feat(security): migrate content scanning and bounce detection to Rust security bridge; add scanContent IPC command and Rust content scanner with tests; update TS RustSecurityBridge and callers, and adjust CI package references
This commit is contained in:
@@ -3,6 +3,6 @@
|
||||
*/
|
||||
export const commitinfo = {
|
||||
name: '@push.rocks/smartmta',
|
||||
version: '2.0.1',
|
||||
version: '2.1.0',
|
||||
description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
|
||||
}
|
||||
|
||||
@@ -2,6 +2,7 @@ import * as plugins from '../../plugins.js';
|
||||
import * as paths from '../../paths.js';
|
||||
import { logger } from '../../logger.js';
|
||||
import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
|
||||
import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
|
||||
import { LRUCache } from 'lru-cache';
|
||||
import type { Email } from './classes.email.js';
|
||||
|
||||
@@ -63,112 +64,6 @@ export interface BounceRecord {
|
||||
nextRetryTime?: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* Email bounce patterns to identify bounce types in SMTP responses and bounce messages
|
||||
*/
|
||||
const BOUNCE_PATTERNS = {
|
||||
// Hard bounce patterns
|
||||
[BounceType.INVALID_RECIPIENT]: [
|
||||
/no such user/i,
|
||||
/user unknown/i,
|
||||
/does not exist/i,
|
||||
/invalid recipient/i,
|
||||
/unknown recipient/i,
|
||||
/no mailbox/i,
|
||||
/user not found/i,
|
||||
/recipient address rejected/i,
|
||||
/550 5\.1\.1/i
|
||||
],
|
||||
[BounceType.DOMAIN_NOT_FOUND]: [
|
||||
/domain not found/i,
|
||||
/unknown domain/i,
|
||||
/no such domain/i,
|
||||
/host not found/i,
|
||||
/domain invalid/i,
|
||||
/550 5\.1\.2/i
|
||||
],
|
||||
[BounceType.MAILBOX_FULL]: [
|
||||
/mailbox full/i,
|
||||
/over quota/i,
|
||||
/quota exceeded/i,
|
||||
/552 5\.2\.2/i
|
||||
],
|
||||
[BounceType.MAILBOX_INACTIVE]: [
|
||||
/mailbox disabled/i,
|
||||
/mailbox inactive/i,
|
||||
/account disabled/i,
|
||||
/mailbox not active/i,
|
||||
/account suspended/i
|
||||
],
|
||||
[BounceType.BLOCKED]: [
|
||||
/blocked/i,
|
||||
/rejected/i,
|
||||
/denied/i,
|
||||
/blacklisted/i,
|
||||
/prohibited/i,
|
||||
/refused/i,
|
||||
/550 5\.7\./i
|
||||
],
|
||||
[BounceType.SPAM_RELATED]: [
|
||||
/spam/i,
|
||||
/bulk mail/i,
|
||||
/content rejected/i,
|
||||
/message rejected/i,
|
||||
/550 5\.7\.1/i
|
||||
],
|
||||
|
||||
// Soft bounce patterns
|
||||
[BounceType.SERVER_UNAVAILABLE]: [
|
||||
/server unavailable/i,
|
||||
/service unavailable/i,
|
||||
/try again later/i,
|
||||
/try later/i,
|
||||
/451 4\.3\./i,
|
||||
/421 4\.3\./i
|
||||
],
|
||||
[BounceType.TEMPORARY_FAILURE]: [
|
||||
/temporary failure/i,
|
||||
/temporary error/i,
|
||||
/temporary problem/i,
|
||||
/try again/i,
|
||||
/451 4\./i
|
||||
],
|
||||
[BounceType.QUOTA_EXCEEDED]: [
|
||||
/quota temporarily exceeded/i,
|
||||
/mailbox temporarily full/i,
|
||||
/452 4\.2\.2/i
|
||||
],
|
||||
[BounceType.NETWORK_ERROR]: [
|
||||
/network error/i,
|
||||
/connection error/i,
|
||||
/connection timed out/i,
|
||||
/routing error/i,
|
||||
/421 4\.4\./i
|
||||
],
|
||||
[BounceType.TIMEOUT]: [
|
||||
/timed out/i,
|
||||
/timeout/i,
|
||||
/450 4\.4\.2/i
|
||||
],
|
||||
|
||||
// Auto-responses
|
||||
[BounceType.AUTO_RESPONSE]: [
|
||||
/auto[- ]reply/i,
|
||||
/auto[- ]response/i,
|
||||
/vacation/i,
|
||||
/out of office/i,
|
||||
/away from office/i,
|
||||
/on vacation/i,
|
||||
/automatic reply/i
|
||||
],
|
||||
[BounceType.CHALLENGE_RESPONSE]: [
|
||||
/challenge[- ]response/i,
|
||||
/verify your email/i,
|
||||
/confirm your email/i,
|
||||
/email verification/i
|
||||
]
|
||||
};
|
||||
|
||||
/**
|
||||
* Retry strategy configuration for soft bounces
|
||||
*/
|
||||
@@ -269,16 +164,16 @@ export class BounceManager {
|
||||
nextRetryTime: bounceData.nextRetryTime
|
||||
};
|
||||
|
||||
// Determine bounce type and category if not provided
|
||||
// Determine bounce type and category via Rust bridge if not provided
|
||||
if (!bounceData.bounceType || bounceData.bounceType === BounceType.UNKNOWN) {
|
||||
const bounceInfo = this.detectBounceType(
|
||||
bounce.smtpResponse || '',
|
||||
bounce.diagnosticCode || '',
|
||||
bounce.statusCode || ''
|
||||
);
|
||||
|
||||
bounce.bounceType = bounceInfo.type;
|
||||
bounce.bounceCategory = bounceInfo.category;
|
||||
const bridge = RustSecurityBridge.getInstance();
