eml-parser 2.0.0__tar.gz → 3.0.6__tar.gz

{eml_parser-2.0.0 → eml_parser-3.0.6}/.gitignore

@@ -1,5 +1,6 @@
 *.eml
 *.pyc
+uv.lock
 
 build
 dist
@@ -11,4 +12,5 @@ eml_parser.egg-info
 .mypy_cache
 .pytest_cache
 venv
-.vscode
+.venv
+.vscode

{eml_parser-2.0.0/eml_parser.egg-info → eml_parser-3.0.6}/PKG-INFO

@@ -1,49 +1,38 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.5
 Name: eml_parser
-Version: 2.0.0
+Version: 3.0.6
 Summary: Python EML parser library
-Author-email: Georges Toth <georges.toth@govcert.etat.lu>
-License: AGPLv3+
 Project-URL: Homepage, https://github.com/GOVCERT-LU/eml_parser
 Project-URL: Documentation, https://eml-parser.readthedocs.io/
 Project-URL: Source, https://github.com/GOVCERT-LU/eml_parser
 Project-URL: Tracker, https://github.com/GOVCERT-LU/eml_parser/issues
 Project-URL: Changelog, https://github.com/GOVCERT-LU/eml_parser/blob/master/CHANGELOG.md
+Author-email: Georges Toth <georges.toth@govcert.etat.lu>
+License: AGPLv3+
+License-File: LICENSE
 Keywords: email
 Classifier: Development Status :: 5 - Production/Stable
-Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
 Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3 :: Only
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Communications :: Email
-Requires-Python: >=3.9
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: python-dateutil
+Requires-Python: >=3.10
 Requires-Dist: charset-normalizer
 Requires-Dist: publicsuffixlist
+Requires-Dist: python-dateutil
 Provides-Extra: filemagic
-Requires-Dist: file-magic>=0.4.0; extra == "filemagic"
+Requires-Dist: file-magic>=0.4.0; extra == 'filemagic'
 Provides-Extra: regex
-Requires-Dist: regex; extra == "regex"
-Provides-Extra: docs
-Requires-Dist: mkdocs-material; extra == "docs"
-Requires-Dist: mkdocstrings[crystal,python]; extra == "docs"
-Provides-Extra: dev
-Requires-Dist: mypy; extra == "dev"
-Requires-Dist: types-python-dateutil; extra == "dev"
-Requires-Dist: types-chardet; extra == "dev"
-Requires-Dist: ruff; extra == "dev"
-Provides-Extra: test
-Requires-Dist: pytest; extra == "test"
-Requires-Dist: pytest-sugar; extra == "test"
-Requires-Dist: coverage; extra == "test"
-
-[![Code Health](https://codebeat.co/badges/d631cfb2-a7f8-476a-9d2e-58e58db95bc8)](https://codebeat.co/projects/github-com-govcert-lu-eml_parser-master)
+Requires-Dist: regex; extra == 'regex'
+Description-Content-Type: text/markdown
+
 [![Documentation Status](https://readthedocs.org/projects/eml-parser/badge/)](http://eml-parser.readthedocs.io)
 [![PyPI](https://badge.fury.io/py/eml-parser.svg)](https://badge.fury.io/py/eml-parser)
 [![PyPI pyversions](https://img.shields.io/pypi/pyversions/eml-parser.svg)](https://pypi.python.org/pypi/eml-parser/)

{eml_parser-2.0.0 → eml_parser-3.0.6}/README.md

@@ -1,4 +1,3 @@
-[![Code Health](https://codebeat.co/badges/d631cfb2-a7f8-476a-9d2e-58e58db95bc8)](https://codebeat.co/projects/github-com-govcert-lu-eml_parser-master)
 [![Documentation Status](https://readthedocs.org/projects/eml-parser/badge/)](http://eml-parser.readthedocs.io)
 [![PyPI](https://badge.fury.io/py/eml-parser.svg)](https://badge.fury.io/py/eml-parser)
 [![PyPI pyversions](https://img.shields.io/pypi/pyversions/eml-parser.svg)](https://pypi.python.org/pypi/eml-parser/)
@@ -122,4 +121,4 @@ Which gives for a minimalistic EML file something like this:
       ]
     }
   }
-```
+```

