[.jaSrSSKJr SSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK r SSK r SSK r SSK r SSKrSSKrSSKrSSKrSSKrSSKJrJr SSKJr SSKJr SSKJr SSKJrJrJrJrJ r J!r!J"r" SS K#J$r$J%r% \ RL"\'5r(\RR"S 5r*S$S jr+S%S jr,S r-\-S&Sj5r.Sr/Sr0Sr1Sr2Sr3Sr4Sr5Sr6Sr7Sr8Sr9Sr://4Sjr;SrSr?S r@S!rAS"rBS(S#jrCg))aR Copyright 2016 Fedele Mantuano (https://twitter.com/fedelemantuano) Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ) annotationsN)Counter namedtuple)HeaderParseError) decode_header normalize)_CLAUSE_SPLITTER_DATE_RE_ENVELOPE_FROM_RE_SENDGRID_DATE_READDRESSES_HEADERS JUNK_PATTERN OTHERS_PARTS)MailParserOSErrorMailParserReceivedParsingErrorzB"([^"]*?)"\s*<([^>]+)>|([^<,]*?)\s*<([^>]+)>|([^\s,<>]+@[^\s,<>]+)c&Uc/$[U[RR5(a[ UR 55nO [U[ 5(d [ U5n[RRU/SS9nUR5(Gas[SU55(Ga[/n[RU5GHnURS5(aOURURS5R5URS5R545 MiURS5(aOURURS5R5URS5R545 MURS5(dMURS URS5R545 GM U(a"[R!S U[#U55 U$U$) uH Parse email addresses from a raw address header with a fallback for RFC-non-compliant but real-world-common formats. RFC 5322 §3.4 requires the display name (phrase) before an angle-bracket address to consist only of printable ASCII characters that are *not* special. The ``@`` character is special, so a header such as:: From: alice@example.com is technically non-conforming because the display name contains an unquoted ``@``. Python's ``email.utils.getaddresses`` with ``strict=True`` (hardened against CVE-2023-27043) correctly returns ``[('', '')]`` for this input, making the real sender invisible. mail-parser is a *security / forensics* tool, not an MTA. Silently discarding an address because its display name happens to look like an e-mail address would hide relevant forensic information from analysts — the very opposite of what the tool is for. We therefore bypass strict RFC compliance by applying a regex-based fallback whenever the strict parser yields only empty addresses, so that analysts always see the value that was actually present in the header. Args: raw_header (str | email.header.Header | None): raw value of an address header (e.g. ``From``, ``To``, ``CC`` …). Accepts a plain ``str``, an ``email.header.Header`` instance (returned by ``email.message.Message.get`` for headers containing RFC 2047 encoded-words such as non-ASCII display names), or ``None``. Returns: list[tuple[str, str]]: list of ``(display_name, email_addr)`` tuples. ``display_name`` is an empty string when absent. T)strictc34# UHupU(+v M g7fN).0_addrs M/home/mande/repo/quber/.venv/lib/python3.13/site-packages/mailparser/utils.py get_addresses..s!A&wqd((&sz\Strict address parsing yielded empty results for %r; regex fallback recovered %d address(es)) isinstanceemailheaderHeaderdecode_header_partencodestrutils getaddressesstripall_ADDR_FALLBACK_REfinditergroupappendlogdebuglen) raw_headerparsedresultsms r get_addressesr:Psd *ell1122' (9(9(;<  C ( (_ [[ % %zl4 % @F c!A&!AAA"++J7Awwqzz 0 0 2AGGAJ4D4D4FGH 0 0 2AGGAJ4D4D4FGHAGGAJ$4$4$678 8  II:G   N McFU(a[R"U5nO[R"5nURU5 [R"[R 5n[R "S5nURU5 URU5 U$)z This function returns a custom logger. :param level: logging level :type level: str :param name: logger name :type name: str :return: logger z]%(asctime)s | %(name)s | %(module)s | %(funcName)s | %(lineno)d | %(levelname)s | %(message)s) logging getLoggersetLevel StreamHandlersysstdout Formatter setFormatter addHandler)levelnamer3ch formatters r custom_logrJsy %!LL   szz *B!! IOOINN2 Jr;cF^[R"T5U4Sj5nU$)z1NFC is the normalization form recommended