|
||||
const rustResult = await bridge.detectBounce({
|
||||
smtpResponse: bounce.smtpResponse,
|
||||
diagnosticCode: bounce.diagnosticCode,
|
||||
statusCode: bounce.statusCode,
|
||||
});
|
||||
bounce.bounceType = rustResult.bounce_type as BounceType;
|
||||
bounce.bounceCategory = rustResult.category as BounceCategory;
|
||||
}
|
||||
|
||||
// Process the bounce based on category
|
||||
@@ -791,134 +686,6 @@ export class BounceManager {
|
||||
return this.bounceCache.get(email.toLowerCase()) || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Analyze SMTP response and diagnostic codes to determine bounce type
|
||||
* @param smtpResponse SMTP response string
|
||||
* @param diagnosticCode Diagnostic code from bounce
|
||||
* @param statusCode Status code from bounce
|
||||
* @returns Detected bounce type and category
|
||||
*/
|
||||
private detectBounceType(
|
||||
smtpResponse: string,
|
||||
diagnosticCode: string,
|
||||
statusCode: string
|
||||
): {
|
||||
type: BounceType;
|
||||
category: BounceCategory;
|
||||
} {
|
||||
// Combine all text for comprehensive pattern matching
|
||||
const fullText = `${smtpResponse} ${diagnosticCode} ${statusCode}`.toLowerCase();
|
||||
|
||||
// Check for auto-responses first
|
||||
if (this.matchesPattern(fullText, BounceType.AUTO_RESPONSE) ||
|
||||
this.matchesPattern(fullText, BounceType.CHALLENGE_RESPONSE)) {
|
||||
return {
|
||||
type: BounceType.AUTO_RESPONSE,
|
||||
category: BounceCategory.AUTO_RESPONSE
|
||||
};
|
||||
}
|
||||
|
||||
// Check for hard bounces
|
||||
for (const bounceType of [
|
||||
BounceType.INVALID_RECIPIENT,
|
||||
BounceType.DOMAIN_NOT_FOUND,
|
||||
BounceType.MAILBOX_FULL,
|
||||
BounceType.MAILBOX_INACTIVE,
|
||||
BounceType.BLOCKED,
|
||||
BounceType.SPAM_RELATED,
|
||||
BounceType.POLICY_RELATED
|
||||
]) {
|
||||
if (this.matchesPattern(fullText, bounceType)) {
|
||||
return {
|
||||
type: bounceType,
|
||||
category: BounceCategory.HARD
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Check for soft bounces
|
||||
for (const bounceType of [
|
||||
BounceType.SERVER_UNAVAILABLE,
|
||||
BounceType.TEMPORARY_FAILURE,
|
||||
BounceType.QUOTA_EXCEEDED,
|
||||
BounceType.NETWORK_ERROR,
|
||||
BounceType.TIMEOUT
|
||||
]) {
|
||||
if (this.matchesPattern(fullText, bounceType)) {
|
||||
return {
|
||||
type: bounceType,
|
||||
category: BounceCategory.SOFT
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Handle DSN (Delivery Status Notification) status codes
|
||||
if (statusCode) {
|
||||
// Format: class.subject.detail
|
||||
const parts = statusCode.split('.');
|
||||
if (parts.length >= 2) {
|
||||
const statusClass = parts[0];
|
||||
const statusSubject = parts[1];
|
||||
|
||||
// 5.X.X is permanent failure (hard bounce)
|
||||
if (statusClass === '5') {
|
||||
// Try to determine specific type based on subject
|
||||
if (statusSubject === '1') {
|
||||
return { type: BounceType.INVALID_RECIPIENT, category: BounceCategory.HARD };
|
||||
} else if (statusSubject === '2') {
|
||||
return { type: BounceType.MAILBOX_FULL, category: BounceCategory.HARD };
|
||||
} else if (statusSubject === '7') {
|
||||
return { type: BounceType.BLOCKED, category: BounceCategory.HARD };
|
||||
} else {
|
||||
return { type: BounceType.UNKNOWN, category: BounceCategory.HARD };
|
||||
}
|
||||
}
|
||||
|
||||
// 4.X.X is temporary failure (soft bounce)
|
||||
if (statusClass === '4') {
|
||||
// Try to determine specific type based on subject
|
||||
if (statusSubject === '2') {
|
||||
return { type: BounceType.QUOTA_EXCEEDED, category: BounceCategory.SOFT };
|
||||
} else if (statusSubject === '3') {
|
||||
return { type: BounceType.SERVER_UNAVAILABLE, category: BounceCategory.SOFT };
|
||||
} else if (statusSubject === '4') {
|
||||
return { type: BounceType.NETWORK_ERROR, category: BounceCategory.SOFT };
|
||||
} else {
|
||||
return { type: BounceType.TEMPORARY_FAILURE, category: BounceCategory.SOFT };
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Default to unknown
|
||||
return {
|
||||
type: BounceType.UNKNOWN,
|
||||
category: BounceCategory.UNKNOWN
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if text matches any pattern for a bounce type
|
||||
* @param text Text to check against patterns
|
||||
* @param bounceType Bounce type to get patterns for
|
||||
* @returns Whether the text matches any pattern