{eml_parser-2.0.0 → eml_parser-3.0.6}/eml_parser/decode.py

@@ -81,7 +81,7 @@ def decode_field(field: str) -> str:
     return string
 
 
-def decode_string(string: bytes, encoding: typing.Optional[str] = None) -> str:
+def decode_string(string: bytes, encoding: str | None = None) -> str:
     """Try anything possible to parse an encoded bytes string and return the result.
 
     We do this using the encoding hint, if this fails, we try to detect the correct
@@ -214,7 +214,7 @@ def robust_string2date(line: str) -> datetime.datetime:
     return date_
 
 
-def json_serial(obj: typing.Any) -> typing.Optional[str]:
+def json_serial(obj: typing.Any) -> str | None:
     """JSON serializer for objects not serializable by default json code."""
     if isinstance(obj, datetime.datetime):
         if obj.tzinfo is not None:
@@ -257,7 +257,11 @@ def rfc2047_decode(value: str) -> str:
     parsed = ''
 
     for k, v in email.header.decode_header(value):
-        if v is None:
+        if isinstance(k, str):
+            # decode_header returns str (not bytes) for fragments which did not
+            # need RFC2047 decoding, e.g. when the whole value is plain ASCII.
+            parsed += k
+        elif v is None:
             parsed += k.decode('ascii', errors='ignore')
 
         else:

{eml_parser-2.0.0 → eml_parser-3.0.6}/eml_parser/parser.py

@@ -105,19 +105,30 @@ class CustomPolicy(email.policy.EmailPolicy):
 
             return eml_parser.decode.robust_string2date(value).isoformat()
 
+        elif header in ('sender', 'resent-sender', 'to', 'resent-to', 'cc', 'resent-cc', 'bcc', 'resent-bcc', 'from', 'resent-from', 'reply-to'):
+            try:
+                return super().header_fetch_parse(name, value)
+            except RecursionError:
+                # This can happen when the recursion gets too deep in in the stdlib recursive descent parser.
+                # In this case, the header is certainly pathological. We still try to extract some addresses.
+                m = eml_parser.regexes.email_regex.findall(value)
+                return ', '.join(m)
+
         return super().header_fetch_parse(name, value)
 
 
 class EmlParser:
     """eml-parser class."""
 
+    MULTIPART_RECURSION_LIMIT = 100
+
     # pylint: disable=too-many-arguments
     def __init__(
         self,
         include_raw_body: bool = False,
         include_attachment_data: bool = False,
-        pconf: typing.Optional[dict] = None,
-        policy: typing.Optional[email.policy.Policy] = None,
+        pconf: dict | None = None,
+        policy: email.policy.Policy | None = None,
         ignore_bad_start: bool = False,
         email_force_tld: bool = False,
         domain_force_tld: bool = False,
@@ -170,6 +181,8 @@ class EmlParser:
 
         if self.email_force_tld:
             eml_parser.regexes.email_regex = eml_parser.regexes.email_force_tld_regex
+        else:
+            eml_parser.regexes.email_regex = eml_parser.regexes.email_no_force_tld_regex
 
         # If no whitelisting is required, set to emtpy list
         if 'whiteip' not in self.pconf:
@@ -178,7 +191,7 @@ class EmlParser:
         if 'whitefor' not in self.pconf:
             self.pconf['whitefor'] = []
 
-        self.msg: typing.Optional[email.message.Message] = None
+        self.msg: email.message.Message | None = None
 
     def decode_email(self, eml_file: os.PathLike, ignore_bad_start: bool = False) -> dict:
         """Function for decoding an EML file into an easily parsable structure.
@@ -322,7 +335,7 @@ class EmlParser:
         # parse and decode Date
         # If date field is present
         if 'date' in self.msg and self.msg.get('date') is not None:
-            headers_struc['date'] = datetime.datetime.fromisoformat(typing.cast(str, self.msg.get('date')))
+            headers_struc['date'] = datetime.datetime.fromisoformat(typing.cast('str', self.msg.get('date')))
         else:
             # If date field is absent...
             headers_struc['date'] = datetime.datetime.fromisoformat(eml_parser.decode.default_date)
@@ -400,10 +413,11 @@ class EmlParser:
 
