feat(security): migrate content scanning and bounce detection to Rust security bridge; add scanContent IPC command and Rust content scanner with tests; update TS RustSecurityBridge and callers, and adjust CI package references
This commit is contained in:
@@ -2,6 +2,7 @@ import * as plugins from '../../plugins.js';
|
||||
import * as paths from '../../paths.js';
|
||||
import { logger } from '../../logger.js';
|
||||
import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
|
||||
import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
|
||||
import { LRUCache } from 'lru-cache';
|
||||
import type { Email } from './classes.email.js';
|
||||
|
||||
@@ -63,112 +64,6 @@ export interface BounceRecord {
|
||||
nextRetryTime?: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* Email bounce patterns to identify bounce types in SMTP responses and bounce messages
|
||||
*/
|
||||
const BOUNCE_PATTERNS = {
|
||||
// Hard bounce patterns
|
||||
[BounceType.INVALID_RECIPIENT]: [
|
||||
/no such user/i,
|
||||
/user unknown/i,
|
||||
/does not exist/i,
|
||||
/invalid recipient/i,
|
||||
/unknown recipient/i,
|
||||
/no mailbox/i,
|
||||
/user not found/i,
|
||||
/recipient address rejected/i,
|
||||
/550 5\.1\.1/i
|
||||
],
|
||||
[BounceType.DOMAIN_NOT_FOUND]: [
|
||||
/domain not found/i,
|
||||
/unknown domain/i,
|
||||
/no such domain/i,
|
||||
/host not found/i,
|
||||
/domain invalid/i,
|
||||
/550 5\.1\.2/i
|
||||
],
|
||||
[BounceType.MAILBOX_FULL]: [
|
||||
/mailbox full/i,
|
||||
/over quota/i,
|
||||
/quota exceeded/i,
|
||||
/552 5\.2\.2/i
|
||||
],
|
||||
[BounceType.MAILBOX_INACTIVE]: [
|
||||
/mailbox disabled/i,
|
||||
/mailbox inactive/i,
|
||||
/account disabled/i,
|
||||
/mailbox not active/i,
|
||||
/account suspended/i
|
||||
],
|
||||
[BounceType.BLOCKED]: [
|
||||
/blocked/i,
|
||||
/rejected/i,
|
||||
/denied/i,
|
||||
/blacklisted/i,
|
||||
/prohibited/i,
|
||||
/refused/i,
|
||||
/550 5\.7\./i
|
||||
],
|
||||
[BounceType.SPAM_RELATED]: [
|
||||
/spam/i,
|
||||
/bulk mail/i,
|
||||
/content rejected/i,
|
||||
/message rejected/i,
|
||||
/550 5\.7\.1/i
|
||||
],
|
||||
|
||||
// Soft bounce patterns
|
||||
[BounceType.SERVER_UNAVAILABLE]: [
|
||||
/server unavailable/i,
|
||||
/service unavailable/i,
|
||||
/try again later/i,
|
||||
/try later/i,
|
||||
/451 4\.3\./i,
|
||||
/421 4\.3\./i
|
||||
],
|
||||
[BounceType.TEMPORARY_FAILURE]: [
|
||||
/temporary failure/i,
|
||||
/temporary error/i,
|
||||
/temporary problem/i,
|
||||
/try again/i,
|
||||
/451 4\./i
|
||||
],
|
||||
[BounceType.QUOTA_EXCEEDED]: [
|
||||
/quota temporarily exceeded/i,
|
||||
/mailbox temporarily full/i,
|
||||
/452 4\.2\.2/i
|
||||
],
|
||||
[BounceType.NETWORK_ERROR]: [
|
||||
/network error/i,
|
||||
/connection error/i,
|
||||
/connection timed out/i,
|
||||
/routing error/i,
|
||||
/421 4\.4\./i
|
||||
],
|
||||
[BounceType.TIMEOUT]: [
|
||||
/timed out/i,
|
||||
/timeout/i,
|
||||
/450 4\.4\.2/i
|
||||
],
|
||||
|
||||
// Auto-responses
|
||||
[BounceType.AUTO_RESPONSE]: [
|
||||
/auto[- ]reply/i,
|
||||
/auto[- ]response/i,
|
||||
/vacation/i,
|
||||
/out of office/i,
|
||||
/away from office/i,
|
||||
/on vacation/i,
|
||||
/automatic reply/i
|
||||
],
|
||||
[BounceType.CHALLENGE_RESPONSE]: [
|
||||
/challenge[- ]response/i,
|
||||
/verify your email/i,
|
||||
/confirm your email/i,
|
||||
/email verification/i
|
||||
]
|
||||
};
|
||||
|
||||
/**
|
||||
* Retry strategy configuration for soft bounces
|
||||
*/
|
||||
@@ -269,16 +164,16 @@ export class BounceManager {
|
||||
nextRetryTime: bounceData.nextRetryTime
|
||||
};
|
||||
|
||||
// Determine bounce type and category if not provided
|
||||
// Determine bounce type and category via Rust bridge if not provided
|
||||
if (!bounceData.bounceType || bounceData.bounceType === BounceType.UNKNOWN) {
|
||||
const bounceInfo = this.detectBounceType(
|
||||
bounce.smtpResponse || '',
|
||||
bounce.diagnosticCode || '',
|
||||
bounce.statusCode || ''
|
||||
);
|
||||
|
||||
bounce.bounceType = bounceInfo.type;
|
||||
bounce.bounceCategory = bounceInfo.category;
|
||||
const bridge = RustSecurityBridge.getInstance();
|
||||
const rustResult = await bridge.detectBounce({
|
||||
smtpResponse: bounce.smtpResponse,
|
||||
diagnosticCode: bounce.diagnosticCode,
|
||||
statusCode: bounce.statusCode,
|
||||
});
|
||||
bounce.bounceType = rustResult.bounce_type as BounceType;
|
||||
bounce.bounceCategory = rustResult.category as BounceCategory;
|
||||
}
|
||||
|
||||
