Branch Coverage

File:blib/lib/Email/Abuse/Investigator.pm
Coverage:72.1%

line%coveragebranch
61950TFif ($HAS_CHI and not $_cache)
75150TFif ref $text eq "SCALAR"
75550TFif defined $text
771100TFif defined $text and $text =~ /\S/
109550TFif $dom and not $seen{$dom}++
1101100TFif $dom and not $seen{$dom}++
117850TFunless ($dom)
118250TFif $dom
118850TFif $u->{'abuse'} and $u->{'abuse'} ne "(unknown)"
119650TFif $covered{$bare}
119750TFif $seen{"url:$bare"}++
1209100TFif $source =~ /^(?:From:|Return-Path:|Sender:) header$/
121050TFif $covered{lc $dom}
121150TFif $seen{"dom:$dom"}++
1454100TFif $self->{'_risk'}
1468100TFif ($orig)
1470100TFif ($orig->{'rdns'} and $orig->{'rdns'} =~ /                    \d+[-_.]\d+[-_.]\d+[-_.]\d+   # dotted-quad in rDNS                    | (?:dsl|adsl|cable|broad|dial|dynamic|dhcp|ppp|                         residential|cust|home|pool|client|user|                         static\d|host\d)            /xi)
1481100TFif (not $orig->{'rdns'} or $orig->{'rdns'} eq "(no reverse DNS)")
1487100TFif ($orig->{'confidence'} eq "low")
1493100TFif ($orig->{'country'} and $orig->{'country'} =~ /^(?:CN|RU|NG|VN|IN|PK|BD)$/)
1502100TFif (defined $auth->{'spf'})
1503100TFif ($auth->{'spf'} =~ /^fail/i) { }
100TFelsif ($auth->{'spf'} =~ /^softfail/i) { }
50TFelsif (not $auth->{'spf'} =~ /^pass/i) { }
1514100TFif (defined $auth->{'dkim'} and not $auth->{'dkim'} =~ /^pass/i)
1518100TFif (defined $auth->{'dmarc'} and not $auth->{'dmarc'} =~ /^pass/i)
1523100TFif ($auth->{'dkim_domain'})
152550TFif ($from_domain)
1528100TFif ($reg_dkim ne $reg_from)
1530100TFif ($auth->{'dkim'} and $auth->{'dkim'} =~ /^pass/i) { }
1546100TFif (not $date_raw && $date_raw =~ /\S/) { }
155150TFif ($date_raw =~ /([+-])(\d{2})(\d{2})\s*$/)
1557100TFif ($implausible)
156650TFif (defined $date_epoch)
1568100TFif ($delta > $DATE_SKEW_DAYS * $SECS_PER_DAY) { }
100TFelsif ($delta < -($DATE_SKEW_DAYS * $SECS_PER_DAY)) { }
1583100TFif ($from_decoded =~ /^"?([^"<]+?)"?\s*<([^>]+)>/)
159150TFif ($reg_disp and $reg_addr and $reg_disp ne $reg_addr)
1599100TFif ($from_raw =~ /\@(gmail|yahoo|hotmail|outlook|live|aol|protonmail|yandex)\./i or $from_raw =~ /\@mail\.ru(?:[\s>]|$)/i)
1607100TFif ($reply_to)
1610100TFif ($from_addr and $reply_addr and lc $from_addr ne lc $reply_addr)
1618100TFif ($to =~ /undisclosed|:;/ or $to eq "")
1625100TFif ($subj_raw =~ /=\?[^?]+\?[BQ]\?/i)
163750TFif $self->{'trusted_domains'}{$bare}
1638100TFif $TRUSTED_DOMAINS{$bare}
1641100TFif ($URL_SHORTENERS{$bare} || $self->{'url_shorteners'}{$bare} and not $shortener_seen{$bare}++)
1646100TFif ($u->{'url'} =~ m[^http://]i and not $url_host_seen{$u->{'host'}}++)
1655100TFif ($d->{'recently_registered'})
1661100TFif ($d->{'expires'})
166250TFif (my $exp = $self->_parse_date_to_epoch($d->{'expires'}))
1665100TFif ($remaining > 0 and $remaining < $EXPIRY_WARN_DAYS * $SECS_PER_DAY) { }
100TFelsif ($remaining <= 0) { }
1679100TFif ($d->{'domain'} =~ /\Q$brand\E/i and not $d->{'domain'} =~ /^\Q$brand\E\.(?:com|co\.uk|net|org)$/)
1689100TF$score >= $SCORE_LOW ? :
100TF$score >= $SCORE_MEDIUM ? :
100TF$score >= $SCORE_HIGH ? :
1773100TFif (@{$risk->{'flags'};})
1783100TFif ($orig)