by W3C.c(>[ST"U0UD65$)NNFCr)argskwargsfuncs rwrappersanitize..wrappersd 5f 566r;) functoolswraps)rPrQs` rsanitizerUs'__T77 Nr;cU(d [5$[U[RR5(a [U5$[U[5(aU$[X5$![ [ 4a [USU5s$f=f)a Give as input raw data and output a str in Python 3. Args: raw_data: bytes or str to convert to str encoding: string giving the name of an encoding errors: specifies the treatment of characters which are invalid in the input encoding Returns: str utf-8)r*r$r%r&r' LookupErrorUnicodeDecodeError)raw_dataencodingerrorss r ported_stringr]su u (ELL//008}(C  .8&& + ,.8Wf--.s A))B B c8U(d [5$[5n[U5Hup#U(aUOSnU[X#S5- nM! UR5$![[4a. [ R SU35 X- nUR5$f=f)zl Given a raw header returns a decoded header Args: header (string): header to decode Returns: str rWignorezFailed decoding header part: )r*rr]r UnicodeErrorr3errorr-)r&outputdcs rr(r(s u UF!&)DAGA mA(3 3F* <<> l + 1&:; <<> s.A,BBc[USSS9$)zxOpen a file with UTF-8 encoding and ignore errors. Args: file_: path to the file to open Returns: file object rWr_)r[r\)open)file_s r ported_openrhs  99r;cURU5[U5-nURX#5nXUR5$![a gf=fr)indexr5r- ValueError)text first_token last_tokenstartends r find_betweenrqsR ;'#k*::jj+#$$&& s?A AAc([SS5n[U[5(dURS5n[R "5nUR U5 UR5n[R"5nUR U5 UR5n[R"5nUR U5 UR5n[R"5nUR U5 UR5nU"X#XE5$)z This function return the fingerprints of data. Args: data (string): raw data Returns: namedtuple: fingerprints md5, sha1, sha256, sha512 Hasheszmd5 sha1 sha256 sha512rW) rr$bytesr)hashlibmd5update hexdigestsha1sha256sha512)datahashesrvryrzr{s r fingerprintsr~s": ;F dE " "{{7# ++-CJJt --/C <<>DKK >> D^^ F MM$    F^^ F MM$    F #V ,,r;c^[R"SS9up[R"U5 U$)aI Create an empty temporary file to hold a converted Outlook email. The OS-level file handle is closed immediately; callers write to the returned path with their own handle (a subprocess ``--outfile`` for ``msgconvert`` or a plain ``open`` for the pure-Python backend). Returns: str: path of the new temporary ``.eml`` file outlook_)prefix)tempfilemkstemposclose)handlepaths r_new_outlook_tempfilerAs'##:6LFHHV Kr;c*SSKn[RS5 URU5n[ USS5nUc&[ SU<S[ U5RS35eU"5nURSS 5S URS S 53R5n[5n[US 5nURUR55 SSS5 Xe4UR5 $!,(df  N!=f!UR5 f=f) a Convert an Outlook ``.msg`` file to ``.eml`` using the pure-Python ``extract-msg`` library (no external Perl tool required). The ``extract_msg`` import is performed lazily inside this function so that the package keeps importing with zero runtime dependencies when the optional ``outlook`` extra is not installed. Args: fp (string): file path of the Outlook ``.msg`` mail Returns: tuple: ``(eml_path, info)`` where ``eml_path`` is the path of the converted ``.eml`` file and ``info`` is a short descriptive string Raises: ImportError: if the ``extract-msg`` library is not installed MailParserOSError: if the ``.msg`` is not a convertible email message (e.g. a contact or calendar item) rNz1Started converting Outlook email with extract-msgasEmailMessagez Outlook file z* is not a convertible email message (type )Fromr#z | Subjectwb) extract_msgr3r4openMsggetattrrtype__name__getr-rrfwriteas_bytesr)fprmsgas_email_messageemlinfotempfs rextract_msg_convertrQs*IIAB   b !C#3(8$?  ##v&!!