search

nodemailer / mailparser

Decode mime formatted e-mails
Other
1.56k stars 279 forks source link

Latest Mail Parser leading to incorrect parsing (2.7.7) #249

Closed mgarf closed 4 years ago

mgarf commented 4 years ago 
 --xYzZY
Content-Disposition: form-data; name="dkim"

{@<removed>.onmicrosoft.com : pass}
--xYzZY
Content-Disposition: form-data; name="subject"

--xYzZY
Content-Disposition: form-data; name="email"

Received: by <removed>.sendgrid.net with SMTP id FYcWbsrNha Sun, 29 Dec 2019 00:38:16 +0000 (UTC)
Received: from <removed>.outlook.com (mail-b<removed>.outlook.com [<removed>]) by <removed>.sendgrid.net (Postfix) with ESMTPS id 6C406A816DE for <<removed>@<removed>.com>; Sun, 29 Dec 2019 00:38:16 +0000 (UTC)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eJiGraw2kzjJRK6o2FHaNPpUNeqT3VKcYP5dFWvSDaowyxkw9LmtANX2hv7nLTWDFDaTUCrdRMvdtOJu6KO6PUYlfnww1JBdKj0PzAQO2nfqJguZ08Z4yIXsVHaoMzM0JpoEhlxyau5bxJC9sKniy144dOINq6mebpU5aKZx/zeK0frluP0M3ex3or6gRY9haunUSP//NvCeiN6HHVlVcGCAFwHV8Yl5U8pqm1nrFp2wlCzRMTDG2RsbZ+MmpUAeYwx7uMG6SiLXG1a0RAt71pTzkk1171TeG1NiJe3ytLCA3LK2OE0Kn+EBMFwl4EH2aqL3csnIVRD3gGSdHuAaOA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=edXw1uonrmyjsk3KByrMq3t6sfs15LsC7A2wN91MsLaBHgpGgOKV9uuM5TEr7fhxMUSc/W+EOC39Rks/ZnkMW3jcnJooW1V1amOAQwOd5IBIx/rm3RdXKmH/xw80BtJFZu2txSS/MUUVAVBcZSOFdRo+4bHgaAZysNMd5a223DYbz18Q74GwiNlhJSYygv9VSaLI4JbMYJq1VJXolv7fFC7c1NI5VE/N7e72oE8BVRY4iIl1LeThWl/JiR8eolIbRjiqvcDqIY0q6SFq2EOAFcBriCqwbgf8WC02Pc7Np3dHM/Yr3ciNXRqgeiV5eLRdiW8ha9c/mXPW4sgUMyA4tw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=<removed>.com; dmarc=pass action=none header.from=<removed>.com; dkim=pass header.d=<removed>.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=<removed>.onmicrosoft.com; s=selector2-superherocontractors-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=DmgP46NFuSrs7vh0W75xb7p5UDWiVTfLx+K+jmhhlNuuj9w7u+BFfrrUJhIyZ0rVmujtIg5JcreKq1aLnbV9mynLh1/PVhztMDy/+DXd3LFF7jPu3VtKfrmDjCh2z32kZozvH/LnM3rpeFA7+qCiWitgvM3r1+acgLt+94Kqs6g=
Received: from <removed>.com (<removed>) by <removed>.com (<removed>) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11; Sun, 29 Dec 2019 00:38:15 +0000
Received: from <removed>.com ([fe80::405f:a9f3:5167:4f55]) by <removed>.com ([fe80::405f:a9f3:5167:4f55%12]) with mapi id 15.20.2581.007; Sun, 29 Dec 2019 00:38:14 +0000
Received: from DGVANC (<removed>) by <removed>.com (2603:10b6:208:238::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11 via Frontend Transport; Sun, 29 Dec 2019 00:38:14 +0000
From: Superhero Contractors Messenger <<removed>@<removed>.com>
To: "<removed>@<removed>.com" <<removed>@<removed>.com>
Subject:
Thread-Index: AQHVveBBdZXlxvYBlU6/AaoWc3CbJA==
Date: Sun, 29 Dec 2019 00:38:14 +0000
Message-ID: <<removed>@<removed>.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-clientproxiedby: <removed>.outlook.com (2603:10b6:208:238::32) To <removed>.com (2603:10b6:320:23::20)
authentication-results: spf=none (sender IP is ) smtp.mailfrom=<removed>@<removed>.com; 
x-ms-exchange-messagesentrepresentingtype: 1
x-originating-ip: [209.59.181.209]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: <removed>
x-ms-traffictypediagnostic: <removed>:
x-microsoft-antispam-prvs: <<removed>@<removed>.com>
x-ms-oob-tlc-oobclassifiers: OLM:1728;
x-forefront-prvs: 0266491E90
x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(366004)(136003)(376002)(396003)(42606007)(39840400004)(199004)(189003)(316002)(6916009)(508600001)(26005)(186003)(16526019)(956004)(52536014)(52116002)(5660300002)(6496006)(5406001)(86362001)(6486002)(9686003)(2906002)(66946007)(558084003)(66446008)(33656002)(66476007)(71200400001)(64756008)(66556008)(81156014)(8936002)(81166006);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR15MB1407;H:MWHPR15MB1230.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;
received-spf: None (protection.outlook.com: <removed>.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: <removed>
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <<removed>@<removed>>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: <removed>
X-MS-Exchange-CrossTenant-Network-Message-Id: <removed>
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Dec 2019 00:38:14.8163 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: <removed>
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: <removed>
X-MS-Exchange-Transport-CrossTenantHeadersStamped: <removed>

