {
       expecting = ADDRESS_OPERATORS.get(chr);
       end = chr === "," || chr === ";" ? index : end;
     } else if (expecting === '"' && chr === "\\") {
-      escaped = true;
+      escaped2 = true;
     }
     if (chr === ":" && expecting === ";" && ++groups > MAX_ADDRESS_GROUPS) {
       break;
@@ -3700,9 +3716,14 @@ var SIGNATURE_FIELDS = /* @__PURE__ */ new Set(["dkim-signature", "arc-message-s
 var AUTH_FIELDS = /* @__PURE__ */ new Set([...KEPT_FIELDS, "arc-seal", "arc-message-signature"]);
 var MAX_SIGNATURES = 10;
 var MAX_DKIM_SIGNATURES = 8;
+function isAttachedMessage(attachment) {
+  const type = String(attachment.contentType).toLowerCase();
+  return type === "message/rfc822" || type === "message/global" || /\.(?:eml|u8msg)$/i.test(String(attachment.filename));
+}
 var MAX_NESTED_DEPTH = 3;
 var MAX_ATTACHMENTS = 100;
 var MAX_NESTED_BYTES = 25 * 1024 * 1024;
+var MAX_ATTACHED_MESSAGES = 100;
 var PARSE_TIMEOUT = 6e4;
 async function simpleParse(raw, { timeout = PARSE_TIMEOUT, parser = simpleParser } = {}) {
   const input = Readable.from([finishable(unfoldHeaders(raw))], { objectMode: false, autoDestroy: false });
@@ -3760,18 +3781,18 @@ function headerValue2(line) {
   let key = null;
   let inKey = false;
   let quoted = false;
-  let escaped = false;
+  let escaped2 = false;
   let value = "";
   for (const chr of line.slice(line.indexOf(":") + 1).replaceAll(/\r?\n[ \t]*/g, " ")) {
     if (inKey && chr === "=") {
       key = value.trim().toLowerCase();
       inKey = false;
       value = "";
-    } else if (inKey || escaped) {
+    } else if (inKey || escaped2) {
       value += chr;
-      escaped = false;
+      escaped2 = false;
     } else if (chr === "\\") {
-      escaped = true;
+      escaped2 = true;
     } else if (chr === '"') {
       quoted = !quoted;
     } else if (chr === ";" && !quoted) {
@@ -3819,7 +3840,7 @@ function unfoldHeaders(raw) {
     if (blank && type.boundary) {
       boundaries.push(Buffer2.from(type.boundary));
     }
-    head = blank && type.value === "message/rfc822" && ["", "7bit", "8bit", "binary"].includes(encoding) && first.get("content-disposition")?.value === "inline";
+    head = blank && ["message/rfc822", "message/global"].includes(type.value) && ["", "7bit", "8bit", "binary"].includes(encoding) && first.get("content-disposition")?.value === "inline";
   };
   for (let start = 0; start < raw.length; ) {
     const lf = raw.indexOf(10, start);
@@ -3956,6 +3977,7 @@ async function expandAttachments(attachments = [], errors = [], parse = parseMes
   let budget = MAX_NESTED_BYTES;
   let nested = 0;
   let tooMany = false;
+  let opened = 0;
   const visit = async (list, prefix, depth) => {
     for (const attachment of list) {
       if (prefix) {
@@ -3972,17 +3994,22 @@ async function expandAttachments(attachments = [], errors = [], parse = parseMes
       const filename = prefix ? `${prefix}/${name}` : name || "attached message";
       all.push(prefix ? { ...attachment, filename: `${prefix}/${name}` } : attachment);
       const { content } = attachment;
-      const attached = attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "");
+      const attached = isAttachedMessage(attachment);
       if (attached && Buffer2.isBuffer(content) && depth >= MAX_NESTED_DEPTH) {
         unopened.push({ filename, reason: `nested more than ${MAX_NESTED_DEPTH} deep` });
         continue;
       }
+      if (attached && Buffer2.isBuffer(content) && opened >= MAX_ATTACHED_MESSAGES) {
+        unopened.push({ filename, reason: `more than ${MAX_ATTACHED_MESSAGES} attached messages` });
+        continue;
+      }
       if (attached && Buffer2.isBuffer(content) && content.length > budget) {
         unopened.push({ filename, reason: `past ${MAX_NESTED_BYTES / 1024 / 1024} MB of attached messages` });
         continue;
       }
       if (attached && Buffer2.isBuffer(content)) {
         budget -= content.length;
+        opened++;
         let inner;
         try {
           inner = await parseWithin(content, parse, deadline);
@@ -5668,9 +5695,12 @@ ${visibleText(html.slice(0, 1e5)).text}`)) {
     hit("SEXTORTION_SUBJECT", 2, "Subject used by sextortion and account takeover scams, without a demand for payment", "SCAM");
   }
   const markup = html.slice(0, 1e5);
+  const readable = readableText(`${subject}
+${text.slice(0, 5e4)}
+${visibleText(withoutHelp(markup)).text}`);
   if (isInjection(`${subject}
 ${text.slice(0, 5e4)}
-${withoutHelp(markup)}`) || attributeText(markup).some(({ text: text2, start, end, help }) => (!help || isOrder(text2)) && isInjection(unquoted(text2), AI_ACTION_OBJECT, () => shownNear(markup, start, end)))) {
+${withoutHelp(markup)}`) || isInjection(readable) || attributeText(markup).some(({ text: text2, start, end, help }) => (!help || isOrder(text2)) && isInjection(unquoted(text2), AI_ACTION_OBJECT, () => shownNear(markup, start, end)))) {
     hit("PROMPT_INJECTION", 3, "Contains instructions addressed to an AI filter", "SPAM");
   }
   if (session.resolvedClientHostname?.endsWith(".outbound.protection.outlook.com")) {
@@ -7048,7 +7078,7 @@ function scoreResults(results, options) {
 var package_default = {
   name: "spamscanner",
   description: "Spam, phishing and malware filter for email in any language: a trainable classifier, link and attachment checks, SPF/DKIM/DMARC, and an optional AI second opinion from any LLM, including local Ollama models. Works as a library, CLI, Postfix milter or HTTP API.",
-  version: "7.0.8",
+  version: "7.0.10",
   author: "Forward Email (https://forwardemail.net)",
   bin: {
     spamscanner: "./dist/esm/cli.js"
@@ -9098,7 +9128,7 @@ var SpamScanner = class {
               message: `Attachment "${filename}" contains ${result.viruses.join(", ")}`
             });
             viruses.push(found);
-            if (attachment.contentType === "message/rfc822" || /\.eml$/i.test(attachment.filename || "")) {
+            if (isAttachedMessage(attachment)) {
               carriers.set(found, attachment.filename || "attached message");
             }
           }