|
||||
*/
|
||||
private matchesPattern(text: string, bounceType: BounceType): boolean {
|
||||
const patterns = BOUNCE_PATTERNS[bounceType];
|
||||
|
||||
if (!patterns) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (const pattern of patterns) {
|
||||
if (pattern.test(text)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all known hard bounced addresses
|
||||
* @returns Array of hard bounced email addresses
|
||||
|
||||
@@ -4,6 +4,7 @@ import { logger } from '../logger.js';
|
||||
import { Email } from '../mail/core/classes.email.js';
|
||||
import type { IAttachment } from '../mail/core/classes.email.js';
|
||||
import { SecurityLogger, SecurityLogLevel, SecurityEventType } from './classes.securitylogger.js';
|
||||
import { RustSecurityBridge } from './classes.rustsecuritybridge.js';
|
||||
import { LRUCache } from 'lru-cache';
|
||||
|
||||
/**
|
||||
@@ -65,75 +66,6 @@ export class ContentScanner {
|
||||
private scanCache: LRUCache<string, IScanResult>;
|
||||
private options: Required<IContentScannerOptions>;
|
||||
|
||||
// Predefined patterns for common threats
|
||||
private static readonly MALICIOUS_PATTERNS = {
|
||||
// Phishing patterns
|
||||
phishing: [
|
||||
/(?:verify|confirm|update|login).*(?:account|password|details)/i,
|
||||
/urgent.*(?:action|attention|required)/i,
|
||||
/(?:paypal|apple|microsoft|amazon|google|bank).*(?:verify|confirm|suspend)/i,
|
||||
/your.*(?:account).*(?:suspended|compromised|locked)/i,
|
||||
/\b(?:password reset|security alert|security notice)\b/i
|
||||
],
|
||||
|
||||
// Spam indicators
|
||||
spam: [
|
||||
/\b(?:viagra|cialis|enlargement|diet pill|lose weight fast|cheap meds)\b/i,
|
||||
/\b(?:million dollars|lottery winner|prize claim|inheritance|rich widow)\b/i,
|
||||
/\b(?:earn from home|make money fast|earn \$\d{3,}\/day)\b/i,
|
||||
/\b(?:limited time offer|act now|exclusive deal|only \d+ left)\b/i,
|
||||
/\b(?:forex|stock tip|investment opportunity|cryptocurrency|bitcoin)\b/i
|
||||
],
|
||||
|
||||
// Malware indicators in text
|
||||
malware: [
|
||||
/(?:attached file|see attachment).*(?:invoice|receipt|statement|document)/i,
|
||||
/open.*(?:the attached|this attachment)/i,
|
||||
/(?:enable|allow).*(?:macros|content|editing)/i,
|
||||
/download.*(?:attachment|file|document)/i,
|
||||
/\b(?:ransomware protection|virus alert|malware detected)\b/i
|
||||
],
|
||||
|
||||
// Suspicious links
|
||||
suspiciousLinks: [
|
||||
/https?:\/\/bit\.ly\//i,
|
||||
/https?:\/\/goo\.gl\//i,
|
||||
/https?:\/\/t\.co\//i,
|
||||
/https?:\/\/tinyurl\.com\//i,
|
||||
/https?:\/\/(?:\d{1,3}\.){3}\d{1,3}/i, // IP address URLs
|
||||
/https?:\/\/.*\.(?:xyz|top|club|gq|cf)\//i, // Suspicious TLDs
|
||||
/(?:login|account|signin|auth).*\.(?!gov|edu|com|org|net)\w+\.\w+/i, // Login pages on unusual domains
|
||||
],
|
||||
|
||||
// XSS and script injection
|
||||
scriptInjection: [
|
||||
/<script.*>.*<\/script>/is,
|
||||
/javascript:/i,
|
||||
/on(?:click|load|mouse|error|focus|blur)=".*"/i,
|
||||
/document\.(?:cookie|write|location)/i,
|
||||
/eval\s*\(/i
|
||||
],
|
||||
|
||||
// Sensitive data patterns
|
||||
sensitiveData: [
|
||||
/\b(?:\d{3}-\d{2}-\d{4}|\d{9})\b/, // SSN
|
||||
/\b\d{13,16}\b/, // Credit card numbers
|
||||
/\b(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\b/ // Possible Base64
|
||||
]
|
||||
};
|
||||
|
||||
// Common executable extensions
|
||||
private static readonly EXECUTABLE_EXTENSIONS = [
|
||||
'.exe', '.dll', '.bat', '.cmd', '.msi', '.ts', '.vbs', '.ps1',
|
||||
'.sh', '.jar', '.py', '.com', '.scr', '.pif', '.hta', '.cpl',
|
||||
'.reg', '.vba', '.lnk', '.wsf', '.msi', '.msp', '.mst'
|
||||
];
|
||||
|
||||
// Document formats that may contain macros
|
||||
private static readonly MACRO_DOCUMENT_EXTENSIONS = [
|
||||
'.doc', '.docm', '.xls', '.xlsm', '.ppt', '.pptm', '.dotm', '.xlsb', '.ppam', '.potm'
|
||||
];
|
||||
|
||||
/**
|
||||
* Default options for the content scanner
|
||||
*/
|
||||
@@ -185,7 +117,9 @@ export class ContentScanner {
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan an email for malicious content
|
||||
* Scan an email for malicious content.
|
||||
* Delegates text/subject/html/filename pattern scanning to Rust.
|
||||
* Binary attachment scanning (PE headers, VBA macros) stays in TS.
|
||||
* @param email The email to scan
|
||||
* @returns Scan result
|