1791100TFif (@contacts)
179850TFif (my(@form_cs) = $self->form_contacts)
18040TFif $c->{'form_domain'}
18050TFif $c->{'form_paste'}
18060TFif $c->{'form_upload'}
1906100TFunless $addr and $addr =~ /\@/
190950TFif ($addr =~ /\@([\w.-]+)$/)
1912100TFif $pa and $pa->{'form'} and not $pa->{'email'}
1915100TFif (exists $seen_idx{$addr})
1923100TFunless $role_counts{$r}++
1926100TF$role_counts{$_} > 1 ? :
1931100TFif (length $joined > $ROLE_MAX_LEN)
1951100TFif ($orig)
1953100TFif ($pa)
1961100TFif ($orig->{'abuse'} and $orig->{'abuse'} ne "(unknown)")
1974100TFif $url_host_seen{$u->{'host'}}++
197850TFif $self->{'trusted_domains'}{$bare_host}
1979100TFif $TRUSTED_DOMAINS{$bare_host}
1981100TFif ($pa)
1989100TFif ($u->{'abuse'} and $u->{'abuse'} ne "(unknown)")
2004100TFif ($d->{'web_abuse'})
200650TFif ($pa)
2022100TFif ($d->{'mx_abuse'})
2035100TFif ($d->{'ns_abuse'})
2048100TFif ($d->{'registrar_abuse'})
2055100TFunless ($spoofable_only)
2071100TF$val =~ /<([^>]*)>\s*$/ ? :
207350TFunless $addr_domain
2076100TFif $addr_spec =~ /\+SRS[0-9]?=/i
2079100TFif ($pa)
208050TF$addr_spec =~ /\@/ ? :
2093100TFif ($auth->{'dkim_domain'})
2095100TFif ($pa)
210750TFif ($unsub)
21180TFif ($pa)
213350TFif $body_addr_seen{$addr_dom}++
2135100TFunless $pa and $pa->{'email'}
223050TFunless $form
2231100TFif $seen{$form}++
2237100TFif ($orig)
223950TFif ($pa and $pa->{'form'})
2254100TFif $url_host_seen{$u->{'host'}}++
225650TFif ($pa and $pa->{'form'})
22730TFif ($pa and $pa->{'form'})
2286100TFif ($d->{'registrar_abuse'} and $d->{'registrar_abuse'} =~ /\@([\w.-]+)/)
2289100TFif ($rpa and $rpa->{'form'})
2306100TF$val =~ /<([^>]*)>\s*$/ ? :
230850TFunless $addr_domain
231050TFif $addr_spec =~ /\+SRS[0-9]?=/i
231250TFif ($pa and $pa->{'form'})
23130TF$addr_spec =~ /@/ ? :
2328100TFif ($auth->{'dkim_domain'})
23300TFif ($pa and $pa->{'form'})
234450TFif ($unsub)
23510TFif ($pa and $pa->{'form'})
2443100TFunless defined $v
2446100TF$decoded ne $v ? :
2454100TFif (@{$risk->{'flags'};}) { }
2466100TFif ($orig) { }
246850TFif $orig->{'rdns'}
2469100TFif $orig->{'country'}
247050TFif $orig->{'org'}
247150TFif $orig->{'abuse'}
2473100TFif $orig->{'note'}
248150TFif (@sw)
249150TFunless defined $_->{'id'}
249350TFif (@trail)
24990TFif $hop->{'for'}
25000TFif $hop->{'id'}
2508100TFif (@urls) { }
2513100TFunless (exists $host_order{$h})
2530100TF$URL_SHORTENERS{$bare} || $self->{'url_shorteners'}{$bare} ? :
253250TFif $m->{'ip'}
2533100TFif $m->{'country'}
253450TFif $m->{'org'}
253550TFif $m->{'abuse'}
2537100TFif (@paths == 1) { }
2553100TFif (@mdoms) { }
2557100TFif ($d->{'recently_registered'})
2560100TFif $d->{'registered'}
2561100TFif $d->{'expires'}
2562100TFif $d->{'registrar'}
2563100TFif $d->{'registrar_abuse'}
2564100TFif ($d->{'web_ip'}) { }
2566100TFif $d->{'web_org'}
2567100TFif $d->{'web_abuse'}
2571100TFif ($d->{'mx_host'}) { }
257350TFif $d->{'mx_ip'}
257450TFif $d->{'mx_org'}
257550TFif $d->{'mx_abuse'}
2579100TFif ($d->{'ns_host'})
258150TFif $d->{'ns_ip'}
258250TFif $d->{'ns_org'}
258350TFif $d->{'ns_abuse'}
2595100TFif (@contacts) { }
259950TFif $c->{'note'}
2610100TFif (@form_cs)
261850TFif $c->{'form_domain'}