                 # search for e-mail addresses
                 for mail_candidate in eml_parser.regexes.email_regex.findall(received_line_flat):
+                    validated_mail_candidate = mail_candidate
                     if self.email_force_tld:
-                        mail_candidate = self.get_valid_domain_or_ip(mail_candidate)
-                    if mail_candidate is not None and mail_candidate not in parsed_routing.get('for', []):
-                        headers_struc['received_email'] += [mail_candidate]
+                        validated_mail_candidate = self.get_valid_domain_or_ip(mail_candidate)
+                    if validated_mail_candidate is not None and validated_mail_candidate not in parsed_routing.get('for', []):
+                        headers_struc['received_email'] += [validated_mail_candidate]
 
         except TypeError:  # Ready to parse email without received headers.
             logger.exception('Exception occurred while parsing received lines.')
@@ -491,6 +505,15 @@ class EmlParser:
                         if valid_ip:
                             list_observed_ip[valid_ip] = 1
 
+            # URLs do not necessarily appear as-is in the body, as they may contain escaped entities.
+            # For this reason, we have to extract the domains again from each parsed URL.
+            # Run once over the deduplicated URLs after slicing to keep the cost linear in the body size.
+            for url in set(list_observed_urls) | set(list_observed_urls_noscheme):
+                for match in eml_parser.regexes.dom_regex.findall(url):
+                    valid_domain = self.get_valid_domain_or_ip(match.lower())
+                    if valid_domain:
+                        list_observed_dom[match.lower()] = 1
+
             # Report uri,email and observed domain or hash if no raw body
             if self.include_raw_body:
                 if list_observed_urls:
@@ -536,12 +559,12 @@ class EmlParser:
             # "a","titi"   --->    c: [truc]
             # "c","truc"
             ch: dict[str, list] = {}
-            for k, v in body_multhead:
+            for header_key, header_value in body_multhead:
                 # make sure we are working with strings only
-                v = str(v)
+                v = str(header_value)
 
                 # We are using replace . to : for avoiding issue in mongo
-                k = k.lower().replace('.', ':')  # Lot of lowers, pre-compute :) .
+                k = header_key.lower().replace('.', ':')  # Lot of lowers, pre-compute :) .
 
                 if multipart:
                     if k in ch:
@@ -584,8 +607,8 @@ class EmlParser:
         # "a","titi"   --->    c: [truc]
         # "c","truc"
         #
-        for k in set(self.msg.keys()):
-            k = k.lower()  # Lot of lower, pre-compute...
+        for header_field_name in set(self.msg.keys()):
+            k = header_field_name.lower()  # Lot of lower, pre-compute...
             decoded_values = []
 
             try:
@@ -678,7 +701,9 @@ class EmlParser:
         else:
             ptr_start = 0
 
-            for ptr_end in range(slice_step, body_length + slice_step, slice_step):
+            for _ptr_end in range(slice_step, body_length + slice_step, slice_step):
+                ptr_end = _ptr_end
+
                 if ' ' in body[ptr_end - 1 : ptr_end]:
                     while not (eml_parser.regexes.window_slice_regex.match(body[ptr_end - 1 : ptr_end]) or ptr_end > body_length):
                         if ptr_end > body_length:
@@ -709,7 +734,7 @@ class EmlParser:
 
                 ptr_start = ptr_end
 
-    def get_valid_domain_or_ip(self, data: str) -> typing.Optional[str]:
+    def get_valid_domain_or_ip(self, data: str) -> str | None:
         """Function to determine if an IP address, Email address, or Domain is valid.
 