||||
*/
|
||||
@@ -193,74 +127,67 @@ export class ContentScanner {
|
||||
try {
|
||||
// Generate a cache key from the email
|
||||
const cacheKey = this.generateCacheKey(email);
|
||||
|
||||
|
||||
// Check cache first
|
||||
const cachedResult = this.scanCache.get(cacheKey);
|
||||
if (cachedResult) {
|
||||
logger.log('info', `Using cached scan result for email ${email.getMessageId()}`);
|
||||
return cachedResult;
|
||||
}
|
||||
|
||||
// Initialize scan result
|
||||
|
||||
// Delegate text/subject/html/filename scanning to Rust
|
||||
const bridge = RustSecurityBridge.getInstance();
|
||||
const rustResult = await bridge.scanContent({
|
||||
subject: this.options.scanSubject ? email.subject : undefined,
|
||||
textBody: this.options.scanBody ? email.text : undefined,
|
||||
htmlBody: this.options.scanBody ? email.html : undefined,
|
||||
attachmentNames: this.options.scanAttachmentNames
|
||||
? email.attachments?.map(a => a.filename) ?? []
|
||||
: [],
|
||||
});
|
||||
|
||||
const result: IScanResult = {
|
||||
isClean: true,
|
||||
threatScore: 0,
|
||||
scannedElements: [],
|
||||
timestamp: Date.now()
|
||||
threatScore: rustResult.threatScore,
|
||||
threatType: rustResult.threatType ?? undefined,
|
||||
threatDetails: rustResult.threatDetails ?? undefined,
|
||||
scannedElements: rustResult.scannedElements,
|
||||
timestamp: Date.now(),
|
||||
};
|
||||
|
||||
// List of scan promises
|
||||
const scanPromises: Array<Promise<void>> = [];
|
||||
|
||||
// Scan subject
|
||||
if (this.options.scanSubject && email.subject) {
|
||||
scanPromises.push(this.scanSubject(email.subject, result));
|
||||
}
|
||||
|
||||
// Scan body content
|
||||
if (this.options.scanBody) {
|
||||
if (email.text) {
|
||||
scanPromises.push(this.scanTextContent(email.text, result));
|
||||
}
|
||||
|
||||
if (email.html) {
|
||||
scanPromises.push(this.scanHtmlContent(email.html, result));
|
||||
}
|
||||
}
|
||||
|
||||
// Scan attachments
|
||||
if (this.options.scanAttachments && email.attachments && email.attachments.length > 0) {
|
||||
|
||||
// Attachment binary scanning stays in TS (PE headers, macro detection)
|
||||
if (this.options.scanAttachments && email.attachments?.length > 0) {
|
||||
for (const attachment of email.attachments) {
|
||||
scanPromises.push(this.scanAttachment(attachment, result));
|
||||
this.scanAttachmentBinary(attachment, result);
|
||||
}
|
||||
}
|
||||
|
||||
// Run all scans in parallel
|
||||
await Promise.all(scanPromises);
|
||||
|
||||
|
||||
// Apply custom rules (TS-only, runtime-configured)
|
||||
this.applyCustomRules(email, result);
|
||||
|
||||
// Determine if the email is clean based on threat score
|
||||
result.isClean = result.threatScore < this.options.minThreatScore;
|
||||
|
||||
|
||||
// Save to cache
|
||||
this.scanCache.set(cacheKey, result);
|
||||
|
||||
|
||||
// Log high threat findings
|
||||
if (result.threatScore >= this.options.highThreatScore) {
|
||||
this.logHighThreatFound(email, result);
|
||||
} else if (!result.isClean) {
|
||||
this.logThreatFound(email, result);
|
||||
}
|
||||
|
||||
|
||||
return result;
|
||||
} catch (error) {
|
||||
logger.log('error', `Error scanning email: ${error.message}`, {
|
||||
messageId: email.getMessageId(),
|
||||
error: error.stack
|
||||
});
|
||||
|
||||
|
||||
// Return a safe default with error indication
|
||||
return {
|
||||
isClean: true, // Let it pass if scanner fails (configure as desired)
|
||||
isClean: true,
|
||||
threatScore: 0,
|
||||
scannedElements: ['error'],
|
||||
timestamp: Date.now(),
|
||||
@@ -269,7 +196,7 @@ export class ContentScanner {
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Generate a cache key from an email
|
||||
* @param email The email to generate a key for
|
||||
@@ -280,7 +207,7 @@ export class ContentScanner {
|
||||
if (email.getMessageId()) {
|
||||
return `email:${email.getMessageId()}`;
|
||||
}
|
||||
|
||||
|
||||
// Fallback to a hash of key content
|
||||
const contentToHash = [
|
||||
email.from,
|
||||
@@ -289,321 +216,75 @@ export class ContentScanner {
|
||||
email.html?.substring(0, 1000) || '',
|
||||
email.attachments?.length || 0
|
||||
].join(':');
|
||||
|
||||
|
||||
return `email:${plugins.crypto.createHash('sha256').update(contentToHash).digest('hex')}`;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Scan email subject for threats