<removed>

--xYzZY
Content-Disposition: form-data; name="to"

"<removed>@<removed>.com" <removed>@<removed>.com>
--xYzZY
Content-Disposition: form-data; name="spam_score"

0
--xYzZY
Content-Disposition: form-data; name="from"

<removed>
--xYzZY
Content-Disposition: form-data; name="sender_ip"

<removed>
--xYzZY
Content-Disposition: form-data; name="spam_report"

Spam detection software, running on the system "<removed>", has
identified this incoming email as possible spam.  The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email.  If you have any questions, see
@@CONTACT_ADDRESS@@ for details.

Content preview:  <removed> [...] 

Content analysis details:   (0.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------

--xYzZY
Content-Disposition: form-data; name="envelope"

{"to":["<removed>@<removed>.com"],"from":"<removed>@<removed>.com"}
--xYzZY
Content-Disposition: form-data; name="charsets"

{"to":"UTF-8","subject":"UTF-8","from":"UTF-8"}
--xYzZY
Content-Disposition: form-data; name="SPF"

pass
--xYzZY--

after looping through the nested attachments led to:

{"attachments":[],"headers":{},"headerLines":[{"key":"","line":""}],"text":"--xYzZY\nContent-Disposition: form-data; name=\"email\"\n\nReceived: by <removed>.sendgrid.net with SMTP id FYcWbsrNha Sun, 29 Dec 2019 00:38:16 +0000 (UTC)\nReceived: from <removed>.outlook.com (<removed>.outlook.com [40.107.92.135]) by <removed>.sendgrid.net (Postfix) with ESMTPS id 6C406A816DE for <<removed>@<removed>.com>; Sun, 29 Dec 2019 00:38:16 +0000 (UTC)\nARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eJiGraw2kzjJRK6o2FHaNPpUNeqT3VKcYP5dFWvSDaowyxkw9LmtANX2hv7nLTWDFDaTUCrdRMvdtOJu6KO6PUYlfnww1JBdKj0PzAQO2nfqJguZ08Z4yIXsVHaoMzM0JpoEhlxyau5bxJC9sKniy144dOINq6mebpU5aKZx/zeK0frluP0M3ex3or6gRY9haunUSP//NvCeiN6HHVlVcGCAFwHV8Yl5U8pqm1nrFp2wlCzRMTDG2RsbZ+MmpUAeYwx7uMG6SiLXG1a0RAt71pTzkk1171TeG1NiJe3ytLCA3LK2OE0Kn+EBMFwl4EH2aqL3csnIVRD3gGSdHuAaOA==\nARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=edXw1uonrmyjsk3KByrMq3t6sfs15LsC7A2wN91MsLaBHgpGgOKV9uuM5TEr7fhxMUSc/W+EOC39Rks/ZnkMW3jcnJooW1V1amOAQwOd5IBIx/rm3RdXKmH/xw80BtJFZu2txSS/MUUVAVBcZSOFdRo+4bHgaAZysNMd5a223DYbz18Q74GwiNlhJSYygv9VSaLI4JbMYJq1VJXolv7fFC7c1NI5VE/N7e72oE8BVRY4iIl1LeThWl/JiR8eolIbRjiqvcDqIY0q6SFq2EOAFcBriCqwbgf8WC02Pc7Np3dHM/Yr3ciNXRqgeiV5eLRdiW8ha9c/mXPW4sgUMyA4tw==\nARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=<removed>.com; dmarc=pass action=none header.from=<removed>.com; dkim=pass header.d=<removed>.com; arc=none\nDKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=<removed>.onmicrosoft.com; s=selector2-<removed>-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=DmgP46NFuSrs7vh0W75xb7p5UDWiVTfLx+K+jmhhlNuuj9w7u+BFfrrUJhIyZ0rVmujtIg5JcreKq1aLnbV9mynLh1/PVhztMDy/+DXd3LFF7jPu3VtKfrmDjCh2z32kZozvH/LnM3rpeFA7+qCiWitgvM3r1+acgLt+94Kqs6g=\nReceived: from MWHPR15MB1230.namprd15.prod.outlook.com (10.175.2.148) by MWHPR15MB1407.namprd15.prod.outlook.com (10.173.235.