mailfilter/filter-rules.py

BLOCK_EMAIL = [
    'chirhart@amazon.com',
    'ron.krogel@citrix.com',
    'replieswelcome@duo.com',
    'webinars@duo.com',
    'diversity@oregonstate.edu',
    'jramiro@pagerduty.com',
    'info@snowflake.com',
    'lisa@duo.com',
    'cortana@microsoft.com'
]

BLOCK_KEYWORDS = [
    'charitable fund drive',
    'election reminder',
    'email preferences',
    'end these email updates',
    'food drive',
    'food share',
    'general election',
    'giving tuesday',
    'hardship leave donations needed',
    'manage your preferences',
    'modify your preferences',
    'opt-out',
    'opt out',
    'prefer not to receive',
    'prefer not to see',
    'register to vote'
    'Samsung SDS America',
    'sidekickopen',
    'special election',
    'subscription preferences',
    'survey',
    'unsubscribe',
    'voter registration',
    'want to receive',
    'webinar',
    'whitepaper',
    'wish to receive',
]

BLOCK_DOMAINS = [
    'customeriomail.com',
    'mailgun.net'
]

ALLOW = [
    'oregonstate.edu',
    'github.com',
    'duo.com',
    'sns.amazonaws.com',
    'opsgenie.net',
    'notify@teamdynamixapp.com',
    'newsbites@email.sans.org',
    'noreply@box.com',
    'noreply@email.teams.microsoft.com',
    'no-reply@sharepointonline.com',
    'slalom.com',
    'govdelivery.com',
    'linkoregon.org',
    'megan@pdxwit.org',
    'busyconf.com',
    'support@githubsupport.com',
    'microsoft.com'
]

def filter_message(self, message):
    # normalize message attributes
    normalized_to = [x.address.lower() for x in message.to]
    normalized_from = message.sender.address.lower()
    normalized_subject = message.subject.lower()

    # filter alerts-sig
    if (normalized_from in ['mcc-b11-stor1@oregonstate.edu',
                            'mcc-b12-stor1@oregonstate.edu',
                            'ousclus@oregonstate.edu',
                            'isilon@storage.sig.oregonstate.edu']
            or 'alarm.DatastoreDiskUsageAlarm' in message.subject):
        self._log_result(message, 'moving to alerts-sig')
        message.move(self._folders['alerts-sig'])
        return

    # filter conference spam
    if 'brocks+conf@onid.oregonstate.edu' in normalized_to:
        self._log_result(message, 'deleting conference spam')
        message.delete()
        return

    # filter backup-nightly
    if 'backup-nightly@lists.oregonstate.edu' in message.to:
        self._log_result(message, 'moving to backup-nightly')
        message.move(self._folders['backup-nightly'])
        return

    # delete HP alert spam
    if normalized_from == 'alerts@alerts.mail.hpe.com':
        self._log_result(message, 'deleting HP alert spam')
        message.delete()
        return

    # keep messages from allowed emails and domains
    for good in ALLOW:
        if good in normalized_from and normalized_from not in BLOCK_EMAIL:
            self._log_result(message,
                             f"keeping message from allowed sender {good}")
            return

    # junk messages from blocked senders
    if normalized_from in BLOCK_EMAIL:
        self._log_result(message, 'junking spam from blocked sender')
        message.move(self._folders['Junk Email'])
        return

    # junk messages with blocked keywords in message body
    is_spam = False
    message_body = message.body.lower()
    for phrase in self._normalized['BLOCK_KEYWORDS']:
        if phrase in normalized_subject:
            is_spam = True
            break
        if phrase in message_body:
            is_spam = True
            break
    if is_spam:
        self._log_result(message, 'junking spam containing blocked keyword')
        message.move(self._folders['Junk Email'])
        return

    # process message headers into a sane data structure
    headers = []
    for header in message.message_headers:
        h = {}
        h[header['name']] = header['value'].lower()
        headers.append(h)

    # junk messages from blocked domains
    for domain in BLOCK_DOMAINS:
        if domain in normalized_from:
            is_spam = True
            break
        if search_headers(domain, headers):
            is_spam = True
            break
    if is_spam:
        self._log_result(message, 'junking spam from blocked domain')
        message.move(self._folders['Junk Email'])
        return

    # junk known spam headers
    if (get_header('X-Spam-Flag' == 'YES', headers)
            or int(get_header('X-MS-Exchange-Organization-SCL', headers)) >= 5):
        self._log_result(message, 'junking spam with known header')
        message.move(self._folders['Junk Email'])
        return

    # KEEP MESSAGE
    self._log_result(message, 'keeping message, passed all filter checks')

def normalize_lists(self):
    self._normalized['BLOCK_KEYWORDS'] = [x.lower() for x in BLOCK_KEYWORDS]

def get_header(header_key, headers):
    vals = []
    for header in headers:
        if header_key in header:
            for val in header.values():
                vals.append(val)
    if len(vals) > 1:
        return vals
    elif len(vals) == 1:
        return vals[0]
    else:
        return False

def search_headers(search, headers):
    vals = []
    is_found = False
    for header in headers:
        for val in header.values():
            if search in val:
                return True