|
||||
* @param subject The subject to scan
|
||||
* @param result The scan result to update
|
||||
*/
|
||||
private async scanSubject(subject: string, result: IScanResult): Promise<void> {
|
||||
result.scannedElements.push('subject');
|
||||
|
||||
// Check against phishing patterns
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.phishing) {
|
||||
if (pattern.test(subject)) {
|
||||
result.threatScore += 25;
|
||||
result.threatType = ThreatCategory.PHISHING;
|
||||
result.threatDetails = `Subject contains potential phishing indicators: ${subject}`;
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Check against spam patterns
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.spam) {
|
||||
if (pattern.test(subject)) {
|
||||
result.threatScore += 15;
|
||||
result.threatType = ThreatCategory.SPAM;
|
||||
result.threatDetails = `Subject contains potential spam indicators: ${subject}`;
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
// Check custom rules
|
||||
for (const rule of this.options.customRules) {
|
||||
const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
|
||||
if (pattern.test(subject)) {
|
||||
result.threatScore += rule.score;
|
||||
result.threatType = rule.type;
|
||||
result.threatDetails = rule.description;
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan plain text content for threats
|
||||
* @param text The text content to scan
|
||||
* @param result The scan result to update
|
||||
*/
|
||||
private async scanTextContent(text: string, result: IScanResult): Promise<void> {
|
||||
result.scannedElements.push('text');
|
||||
|
||||
// Check suspicious links
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.suspiciousLinks) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += 20;
|
||||
if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SUSPICIOUS_LINK ? 0 : 20)) {
|
||||
result.threatType = ThreatCategory.SUSPICIOUS_LINK;
|
||||
result.threatDetails = `Text contains suspicious links`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check phishing
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.phishing) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += 25;
|
||||
if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.PHISHING ? 0 : 25)) {
|
||||
result.threatType = ThreatCategory.PHISHING;
|
||||
result.threatDetails = `Text contains potential phishing indicators`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check spam
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.spam) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += 15;
|
||||
if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SPAM ? 0 : 15)) {
|
||||
result.threatType = ThreatCategory.SPAM;
|
||||
result.threatDetails = `Text contains potential spam indicators`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check malware indicators
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.malware) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += 30;
|
||||
if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.MALWARE ? 0 : 30)) {
|
||||
result.threatType = ThreatCategory.MALWARE;
|
||||
result.threatDetails = `Text contains potential malware indicators`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check sensitive data
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.sensitiveData) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += 25;
|
||||
if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SENSITIVE_DATA ? 0 : 25)) {
|
||||
result.threatType = ThreatCategory.SENSITIVE_DATA;
|
||||
result.threatDetails = `Text contains potentially sensitive data patterns`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check custom rules
|
||||
for (const rule of this.options.customRules) {
|
||||
const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += rule.score;
|
||||
if (!result.threatType || result.threatScore > 20) {
|
||||
result.threatType = rule.type;
|
||||
result.threatDetails = rule.description;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan HTML content for threats
|
||||
* @param html The HTML content to scan
|
||||
* @param result The scan result to update
|
||||
*/
|
||||
private async scanHtmlContent(html: string, result: IScanResult): Promise<void> {
|
||||
result.scannedElements.push('html');
|
||||
|
||||
// Check for script injection
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.scriptInjection) {