         Args:
@@ -737,7 +762,7 @@ class EmlParser:
 
         return None
 
-    def clean_found_uri(self, url: str) -> typing.Optional[str]:
+    def clean_found_uri(self, url: str) -> str | None:
         """Function for validating URLs from the input string.
 
         Args:
@@ -746,6 +771,9 @@ class EmlParser:
         Returns:
             str: Returns a valid URL, if found in the input string.
         """
+        if '&' in url:
+            url = unescape(url)
+
         if '.' not in url and '[' not in url:
             # if we found a URL like e.g. http://afafasasfasfas; that makes no
             # sense, thus skip it, but include http://[2001:db8::1]
@@ -779,9 +807,6 @@ class EmlParser:
         if url.endswith('://'):
             return None
 
-        if '&' in url:
-            url = unescape(url)
-
         return url
 
     def get_uri_ondata(self, body: str) -> list[str]:
@@ -836,15 +861,26 @@ class EmlParser:
             _field = eml_parser.decode.workaround_field_value_parsing_errors(self.msg, header)
             field = []
 
-            for v in _field:
-                v = eml_parser.decode.rfc2047_decode(v).replace('\n', '').replace('\r', '')
+            for raw_value in _field:
+                v = eml_parser.decode.rfc2047_decode(raw_value).replace('\n', '').replace('\r', '')
 
-                parsing_result: dict[str, typing.Any] = {}
-                parser_cls = typing.cast(email.headerregistry.AddressHeader, email.headerregistry.HeaderRegistry()[header])
-                parser_cls.parse(v, parsing_result)
-                for _group in parsing_result['groups']:
-                    for _address in _group.addresses:
-                        field.append((_address.display_name, _address.addr_spec))
+                try:
+                    parsing_result: dict[str, typing.Any] = {}
+                    parser_cls = typing.cast('email.headerregistry.AddressHeader', email.headerregistry.HeaderRegistry()[header])
+                    parser_cls.parse(v, parsing_result)
+                    for _group in parsing_result['groups']:
+                        for _address in _group.addresses:
+                            field.append((_address.display_name, _address.addr_spec))
+                except (AttributeError, IndexError):
+                    # The stdlib address/header parser can itself raise on certain malformed
+                    # values (e.g. an unquoted display name ending in a bare period, such as
+                    # "Test.<test@example.com>"). The exact exception type raised for this
+                    # case has varied across Python versions, so we defensively catch it here
+                    # too and fall back to a best-effort regex extraction of e-mail addresses.
+                    logger.exception('Field value parsing error while parsing "%s", falling back to regex extraction!', v)
+
+                    for m in eml_parser.regexes.email_regex.findall(v):
+                        field.append(('', m))
 
         return_field = []
 
@@ -859,23 +895,31 @@ class EmlParser:
         return return_field
 
     def get_raw_body_text(
-        self, msg: email.message.Message, boundary: typing.Optional[str] = None
-    ) -> list[tuple[typing.Any, typing.Any, typing.Any, typing.Optional[str]]]:
+        self, msg: email.message.Message, boundary: str | None = None, depth: int = 0
+    ) -> list[tuple[typing.Any, typing.Any, typing.Any, str | None]]:
         """This method recursively retrieves all e-mail body parts and returns them as a list.
 
         Args:
             msg (email.message.Message): The actual e-mail message or sub-message.
             boundary: Used for passing the boundary marker of multipart messages, and used to easier distinguish different parts.
+            depth: Parameter used to track the current recursion level.
 
         Returns:
             list: Returns a list of sets which are in the form of "set(encoding, raw_body_string, message field headers, possible boundary marker)"
+
+        Raises:
+            RecursionError: If recursion limit exceeded.
         """
-        raw_body: list[tuple[typing.Any, typing.Any, typing.Any, typing.Optional[str]]] = []
+        raw_body: list[tuple[typing.Any, typing.Any, typing.Any, str | None]] = []
+
+        if depth > EmlParser.MULTIPART_RECURSION_LIMIT:
+            logger.warning('multi-part nesting limit (%d) exceeded, aborting', EmlParser.MULTIPART_RECURSION_LIMIT)
+            raise RecursionError('Recursion limit exceeded')
 