261950TFif $c->{'note'}
262050TFif ($c->{'form_paste'})
2626100TFif (defined $line and length "$line $w" > $ROLE_WRAP_LEN) { }
2630100TFdefined $line ? :
263350TFif defined $line
263450TFif @lines
263750TFif $c->{'form_upload'}
2671100TFunless defined $str
271250TFunless defined $header_block and $header_block =~ /\S/
2721100TFif ($line =~ /^([\w-]+)\s*:\s*(.*)/)
2736100TFdefined $ct_h ? :
2737100TFdefined $cte_h ? :
2740100TFif ($ct =~ /multipart/i) { }
274350TFif $boundary
2746100TFif ($ct =~ /html/i) { }
2766100TFunless $h
278150TFunless defined $ip or defined $for_addr or defined $srv_id
2820100TFif ($depth >= $MAX_MULTIPART_DEPTH)
2831100TFunless $part =~ /\S/
2837100TFunless defined $pbody
284550TFif $line =~ /^([\w-]+)\s*:\s*(.*)/
2853100TFif ($pct =~ /multipart/i)
285550TFif ($inner_boundary)
2865100TFif ($pct =~ m[text/html]i) { }
100TFelsif ($pct =~ /text/i or not $pct) { }
2890100TFif $cte =~ /quoted-printable/i
2891100TFif $cte =~ /base64/i
2930100TFif $self->_is_private($ip)
2931100TFif $self->_is_trusted($ip)
2936100TFunless (@candidates)
2938100TFif ($xoip)
2940100TFunless $self->_is_private($xoip)
2948100TF@candidates > 1 ? :
2975100TFif ($hdr =~ /$re/)
2979100TFif $ip =~ /:/
2982100TFunless $ip =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
2983100TFif grep {$_ > 255;} split(/\./, $ip, 0)
3009100TFunless defined $ip and $ip ne ""
3010100TFif $ip =~ /$re/
3030100TFif $self->_ip_in_cidr($ip, $cidr)
306950TFif $host
307350TFif ($HAS_ANYEVENT_DNS and scalar keys %hostname_needed > 1)
308050TFunless $host
3083100TFunless (exists $host_cache{$host})
308550TF$_cache ? :
308650TFif ($cached) { }
3090100TF$ip ne '(unresolved)' ? :
3095100TFunless ($whois->{'abuse'})
3098100TFif $dw->{'abuse'}
311050TFif $_cache
314050TFunless $HAS_ANYEVENT_DNS
31520TFif (@answers)
31570TFif --$pending <= 0
318450TFif ($HAS_HTML_LINKEXTOR)
3189100TFif ($val =~ m[^https?://]i) { }
100TFelsif ($val =~ m[^//[\w.-]]) { }
325550TFunless $hop->{'for'} and $hop->{'for'} =~ /\@([\w.-]+)/
326750TFif $self->{'trusted_domains'}{$dom}
3268100TFif $TRUSTED_DOMAINS{$dom}
3269100TFif $recipient_domains{$dom}
327050TFif $recipient_domains{_registrable($dom) // $dom}
3272100TFunless $dom =~ /\.[a-zA-Z]{2,}$/
3273100TFif $dom =~ /\.(?:local|internal|lan|localdomain|arpa)$/i
3274100TFif $seen{$dom}++
3293100TFif ($mid and $mid =~ /\@([\w.-]+)/)
329750TFunless $TRUSTED_DOMAINS{$mid_dom} or $TRUSTED_DOMAINS{$mid_reg} or $self->{'trusted_domains'}{$mid_dom} or $self->{'trusted_domains'}{$mid_reg}
330850TFif ($unsub)
3350100TFunless $seen{$dom}++
3356100TFunless $seen{$dom}++
3393100TFif $self->{'_domain_info'}{$domain}
339650TFif ($_cache)
33980TFif ($cached)
3409100TFif ($web_ip)
3412100TFif $w->{'org'}
3413100TFif $w->{'abuse'}
341750TFif ($HAS_NET_DNS)
34250TFif ($mxq)
34280TFif ($best)
34320TFif ($mx_ip)
34350TFif $mw->{'org'}
34360TFif $mw->{'abuse'}
34430TFif ($nsq)
34450TFif ($first)
34490TFif ($ns_ip)
34520TFif $nw->{'org'}
34530TFif $nw->{'abuse'}
3461100TFif ($domain_whois)
3466100TFif ($domain_whois =~ /Registrar:\s*(.+)/i)
3476100TFif (not $info{'registrar_abuse'} and $domain_whois =~ /$pat/)
3488100TFif (not $info{'registered'} and $domain_whois =~ /$pat/)
