From 2611c6485fa733e627f2c62c0369260f3a96d0bc Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Thu, 10 Sep 2026 11:23:27 +0200 Subject: docs: record the report spec and both sweeps Sweep A over 92 real messages after task 1 changed parse.py: 1685 indicators, 92 bodies, 0 crashes, 0 empty parses, no address from a raw source in the IOC output and no recipient address in any generated body. What it measured is the limit the spec already accepts. Subject is published verbatim, and 14 of the 92 messages carried the recipient's local part inside it because the kit personalises the lure. None carried it in the From display name, and the envelope recipient was cut from the boundary Received line in every message. That is the whitelist governing which headers travel rather than what is inside one, which the spec's "attacker-controlled free text is published unfiltered" section states outright and names the sweep as the cover for. personalised-subject.eml pins all three behaviours, the accepted one included, so the number cannot drift unnoticed. The for-clause test is mutation-checked: stop cutting the clause and all three fail. Sweep B, 12 hand-picked public targets and none from the corpus: 12 of 12, 0 failures, all five RIRs parseable, IPv6 live, the label walk and the multi-part suffix both correct. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01LByBnw83xr9YP85nskzkyE --- tests/fixtures/personalised-subject.eml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 tests/fixtures/personalised-subject.eml (limited to 'tests/fixtures/personalised-subject.eml') diff --git a/tests/fixtures/personalised-subject.eml b/tests/fixtures/personalised-subject.eml new file mode 100644 index 0000000..aba2529 --- /dev/null +++ b/tests/fixtures/personalised-subject.eml @@ -0,0 +1,14 @@ +Received: from mx.example.org (mx.example.org [192.0.2.10]) + by mail.example.org with ESMTP id ABC123 + for ; Tue, 08 Sep 2026 09:15:00 +0000 +Received: from sender.invalid (sender.invalid [203.0.113.55]) + by mx.example.org with ESMTP id DEF456 + for ; Tue, 08 Sep 2026 09:14:58 +0000 +From: Account Security +To: alicejones@example.org +Subject: alicejones, your account has been suspended +Date: Tue, 08 Sep 2026 09:14:55 +0000 +Message-ID: +Content-Type: text/plain; charset=us-ascii + +Verify at http://phish.sender.invalid/verify -- cgit v1.2.3