Team meeting at 10am tomorrow in Conference Room A.
-Please bring your laptops.
- - - """, - - # Email with text salting (hidden text) - """ - - - -- You have WON a FREE iPhone 15 Pro! -
-Click HERE to claim.
- - - """, - - # Email with clip-path salting - """ - - - -Please click the link below to verify your account.
- Verify Now - - - """, - - # Email with text-indent salting - """ - - -- This is a legitimate newsletter about software development. - We discuss best practices and industry trends. -
-You have been selected for an exclusive offer.
- - - """ - ] - - print("\n🧪 Testing Detection:") - print("-" * 40) - - for i, html in enumerate(test_emails, 1): - print(f"\n{i}. Test Email {i}:") - result = detector.detect(html) - - print(f" Is Suspicious: {'✅ YES' if result['is_suspicious'] else '❌ NO'}") - print(f" Confidence: {result['confidence']:.1%}") - print(f" Summary: {result['summary']}") - - if result['is_suspicious']: - print(f" Analysis: {result['analysis'].get('reason', 'N/A')}") - if result.get('recommendations'): - print(f" Recommendation: {result['recommendations'][0]}") - - # Show hidden content stats - hidden = result.get('hidden_content', {}) - visible = result.get('visible_content', {}) - if hidden.get('total_chars', 0) > 0: - print(f" Hidden Text: {hidden.get('total_chars', 0)} chars in {hidden.get('elements_count', 0)} elements") - print(f" Visible Text: {visible.get('chars', 0)} chars") - - print("\n" + "=" * 60) - print("✅ Text Salting Defense System Ready!") - print(f" Output directory: {OUTPUT_DIR}") - - return detector - - -def _command_detect(detector, params): - html = params.get("html") - if not isinstance(html, str) or not html.strip(): - raise ValueError("Parameter 'html' is required and must be a non-empty string") - return detector.detect(html) - - -def _command_status(_detector): - return { - "ready": True, - "outputDir": str(OUTPUT_DIR), - } - - -def _emit(payload): - """Write a single JSON object to stdout for the calling Express process. - All diagnostics (render/OCR warnings) go to stderr instead of print()'s - default stdout so this is always the only thing on stdout.""" - sys.stdout.write(json.dumps(payload, default=str)) - sys.stdout.flush() - - -def run_cli(argv=None): - parser = argparse.ArgumentParser(description="Text Salting Defense CLI") - parser.add_argument( - "--command", - choices=["detect", "status"], - help="Operation to run. Omit to run the interactive demo.", - ) - parser.add_argument( - "--params", - default="{}", - help="JSON-encoded parameters for the command.", - ) - args = parser.parse_args(argv) - - # No command -> preserve the original demo behaviour when run directly. - if args.command is None: - main() - return 0 - - try: - params = json.loads(args.params) - except json.JSONDecodeError as error: - _emit({"success": False, "command": args.command, "error": f"Invalid --params JSON: {error}"}) - return 1 - if not isinstance(params, dict): - _emit({"success": False, "command": args.command, "error": "--params must be a JSON object"}) - return 1 - - try: - detector = TextSaltingDetector() - if args.command == "detect": - result = _command_detect(detector, params) - else: - result = _command_status(detector) - except Exception as error: # surfaced to Express via stderr + non-zero exit - print(f"{args.command} failed: {error}", file=sys.stderr) - _emit({"success": False, "command": args.command, "error": str(error)}) - return 1 - - _emit({"success": True, "command": args.command, **result}) - return 0 - - -if __name__ == "__main__": - sys.exit(run_cli()) \ No newline at end of file +#!/usr/bin/env python3 +""" +Text Salting Attack Defense System +Detects hidden text in emails using CSS techniques to evade AI security +""" + +import re +import json +import base64 +from pathlib import Path +from datetime import datetime +import hashlib +from bs4 import BeautifulSoup +import cv2 +import numpy as np +from PIL import Image +import pytesseract +from html2image import Html2Image +import tempfile +import os + +# ============================================ +# CONFIGURATION +# ============================================ + +BASE_DIR = Path(__file__).resolve().parent +OUTPUT_DIR = BASE_DIR / 'output' +OUTPUT_DIR.mkdir(exist_ok=True) + +# ============================================ +# HTML PARSER & HIDDEN CONTENT EXTRACTOR +# ============================================ + +class HTMLHiddenContentExtractor: + """Extracts hidden text from HTML using various techniques""" + + def __init__(self): + # CSS properties that hide text + self.hidden_css_properties = [ + ('clip', r'clip:\s*(rect\(0,0,0,0\)|rect\(0\s+0\s+0\s+0\))'), + ('clip-path', r'clip-path:\s*inset\(100%\)'), + ('text-indent', r'text-indent:\s*-\d+px'), + ('font-size', r'font-size:\s*0'), + ('font-size', r'font-size:\s*0\.\d+px'), + ('position', r'position:\s*absolute'), + ('left', r'left:\s*-\d+px'), + ('top', r'top:\s*-\d+px'), + ('opacity', r'opacity:\s*0'), + ('visibility', r'visibility:\s*hidden'), + ('display', r'display:\s*none'), + ('color', r'color:\s*#\w{6}\s*;\s*background-color:\s*#\w{6}'), + ('height', r'height:\s*0'), + ('width', r'width:\s*0'), + ('max-height', r'max-height:\s*0'), + ('overflow', r'overflow:\s*hidden'), + ('white-space', r'white-space:\s*nowrap'), + ] + + self.compiled_patterns = [] + for prop, pattern in self.hidden_css_properties: + self.compiled_patterns.append({ + 'property': prop, + 'pattern': re.compile(pattern, re.IGNORECASE) + }) + + # Suspicious inline style patterns + self.suspicious_style_patterns = [ + r'style="[^"]*(?:display\s*:\s*none|visibility\s*:\s*hidden|opacity\s*:\s*0)"', + r'style="[^"]*(?:font-size\s*:\s*0|font-size\s*:\s*0\.