|
||||
if (pattern.test(html)) {
|
||||
result.threatScore += 40;
|
||||
if (!result.threatType || result.threatType !== ThreatCategory.XSS) {
|
||||
result.threatType = ThreatCategory.XSS;
|
||||
result.threatDetails = `HTML contains potentially malicious script content`;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Extract text content from HTML for further scanning
|
||||
const textContent = this.extractTextFromHtml(html);
|
||||
if (textContent) {
|
||||
// We'll leverage the text scanning but not double-count threat score
|
||||
const tempResult: IScanResult = {
|
||||
isClean: true,
|
||||
threatScore: 0,
|
||||
scannedElements: [],
|
||||
timestamp: Date.now()
|
||||
};
|
||||
|
||||
await this.scanTextContent(textContent, tempResult);
|
||||
|
||||
// Only add additional threat types if they're more severe
|
||||
if (tempResult.threatType && tempResult.threatScore > 0) {
|
||||
// Add half of the text content score to avoid double counting
|
||||
result.threatScore += Math.floor(tempResult.threatScore / 2);
|
||||
|
||||
// Adopt the threat type if more severe or no existing type
|
||||
if (!result.threatType || tempResult.threatScore > result.threatScore) {
|
||||
result.threatType = tempResult.threatType;
|
||||
result.threatDetails = tempResult.threatDetails;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Extract and check links from HTML
|
||||
const links = this.extractLinksFromHtml(html);
|
||||
if (links.length > 0) {
|
||||
// Check for suspicious links
|
||||
let suspiciousLinks = 0;
|
||||
for (const link of links) {
|
||||
for (const pattern of ContentScanner.MALICIOUS_PATTERNS.suspiciousLinks) {
|
||||
if (pattern.test(link)) {
|
||||
suspiciousLinks++;
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (suspiciousLinks > 0) {
|
||||
// Add score based on percentage of suspicious links
|
||||
const suspiciousPercentage = (suspiciousLinks / links.length) * 100;
|
||||
const additionalScore = Math.min(40, Math.floor(suspiciousPercentage / 2.5));
|
||||
result.threatScore += additionalScore;
|
||||
|
||||
if (!result.threatType || additionalScore > 20) {
|
||||
result.threatType = ThreatCategory.SUSPICIOUS_LINK;
|
||||
result.threatDetails = `HTML contains ${suspiciousLinks} suspicious links out of ${links.length} total links`;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Scan an attachment for threats
|
||||
* Scan attachment binary content for PE headers and VBA macros.
|
||||
* This stays in TS because it accesses raw Buffer data (too large for IPC).
|
||||
* @param attachment The attachment to scan
|
||||
* @param result The scan result to update
|
||||
*/
|
||||
private async scanAttachment(attachment: IAttachment, result: IScanResult): Promise<void> {
|
||||
const filename = attachment.filename.toLowerCase();
|
||||
result.scannedElements.push(`attachment:${filename}`);
|
||||
|
||||
// Skip large attachments if configured
|
||||
if (attachment.content && attachment.content.length > this.options.maxAttachmentSizeToScan) {
|
||||
logger.log('info', `Skipping scan of large attachment: ${filename} (${attachment.content.length} bytes)`);
|
||||
private scanAttachmentBinary(attachment: IAttachment, result: IScanResult): void {
|
||||
if (!attachment.content) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Check filename for executable extensions
|
||||
if (this.options.blockExecutables) {
|
||||
for (const ext of ContentScanner.EXECUTABLE_EXTENSIONS) {
|
||||
if (filename.endsWith(ext)) {
|
||||
result.threatScore += 70; // High score for executable attachments
|
||||
result.threatType = ThreatCategory.EXECUTABLE;
|
||||
result.threatDetails = `Attachment has a potentially dangerous extension: ${filename}`;
|
||||
return; // No need to scan contents if filename already flagged
|
||||
}
|
||||
}
|
||||
|
||||
// Skip large attachments
|
||||
if (attachment.content.length > this.options.maxAttachmentSizeToScan) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Check for Office documents with macros
|
||||
if (this.options.blockMacros) {
|
||||
for (const ext of ContentScanner.MACRO_DOCUMENT_EXTENSIONS) {
|
||||
if (filename.endsWith(ext)) {
|
||||
// For Office documents, check if they contain macros
|
||||
// This is a simplified check - a real implementation would use specialized libraries
|
||||
// to detect macros in Office documents