         if msg.is_multipart():
             boundary = msg.get_boundary(failobj=None)
             for part in msg.get_payload():
-                raw_body.extend(self.get_raw_body_text(typing.cast(email.message.Message, part), boundary=boundary))
+                raw_body.extend(self.get_raw_body_text(typing.cast('email.message.Message', part), boundary=boundary, depth=depth + 1))
         else:
             # Treat text document attachments as belonging to the body of the mail.
             # Attachments with a file-extension of .htm/.html are implicitly treated
@@ -897,14 +941,14 @@ class EmlParser:
 
                 charset = msg.get_content_charset()
                 if charset is None:
-                    raw_body_b = typing.cast(bytes, msg.get_payload(decode=True))
+                    raw_body_b = typing.cast('bytes', msg.get_payload(decode=True))
                     raw_body_str = eml_parser.decode.decode_string(raw_body_b, None)
                 else:
                     try:
-                        raw_body_str = typing.cast(bytes, msg.get_payload(decode=True)).decode(charset, 'ignore')
+                        raw_body_str = typing.cast('bytes', msg.get_payload(decode=True)).decode(charset, 'ignore')
                     except (LookupError, ValueError):
                         logger.debug('An exception occurred while decoding the payload!', exc_info=True)
-                        raw_body_str = typing.cast(bytes, msg.get_payload(decode=True)).decode('ascii', 'ignore')
+                        raw_body_str = typing.cast('bytes', msg.get_payload(decode=True)).decode('ascii', 'ignore')
 
                 # In case we hit bug 27257 or any other parsing error, try to downgrade the used policy
                 try:
@@ -931,7 +975,7 @@ class EmlParser:
         return {k: EmlParser.get_hash(data, k) for k in hashalgo}
 
     @staticmethod
-    def get_hash(value: typing.Union[str, bytes], hash_type: str) -> str:
+    def get_hash(value: str | bytes, hash_type: str) -> str:
         """Generate a hash of type *hash_type* for a given value.
 
         Args:
@@ -953,20 +997,28 @@ class EmlParser:
 
         return hash_algo(_value).hexdigest()
 
-    def traverse_multipart(self, msg: email.message.Message, counter: int = 0) -> dict[str, typing.Any]:
+    def traverse_multipart(self, msg: email.message.Message, counter: int = 0, depth: int = 0) -> dict[str, typing.Any]:
         """Recursively traverses all e-mail message multi-part elements and returns in a parsed form as a dict.
 
         Args:
             msg (email.message.Message): An e-mail message object.
             counter (int, optional): A counter which is used for generating attachments
                 file-names in case there are none found in the header. Default = 0.
+            depth: Parameter used to track the current recursion level.
 
         Returns:
             dict: Returns a dict with all original multi-part headers as well as generated hash check-sums,
                 date size, file extension, real mime-type.
+
+        Raises:
+            RecursionError: If recursion limit exceeded.
         """
         attachments = {}
 
+        if depth > EmlParser.MULTIPART_RECURSION_LIMIT:
+            logger.warning('multi-part nesting limit (%d) exceeded, aborting', EmlParser.MULTIPART_RECURSION_LIMIT)
+            raise RecursionError('Recursion limit exceeded')
+
         if msg.is_multipart():
             if 'content-type' in msg:
                 if msg.get_content_type() == 'message/rfc822':
@@ -974,7 +1026,7 @@ class EmlParser:
                     attachments.update(self.prepare_multipart_part_attachment(msg, counter))
 
             for part in msg.get_payload():
-                attachments.update(self.traverse_multipart(typing.cast(email.message.EmailMessage, part), counter))
+                attachments.update(self.traverse_multipart(typing.cast('email.message.EmailMessage', part), counter=counter, depth=depth + 1))
         else:
             return self.prepare_multipart_part_attachment(msg, counter)
 
