SpamScope

mail-parser

Overview

mail-parser is not only a wrapper for email Python Standard Library. It give you an easy way to pass from raw mail to Python object that you can use in your code. It's the key module of SpamScope.

mail-parser can parse Outlook email format (.msg). To use this feature, you need to install libemail-outlook-message-perl package. For Debian based systems:

$ apt-get install libemail-outlook-message-perl

For more details:

$ apt-cache show libemail-outlook-message-perl

mail-parser supports Python 3.

mail-parser on Web

Description

mail-parser takes as input a raw email and generates a parsed object. The properties of this object are the same name of RFC headers:

bcc
cc
date
delivered_to
from_ (not from because is a keyword of Python)
message_id
received
reply_to
subject
to

There are other properties to get:

body
body html
body plain
headers
attachments
sender IP address
to domains
timezone

The attachments property is a list of objects. Every object has the following keys:

binary: it's true if the attachment is a binary
charset
content_transfer_encoding
content-disposition
content-id
filename
mail_content_type
payload: attachment payload in base64

To get custom headers you should replace "-" with "_". Example for header X-MSMail-Priority:

$ mail.X_MSMail_Priority

The received header is parsed and splitted in hop. The fields supported are:

by
date
date_utc
delay (between two hop)
envelope_from
envelope_sender
for
from
hop
with

mail-parser can detect defect in mail:

defects: mail with some not compliance RFC part

All properties have a JSON and raw property that you can get with:

name_json
name_raw

Example:

$ mail.to (Python object)
$ mail.to_json (JSON)
$ mail.to_raw (raw header)

The command line tool use the JSON format.

Defects

These defects can be used to evade the antispam filter. An example are the mails with a malformed boundary that can hide a not legitimate epilogue (often malware). This library can take these epilogues.

Apache 2 Open Source License

mail-parser can be downloaded, used, and modified free of charge. It is available under the Apache 2 license.

If you want support the project:

Authors

Main Author

Fedele Mantuano: LinkedIn

Installation

Clone repository

git clone https://github.com/SpamScope/mail-parser.git

and install mail-parser with setup.py:

$ cd mail-parser

$ python setup.py install

or use pip:

$ pip install mail-parser

Usage in a project

Import mailparser module:

import mailparser

mail = mailparser.parse_from_bytes(byte_mail)
mail = mailparser.parse_from_file(f)
mail = mailparser.parse_from_file_msg(outlook_mail)
mail = mailparser.parse_from_file_obj(fp)
mail = mailparser.parse_from_string(raw_mail)

Then you can get all parts

mail.attachments: list of all attachments
mail.body
mail.date: datetime object in UTC
mail.defects: defect RFC not compliance
mail.defects_categories: only defects categories
mail.delivered_to
mail.from_
mail.get_server_ipaddress(trust="my_server_mail_trust")
mail.headers
mail.mail: tokenized mail in a object
mail.message: email.message.Message object
mail.message_as_string: message as string
mail.message_id
mail.received
mail.subject
mail.text_plain: only text plain mail parts in a list
mail.text_html: only text html mail parts in a list
mail.text_not_managed: all not managed text (check the warning logs to find content subtype)
mail.to
mail.to_domains
mail.timezone: returns the timezone, offset from UTC
mail.mail_partial: returns only the mains parts of emails

It's possible to write the attachments on disk with the method:

mail.write_attachments(base_path)

Usage from command-line

If you installed mailparser with pip or setup.py you can use it with command-line.

These are all swithes:

usage: mailparser [-h] (-f FILE | -s STRING | -k)
                   [-l {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}] [-j] [-b]
                   [-a] [-r] [-t] [-dt] [-m] [-u] [-c] [-d] [-o]
                   [-i Trust mail server string] [-p] [-z] [-v]

Wrapper for email Python Standard Library

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Raw email file (default: None)
  -s STRING, --string STRING
                        Raw email string (default: None)
  -k, --stdin           Enable parsing from stdin (default: False)
  -l {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}, --log-level {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}                                                                                          
                        Set log level (default: WARNING)
  -j, --json            Show the JSON of parsed mail (default: False)
  -b, --body            Print the body of mail (default: False)
  -a, --attachments     Print the attachments of mail (default: False)
  -r, --headers         Print the headers of mail (default: False)
  -t, --to              Print the to of mail (default: False)
  -dt, --delivered-to   Print the delivered-to of mail (default: False)
  -m, --from            Print the from of mail (default: False)
  -u, --subject         Print the subject of mail (default: False)
  -c, --receiveds       Print all receiveds of mail (default: False)
  -d, --defects         Print the defects of mail (default: False)
  -o, --outlook         Analyze Outlook msg (default: False)
  -i Trust mail server string, --senderip Trust mail server string
                        Extract a reliable sender IP address heuristically
                        (default: None)
  -p, --mail-hash       Print mail fingerprints without headers (default:
                        False)
  -z, --attachments-hash
                        Print attachments with fingerprints (default: False)
  -sa, --store-attachments
                        Store attachments on disk (default: False)
  -ap ATTACHMENTS_PATH, --attachments-path ATTACHMENTS_PATH
                        Path where store attachments (default: /tmp)
  -v, --version         show program's version number and exit

It takes as input a raw mail and generates a parsed object.

Example:

$ mailparser -f example_mail -j

This example will show you the tokenized mail in a JSON pretty format.

From raw mail to parsed mail.

Exceptions

Exceptions hierarchy of mail-parser:

MailParserError: Base MailParser Exception
|
\── MailParserOutlookError: Raised with Outlook integration errors
|
\── MailParserEnvironmentError: Raised when the environment is not correct
|
\── MailParserOSError: Raised when there is an OS error
|
\── MailParserReceivedParsingError: Raised when a received header cannot be parsed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

mail-parser-3.12.0.tar.gz (16.8 kB view details)

Uploaded Jan 27, 2020 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

mail_parser-3.12.0-py3-none-any.whl (25.2 kB view details)

Uploaded Jan 27, 2020 Python 3

File details

Details for the file mail-parser-3.12.0.tar.gz.

File metadata

Download URL: mail-parser-3.12.0.tar.gz
Upload date: Jan 27, 2020
Size: 16.8 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/1.15.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.0.1 requests-toolbelt/0.9.1 tqdm/4.41.1 CPython/3.7.3rc1

File hashes

Hashes for mail-parser-3.12.0.tar.gz
Algorithm	Hash digest
SHA256	`e8ff4ac4b27d4a0a87fe69cdaca9a9123f9662b28991b3b838e449a779345214`
MD5	`c56e3879b900dfb3e7e6e0b20f4554cf`
BLAKE2b-256	`218d50ce414921deb761cf29e148cfe606587cdb041ede06c06390600e467496`

See more details on using hashes here.

File details

Details for the file mail_parser-3.12.0-py3-none-any.whl.

File metadata

Download URL: mail_parser-3.12.0-py3-none-any.whl
Upload date: Jan 27, 2020
Size: 25.2 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/1.15.0 pkginfo/1.5.0.1 requests/2.22.0 setuptools/41.0.1 requests-toolbelt/0.9.1 tqdm/4.41.1 CPython/3.7.3rc1

File hashes

Hashes for mail_parser-3.12.0-py3-none-any.whl
Algorithm	Hash digest
SHA256	`b948e2905ae1f8823b2b2b3acaca8595d959cf73ca89e2bc86220b895f7af4d2`
MD5	`1ee6690c50678e9bedc49a2a9496ad6d`
BLAKE2b-256	`a9e9d8c5df0f799b025e7eaf1282d099d7a07cbb4bfcd11e3669fc69ff1d4fb5`