MailBody.C

Go to the documentation of this file.

#include "MailBody.h"

MailBody::MailBody( SpamParameters &param, HeaderInfo &headInfo ) : 
  mParams( param ), mHeadInfo( headInfo )
{
  log = pLogger->getLogger("MailBody");
} // MailBody


MailBody::lineType MailBody::getLine(char *buf, 
                                     const size_t bufSize, 
                                     FILE *fp, 
                                     const char *boundary)
{
  lineType type = EndOfFile;

  char *pStr;
  // skip any blank lines
  do {
     pStr = fgets(buf, bufSize, fp);
  } while (pStr != 0 && SpamUtil().isBlankLine(buf));

  if (pStr != 0) {

    type = LINE;
    if (boundary != 0) {
      if (buf[0] == '-' && buf[1] == '-') {
        if (strstr(buf+2, boundary) != 0) {
          type = BOUNDARY;
        }
      }
    }

    if (type != BOUNDARY) {
      SpamUtil().toLower(buf, buf, bufSize);
    }
  }

  return type;
} // getLine;


MailBody::lineType MailBody::getHtmlLine(char *buf, 
                                         const size_t bufSize, 
                                         FILE *fp, 
                                         const char *boundary)
{
  char *tmpBuf = new char[ bufSize ];
  lineType type = EndOfFile;

  *buf = '\0';

  char *pStr;
  // skip any blank lines
  do {
     pStr = fgets(tmpBuf, bufSize, fp);
  } while (pStr != 0 && SpamUtil().isBlankLine(tmpBuf));

  if (pStr != 0) {

    type = LINE;
    if (boundary != 0) {
      if (tmpBuf[0] == '-' && tmpBuf[1] == '-') {
        if (strstr(tmpBuf+2, boundary) != 0) {
          type = BOUNDARY;
        }
      }
    }

    if (type != BOUNDARY) {
      size_t i = 0; // buf index
      bool copyChar = true;
      for (size_t j = 0; j < bufSize-1 && tmpBuf[j] != '\0'; j++) {
        char ch = tmpBuf[j];
        if (ch == '<') {
          copyChar = false;
        }
        else if (ch == '>') {
          copyChar = true;
        }
        else if (copyChar) {
          buf[i] = tolower(ch);
          i++;
        }
      } // for
      buf[i] = '\0';
    }
  }
  delete [] tmpBuf;

  return type;
} // getHtmlLine


MailBody::lineType MailBody::findSection( const char *boundary, FILE *fp )
{

  const size_t BUF_SIZE = 128;
  char buf[ BUF_SIZE ];

  lineType ty;

  while ((ty = getLine(buf, sizeof(buf), fp, boundary )) != MailBody::EndOfFile) {
    if (ty == BOUNDARY) {
      break;
    }
  }
  
  return ty;
} // findSection



SpamUtil::contentType MailBody::classifyMailSection(FILE *fp)
{
  SpamUtil::contentType type = SpamUtil::UNKNOWN;
  char buf[128];
  char *bufPtr;
    
  // get the line following the boundary line (may be blank)
  if ((bufPtr = fgets(buf, sizeof(buf), fp)) != 0) {
    if (SpamUtil().isBlankLine(buf)) {
      type = SpamUtil::BLANK;
    }
    else {
      static const char *CONTENT_TYPE = "Content-Type:";
      static const size_t content_typeLen = strlen( CONTENT_TYPE );
      const char *ptr;