@@ -1013,14 +1065,14 @@ class EmlParser:
 
                 try:
                     custom_policy: email.policy.Policy = email.policy.default.clone(max_line_length=0)
-                    data = typing.cast(list[email.message.EmailMessage], payload)[0].as_bytes(policy=custom_policy)
+                    data = typing.cast('list[email.message.EmailMessage]', payload)[0].as_bytes(policy=custom_policy)
                 except UnicodeEncodeError:
                     custom_policy = email.policy.compat32.clone(max_line_length=0)
-                    data = typing.cast(list[email.message.EmailMessage], payload)[0].as_bytes(policy=custom_policy)
+                    data = typing.cast('list[email.message.EmailMessage]', payload)[0].as_bytes(policy=custom_policy)
 
                 file_size = len(data)
             else:
-                data = typing.cast(bytes, msg.get_payload(decode=True))
+                data = typing.cast('bytes', msg.get_payload(decode=True))
                 file_size = len(data)
 
             filename = msg.get_filename('')
@@ -1055,9 +1107,9 @@ class EmlParser:
                 attachment[file_id]['raw'] = base64.b64encode(data)
 
             ch: dict[str, list[str]] = {}
-            for k, v in msg.items():
-                k = k.lower()
-                v = str(v)
+            for header_key, header_value in msg.items():
+                k = header_key.lower()
+                v = str(header_value)
 
                 if k in ch:
                     ch[k].append(v)
@@ -1071,7 +1123,7 @@ class EmlParser:
         return attachment
 
     @staticmethod
-    def get_mime_type(data: bytes) -> typing.Union[tuple[str, str], tuple[None, None]]:
+    def get_mime_type(data: bytes) -> tuple[str, str] | tuple[None, None]:
         """Get mime-type information based on the provided bytes object.
 
         Args:

{eml_parser-2.0.0 → eml_parser-3.0.6}/eml_parser/regexes.py

@@ -14,8 +14,12 @@ __license__ = 'AGPL v3+'
 
 # regex compilation
 # W3C HTML5 standard recommended regex for e-mail validation
-email_regex = re.compile(r"""([a-zA-Z0-9.!#$%&'*+-/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)""", re.MULTILINE)
-email_force_tld_regex = re.compile(r"""([a-zA-Z0-9.!#$%&'*+-/=?^_`{|}~-]+@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)+)""", re.MULTILINE)
+# It also implements the 64 character limit on the local part (RFC 5321, section 2.4), with a safety factor.
+# This mitigates an issue with quadratic complexity when searching for e-mail addresses in very long strings.
+email_no_force_tld_regex = re.compile(r"""([a-zA-Z0-9.!#$%&'*+\-/=?^_`{|}~]{1,128}@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)*)""", re.MULTILINE)
+email_force_tld_regex = re.compile(r"""([a-zA-Z0-9.!#$%&'*+\-/=?^_`{|}~]{1,128}@[a-zA-Z0-9-]+(?:\.[a-zA-Z0-9-]+)+)""", re.MULTILINE)
+email_regex = email_no_force_tld_regex
+
 
 # regex for detecting RFC2047 encodings - used from https://dmorgan.info/posts/encoded-word-syntax/
 email_regex_rfc2047 = re.compile(r"""=\?{1}([\w\S]+)\?{1}([B|Q|b|q])\?{1}([\w\S]+)\?{1}=""")
@@ -96,7 +100,6 @@ url_regex_href = re.compile(
 )
 
 date_regex = re.compile(r""";[ \w\s:,+\-()]+$""")
-noparenthesis_regex = re.compile(r"""\([^()]*\)""")
 cleanline_regex = re.compile(r"""(^[;\s]{0,}|[;\s]{0,}$)""")
 
 escape_special_regex_chars = re.compile(r"""([\^$\[\]()+?.])""")

{eml_parser-2.0.0 → eml_parser-3.0.6}/eml_parser/routing.py

@@ -8,29 +8,24 @@ import eml_parser.regexes
 
 
 def noparenthesis(line: str) -> str:
-    """Remove nested parenthesis, until none are present.
-
-    @FIXME rewrite this function.
+    """Remove nested parentheses, until no pairs of matching parentyheses are present.
 