[0-9]+px)"', + r'style="[^"]*(?:text-indent\s*:\s*-\d+px|clip\s*:\s*rect\(0,0,0,0\))"', + r'style="[^"]*(?:position\s*:\s*absolute\s*;?\s*(?:left|top)\s*:\s*-\d+px)"', + r'class="[^"]*(?:hidden|invisible|sr-only|visually-hidden)"', + ] + self.suspicious_styles = [re.compile(p, re.I) for p in self.suspicious_style_patterns] + + def extract_hidden_text(self, html): + """Extract text that is hidden in the HTML""" + soup = BeautifulSoup(html, 'html.parser') + + hidden_text = [] + hidden_elements = [] + + # Find all elements with suspicious attributes + for element in soup.find_all(): + is_hidden = False + reason = [] + + # Check style attribute + style = element.get('style', '') + if style: + for item in self.compiled_patterns: + if item['pattern'].search(style): + is_hidden = True + reason.append(item['property']) + + # Check class attribute + classes = element.get('class', []) + hidden_classes = ['hidden', 'invisible', 'sr-only', 'visually-hidden', 'd-none'] + for cls in classes: + if cls in hidden_classes: + is_hidden = True + reason.append(f'class:{cls}') + + # Check for hidden attributes + if element.get('aria-hidden') == 'true': + is_hidden = True + reason.append('aria-hidden') + + if element.get('hidden') is not None: + is_hidden = True + reason.append('hidden') + + # Check for display:none in style + if style and 'display:none' in style.replace(' ', '').lower(): + is_hidden = True + reason.append('display:none') + + # Check if element has no visible content but has text + if is_hidden and element.text and element.text.strip(): + text = element.text.strip() + hidden_text.append({ + 'text': text, + 'element': element.name, + 'reason': reason, + 'html': str(element)[:200] + }) + hidden_elements.append(element) + + # Also check for text nodes inside hidden parents + for hidden in hidden_elements: + # Remove hidden elements from soup to get visible text + hidden.decompose() + + # Get visible text after removing hidden elements + visible_text = soup.get_text(separator=' ', strip=True) + + return { + 'hidden_texts': hidden_text, + 'total_hidden_chars': sum(len(h['text']) for h in hidden_text), + 'visible_text': visible_text, + 'hidden_elements_count': len(hidden_elements) + } + + def check_suspicious_styles(self, html): + """Check for suspicious style patterns""" + matches = [] + for pattern in self.suspicious_styles: + found = pattern.findall(html) + if found: + matches.extend(found) + return matches + + +# ============================================ +# EMAIL RENDERER FOR VISUAL ANALYSIS +# ============================================ + +class EmailRenderer: + """Renders HTML emails as images for visual analysis""" + + def __init__(self): + self.temp_dir = tempfile.mkdtemp() + self.width = 800 + self.height = 600 + + def render(self, html): + """Render HTML to image""" + try: + from html2image import Html2Image + hti = Html2Image(output_path=self.temp_dir) + + html_file = os.path.join(self.temp_dir, 'email.html') + with open(html_file, 'w', encoding='utf-8') as f: + f.write(html) + + png_file = os.path.join(self.temp_dir, 'email.png') + hti.screenshot(html_file=html_file, save_as='email.png', + size=(self.width, self.height)) + + img = Image.open(png_file) + + # Cleanup + os.remove(html_file) + os.remove(png_file) + + return img + + except Exception as e: + print(f"⚠️ HTML rendering failed: {e}") + # Fallback: Create image with text + return self._render_text_fallback(html) + + def _render_text_fallback(self, html): + """Fallback renderer for simple text""" + from PIL import Image, ImageDraw, ImageFont + + # Extract visible text + soup = BeautifulSoup(html, 'html.parser') + text = soup.get_text(separator=' ', strip=True) + + img = Image.new('RGB', (self.width, self.height), color='white') + draw = ImageDraw.Draw(img) + + try: + font = ImageFont.truetype("/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf", 14) + except: + font = ImageFont.load_default() + + y = 10 + for line in text.split('\n')[:30]: + if y > self.height - 20: + break + draw.text((10, y), line[:100], fill='black', font=font) + y += 20 + + return img + + +# ============================================ +# OCR EXTRACTOR +# ============================================ + +class OCRTextExtractor: + """Extracts text from rendered images using OCR""" + + def __init__(self): + self.config = '--psm 6 --oem 3' + + def extract(self, image): + """Extract text from image""" + try: + # Convert PIL to OpenCV + if isinstance(image, Image.Image): + img = np.array(image) + img = cv2.cvtColor(img, cv2.COLOR_RGB2BGR) + else: + img = image + + # Preprocess + gray = cv2.cvtColor(img, cv2.COLOR_BGR2GRAY) + _, thresh = cv2.threshold(gray, 0, 255, cv2.THRESH_BINARY + cv2.THRESH_OTSU) + + # OCR + text = pytesseract.image_to_string(thresh, config=self.config) + + return text.strip() + except Exception as e: + print(f"⚠️ OCR failed: {e}") + return "" + + +# ============================================ +# TEXT SALTING DETECTOR +# ============================================ + +class TextSaltingDetector: + """Detects text salting attacks in emails""" + + def __init__(self): + self.html_parser = HTMLHiddenContentExtractor() + self.renderer = EmailRenderer() + self.ocr = OCRTextExtractor() + self.threshold_ratio = 2.0 # Hidden text > 2x visible text = suspicious + self.min_visible_text = 50 # Minimum visible text to consider + + def detect(self, html): + """Detect text salting attacks""" + results = { + 'is_suspicious': False, + 'confidence': 0.0, + 'hidden_content': {}, + 'visible_content': {}, + 'analysis': {}, + 'recommendations': [] + } + + # Step 1: Parse HTML for hidden content + hidden_analysis = self.html_parser.extract_hidden_text(html) + + # Step 2: Render email as image + try: + rendered_image = self.renderer.render(html) + except Exception as e: + results['error'] = f"Render failed: {e}" + return results + + # Step 3: Extract visible text via OCR + visible_text = self.ocr.extract(rendered_image) + + # Step 4: Calculate hidden vs visible ratio + hidden_chars = hidden_analysis['total_hidden_chars'] + visible_chars = len(visible_text) + + results['hidden_content'] = { + 'texts': hidden_analysis['hidden_texts'][:10], # Limit for response + 'total_chars': hidden_chars, + 'elements_count': hidden_analysis['hidden_elements_count'] + } + + results['visible_content'] = { + 'text': visible_text[:500], # Limit for response + 'chars': visible_chars + } + + # Step 5: Analyze salting + if visible_chars < self.min_visible_text and hidden_chars > 100: + results['is_suspicious'] = True + results['confidence'] = 0.9 + results['analysis']['reason'] = 'Very little visible text with large hidden content' + results['recommendations'].append('Email appears to be mostly hidden text - potential salting attack') + + elif hidden_chars > visible_chars * self.threshold_ratio: + results['is_suspicious'] = True + results['confidence'] = min(0.95, hidden_chars / (visible_chars + 1)) + results['analysis']['reason'] = f'Hidden text ({hidden_chars} chars) exceeds visible text ({visible_chars} chars) by {hidden_chars/visible_chars:.1f}x' + results['recommendations'].append('Significant text salting detected - hidden content used to dilute spam signals') + + elif hidden_chars > 0 and hidden_chars < visible_chars * 0.5: + # Some hidden content but not enough to be salting + results['confidence'] = 0.2 + results['analysis']['reason'] = 'Minor hidden content detected' + + # Step 6: Check for suspicious patterns + suspicious_styles = self.html_parser.check_suspicious_styles(html) + if suspicious_styles: + results['analysis']['suspicious_styles'] = suspicious_styles[:5] + if not results['is_suspicious']: + results['confidence'] = max(results['confidence'], 0.4) + + # Step 7: Check for text salting patterns + salting_patterns = self._detect_salting_patterns(html, visible_text) + if salting_patterns: + results['analysis']['salting_patterns'] = salting_patterns + results['is_suspicious'] = True + results['confidence'] = max(results['confidence'], 0.85) + results['recommendations'].append(f'Text salting pattern detected: {", ".join(salting_patterns[:3])}') + + # Step 8: Generate summary + results['summary'] = self._generate_summary(results) + + return results + + def _detect_salting_patterns(self, html, visible_text): + """Detect specific text salting patterns""" + patterns = [] + + # Check for huge text blocks that would be invisible + large_blocks = re.findall(r'<[^>]*>[^<]{100,}]*>', html, re.I) + if len(large_blocks) > 5: + patterns.append('multiple_large_text_blocks') + + # Check for seemingly random text + hidden_analysis = self.html_parser.extract_hidden_text(html) + for hidden in hidden_analysis['hidden_texts']: + text = hidden['text'] + # Check for random-looking text (low entropy) + if len(text) > 100: + entropy = self._calculate_entropy(text) + if entropy > 4.5: # High entropy = random-looking + patterns.append('high_entropy_hidden_text') + break + + # Check for repeated benign phrases + visible_words = set(visible_text.lower().split()) + hidden_text = ' '.join([h['text'] for h in hidden_analysis['hidden_texts']]) + hidden_words = set(hidden_text.lower().split()) + + # Find words that appear in hidden but not visible + unique_hidden = hidden_words - visible_words + if len(unique_hidden) > 50: + patterns.append('unique_benign_words_in_hidden') + + return patterns + + def _calculate_entropy(self, text): + """Calculate Shannon entropy of text""" + if not text: + return 0 + text = text.lower() + freq = {} + for char in text: + if char.isalpha(): + freq[char] = freq.get(char, 0) + 1 + + entropy = 0 + total = sum(freq.values()) + for count in freq.values(): + p = count / total + entropy -= p * (p ** 0.5) # Simplified entropy + + return entropy + + def _generate_summary(self, results): + """Generate human-readable summary""" + if results['is_suspicious']: + return f"⚠️ Text salting detected! {results['analysis'].get('reason', 'Hidden content exceeds visible content')}" + elif results['confidence'] > 0.3: + return f"⚠️ Suspicious patterns detected. Confidence: {results['confidence']:.0%}" + else: + return "✅ No text salting detected" + + +# ============================================ +# MAIN - Test & Demo +# ============================================ + +def main(): + print("=" * 60) + print("🛡️ Text Salting Attack Defense System") + print("=" * 60) + + detector = TextSaltingDetector() + + # Test emails + test_emails = [ + # Normal email + """ + + +Team meeting at 10am tomorrow in Conference Room A.