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11; Sun, 29 Dec 2019 00:38:15 +0000\nReceived: from <removed>.outlook.com ([fe80::405f:a9f3:5167:4f55]) by <removed>.outlook.com ([fe80::405f:a9f3:5167:4f55%12]) with mapi id 15.20.2581.007; Sun, 29 Dec 2019 00:38:14 +0000\nReceived: from DGVANC (209.59.181.209) by <removed>.outlook.com (2603:10b6:208:238::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11 via Frontend Transport; Sun, 29 Dec 2019 00:38:14 +0000\nFrom: <removed><<removed>@<removed>.com>\nTo: \"<removed>@<removed>.com\" <<removed>@<removed>.com>\nSubject:\nThread-Index: AQHVveBBdZXlxvYBlU6/AaoWc3CbJA==\nDate: Sun, 29 Dec 2019 00:38:14 +0000\nMessage-ID: <<removed>@<removed>.outlook.com>\nAccept-Language: en-US\nContent-Language: en-US\nX-MS-Has-Attach:\nX-MS-TNEF-Correlator:\nx-clientproxiedby: <removed>.outlook.com (2603:10b6:208:238::32) To <removed>outlook.com (2603:10b6:320:23::20)\nauthentication-results: spf=none (sender IP is ) smtp.mailfrom=<removed>@<removed>.com; \nx-ms-exchange-messagesentrepresentingtype: 1\nx-originating-ip: [209.59.181.209]\nx-ms-publictraffictype: Email\nx-ms-office365-filtering-correlation-id: 813547fd-d9f9-4ff6-0f8a-08d78bf763e7\nx-ms-traffictypediagnostic: MWHPR15MB1407:\nx-microsoft-antispam-prvs: <<removed>@<removed>.outlook.com>\nx-ms-oob-tlc-oobclassifiers: OLM:1728;\nx-forefront-prvs: 0266491E90\nx-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(366004)(136003)(376002)(396003)(42606007)(39840400004)(199004)(189003)(316002)(6916009)(508600001)(26005)(186003)(16526019)(956004)(52536014)(52116002)(5660300002)(6496006)(5406001)(86362001)(6486002)(9686003)(2906002)(66946007)(558084003)(66446008)(33656002)(66476007)(71200400001)(64756008)(66556008)(81156014)(8936002)(81166006);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR15MB1407;<removed>.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;\nreceived-spf: None (protection.outlook.com: <removed>.com does not designate permitted sender hosts)\nx-ms-exchange-senderadcheck: 1\nx-microsoft-antispam: BCL:0;\nx-microsoft-antispam-message-info: YhRUi/HAK6eyieYlMSdu8RD4AWJTj9WQWYKrAeBoXOUHFmr1ydGL4pFCoyWBqbDJ0fqZXYzQ/WEfWe3ASWsouctgk7njC/7VZg0hBq7w6aI20v118/i+WFu/dIVZGR/y1twp7XMVuTzwFwT27p1jtDk/lq6Co9uZS2jutD5ravimtH2z3XLnPugOcophG7FGBD8r/vP5nAbdGNRIfgZZXSI/gMPzQ9hc4qPJiWdk5/HRTp8akh/4sbRXDHH9nSd2bjyXSEAZhejbxqDsdA5MCBK5D2o7zBA31BhdzkyQ80KMWbiY9kL/qgSsyzLdSdVl4BHs+9LQ76GCU93YVIkWO0xkJn+JfHY9Dw0McHVp6Qt8bbEXN5rlP+4ft1jsllyNNW9tYeVIKncABJ4M1kg2AIz2u2JmWqEqGDQrFLN1fen08wAIwugGdku/IbRvd2+J\nx-ms-exchange-transport-forked: True\nContent-Type: text/plain; charset=\"us-ascii\"\nContent-ID: <<removed>@<removed>.outlook.com>\nContent-Transfer-Encoding: quoted-printable\nMIME-Version: 1.0\nX-OriginatorOrg: superherocontractors.com\nX-MS-Exchange-CrossTenant-Network-Message-Id: 813547fd-d9f9-4ff6-0f8a-08d78bf763e7\nX-MS-Exchange-CrossTenant-originalarrivaltime: 29 Dec 2019 00:38:14.8163 (UTC)\nX-MS-Exchange-CrossTenant-fromentityheader: Hosted\nX-MS-Exchange-CrossTenant-id: <removed>\nX-MS-Exchange-CrossTenant-mailboxtype: HOSTED\nX-MS-Exchange-CrossTenant-userprincipalname: 93KdEKN6/HaF6wFt9aJxHl9VCFiFPLtLlP+0Ae2a6cLHAbfaBPnBRaVG40ynMvfWKR7iqiXdizQKNhyXh3jnO1W0tMV040vSvagP8bjSKok=\nX-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR15MB1407\n\n<removed>\n\n\n--xYzZY\nContent-Disposition: form-data; name=\"to\"\n\n\"<removed>@<removed>.com\" <<removed>@<removed>.com>\n--xYzZY\nContent-Disposition: form-data; name=\"spam_score\"\n\n0\n--xYzZY\nContent-Disposition: form-data; name=\"from\"\n\n<removed> <<removed>@<removed>.com>\n--xYzZY\nContent-Disposition: form-data; name=\"sender_ip\"\n\n40.107.92.135\n--xYzZY\nContent-Disposition: form-data; name=\"spam_report\"\n\nSpam detection software, running on the system \"<removed>.sendgrid.net\", has\nidentified this incoming email as possible spam.  The original message\nhas been attached to this so you can view it (if it isn't spam) or label\nsimilar future email.  If you have any questions, see\n@@CONTACT_ADDRESS@@ for details.\n\nContent preview: <removed> [...] \n\nContent analysis details:   (0.0 points, 5.0 required)\n\n pts rule name              description\n---- ---------------------- --------------------------------------------------\n\n\n--xYzZY\nContent-Disposition: form-data; name=\"envelope\"\n\n{\"to\":[\"<removed>@<removed>.com\"],\"from\":\"<removed>@<removed>.com\"}\n--xYzZY\nContent-Disposition: form-data; name=\"charsets\"\n\n{\"to\":\"UTF-8\",\"subject\":\"UTF-8\",\"from\":\"UTF-8\"}\n--xYzZY\nContent-Disposition: form-data; name=\"SPF\"\n\npass\n--xYzZY--\n","textAsHtml":"<p>--xYzZY<br/>Content-Disposition: form-data; name=&quot;email&quot;</p><p>Received: by <a href=\"http://<removed>.sendgrid.net\"><removed>.sendgrid.net</a> with SMTP id FYcWbsrNha Sun, 29 Dec 2019 00:38:16 +0000 (UTC)<br/>Received: from <a href=\"http://<removed>.outlook.com\"><removed>.outlook.com</a> (<a href=\"http://<removed>.outlook.com\">mail-<removed>.outlook.com</a> [<a href=\"http://<removed>\"><removed></a>]) by <a href=\"http://<removed>.sendgrid.net\"><removed>.sendgrid.net</a> (Postfix) with ESMTPS id 6C406A816DE for &lt;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&gt;; Sun, 