%c!3!3 4A7  ''&"%&c#'')R*@)ABHHJ$& $  GGCLLN #z   s$BD4 C/ D/ C=9DDc[RS5 [5nSSX/n[R"U[R [R [R S9nUR5upEXRS5R54$![a+nSU<3n[RU5 [U5eSnAff=f)a# Exec msgconvert tool, to convert msg Outlook mail in eml mail format Args: email (string): file path of Outlook msg mail Returns: tuple with file path of mail converted and standard output data (str) Raises: MailParserOSError: if the ``msgconvert`` tool is not installed z Started converting Outlook email msgconvertz --outfile)stdinrBstderrrWzCannot convert Outlook .msg: no conversion backend available. Install pure-Python support with 'pip install mail-parser[outlook]', or install the 'msgconvert' Perl tool (libemail-outlook-message-perl). N) r3r4r subprocessPopenPIPEDEVNULL communicatedecoder-OSError exceptionr)r%rcommandout stdoutdataremessages rrr}sII01 "D[$6G8 //??%%  &) &&w/55777  ) 012u  6  g(( )sAB C#&C  Ccj0n[R"U5nU(a(URS5US'USUR5nOG[R"U5nU(a(URS5US'USUR5nOUn[ R "U5nSnUS-[U5:aXVR5nXVS-R5nUS- nUS;aA[R"U5n U (a#U RS5XRSS5'O US:XaXU'OUS :Xa S U;aXU'OXU'US-[U5:aMS Hn URU S 5n S HnupX;dM XR5;dM![R"S [R"U 5-S-U 5n U (dM[U RS5X'Mp M U(dSU-n[U5e[ R#S[%UR'555 U$)u Parse a single received header by tokenizing on RFC 5321 §4.4 keywords. Uses a keyword-based splitter to divide the header into clauses (from, by, via, with, id, for, envelope-from, envelope-sender), then extracts the date from after the semicolon. Arguments: received {str} -- single received header Raises: MailParserReceivedParsingError -- Raised when a received header cannot be parsed Returns: dict -- values by clause rdateNr) envelope-fromenvelope-sender-rforfrom)byrwithr#)) envelope_fromr)envelope_senderrz(?i)z \s+<([^>]+)>z!Unable to match any clauses in %szParsed clauses: %s)r searchr1ror r splitr5lowerr-r replacerreescaperr3r4listkeys)receivedvalues_by_clause date_match header_bodysg_matchpartsikeywordvaluer9 clause_key clause_valenv_keyenv_namers rparse_receivedrs&*J#-#3#3A#6 3!1!1!34 %++H5 '/~~a'8 V $"#5X^^%56K"K  " "; /E A a%#e* (.."!e ""$ Q : :!((/A>?ggaj c!:;  (-W %  --,1)(-W %' a%#e* 0- %))*b9 " G.8?O?O?Q3QIIbii11OC101 $-" - 1X>,S11II"D)9)>)>)@$AB r;c  /nUVs/sH-n[R"[SU5R5PM/ nn[ U5n[ R SU35 [U5HYupE[ R SUS-SU35 [ R SU<35 [U5nURU5 M[ [ R S[ U5<S [ U5<35 [ U5[ U5:waB[ RS [ U5<S [ U5<S U<S U<35 [U5$[U5$s snf![a URSU05 GMf=f)z This function parses the receiveds headers. Args: receiveds (list): list of raw receiveds headers Returns: a list of parsed receiveds headers with first hop in first position  zNr. of receiveds. zParsing received r/z Try to parse rawzlen(receiveds) z, len(parsed) zlen(receiveds): z, len(parsed): z , receiveds: z, parsed: )rsubrr-r5r3r4 enumeraterr2rrareceiveds_not_parsedreceiveds_format) receivedsr7rnidxrrs rreceiveds_parsingrsGF?HIy! c1-335yII IAII"1#&'"9-  %cAgYas34 M(./ ,-h7  MM* +.IIS^S[QR 9~V$ 9~s6{Iv ? $I.. ''?J. - MM5(+ , , -s4E( E!!FFc[RSU<35 [RR U5nUc[ SU<35e[RSU<35 [RR U5n[RSU<35 [RRU[RR5nUS(aUSS- OSnUSn[RS U<35 X44$) z+ Convert a mail date in a datetime object. zDate to parse: zCannot parse date: z Date parsed: zDate parsed in timestamp: g @rz+.1fzCalculated timezone: ) r3r4r%r+ parsedate_tzrk mktime_tzdatetime fromtimestamptimezoneutc)rrctdate_utcrs rconvert_mail_dater.sIIx()   &Ay.th788II aU#$ a AII*1%01  ..q(2C2C2G2GHH !!qtf}!H4HII%h\23  r;c[RS5 /n[5nUSSS2H>nSUR50nUSS-US'US==S- ss'UR U5 M@ U$)a If receiveds are not parsed, makes a new structure with raw field. It's useful to have the same structure of receiveds parsed. Args: receiveds (list): list of raw receiveds headers Returns: a list of not parsed receiveds headers with first hop in first position z'Receiveds for this email are not parsedNrhopr)r3r4rr-r2)rrbcounterrjs rrr@srII78 FiG tt_ AGGI 5>A%%! a  Mr;c~[RS5 /n[5nUSSS2GH6nUR5VVs0sHupEU(dMXER 5_M nnnUSS-US'UR S5(aMUSR