+Please bring your laptops.
+ + + """, + + # Email with text salting (hidden text) + """ + + + ++ You have WON a FREE iPhone 15 Pro! +
+Click HERE to claim.
+ + + """, + + # Email with clip-path salting + """ + + + +Please click the link below to verify your account.
+ Verify Now + + + """, + + # Email with text-indent salting + """ + + ++ This is a legitimate newsletter about software development. + We discuss best practices and industry trends. +
+You have been selected for an exclusive offer.
+ + + """ + ] + + print("\n🧪 Testing Detection:") + print("-" * 40) + + for i, html in enumerate(test_emails, 1): + print(f"\n{i}. Test Email {i}:") + result = detector.detect(html) + + print(f" Is Suspicious: {'✅ YES' if result['is_suspicious'] else '❌ NO'}") + print(f" Confidence: {result['confidence']:.1%}") + print(f" Summary: {result['summary']}") + + if result['is_suspicious']: + print(f" Analysis: {result['analysis'].get('reason', 'N/A')}") + if result.get('recommendations'): + print(f" Recommendation: {result['recommendations'][0]}") + + # Show hidden content stats + hidden = result.get('hidden_content', {}) + visible = result.get('visible_content', {}) + if hidden.get('total_chars', 0) > 0: + print(f" Hidden Text: {hidden.get('total_chars', 0)} chars in {hidden.get('elements_count', 0)} elements") + print(f" Visible Text: {visible.get('chars', 0)} chars") + + print("\n" + "=" * 60) + print("✅ Text Salting Defense System Ready!") + print(f" Output directory: {OUTPUT_DIR}") + + return detector + + +if __name__ == "__main__": + import argparse + import sys + + parser = argparse.ArgumentParser(description="Text Salting Detector CLI") + parser.add_argument("--command", type=str, required=False, help="Command to run") + parser.add_argument("--params", type=str, required=False, help="JSON params for command") + + args = parser.parse_args() + + if args.command: + try: + params = json.loads(args.params) if args.params else {} + except Exception as e: + print(json.dumps({"success": False, "error": f"Invalid params JSON: {str(e)}"})) + sys.exit(1) + + detector = TextSaltingDetector() + + if args.command == "detect": + html = params.get("html", "") + result = detector.detect(html) + print(json.dumps(result)) + elif args.command == "status": + print(json.dumps({"status": "active", "version": "1.0.0"})) + else: + print(json.dumps({"success": False, "error": f"Unknown command: {args.command}"})) + sys.exit(1) + else: + detector = main() + + +#!/usr/bin/env python3 +""" +Text Salting Attack Defense System +Detects hidden text in emails using CSS techniques to evade AI security +""" + +import re +import sys +import json +import base64 +import argparse +from pathlib import Path +from datetime import datetime +import hashlib +from bs4 import BeautifulSoup +import cv2 +import numpy as np +from PIL import Image +import pytesseract +from html2image import Html2Image +import tempfile +import os + +# ============================================ +# CONFIGURATION +# ============================================ + +BASE_DIR = Path(__file__).resolve().parent +OUTPUT_DIR = BASE_DIR / 'output' +OUTPUT_DIR.mkdir(exist_ok=True) + +# ============================================ +# HTML PARSER & HIDDEN CONTENT EXTRACTOR +# ============================================ + +class HTMLHiddenContentExtractor: + """Extracts hidden text from HTML using various techniques""" + + def __init__(self): + # CSS properties that hide text + self.hidden_css_properties = [ + ('clip', r'clip:\s*(rect\(0,0,0,0\)|rect\(0\s+0\s+0\s+0\))'), + ('clip-path', r'clip-path:\s*inset\(100%\)'), + ('text-indent', r'text-indent:\s*-\d+px'), + ('font-size', r'font-size:\s*0'), + ('font-size', r'font-size:\s*0\.\d+px'), + ('position', r'position:\s*absolute'), + ('left', r'left:\s*-\d+px'), + ('top', r'top:\s*-\d+px'), + ('opacity', r'opacity:\s*0'), + ('visibility', r'visibility:\s*hidden'), + ('display', r'display:\s*none'), + ('color', r'color:\s*#\w{6}\s*;\s*background-color:\s*#\w{6}'), + ('height', r'height:\s*0'), + ('width', r'width:\s*0'), + ('max-height', r'max-height:\s*0'), + ('overflow', r'overflow:\s*hidden'), + ('white-space', r'white-space:\s*nowrap'), + ] + + self.compiled_patterns = [] + for prop, pattern in self.hidden_css_properties: + self.compiled_patterns.append({ + 'property': prop, + 'pattern': re.compile(pattern, re.IGNORECASE) + }) + + # Suspicious inline style patterns + self.suspicious_style_patterns = [ + r'style="[^"]*(?:display\s*:\s*none|visibility\s*:\s*hidden|opacity\s*:\s*0)"', + r'style="[^"]*(?:font-size\s*:\s*0|font-size\s*:\s*0\.[0-9]+px)"', + r'style="[^"]*(?:text-indent\s*:\s*-\d+px|clip\s*:\s*rect\(0,0,0,0\))"', + r'style="[^"]*(?:position\s*:\s*absolute\s*;?