diff options
Diffstat (limited to 'tests/test_parse.py')
| -rw-r--r-- | tests/test_parse.py | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/tests/test_parse.py b/tests/test_parse.py index 60c1fb5..11345c7 100644 --- a/tests/test_parse.py +++ b/tests/test_parse.py @@ -98,6 +98,12 @@ class TestSenderDomains(unittest.TestCase): }, ) + def test_sender_is_collected_when_it_differs_from_from(self): + # Sender names the party who actually injected the message, which on + # a spam run is often a relay distinct from the forged From. + domains = parse.sender_domains(load("leaky.eml")) + self.assertEqual(domains["sender"], "relay.example.invalid") + def test_reply_to_is_absent_when_it_matches_from(self): # Only a DIFFERING Reply-To is an indicator; repeating From adds noise. domains = parse.sender_domains(load("with-attachment.eml")) @@ -245,6 +251,17 @@ class TestIocAssembly(unittest.TestCase): self.assertEqual(targets[0]["value"], "http://evil.example.invalid/pay?ref=REDACTED") + def test_an_unsubscribe_url_is_reported_and_redacted(self): + # List-Unsubscribe routinely names a domain appearing nowhere else, + # and an unsubscribe link is a prime carrier of a recipient token, + # so it is an indicator that must arrive redacted. + iocs = parse.iocs(load("leaky.eml"), trusted=["192.0.2.0/24"]) + unsub = [i for i in iocs if i["origin"] == "header-list_unsubscribe"] + self.assertEqual( + [i["value"] for i in unsub], + ["http://unsub.example.invalid/u?e=REDACTED"], + ) + def test_an_attachment_becomes_a_hash_ioc(self): iocs = parse.iocs(load("with-attachment.eml"), trusted=["192.0.2.0/24"]) hashes = [i for i in iocs if i["type"] == "sha256"] |