// Process the bounce based on category
|
||||
@@ -791,134 +686,6 @@ export class BounceManager {
|
||||
return this.bounceCache.get(email.toLowerCase()) || null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Analyze SMTP response and diagnostic codes to determine bounce type
|
||||
* @param smtpResponse SMTP response string
|
||||
* @param diagnosticCode Diagnostic code from bounce
|
||||
* @param statusCode Status code from bounce
|
||||
* @returns Detected bounce type and category
|
||||
*/
|
||||
private detectBounceType(
|
||||
smtpResponse: string,
|
||||
diagnosticCode: string,
|
||||
statusCode: string
|
||||
): {
|
||||
type: BounceType;
|
||||
category: BounceCategory;
|
||||
} {
|
||||
// Combine all text for comprehensive pattern matching
|
||||
const fullText = `${smtpResponse} ${diagnosticCode} ${statusCode}`.toLowerCase();
|
||||
|
||||
// Check for auto-responses first
|
||||
if (this.matchesPattern(fullText, BounceType.AUTO_RESPONSE) ||
|
||||
this.matchesPattern(fullText, BounceType.CHALLENGE_RESPONSE)) {
|
||||
return {
|
||||
type: BounceType.AUTO_RESPONSE,
|
||||
category: BounceCategory.AUTO_RESPONSE
|
||||
};
|
||||
}
|
||||
|
||||
// Check for hard bounces
|
||||
for (const bounceType of [
|
||||
BounceType.INVALID_RECIPIENT,
|
||||
BounceType.DOMAIN_NOT_FOUND,
|
||||
BounceType.MAILBOX_FULL,
|
||||
BounceType.MAILBOX_INACTIVE,
|
||||
BounceType.BLOCKED,
|
||||
BounceType.SPAM_RELATED,
|
||||
BounceType.POLICY_RELATED
|
||||
]) {
|
||||
if (this.matchesPattern(fullText, bounceType)) {
|
||||
return {
|
||||
type: bounceType,
|
||||
category: BounceCategory.HARD
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Check for soft bounces
|
||||
for (const bounceType of [
|
||||
BounceType.SERVER_UNAVAILABLE,
|
||||
BounceType.TEMPORARY_FAILURE,
|
||||
BounceType.QUOTA_EXCEEDED,
|
||||
BounceType.NETWORK_ERROR,
|
||||
BounceType.TIMEOUT
|
||||
]) {
|
||||
if (this.matchesPattern(fullText, bounceType)) {
|
||||
return {
|
||||
type: bounceType,
|
||||
category: BounceCategory.SOFT
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
// Handle DSN (Delivery Status Notification) status codes
|
||||
if (statusCode) {
|
||||
// Format: class.subject.detail
|
||||
const parts = statusCode.split('.');
|
||||
if (parts.length >= 2) {
|
||||
const statusClass = parts[0];
|
||||
const statusSubject = parts[1];
|
||||
|
||||
// 5.X.X is permanent failure (hard bounce)
|
||||
if (statusClass === '5') {
|
||||
// Try to determine specific type based on subject
|
||||
if (statusSubject === '1') {
|
||||
return { type: BounceType.INVALID_RECIPIENT, category: BounceCategory.HARD };
|
||||
} else if (statusSubject === '2') {
|
||||
return { type: BounceType.MAILBOX_FULL, category: BounceCategory.HARD };
|
||||
} else if (statusSubject === '7') {
|
||||
return { type: BounceType.BLOCKED, category: BounceCategory.HARD };
|
||||
} else {
|
||||
return { type: BounceType.UNKNOWN, category: BounceCategory.HARD };
|
||||
}
|
||||
}
|
||||
|
||||
// 4.X.X is temporary failure (soft bounce)
|
||||
if (statusClass === '4') {
|
||||
// Try to determine specific type based on subject
|
||||
if (statusSubject === '2') {
|
||||
return { type: BounceType.QUOTA_EXCEEDED, category: BounceCategory.SOFT };
|
||||
} else if (statusSubject === '3') {
|
||||
return { type: BounceType.SERVER_UNAVAILABLE, category: BounceCategory.SOFT };
|
||||
} else if (statusSubject === '4') {
|
||||
return { type: BounceType.NETWORK_ERROR, category: BounceCategory.SOFT };
|
||||
} else {
|
||||
return { type: BounceType.TEMPORARY_FAILURE, category: BounceCategory.SOFT };
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Default to unknown
|
||||
return {
|
||||
type: BounceType.UNKNOWN,
|
||||
category: BounceCategory.UNKNOWN
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if text matches any pattern for a bounce type
|
||||
* @param text Text to check against patterns
|
||||
* @param bounceType Bounce type to get patterns for
|
||||
* @returns Whether the text matches any pattern
|
||||
*/
|
||||
private matchesPattern(text: string, bounceType: BounceType): boolean {
|
||||
const patterns = BOUNCE_PATTERNS[bounceType];
|
||||
|
||||
if (!patterns) {
|
||||
return false;
|
||||
}
|
||||
|
||||
for (const pattern of patterns) {
|
||||
if (pattern.test(text)) {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all known hard bounced addresses
|
||||
* @returns Array of hard bounced email addresses
|
||||
|
||||
Reference in New Issue
Block a user