\s*(?:left|top)\s*:\s*-\d+px)"', + r'class="[^"]*(?:hidden|invisible|sr-only|visually-hidden)"', + ] + self.suspicious_styles = [re.compile(p, re.I) for p in self.suspicious_style_patterns] + + def extract_hidden_text(self, html): + """Extract text that is hidden in the HTML""" + soup = BeautifulSoup(html, 'html.parser') + + hidden_text = [] + hidden_elements = [] + + # Find all elements with suspicious attributes + for element in soup.find_all(): + is_hidden = False + reason = [] + + # Check style attribute + style = element.get('style', '') + if style: + for item in self.compiled_patterns: + if item['pattern'].search(style): + is_hidden = True + reason.append(item['property']) + + # Check class attribute + classes = element.get('class', []) + hidden_classes = ['hidden', 'invisible', 'sr-only', 'visually-hidden', 'd-none'] + for cls in classes: + if cls in hidden_classes: + is_hidden = True + reason.append(f'class:{cls}') + + # Check for hidden attributes + if element.get('aria-hidden') == 'true': + is_hidden = True + reason.append('aria-hidden') + + if element.get('hidden') is not None: + is_hidden = True + reason.append('hidden') + + # Check for display:none in style + if style and 'display:none' in style.replace(' ', '').lower(): + is_hidden = True + reason.append('display:none') + + # Check if element has no visible content but has text + if is_hidden and element.text and element.text.strip(): + text = element.text.strip() + hidden_text.append({ + 'text': text, + 'element': element.name, + 'reason': reason, + 'html': str(element)[:200] + }) + hidden_elements.append(element) + + # Also check for text nodes inside hidden parents + for hidden in hidden_elements: + # Remove hidden elements from soup to get visible text + hidden.decompose() + + # Get visible text after removing hidden elements + visible_text = soup.get_text(separator=' ', strip=True) + + return { + 'hidden_texts': hidden_text, + 'total_hidden_chars': sum(len(h['text']) for h in hidden_text), + 'visible_text': visible_text, + 'hidden_elements_count': len(hidden_elements) + } + + def check_suspicious_styles(self, html): + """Check for suspicious style patterns""" + matches = [] + for pattern in self.suspicious_styles: + found = pattern.findall(html) + if found: + matches.extend(found) + return matches + + +# ============================================ +# EMAIL RENDERER FOR VISUAL ANALYSIS +# ============================================ + +class EmailRenderer: + """Renders HTML emails as images for visual analysis""" + + def __init__(self): + self.temp_dir = tempfile.mkdtemp() + self.width = 800 + self.height = 600 + + def render(self, html): + """Render HTML to image""" + try: + from html2image import Html2Image + hti = Html2Image(output_path=self.temp_dir) + + html_file = os.path.join(self.temp_dir, 'email.html') + with open(html_file, 'w', encoding='utf-8') as f: + f.write(html) + + png_file = os.path.join(self.temp_dir, 'email.png') + hti.screenshot(html_file=html_file, save_as='email.png', + size=(self.width, self.height)) + + img = Image.open(png_file) + + # Cleanup + os.remove(html_file) + os.remove(png_file) + + return img + + except Exception as e: + print(f"⚠️ HTML rendering failed: {e}", file=sys.stderr) + # Fallback: Create image with text + return self._render_text_fallback(html) + + def _render_text_fallback(self, html): + """Fallback renderer for simple text""" + from PIL import Image, ImageDraw, ImageFont + + # Extract visible text + soup = BeautifulSoup(html, 'html.parser') + text = soup.get_text(separator=' ', strip=True) + + img = Image.new('RGB', (self.width, self.height), color='white') + draw = ImageDraw.Draw(img) + + try: + font = ImageFont.truetype("/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf", 14) + except: + font = ImageFont.load_default() + + y = 10 + for line in text.split('\n')[:30]: + if y > self.height - 20: + break + draw.text((10, y), line[:100], fill='black', font=font) + y += 20 + + return img + + +# ============================================ +# OCR EXTRACTOR +# ============================================ + +class OCRTextExtractor: + """Extracts text from rendered images using OCR""" + + def __init__(self): + self.config = '--psm 6 --oem 3' + + def extract(self, image): + """Extract text from image""" + try: + # Convert PIL to OpenCV + if isinstance(image, Image.Image): + img = np.array(image) + img = cv2.cvtColor(img, cv2.COLOR_RGB2BGR) + else: + img = image + + # Preprocess + gray = cv2.cvtColor(img, cv2.COLOR_BGR2GRAY) + _, thresh = cv2.threshold(gray, 0, 255, cv2.THRESH_BINARY + cv2.THRESH_OTSU) + + # OCR + text = pytesseract.image_to_string(thresh, config=self.config) + + return text.strip() + except Exception as e: + print(f"⚠️ OCR failed: {e}", file=sys.stderr) + return "" + + +# ============================================ +# TEXT SALTING DETECTOR +# ============================================ + +class TextSaltingDetector: + """Detects text salting attacks in emails""" + + def __init__(self): + self.html_parser = HTMLHiddenContentExtractor() + self.renderer = EmailRenderer() + self.ocr = OCRTextExtractor() + self.threshold_ratio = 2.0 # Hidden text > 2x visible text = suspicious + self.min_visible_text = 50 # Minimum visible text to consider + + def detect(self, html): + """Detect text salting attacks""" + results = { + 'is_suspicious': False, + 