S5SUS'[R"SS US5US'[US5uUS 'n[U5nUR S 5n U(aCU (a<XSS- R S 5n U (aX- R5US 'O S US 'OS US 'URU5 US==S- ss'GM9 UH1nUR S 5(dMUS R5US 'M3 U$s snnf![[4a SUS 'Nf=f) z Given a list of receiveds hop, adds metadata and reformat field values Args: receiveds (list): list of receiveds hops already formatted Returns: list of receiveds reformated and with new fields z#Receiveds for this email are parsedNrrrr;z^\s*(?:\([^)]*\)\s*)+r#rdelayr)r3r4ritemsr-rrrrr TypeErrorrkr5 total_secondsr2 isoformat) rrbrrkvrrsizenowbefores rrrZsII34 FiG tt_&'ggi 5ida1\Q \i 55>A%% 55==& ,R0AfI7QvYGAfI %#4QvY#? * q 6{eeJ CENQ./33J?F!l99;' ' AgJ  a !KN 55  jM335AjM MQ 6z* % $*  %s FFF$$F<;F<c[5nX-HFnURUSRS5SR5R 55 MH [U5$![ [ 4a Mhf=f)Nr@r)setaddrrr-KeyError IndexErrorr)toreply_todomainsrs rget_to_domainsrsneG ]  KK! 3+11399; < =*%   sAA$$A87A8cURU5n[RSU<SU<35 U(a?UVs/sHn[U5PM nn[ U5S:XaUSR 5$U$[ 5$s snf)a Gets an email.message.Message and a header name and returns the mail header decoded with the correct charset. Args: message (email.message.Message): email message object name (string): header to get Returns: str if there is an header list if there are more than one zGetting header z: rr)get_allr3r4r(r5r-r*)rrGheadersrs r get_headerrsxood#GIIxr'5629:'Q%a(': w<1 1:##% % 5L ;sA?cnU(aS[RS5 UR5Vs1sHo"R5iM nn[[ -U-nO"[RS5 [[ -n[RSR SRU555 U$s snf)z Given an email.message.Message, return a set with all email parts to get Args: message (email.message.Message): email message object complete (bool): if True returns all email headers Returns: set with all email parts zGet all headerszGet only mains headerszAll parts to get: {}z, )r3r4rrrrformatjoin)rcompleterall_headers_keys all_partss r get_mail_keysr s #$/6||~>~!GGI~>% 47GG  *+% 4 II$++DIIi,@AB ?sB2cp[U5 g![a [URS55 gf=f)NrW)printUnicodeEncodeErrorr))r|s r safe_printrs.$ d $ dkk'"#$s $55c[U5upp4[SU35 [SU35 [SU35 [SU35 g)Nzmd5: zsha1: zsha256: zsha512: )r~r)r|rvryrzr{s rprint_mail_fingerprintsrsL ,T 2Cv F3%. GD6  IfX  IfX r;c U(aYUHSnURS5S:Xa[R"US5nOUSn[U5uUS'US'US'US'MU UH"n[ [ R "USS S 95 M$ g) Ncontent_transfer_encodingbase64payloadrvryrzr{Fr ) ensure_asciiindent)rr b64decoder~rjsondumps) attachments flag_hashrrs rprint_attachmentsrsAuu01X= **1Y<8I,?r;c@UHn[USUSUUSS9 M g)Nbinaryrfilename)r!rrr") write_sample)r base_pathas rwrite_attachmentsr&s, X;iLz]  r;c[RRU5(d[R"U5 [RR X#5nU(a;[ US5nUR [R"U55 SSS5 g[ US5nUR U5 SSS5 g!,(df  g=f!,(df  g=f)a This function writes a sample on file system. Args: binary (bool): True if it's a binary file payload: payload of sample, in base64 if it's a binary path (string): path of file filename (string): name of file hash_ (string): file hash rNw) rrexistsmakedirsr rfrrr)r!rrr"samplers rr#r#s 77>>$   D WW\\$ )F &$ 1 GGF$$W- . &# ! GGG    s-&C(C C C"cl^[RmSRU4Sj[U555$)zGenerate a random string of fixed length Keyword Arguments: string_length {int} -- String length (default: {10}) Returns: str -- Random string r#c3P># UHn[R"T5v M g7fr)randomchoice)rrletterss rr random_string..sH3Ga6==))3Gs#&)stringascii_lowercaser range) string_lengthr0s @r random_stringr6s*$$G 77H53GH HHr;)r6z str | email.header.Header | Nonereturnzlist[tuple[str, str]])WARNINGN)rWr_)T) )D__doc__ __future__rrrr% email.header email.utilsrSrurr=rr.rr2rrAr collectionsrr email.errorsrr unicodedatar mailparser.constr r r r rrrmailparser.exceptionsrrr>rr3compiler/r:rJrUr]r(rhrqr~rrrrrrrrrrr rrrr&r#r6rr;rrDs6 #     +)&!T !(JJP0PPf: . .<8 :$-N  )X(8VUp+(\$4:z240$  @ . Ir;