package Mail::SpamAssassin::Plugin::Phisher;

use strict;

#
# Phisher.pm
#
# Version .05 (may explode without warning)
#
# SpamAssassin plug-in to detect Phishing attacks
#
# (c) 2005, Faisal N. Jawdat
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# Redistributions of source code must retain the above copyright notice,
# this list of conditions and the following disclaimer. Redistributions in
# binary form must reproduce the above copyright notice, this list of
# conditions and the following disclaimer in the documentation and/or
# other materials provided with the distribution. Neither the name of
# Faisal N. Jawdat nor the names of its contributors may be used to
# endorse or promote products derived from this software without specific
# prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT
# HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
# THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
# ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# To use, add the following lines to local.cf (without the comments), edit
# the path, and change the score appropriately:
#
# loadplugin    Mail::SpamAssassin::Plugin::Phisher    PATH/TO/Phisher.pm
# rawbody HREF_NEQ_ANCHOR        eval:href_neq_anchor()
# describe HREF_NEQ_ANCHOR       URL in anchor does not match its HREF
# score HREF_NEQ_ANCHOR          .1
#


use Mail::SpamAssassin::Plugin;

our @ISA = qw(Mail::SpamAssassin::Plugin);

sub new {
    my ($class, $mailsa) = @_;

    # the usual perlobj boilerplate to create a subclass object
    $class = ref($class) || $class;
    my $self = $class->SUPER::new($mailsa);
    bless ($self, $class);

    # then register an eval rule, if desired...
    $self->register_eval_rule ("href_neq_anchor");

    # and return the new plugin object
    return $self;
}

sub href_neq_anchor {
    my ($self, $permsgstatus) = @_;

    my $failed_test = 0;

    my $rawbody_aref = $permsgstatus->get_decoded_body_text_array();
    my $rawbody = join(' ', @$rawbody_aref);

    $rawbody =~ s/\s+/ /gs;

    while ($rawbody =~ /<a .*?href=(\S*\.\S*).*?>(\S*\.\S*)<\/a[\s|>]/migc) {
        my $href = $1;
        my $linktext = $2;

        # normalize both link types

        # strip beginning and end quotes for href
        $href =~ s/^\"//s;
        $href =~ s/^\'//s;
        $href =~ s/\'$//s;
        $href =~ s/\"$//s;

        # drop http, www., and any path after the domain
        $href =~ s/^http:\/\///is;
        $href =~ s/^https:\/\///is;
        $href =~ s/^www\.//is;
        $href =~ s/\/.*$//s;

        # drop http, www., and any path after the domain
        $linktext =~ s/^http:\/\///is;
        $linktext =~ s/^https:\/\///is;
        $linktext =~ s/^www\.//is;
        $linktext =~ s/\/.*$//s;

        if (!($linktext eq $href)) {
            $failed_test = 1;
        }
    }

    return $failed_test;
}

1;