'confidence': 0.0, + 'hidden_content': {}, + 'visible_content': {}, + 'analysis': {}, + 'recommendations': [] + } + + # Step 1: Parse HTML for hidden content + hidden_analysis = self.html_parser.extract_hidden_text(html) + + # Step 2: Render email as image + try: + rendered_image = self.renderer.render(html) + except Exception as e: + results['error'] = f"Render failed: {e}" + return results + + # Step 3: Extract visible text via OCR + visible_text = self.ocr.extract(rendered_image) + + # Step 4: Calculate hidden vs visible ratio + hidden_chars = hidden_analysis['total_hidden_chars'] + visible_chars = len(visible_text) + + results['hidden_content'] = { + 'texts': hidden_analysis['hidden_texts'][:10], # Limit for response + 'total_chars': hidden_chars, + 'elements_count': hidden_analysis['hidden_elements_count'] + } + + results['visible_content'] = { + 'text': visible_text[:500], # Limit for response + 'chars': visible_chars + } + + # Step 5: Analyze salting + if visible_chars < self.min_visible_text and hidden_chars > 100: + results['is_suspicious'] = True + results['confidence'] = 0.9 + results['analysis']['reason'] = 'Very little visible text with large hidden content' + results['recommendations'].append('Email appears to be mostly hidden text - potential salting attack') + + elif hidden_chars > visible_chars * self.threshold_ratio: + ratio = hidden_chars / (visible_chars + 1) + results['is_suspicious'] = True + results['confidence'] = min(0.95, ratio) + results['analysis']['reason'] = f'Hidden text ({hidden_chars} chars) exceeds visible text ({visible_chars} chars) by {ratio:.1f}x' + results['recommendations'].append('Significant text salting detected - hidden content used to dilute spam signals') + + elif hidden_chars > 0 and hidden_chars < visible_chars * 0.5: + # Some hidden content but not enough to be salting + results['confidence'] = 0.2 + results['analysis']['reason'] = 'Minor hidden content detected' + + # Step 6: Check for suspicious patterns + suspicious_styles = self.html_parser.check_suspicious_styles(html) + if suspicious_styles: + results['analysis']['suspicious_styles'] = suspicious_styles[:5] + if not results['is_suspicious']: + results['confidence'] = max(results['confidence'], 0.4) + + # Step 7: Check for text salting patterns + salting_patterns = self._detect_salting_patterns(html, visible_text) + if salting_patterns: + results['analysis']['salting_patterns'] = salting_patterns + results['is_suspicious'] = True + results['confidence'] = max(results['confidence'], 0.85) + results['recommendations'].append(f'Text salting pattern detected: {", ".join(salting_patterns[:3])}') + + # Step 8: Generate summary + results['summary'] = self._generate_summary(results) + + return results + + def _detect_salting_patterns(self, html, visible_text): + """Detect specific text salting patterns""" + patterns = [] + + # Check for huge text blocks that would be invisible + large_blocks = re.findall(r'<[^>]*>[^<]{100,}]*>', html, re.I) + if len(large_blocks) > 5: + patterns.append('multiple_large_text_blocks') + + # Check for seemingly random text + hidden_analysis = self.html_parser.extract_hidden_text(html) + for hidden in hidden_analysis['hidden_texts']: + text = hidden['text'] + # Check for random-looking text (low entropy) + if len(text) > 100: + entropy = self._calculate_entropy(text) + if entropy > 4.5: # High entropy = random-looking + patterns.append('high_entropy_hidden_text') + break + + # Check for repeated benign phrases + visible_words = set(visible_text.lower().split()) + hidden_text = ' '.join([h['text'] for h in hidden_analysis['hidden_texts']]) + hidden_words = set(hidden_text.lower().split()) + + # Find words that appear in hidden but not visible + unique_hidden = hidden_words - visible_words + if len(unique_hidden) > 50: + patterns.append('unique_benign_words_in_hidden') + + return patterns + + def _calculate_entropy(self, text): + """Calculate Shannon entropy of text""" + if not text: + return 0 + text = text.lower() + freq = {} + for char in text: + if char.isalpha(): + freq[char] = freq.get(char, 0) + 1 + + entropy = 0 + total = sum(freq.values()) + for count in freq.values(): + p = count / total + entropy -= p * (p ** 0.5) # Simplified entropy + + return entropy + + def _generate_summary(self, results): + """Generate human-readable summary""" + if results['is_suspicious']: + return f"⚠️ Text salting detected! {results['analysis'].get('reason', 'Hidden content exceeds visible content')}" + elif results['confidence'] > 0.3: + return f"⚠️ Suspicious patterns detected. Confidence: {results['confidence']:.0%}" + else: + return "✅ No text salting detected" + + +# ============================================ +# MAIN - Test & Demo +# ============================================ + +def main(): + print("=" * 60) + print("🛡️ Text Salting Attack Defense System") + print("=" * 60) + + detector = TextSaltingDetector() + + # Test emails + test_emails = [ + # Normal email + """ + + +Team meeting at 10am tomorrow in Conference Room A.