29 Dec 2019 00:38:16 +0000 (UTC)<br/>ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; <a href=\"http://d=microsoft.com\">d=microsoft.com</a>; cv=none; b=eJiGraw2kzjJRK6o2FHaNPpUNeqT3VKcYP5dFWvSDaowyxkw9LmtANX2hv7nLTWDFDaTUCrdRMvdtOJu6KO6PUYlfnww1JBdKj0PzAQO2nfqJguZ08Z4yIXsVHaoMzM0JpoEhlxyau5bxJC9sKniy144dOINq6mebpU5aKZx/zeK0frluP0M3ex3or6gRY9haunUSP//NvCeiN6HHVlVcGCAFwHV8Yl5U8pqm1nrFp2wlCzRMTDG2RsbZ+MmpUAeYwx7uMG6SiLXG1a0RAt71pTzkk1171TeG1NiJe3ytLCA3LK2OE0Kn+EBMFwl4EH2aqL3csnIVRD3gGSdHuAaOA==<br/>ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; <a href=\"http://d=microsoft.com\">d=microsoft.com</a>; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=edXw1uonrmyjsk3KByrMq3t6sfs15LsC7A2wN91MsLaBHgpGgOKV9uuM5TEr7fhxMUSc/W+EOC39Rks/ZnkMW3jcnJooW1V1amOAQwOd5IBIx/rm3RdXKmH/xw80BtJFZu2txSS/MUUVAVBcZSOFdRo+4bHgaAZysNMd5a223DYbz18Q74GwiNlhJSYygv9VSaLI4JbMYJq1VJXolv7fFC7c1NI5VE/N7e72oE8BVRY4iIl1LeThWl/JiR8eolIbRjiqvcDqIY0q6SFq2EOAFcBriCqwbgf8WC02Pc7Np3dHM/Yr3ciNXRqgeiV5eLRdiW8ha9c/mXPW4sgUMyA4tw==<br/>ARC-Authentication-Results: i=1; <a href=\"http://mx.microsoft.com\">mx.microsoft.com</a> 1; spf=pass <a href=\"http://smtp.mailfrom=<removed>.com\">smtp.mailfrom=<removed>.com</a>; dmarc=pass action=none <a href=\"http://header.from=<removed>.com\">header.from=<removed>.com</a>; dkim=pass <a href=\"http://header.d=<removed>.com\">header.d=<removed>.com</a>; arc=none<br/>DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; <a href=\"http://d=<removed>.onmicrosoft.com\">d=<removed>.onmicrosoft.com</a>; s=selector2-<removed>-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5YiamY6w0m7mGnbyTP85FF0VVR/alwVXku2cs+htitU=; b=DmgP46NFuSrs7vh0W75xb7p5UDWiVTfLx+K+jmhhlNuuj9w7u+BFfrrUJhIyZ0rVmujtIg5JcreKq1aLnbV9mynLh1/PVhztMDy/+DXd3LFF7jPu3VtKfrmDjCh2z32kZozvH/LnM3rpeFA7+qCiWitgvM3r1+acgLt+94Kqs6g=<br/>Received: from <a href=\"http://<removed>.outlook.com\"><removed>.outlook.com</a> (<a href=\"http://<removed>\"><removed></a>) by <a href=\"http://<removed>.outlook.com\"><removed>.com</a> (<a href=\"http://<removed>\"><removed></a>) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11; Sun, 29 Dec 2019 00:38:15 +0000<br/>Received: from <a href=\"http://<removed>.outlook.com\"><removed>.outlook.com</a> ([fe80::405f:a9f3:5167:4f55]) by <a href=\"http://<removed>.outlook.com\"><removed>.outlook.com</a> ([fe80::405f:a9f3:5167:4f55%12]) with mapi id 15.20.2581.007; Sun, 29 Dec 2019 00:38:14 +0000<br/>Received: from DGVANC (<a href=\"http://<removed>\"><removed></a>) by <a href=\"http://<removed>.com\"><removed>.outlook.com</a> (2603:10b6:208:238::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2581.11 via Frontend Transport; Sun, 29 Dec 2019 00:38:14 +0000<br/>From: <removed> &lt;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&gt;<br/>To: &quot;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&quot; &lt;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&gt;<br/>Subject:<br/>Thread-Index: AQHVveBBdZXlxvYBlU6/AaoWc3CbJA==<br/>Date: Sun, 29 Dec 2019 00:38:14 +0000<br/>Message-ID: &lt;<a href=\"mailto:<removed>@<removed>.outlook.com\"><removed>@<removed>.outlook.com</a>&gt;<br/>Accept-Language: en-US<br/>Content-Language: en-US<br/>X-MS-Has-Attach:<br/>X-MS-TNEF-Correlator:<br/>x-clientproxiedby: <a href=\"http://<removed>.outlook.com\"><removed>.outlook.com</a> (2603:10b6:208:238::32) To <a href=\"http://<removed>.com\"><removed>.outlook.com</a> (2603:10b6:320:23::20)<br/>authentication-results: spf=none (sender IP is ) <a href=\"mailto:smtp.mailfrom=<removed>@<removed>.com\">smtp.mailfrom=<removed>@<removed>.com</a>;<br/>x-ms-exchange-messagesentrepresentingtype: 1<br/>x-originating-ip: [<a href=\"http://<removed>\"><removed></a>]<br/>x-ms-publictraffictype: Email<br/>x-ms-office365-filtering-correlation-id: 813547fd-d9f9-4ff6-0f8a-08d78bf763e7<br/>x-ms-traffictypediagnostic: <removed>:<br/>x-microsoft-antispam-prvs: &lt;<a href=\"<removed>@<removed>.outlook.com\"><removed>@<removed>.outlook.com</a>&gt;<br/>x-ms-oob-tlc-oobclassifiers: OLM:1728;<br/>x-forefront-prvs: 0266491E90<br/>x-forefront-antispam-report: SFV:NSPM;SFS:(10019020)(346002)(366004)(136003)(376002)(396003)(42606007)(39840400004)(199004)(189003)(316002)(6916009)(508600001)(26005)(186003)(16526019)(956004)(52536014)(52116002)(5660300002)(6496006)(5406001)(86362001)(6486002)(9686003)(2906002)(66946007)(558084003)(66446008)(33656002)(66476007)(71200400001)(64756008)(66556008)(81156014)(8936002)(81166006);DIR:OUT;SFP:1102;SCL:1;SRVR:MWHPR15MB1407;H:MWHPR15MB1230.namprd15.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;A:1;MX:1;<br/>received-spf: None (<a href=\"http://protection.outlook.com\">protection.outlook.com</a>: <a href=\"http://<removed>.com\"><removed>.com</a> does not designate permitted sender hosts)<br/>x-ms-exchange-senderadcheck: 1<br/>x-microsoft-antispam: BCL:0;<br/>x-microsoft-antispam-message-info: YhRUi/HAK6eyieYlMSdu8RD4AWJTj9WQWYKrAeBoXOUHFmr1ydGL4pFCoyWBqbDJ0fqZXYzQ/WEfWe3ASWsouctgk7njC/7VZg0hBq7w6aI20v118/i+WFu/dIVZGR/y1twp7XMVuTzwFwT27p1jtDk/lq6Co9uZS2jutD5ravimtH2z3XLnPugOcophG7FGBD8r/vP5nAbdGNRIfgZZXSI/gMPzQ9hc4qPJiWdk5/HRTp8akh/4sbRXDHH9nSd2bjyXSEAZhejbxqDsdA5MCBK5D2o7zBA31BhdzkyQ80KMWbiY9kL/qgSsyzLdSdVl4BHs+9LQ76GCU93YVIkWO0xkJn+JfHY9Dw0McHVp6Qt8bbEXN5rlP+4ft1jsllyNNW9tYeVIKncABJ4M1kg2AIz2u2JmWqEqGDQrFLN1fen08wAIwugGdku/IbRvd2+J<br/>x-ms-exchange-transport-forked: True<br/>Content-Type: text/plain; charset=&quot;us-ascii&quot;<br/>Content-ID: &lt;<a href=\"<removed>@<removed>.outlook.com\"><removed>@<removed>.outlook.com</a>&gt;<br/>Content-Transfer-Encoding: quoted-printable<br/>MIME-Version: 1.0<br/>X-OriginatorOrg: <a href=\"http://<removed>.com\"><removed>.com</a><br/>X-MS-Exchange-CrossTenant-Network-Message-Id: <removed><br/>X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Dec 2019 00:38:14.8163 (UTC)<br/>X-MS-Exchange-CrossTenant-fromentityheader: Hosted<br/>X-MS-Exchange-CrossTenant-id: <removed><br/>X-MS-Exchange-CrossTenant-mailboxtype: HOSTED<br/>X-MS-Exchange-CrossTenant-userprincipalname: <removed><br/>X-MS-Exchange-Transport-CrossTenantHeadersStamped: <removed></p><p><removed></p><p>--xYzZY<br/>Content-Disposition: form-data; name=&quot;to&quot;</p><p>&quot;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&quot; &lt;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&gt;<br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;spam_score&quot;</p><p>0<br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;from&quot;</p><p>Superhero Contractors Messenger &lt;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&gt;<br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;sender_ip&quot;</p><p><a href=\"http://<removed>\"><removed></a><br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;spam_report&quot;</p><p>Spam detection software, running on the system &quot;<a href=\"http://<removed>.sendgrid.net\"><removed>.sendgrid.net</a>&quot;, has<br/>identified this incoming email as possible spam.  The original message<br/>has been attached to this so you can view it (if it isn&apos;t spam) or label<br/>similar future email.  If you have any questions, see<br/>@@CONTACT_ADDRESS@@ for details.</p><p>Content preview:  <removed> [...]</p><p>Content analysis details:   (0.0 points, 5.0 required)</p><p> pts rule name              description<br/>---- ---------------------- --------------------------------------------------</p><p>--xYzZY<br/>Content-Disposition: form-data; name=&quot;envelope&quot;</p><p>{&quot;to&quot;:[&quot;<a href=\"mailto:<removed>@<removed>.com\"><removed>@<removed>.com</a>&quot;],&quot;<a href=\"mailto:from\":\"<removed>@<removed>.com\">from\":\"<removed>@<removed>.com</a>&quot;}<br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;charsets&quot;</p><p>{&quot;to&quot;:&quot;UTF-8&quot;,&quot;subject&quot;:&quot;UTF-8&quot;,&quot;from&quot;:&quot;UTF-8&quot;}<br/>--xYzZY<br/>Content-Disposition: form-data; name=&quot;SPF&quot;</p><p>pass<br/>--xYzZY--</p>","html":false}
mgarf commented 4 years ago

FIgured it out. The emails were getting their lines stripped out making it impossible to parse especially when there isn't a content type for the body