3499100TFif (not $info{'expires'} and $domain_whois =~ /$pat/)
3505100TFif ($info{'registered'})
3507100TFif $epoch and time - $epoch < $RECENT_REG_DAYS * $SECS_PER_DAY
351450TFif $_cache
3542100TFif $host =~ /^\d{1,3}(?:\.\d{1,3}){3}$/
354550TFif ($_cache)
35470TFif defined $cached_ip
355250TFif ($HAS_NET_DNS) { }
35610TFif ($query)
35630TFif ($rr->type eq 'A') { }
0TFelsif ($rr->type eq 'AAAA') { }
35720TFif defined $ip
357750TF$packed ? :
358150TFif ($_cache)
360250TFunless $ip
360450TFif ($HAS_NET_DNS)
36070TFif ($query)
36090TFif $rr->type eq "PTR"
364050TFif ($_cache)
36420TFif $cached
364550TF$HAS_LWP ? :
364850TFunless ($result->{'org'})
3650100TFif ($raw)
3652100TF$ref ? :
365350TFif $detail
365850TFif $_cache and $result
3679100TFunless $server
370050TFif ($raw =~ /Registrar:\s*(.+)/i)
3709100TFif (not $info{'abuse'} and $raw =~ /$pat/)
37310TFunless $HAS_LWP
37340TFunless (defined $ua)
37400TFif ($HAS_CONN_CACHE)
37530TFunless $res and $res->is_success
37590TFif $j =~ /"name"\s*:\s*"([^"]+)"/
37600TFif $j =~ /"handle"\s*:\s*"([^"]+)"/
37630TFif ($j =~ /"abuse".*?"email"\s*:\s*"([^"]+)"/s) { }
0TFelsif ($j =~ /"email"\s*:\s*"([^\@"]+\@[^"]+)"/) { }
37700TFif $j =~ /"country"\s*:\s*"([A-Z]{2})"/
380450TF$HAS_IO_SOCKET_IP ? :
381550TFunless $sock
381850TFunless ($sock->print("$query\r\n"))
3830100TFif ($@ or not defined $n or $n <= 0)
383150TFif $@
383450TFunless defined $n and $n > 0
3856100TFunless $text
3864100TFif (not $info{'org'} and $text =~ /$pat/)
3874100TFif (not $info{'abuse'} and $text =~ /$pat/)
3880100TFif $text =~ /(abuse\@[\w.-]+)/i
3883100TFif ($text =~ /^country:\s*([A-Za-z]{2})\s*$/m)
3909100TFif $self->{'_auth_results'}
3921100TFif $raw =~ /\bspf=(\S+)/i
3922100TFif $raw =~ /\bdkim=(\S+)/i
3923100TFif $raw =~ /\bdmarc=(\S+)/i
3924100TFif $raw =~ /\barc=(\S+)/i
3928100TFif defined $auth{$k}
393550TFif ($h->{'value'} =~ /\bd=([^;,\s]+)/)
3940100TFif (@dkim_domains)
3944100TFif ($self->_provider_abuse_for_host($d))
397850TFif $self->{'provider_abuse'}{$host}
3979100TFif $PROVIDER_ABUSE{$host}
4000100TFif $rdns
4028100TFunless $host and $host =~ /\./
403150TFif ($HAS_PUBLIC_SUFFIX)
40340TFif $root
4039100TFif @labels <= 2
4042100TFif ($labels[-1] =~ /^[a-z]{2}$/ and $labels[-2] =~ /^(?:co|com|net|org|gov|edu|ac|me)$/)
4098100TFif $h->{'name'} eq lc $name
4118100TFunless $cidr =~ m[/]
4120100TFunless defined $prefix and $prefix =~ /^\d+$/ and $prefix <= 32
4143100TFunless defined $str
4161100TFif (uc $enc eq 'B') { }
4185100TFunless $str
4191100TFif ($str =~ /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.\d+)?Z$/)
420550TFif defined $epoch
4209100TFif ($str =~ /^(\d{4})-(\d{2})-(\d{2})/) { }
100TFelsif ($str =~ /^(\d{2})-([A-Za-z]{3})-(\d{4})/) { }
100TFelsif ($str =~ m[^(\d{2})/(\d{2})/(\d{4})]) { }
4213100TFunless $y and $m and $d
421550TFif (eval {         do {         require Time::Local; 1 } })
423850TFunless $str
424150TFif ($str =~ /(\d{1,2})\s+([A-Za-z]{3})\s+(\d{4})\s+(\d{2}):(\d{2}):(\d{2})/)
424450TFunless $m
424550TFif (eval {         do {         require Time::Local; 1 } })
4289100TFif ($self->{'verbose'})
429050TFif (my $logger = $self->{'logger'}) { }