      // see if we can find Content-Type:, if not, its an empty section
      if ((ptr = strstr(buf, CONTENT_TYPE)) != 0) {
        type = SpamUtil().classifySection( ptr+content_typeLen );
        // get the line after Content-Type
        if ((bufPtr = fgets(buf, sizeof(buf), fp)) != 0) {
          // if there is a colon, it's probably a Content-Transfer-Encoding line
          if (SpamUtil().findColon( bufPtr ) == 0) {
            // OK, no colon.  If the type was TEXT look for Windows char set.
            if (type == SpamUtil::TEXT) {
              static const char *CHARSET = "charset";
              static const size_t charsetLen = strlen( CHARSET );
              if ((ptr = strstr(buf, "charset")) != 0) {
                if (strstr(ptr+charsetLen, "Windows") != 0) {
                  type = SpamUtil::WINDOZ;
                } // Windows string
              } // charset string
            } // type == TEXT
            bufPtr = fgets(buf, sizeof(buf), fp);
          } // find colon
          if (bufPtr != 0) {
            // look for the base64 in Content-Transfer-Encoding: base64
            if (strstr(buf, "base64") != 0) {
              type = SpamUtil::BASE64;
            }
          }
        } // fgets != 0
      } // Content-Type string
    }
  } // fgets != 0
  else {
    log.log(Logger::ERROR, "classifyMailSection", "line expected after boundary");
  }

  return type;
} // classifyMailSection



void MailBody::mailBodyMsg( MailFilter::classification klass,
                                const char *foundStr,
                                const char *funcName )
{
  char msg[256];
  char startMsg[64];
  const char *pMsg = msg;

  const char *klassStr = "email";
  if (klass == MailFilter::SUSPECT) {
    klassStr = "suspect";
  }
  else if (klass == MailFilter::GARBAGE) {
    klassStr = "garbage";
  }
  sprintf(startMsg, "email classified as %s", klassStr);
  if (foundStr[0] != '\0') {
    sprintf(msg, "%s, found \"%s\"", startMsg, foundStr );
  }
  else {
    pMsg = startMsg;
  }
  log.log(Logger::DEBUG, funcName, pMsg );
} // mailBodyMsg



MailFilter::classification MailBody::processBySection(const char *boundary, 
                                                      FILE *fp)
{
  MailFilter::classification klass = MailFilter::UNKNOWN;
  log.log(Logger::DEBUG, "processBySection", "enter");

  log.log(Logger::DEBUG, "processBySection", "processing first section");

  if (findSection(boundary, fp) == BOUNDARY) {
    char foundStr[128];
    foundStr[0] = '\0';

    log.log(Logger::DEBUG, "processBySection", "found boundary");

    SpamUtil::contentType type = classifyMailSection(fp);
    if (type == SpamUtil::TEXT) {
      char buf[4096];

      bool foundNonBlankLine = false;
      MailBody::lineType lineTy;
      while ((lineTy = getLine(buf, sizeof(buf), fp, boundary)) == LINE) {
        klass = SpamUtil().checkLine(buf, 
                                     mParams,
                                     foundStr,
                                     sizeof(foundStr));
        foundNonBlankLine = true;
        if (klass != MailFilter::UNKNOWN) {
          mHeadInfo.reason(foundStr);
          break;
        }
      } // while

      // The text section was empty, so it is probably spam, since 
      // legitimate email usually provides a text version and an HTML
      // version.
      if (! foundNonBlankLine) {
        log.log(Logger::DEBUG, "processBySection", "found blank text section");
        klass = MailFilter::SUSPECT;
      }
      else {
        char msg[128];
        sprintf(msg, "first section type = %s", SpamUtil().typeToStr( type ));
        log.log(Logger::DEBUG, "processBySection", msg );
      }

      // if we don't know it's spam or garbage, check the type of the
      // section that follows the text section (it may, for example, be
      // a base64 section).
      if (lineTy == BOUNDARY) {
        log.log(Logger::DEBUG, "processBySection", "found second section boundary" );
        SpamUtil::contentType secondSecType = classifyMailSection(fp);
        type = secondSecType;
        char msg[128];
        sprintf(msg, "second section type = %s", SpamUtil().typeToStr( secondSecType ));
        log.log(Logger::DEBUG, "processBySection", msg );