|
||||
if (attachment.content && this.likelyContainsMacros(attachment)) {
|
||||
result.threatScore += 60;
|
||||
result.threatType = ThreatCategory.MALICIOUS_MACRO;
|
||||
result.threatDetails = `Attachment appears to contain macros: ${filename}`;
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const filename = attachment.filename.toLowerCase();
|
||||
|
||||
// Check for PE headers (Windows executables disguised with non-.exe extensions)
|
||||
if (attachment.content.length > 64 &&
|
||||
attachment.content[0] === 0x4D &&
|
||||
attachment.content[1] === 0x5A) { // 'MZ' header
|
||||
result.threatScore += 80;
|
||||
result.threatType = ThreatCategory.EXECUTABLE;
|
||||
result.threatDetails = `Attachment contains executable code: ${filename}`;
|
||||
return;
|
||||
}
|
||||
|
||||
// Perform basic content analysis if we have content buffer
|
||||
if (attachment.content) {
|
||||
// Convert to string for scanning, with a limit to prevent memory issues
|
||||
const textContent = this.extractTextFromBuffer(attachment.content);
|
||||
|
||||
if (textContent) {
|
||||
// Scan for malicious patterns in attachment content
|
||||
for (const category in ContentScanner.MALICIOUS_PATTERNS) {
|
||||
const patterns = ContentScanner.MALICIOUS_PATTERNS[category];
|
||||
for (const pattern of patterns) {
|
||||
if (pattern.test(textContent)) {
|
||||
result.threatScore += 30;
|
||||
|
||||
if (!result.threatType) {
|
||||
result.threatType = this.mapCategoryToThreatType(category);
|
||||
result.threatDetails = `Attachment content contains suspicious patterns: ${filename}`;
|
||||
}
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check for PE headers (Windows executables)
|
||||
if (attachment.content.length > 64 &&
|
||||
attachment.content[0] === 0x4D &&
|
||||
attachment.content[1] === 0x5A) { // 'MZ' header
|
||||
result.threatScore += 80;
|
||||
result.threatType = ThreatCategory.EXECUTABLE;
|
||||
result.threatDetails = `Attachment contains executable code: ${filename}`;
|
||||
}
|
||||
|
||||
// Check for VBA macro indicators in Office documents
|
||||
if (this.options.blockMacros && this.likelyContainsMacros(attachment)) {
|
||||
result.threatScore += 60;
|
||||
result.threatType = ThreatCategory.MALICIOUS_MACRO;
|
||||
result.threatDetails = `Attachment appears to contain macros: ${filename}`;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Extract links from HTML content
|
||||
* @param html HTML content
|
||||
* @returns Array of extracted links
|
||||
* Apply custom rules (runtime-configured patterns) to the email.
|
||||
* These stay in TS because they are configured at runtime.
|
||||
* @param email The email to check
|
||||
* @param result The scan result to update
|
||||
*/
|
||||
private extractLinksFromHtml(html: string): string[] {
|
||||
const links: string[] = [];
|
||||
|
||||
// Simple regex-based extraction - a real implementation might use a proper HTML parser
|
||||
const matches = html.match(/href=["'](https?:\/\/[^"']+)["']/gi);
|
||||
if (matches) {
|
||||
for (const match of matches) {
|
||||
const linkMatch = match.match(/href=["'](https?:\/\/[^"']+)["']/i);
|
||||
if (linkMatch && linkMatch[1]) {
|
||||
links.push(linkMatch[1]);
|
||||
private applyCustomRules(email: Email, result: IScanResult): void {
|
||||
if (!this.options.customRules.length) {
|
||||
return;
|
||||
}
|
||||
|
||||
const textsToCheck: string[] = [];
|
||||
if (email.subject) textsToCheck.push(email.subject);
|
||||
if (email.text) textsToCheck.push(email.text);
|
||||
if (email.html) textsToCheck.push(email.html);
|
||||
|
||||
for (const rule of this.options.customRules) {
|
||||
const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
|
||||
for (const text of textsToCheck) {
|
||||
if (pattern.test(text)) {
|
||||
result.threatScore += rule.score;
|
||||
result.threatType = rule.type;
|
||||
result.threatDetails = rule.description;
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return links;
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract plain text from HTML
|
||||
* @param html HTML content
|
||||
* @returns Extracted text
|
||||
*/
|
||||
private extractTextFromHtml(html: string): string {
|
||||
// Remove HTML tags and decode entities - simplified version
|
||||
return html
|
||||
.replace(/<style[^>]*>.*?<\/style>/gs, '')
|
||||
.replace(/<script[^>]*>.*?<\/script>/gs, '')