     Args:
-        line (str): Input text to search in for parenthesis.
+        line (str): Input text to search in for parentheses.
 
     Returns:
-        str: Return a string with all parenthesis removed.
+        str: Return a string with all text in matching parentheses removed. For example,
+        noparenthesis('a((b)c(d') == 'a(c(d'
     """
-    # check empty string
-    if not line:
-        return line
-
-    line_ = line
-
-    while True:
-        lline = line_
-        line_ = eml_parser.regexes.noparenthesis_regex.sub('', line_)
-        if lline == line_:
-            break
-
-    return line_
+    fragments: list[list[str]] = [[]]
+    for ch in line:
+        if ch == '(':
+            fragments.append([ch])
+        else:
+            fragments[-1].append(ch)
+        if ch == ')' and len(fragments) > 1:
+            fragments.pop()
+    return ''.join(ch for w in fragments for ch in w)
 
 
 def cleanline(line: str) -> str:
@@ -63,7 +58,7 @@ def get_domain_ip(line: str) -> list[str]:
 
 
 def parserouting(line: str) -> dict[str, typing.Any]:
-    """This method tries to parsed a e-mail header received line and extract machine readable information.
+    """This method tries to parse an e-mail header received line and extract machine-readable information.
 
     Note that there are a large number of formats for these lines
     and a lot of weird ones which are not commonly used.
@@ -105,49 +100,32 @@ def parserouting(line: str) -> dict[str, typing.Any]:
     npline = npline.strip(' ')  # Remove any border WhiteSpace
 
     borders = ['from ', 'by ', 'with ', 'for ']
-    result: list[dict[str, typing.Any]] = []
 
     # Scan the line to determine the order, and presence of each "from/by/with/for" words
+    raw_matches: list[tuple[int, str]] = []
     for word in borders:
-        candidate = list(borders)
-        candidate.remove(word)
-        for endword in candidate:
-            if word in npline:
-                loc = npline.find(word)
-                end = npline.find(endword)
-                if end < loc or end == -1:
-                    end = 0xFFFFFFF  # Kindof MAX 31 bits
-                result.append({'name_in': word, 'pos': loc, 'name_out': endword, 'weight': end + loc})
-                # print({'name_in': word, 'pos': loc, 'name_out': endword, 'weight': end+loc})
-
-    # Create the word list... "from/by/with/for" by sorting the list.
-    if not result:
+        pos = npline.find(word)
+        if pos != -1:
+            raw_matches.append((pos, word))
+
+    if not raw_matches:
         out['warning'] = ['Nothing Parsable']
         return out
 
-    tout = []
-    for word in borders:
-        result_max = 0xFFFFFFFF
-        line_max: dict[str, typing.Any] = {}
-        for eline in result:
-            if eline['name_in'] == word and eline['weight'] <= result_max:
-                result_max = eline['weight']
-                line_max = eline
+    # Sort keywords sequentially by their appearance order in the header
+    tout = sorted(raw_matches, key=lambda match: match[0])
 
-        if line_max:
-            tout.append([line_max.get('pos'), line_max.get('name_in')])
+    reg = ''
+    for i, item in enumerate(tout):
+        field = item[1].strip()
+        kw = item[1]
 
-    # structure is list[list[int, str]]
-    # we sort based on the first element of the sub list, i.e. int
-    tout = sorted(tout, key=lambda x: typing.cast(int, x[0]))
+        # Capture lazily until the next keyword
+        reg += kw + r'(?P<' + field + r'>.*?)'
 
-    # build regex.
-    reg = ''
-    for item in tout:
-        reg += item[1] + '(?P<' + item[1].strip() + '>.*)'  # type: ignore
-    if npdate:
-        # escape special regex chars
-        reg += eml_parser.regexes.escape_special_regex_chars.sub(r"""\\\1""", npdate)
+        if i + 1 >= len(tout):
+            # Last field captures lazily until a date separator ';' or end of string
+            reg += '(?:;|$)'
 
     reparse = re.compile(reg)
     reparseg = reparse.search(line)