        if (secondSecType == SpamUtil::HTML && (foundNonBlankLine)) {
          // There was a non-blank text section.  Some spammers will fill
          // in text from on-line books in this section and then include
          // the spam in the HTML section in an attempt to fool spam filters
          // (especially baysian filters).  So check for spam words here as well.
          log.log(Logger::DEBUG, "processBySection", "processing HTML section" );
          while ((lineTy = getHtmlLine(buf, sizeof(buf), fp, boundary)) == LINE) {
            klass = SpamUtil().checkLine(buf, 
                                         mParams,
                                         foundStr,
                                         sizeof(foundStr)); // true means HTML section
            if (klass != MailFilter::UNKNOWN) {
              mHeadInfo.reason(foundStr);
              break;
            }
          } // while
        } // if section is HTML

      }
    }
    else if (type == SpamUtil::HTML || 
             type == SpamUtil::BLANK || 
             type == SpamUtil::WINDOZ) {
      // We know it's suspect, the only question now is, is it garbage?
      klass = MailFilter::SUSPECT;
      if (type == SpamUtil::HTML) {
        log.log(Logger::DEBUG, "processBySection", "begins with HTML section");
      }
      else if (type == SpamUtil::BLANK) {
        log.log(Logger::DEBUG, "processBySection", "found boundary, no Content-Type");
      }
      if (findSection(boundary, fp) == BOUNDARY) {
        type = classifyMailSection(fp);
      }
    }

    if (type == SpamUtil::WINDOZ || 
        type == SpamUtil::IMAGE  ||
        type == SpamUtil::AUDIO  ||
        type == SpamUtil::MULTIPART) {
      char msg[128];
      sprintf(msg, "found section type %s", SpamUtil().typeToStr( type ) );
      log.log(Logger::DEBUG, "processBySection", msg );
      klass = MailFilter::SUSPECT;
    }
    else if (type == SpamUtil::BASE64) {
      log.log(Logger::DEBUG, "processBySection", "found base64 section");
      if (mParams.hasFlag("kill_base64")) {
        klass = MailFilter::GARBAGE;
        mHeadInfo.reason("found base64 encoding");
      }
      else {
        klass = MailFilter::SUSPECT;
      }
    }
    // if the email class is still "UNKNOWN" then we assume it is 
    // email.
    if (klass == MailFilter::UNKNOWN) {
      klass = MailFilter::EMAIL;
    }

    mailBodyMsg( klass, foundStr, "processBySection");
  }
  else {
    log.log(Logger::ERROR, "processBySection", "boundary not found");
  }

  log.log(Logger::DEBUG, "processBySection", "exit");
  return klass;
} // processBySection


MailFilter::classification MailBody::processTextBody( FILE *fp )
{
  MailFilter::classification klass = MailFilter::UNKNOWN;
  log.log(Logger::DEBUG, "processTextBody", "enter");
  char buf[256];
  char foundStr[128];

  foundStr[0] = '\0';
  MailBody::lineType lineTy;
  while ((lineTy = getLine(buf, sizeof(buf), fp, 0)) == LINE) {
    klass = SpamUtil().checkLine(buf, 
                                 mParams,
                                 foundStr,
                                 sizeof(foundStr));
    if (klass != MailFilter::UNKNOWN) {
      break;
    }
  } // while

  if (klass != MailFilter::UNKNOWN) {
    mHeadInfo.reason( foundStr );
  }

  // if the email class is still "UNKNOWN" then we assume it is 
  // email.
  if (klass == MailFilter::UNKNOWN) {
    klass = MailFilter::EMAIL;
  }
  mailBodyMsg( klass, foundStr, "processTextBody");
  
  log.log(Logger::DEBUG, "processTextBody", "exit");
  return klass;
} // processTextBody


MailFilter::classification MailBody::checkBody(const char *boundary, FILE *fp)
{
  MailFilter::classification klass = MailFilter::UNKNOWN;
  if (! feof(fp)) {
    if (boundary != 0 && boundary[0] != '\0') {
      klass = processBySection( boundary, fp );
    }
    else {
      klass = processTextBody( fp );
    }
  }
  return klass;
} // checkBody

---