|
||||
.replace(/<[^>]+>/g, ' ')
|
||||
.replace(/ /g, ' ')
|
||||
.replace(/</g, '<')
|
||||
.replace(/>/g, '>')
|
||||
.replace(/&/g, '&')
|
||||
.replace(/"/g, '"')
|
||||
.replace(/'/g, "'")
|
||||
.replace(/\s+/g, ' ')
|
||||
.trim();
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Extract text from a binary buffer for scanning
|
||||
* @param buffer Binary content
|
||||
@@ -614,7 +295,7 @@ export class ContentScanner {
|
||||
// Limit the amount we convert to avoid memory issues
|
||||
const sampleSize = Math.min(buffer.length, 100 * 1024); // 100KB max sample
|
||||
const sample = buffer.slice(0, sampleSize);
|
||||
|
||||
|
||||
// Try to convert to string, filtering out non-printable chars
|
||||
return sample.toString('utf8')
|
||||
.replace(/[\x00-\x09\x0B-\x1F\x7F-\x9F]/g, '') // Remove control chars
|
||||
@@ -624,16 +305,13 @@ export class ContentScanner {
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Check if an Office document likely contains macros
|
||||
* This is a simplified check - real implementation would use specialized libraries
|
||||
* @param attachment The attachment to check
|
||||
* @returns Whether the file likely contains macros
|
||||
*/
|
||||
private likelyContainsMacros(attachment: IAttachment): boolean {
|
||||
// Simple heuristic: look for VBA/macro related strings
|
||||
// This is a simplified approach and not comprehensive
|
||||
const content = this.extractTextFromBuffer(attachment.content);
|
||||
const macroIndicators = [
|
||||
/vbaProject\.bin/i,
|
||||
@@ -647,33 +325,16 @@ export class ContentScanner {
|
||||
/\bShell\(/i,
|
||||
/\bCreateObject\(/i
|
||||
];
|
||||
|
||||
|
||||
for (const indicator of macroIndicators) {
|
||||
if (indicator.test(content)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a pattern category to a threat type
|
||||
* @param category The pattern category
|
||||
* @returns The corresponding threat type
|
||||
*/
|
||||
private mapCategoryToThreatType(category: string): string {
|
||||
switch (category) {
|
||||
case 'phishing': return ThreatCategory.PHISHING;
|
||||
case 'spam': return ThreatCategory.SPAM;
|
||||
case 'malware': return ThreatCategory.MALWARE;
|
||||
case 'suspiciousLinks': return ThreatCategory.SUSPICIOUS_LINK;
|
||||
case 'scriptInjection': return ThreatCategory.XSS;
|
||||
case 'sensitiveData': return ThreatCategory.SENSITIVE_DATA;
|
||||
default: return ThreatCategory.BLACKLISTED_CONTENT;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Log a high threat finding to the security logger
|
||||
* @param email The email containing the threat
|
||||
|
||||
@@ -59,6 +59,13 @@ interface IReputationResult {
|
||||
total_checked: number;
|
||||
}
|
||||
|
||||
interface IContentScanResult {
|
||||
threatScore: number;
|
||||
threatType: string | null;
|
||||
threatDetails: string | null;
|
||||
scannedElements: string[];
|
||||
}
|
||||
|
||||
interface IVersionInfo {
|
||||
bin: string;
|
||||
core: string;
|
||||
@@ -102,6 +109,15 @@ type TMailerCommands = {
|
||||
params: { ip: string; heloDomain: string; hostname?: string; mailFrom: string };
|
||||
result: ISpfResult;
|
||||
};
|
||||
scanContent: {
|
||||
params: {
|
||||
subject?: string;
|
||||
textBody?: string;
|
||||
htmlBody?: string;
|
||||
attachmentNames?: string[];
|
||||
};
|
||||
result: IContentScanResult;
|
||||
};
|
||||
verifyEmail: {
|
||||
params: {
|
||||
rawMessage: string;
|
||||
@@ -243,6 +259,16 @@ export class RustSecurityBridge {
|
||||
return this.bridge.sendCommand('detectBounce', opts);
|
||||
}
|
||||
|
||||
/** Scan email content for threats (phishing, spam, malware, etc.). */
|
||||
public async scanContent(opts: {
|
||||
subject?: string;
|
||||
textBody?: string;
|
||||
htmlBody?: string;
|
||||
attachmentNames?: string[];
|
||||
}): Promise<IContentScanResult> {
|
||||
return this.bridge.sendCommand('scanContent', opts);
|
||||
}
|
||||
|
||||
/** Check IP reputation via DNSBL. */
|
||||
public async checkIpReputation(ip: string): Promise<IReputationResult> {
|
||||
return this.bridge.sendCommand('checkIpReputation', { ip });
|
||||
@@ -298,6 +324,7 @@ export type {
|
||||
IEmailSecurityResult,
|
||||
IValidationResult,
|
||||
IBounceDetection,
|
||||
IContentScanResult,
|
||||
IReputationResult as IRustReputationResult,
|
||||
IVersionInfo,
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user