+Please bring your laptops.
+ + + """, + + # Email with text salting (hidden text) + """ + + + ++ You have WON a FREE iPhone 15 Pro! +
+Click HERE to claim.
+ + + """, + + # Email with clip-path salting + """ + + + +Please click the link below to verify your account.
+ Verify Now + + + """, + + # Email with text-indent salting + """ + + ++ This is a legitimate newsletter about software development. + We discuss best practices and industry trends. +
+You have been selected for an exclusive offer.
+ + + """ + ] + + print("\n🧪 Testing Detection:") + print("-" * 40) + + for i, html in enumerate(test_emails, 1): + print(f"\n{i}. Test Email {i}:") + result = detector.detect(html) + + print(f" Is Suspicious: {'✅ YES' if result['is_suspicious'] else '❌ NO'}") + print(f" Confidence: {result['confidence']:.1%}") + print(f" Summary: {result['summary']}") + + if result['is_suspicious']: + print(f" Analysis: {result['analysis'].get('reason', 'N/A')}") + if result.get('recommendations'): + print(f" Recommendation: {result['recommendations'][0]}") + + # Show hidden content stats + hidden = result.get('hidden_content', {}) + visible = result.get('visible_content', {}) + if hidden.get('total_chars', 0) > 0: + print(f" Hidden Text: {hidden.get('total_chars', 0)} chars in {hidden.get('elements_count', 0)} elements") + print(f" Visible Text: {visible.get('chars', 0)} chars") + + print("\n" + "=" * 60) + print("✅ Text Salting Defense System Ready!") + print(f" Output directory: {OUTPUT_DIR}") + + return detector + + +def _command_detect(detector, params): + html = params.get("html") + if not isinstance(html, str) or not html.strip(): + raise ValueError("Parameter 'html' is required and must be a non-empty string") + return detector.detect(html) + + +def _command_status(_detector): + return { + "ready": True, + "outputDir": str(OUTPUT_DIR), + } + + +def _emit(payload): + """Write a single JSON object to stdout for the calling Express process. + All diagnostics (render/OCR warnings) go to stderr instead of print()'s + default stdout so this is always the only thing on stdout.""" + sys.stdout.write(json.dumps(payload, default=str)) + sys.stdout.flush() + + +def run_cli(argv=None): + parser = argparse.ArgumentParser(description="Text Salting Defense CLI") + parser.add_argument( + "--command", + choices=["detect", "status"], + help="Operation to run. Omit to run the interactive demo.", + ) + parser.add_argument( + "--params", + default="{}", + help="JSON-encoded parameters for the command.", + ) + args = parser.parse_args(argv) + + # No command -> preserve the original demo behaviour when run directly. + if args.command is None: + main() + return 0 + + try: + params = json.loads(args.params) + except json.JSONDecodeError as error: + _emit({"success": False, "command": args.command, "error": f"Invalid --params JSON: {error}"}) + return 1 + if not isinstance(params, dict): + _emit({"success": False, "command": args.command, "error": "--params must be a JSON object"}) + return 1 + + try: + detector = TextSaltingDetector() + if args.command == "detect": + result = _command_detect(detector, params) + else: + result = _command_status(detector) + except Exception as error: # surfaced to Express via stderr + non-zero exit + print(f"{args.command} failed: {error}", file=sys.stderr) + _emit({"success": False, "command": args.command, "error": str(error)}) + return 1 + + _emit({"success": True, "command": args.command, **result}) + return 0 + + +if __name__ == "__main__": + sys.exit(run_cli()) diff --git a/backend/utils/adminRuleEvaluator.js b/backend/utils/adminRuleEvaluator.js index ca178968..0c24a2ef 100644 --- a/backend/utils/adminRuleEvaluator.js +++ b/backend/utils/adminRuleEvaluator.js @@ -55,10 +55,11 @@ const evaluateAdminRules = (text) => { const patternLower = rule.pattern.toLowerCase(); switch (rule.type) { - case 'regex': + case 'regex': { const regex = new RegExp(rule.pattern, 'i'); isMatch = regex.test(text); break; + } case 'keyword': isMatch = textLower.includes(patternLower); break; diff --git a/backend/utils/emailRules.js b/backend/utils/emailRules.js index ddbe8165..a45a6514 100644 --- a/backend/utils/emailRules.js +++ b/backend/utils/emailRules.js @@ -71,7 +71,7 @@ async function applyRulesToEmails(userId, emails) { return { ...email, prediction: updatedPrediction, - rule_applied: matchingRule.type + rule_applied: matchedType }; } diff --git a/backend/visual_detector.py b/backend/visual_detector.py index cd23b6d8..42144bb5 100644 --- a/backend/visual_detector.py +++ b/backend/visual_detector.py @@ -683,4 +683,32 @@ def main(): if __name__ == "__main__": - main() \ No newline at end of file + import argparse + import sys + + parser = argparse.ArgumentParser(description="VBSF Visual Detector CLI") + parser.add_argument("--command", type=str, required=False, help="Command to run") + parser.add_argument("--params", type=str, required=False, help="JSON params for command") + + args = parser.parse_args() + + if args.command: + try: + params = json.loads(args.params) if args.params else {} + except Exception as e: + print(json.dumps({"success": False, "error": f"Invalid params JSON: {str(e)}"})) + sys.exit(1) + + ensemble = StackingEnsemble() + + if args.command == "detect": + html = params.get("html", "") + result = ensemble.detect(html) + print(json.dumps(result)) + elif args.command == "status": + print(json.dumps({"status": "active", "version": "1.0.0", "trained": ensemble.is_trained})) + else: + print(json.dumps({"success": False, "error": f"Unknown command: {args.command}"})) + sys.exit(1) + else: + main() \ No newline at end of file diff --git a/backend/worker.js b/backend/worker.js index f45fe3a7..e113f847 100644 --- a/backend/worker.js +++ b/backend/worker.js @@ -75,7 +75,7 @@ const worker = new Worker('PredictionQueue', async job => { dbJob.error = errorMsg; await dbJob.save(); } - throw new Error(errorMsg); + throw new Error(errorMsg, { cause: error }); } finally { // Cleanup temporary file if (filePath && fs.existsSync(filePath)) { diff --git a/frontend/src/components/ActivityHeatmap.jsx b/frontend/src/components/ActivityHeatmap.jsx index 2c5b976a..8cf8d6bb 100644 --- a/frontend/src/components/ActivityHeatmap.jsx +++ b/frontend/src/components/ActivityHeatmap.jsx @@ -15,6 +15,7 @@ const ActivityHeatmap = ({ userId, darkMode }) => { useEffect(() => { fetchActivityData(); + // eslint-disable-next-line react-hooks/exhaustive-deps }, [currentMonth, userId]); const fetchActivityData = async () => { diff --git a/frontend/src/components/AdminFeedbackView.jsx b/frontend/src/components/AdminFeedbackView.jsx index 842bf458..31f63acb 100644 --- a/frontend/src/components/AdminFeedbackView.jsx +++ b/frontend/src/components/AdminFeedbackView.jsx @@ -3,7 +3,7 @@ import api from "../utils/axiosInstance"; import { useTheme } from "../context/ThemeContext"; export default function AdminFeedbackView() { - const { isDark, activeTheme } = useTheme(); + const { isDark } = useTheme(); const [stats, setStats] = useState(null); const [feedbackList, setFeedbackList] = useState([]); const [loading, setLoading] = useState(true); diff --git a/frontend/src/components/Appearancesetting.jsx b/frontend/src/components/Appearancesetting.jsx index ede66ae5..98fe17e6 100644 --- a/frontend/src/components/Appearancesetting.jsx +++ b/frontend/src/components/Appearancesetting.jsx @@ -1,4 +1,4 @@ -import React from 'react'; +import React, { useState } from 'react'; export function Appearancesetting() { const [theme,setTheme] = useState(localStorage.getItem('theme') || 'light'); diff --git a/frontend/src/components/EmailScannerDashboard.jsx b/frontend/src/components/EmailScannerDashboard.jsx index 4341f530..5de8c798 100644 --- a/frontend/src/components/EmailScannerDashboard.jsx +++ b/frontend/src/components/EmailScannerDashboard.jsx @@ -41,6 +41,7 @@ export default function EmailScannerDashboard() { checkConnectionStatus(); handleOAuthCallback(); refreshImapStatus(); + // eslint-disable-next-line react-hooks/exhaustive-deps }, []); const checkConnectionStatus = async () => { diff --git a/frontend/src/components/ProfileSettings.jsx b/frontend/src/components/ProfileSettings.jsx index bd053515..48c75320 100644 --- a/frontend/src/components/ProfileSettings.jsx +++ b/frontend/src/components/ProfileSettings.jsx @@ -16,7 +16,7 @@ export function ProfileSettings() { headers: { Authorization: `Bearer ${token}` } }); alert('Profile updated!'); - } catch (err) { + } catch { alert('Failed to update profile'); } finally { setLoading(false); diff --git a/frontend/src/components/SpamInsightsDashboard.jsx b/frontend/src/components/SpamInsightsDashboard.jsx index 3a160fd3..07088e15 100644 --- a/frontend/src/components/SpamInsightsDashboard.jsx +++ b/frontend/src/components/SpamInsightsDashboard.jsx @@ -33,6 +33,7 @@ export default function SpamInsightsDashboard() { useEffect(() => { fetchInsights(); + // eslint-disable-next-line react-hooks/exhaustive-deps }, []); const handleCategoryChange = (e) => { diff --git a/frontend/src/pages/History.jsx b/frontend/src/pages/History.jsx index def78cc0..64fba585 100644 --- a/frontend/src/pages/History.jsx +++ b/frontend/src/pages/History.jsx @@ -11,6 +11,7 @@ const History = () => { useEffect(()=>{ fetchHistory(); + // eslint-disable-next-line react-hooks/exhaustive-deps }, []); const fetchHistory = async () => {