过滤 AWS 资源访问验证成功通知

aws-email-check/tests/test_extraction.py

@@ -83,8 +83,91 @@ class ExtractionTests(unittest.TestCase):
         )
         self.assertEqual(record["type"], "账户验证或暂停")
 
-    def test_local_forwarded_login_code_is_filtered(self):
-        self.assertIsNone(sample("*.eml", "过滤邮件"))
+    def test_local_forwarded_login_code_is_filtered(self):
+        self.assertIsNone(sample("*FW__*.eml", "过滤邮件"))
+
+    def test_local_forwarded_access_validated_notice_is_filtered(self):
+        self.assertIsNone(sample("*Resources_Has_Been_Validated.eml", "过滤邮件"))
+
+    def test_access_validated_notices_are_filtered(self):
+        cases = [
+            ("您访问 AWS 资源的请求已得到验证", "您的 AWS 资源访问请求已完成核验，现在可以访问资源。", False),
+            ("AWS: Your Request For Accessing AWS Resources Has Been Validated",
+             "The request is complete. You may access AWS resources.", False),
+            ("Fw: 您访问 AWS 资源的请求已得到验证 / "
+             "Your Request For Accessing AWS Resources Has Been Validated",
+             "AWS 资源访问现已恢复。如果您有任何问题，请联系支持。", False),
+            ("Fwd: AWS notification", "Forwarded message:\nSubject: Your Request For Accessing "
+             "AWS Resources Has Been Validated\nYou may access resources again.", False),
+            ("FW: AWS notification", "<div>Your Request For Accessing</div><p>AWS Resources "
+             "Has Been Successfully Validated</p><p>You may access AWS resources.</p>", True),
+            ("Fw: AWS 通知", "<p>您访问 AWS 资源的请求已得到验证</p><p>现在可以访问资源。</p>", True),
+        ]
+        for subject, body, rich in cases:
+            with self.subTest(subject=subject, rich=rich):
+                self.assertIsNone(synthetic(subject, body, rich))
+
+    def test_success_notice_does_not_hide_actual_risk_or_required_documents(self):
+        success = "Your Request For Accessing AWS Resources Has Been Validated"
+        risks = [
+            "Your AWS account has been suspended.",
+            "Your AWS account is restricted.",
+            "Your AWS account is disabled.",
+            "Your AWS account has been terminated.",
+            "Your AWS account is closed.",
+            "Your access key has been compromised.",
+            "Your AWS resource has been implicated in hosting a phishing website.",
+            "We detected potentially unwanted activity in your AWS account.",
+            "Please upload your identity documents.",
+            "If you fail to respond, your account will be suspended.",
+            "您的 AWS 账户已受限。",
+            "您的账户已暂停。请提交身份证明材料。",
+        ]
+        for body in risks:
+            with self.subTest(body=body):
+                self.assertIsNotNone(synthetic(success, body))
+        for subject in ("AWS Abuse Report", "AWS Suspicious Activity", "AWS Account Permanent Closure Confirmation"):
+            with self.subTest(subject=subject):
+                self.assertIsNotNone(synthetic(subject, success))
+
+    def test_other_validation_notices_remain_reported(self):
+        cases = [
+            ("AWS Identity Validated", "Contact support regarding your identity verification."),
+            ("AWS 验证您的身份", "请上传身份证核验材料。"),
+            ("Your Request For Accessing AWS Resources Has Not Been Validated",
+             "We could not validate important details. Please upload proof of identity."),
+            ("AWS notification", "Your Request For Accessing AWS Resources Has Been Validated? "
+             "Your account has been placed on hold."),
+        ]
+        for subject, body in cases:
+            with self.subTest(subject=subject):
+                self.assertIsNotNone(synthetic(subject, body))
+
+    def test_access_success_keeps_explicit_resource_risk_actions(self):
+        subject = "Your Request For Accessing AWS Resources Has Been Validated"
+        cases = [
+            "Please take action immediately to remove phishing content from your AWS resource.",
+            "Please delete malicious content hosted on your AWS resource.",
+            "You must stop abusive traffic from your AWS resource.",
+            "请立即删除您的 AWS 资源上的钓鱼内容。",
+            "必须停止 AWS 资源上的滥用行为。",
+        ]
+        for body in cases:
+            with self.subTest(body=body):
+                self.assertIsNotNone(synthetic(subject, body))
+
+    def test_access_success_security_tips_are_still_filtered(self):
+        subject = "Your Request For Accessing AWS Resources Has Been Validated"
+        cases = [
+            "If you find phishing content, please remove phishing content from your AWS resource.",
+            "If you have questions, please take action to contact AWS support.",
+            "如果您发现钓鱼内容，请立即删除 AWS 资源上的钓鱼内容。",
+            "如果您有任何问题，请联系支持团队。",
+            "Please contact AWS support if you need help accessing resources.",
+        ]
+        for body in cases:
+            with self.subTest(body=body):
+                self.assertIsNone(synthetic(subject, body))
 
     def test_login_codes_with_security_boilerplate_are_filtered(self):
         cases = [

aws-email-check/tests/test_replay.py

@@ -204,6 +204,38 @@ class ReplayTests(unittest.TestCase):
         self.assertEqual(after["report_history"], before["report_history"])
         self.assertEqual(self.run_main("--replay-last"), first)
 
+    def test_filtered_access_validated_notice_is_deduplicated_without_history(self):
+        mail = EmailMessage()
+        mail["Subject"] = "Fw: Your Request For Accessing AWS Resources Has Been Validated"
+        mail["Message-ID"] = "<validated-42@example.com>"
+        mail.set_content("Your AWS resource-access request has completed verification.")
+        fake = FakeIMAP(mail.as_bytes())
+        with patch.object(check_mail.imaplib, "IMAP4_SSL", return_value=fake):
+            self.assertEqual(self.run_main(), check_mail.NO_NEW + "\n")
+            self.assertEqual(self.run_main(), check_mail.NO_NEW + "\n")
+        self.assertEqual(fake.fetches, 1)
+        state = json.loads(self.state.read_text(encoding="utf-8"))
+        entry = next(iter(state["mailboxes"].values()))
+        self.assertEqual(entry["uids"], ["42"])
+        self.assertEqual(entry["message_ids"], ["<validated-42@example.com>"])
+        self.assertNotIn("report_history", state)
+        self.assertNotIn("last_report", state)
+
+    def test_filtered_access_validated_notice_preserves_previous_report(self):
+        with patch.object(check_mail.imaplib, "IMAP4_SSL", return_value=self.fake):
+            first = self.run_main()
+        before = json.loads(self.state.read_text(encoding="utf-8"))
+        mail = EmailMessage()
+        mail["Subject"] = "Fw: 您访问 AWS 资源的请求已得到验证"
+        mail["Message-ID"] = "<validated-43@example.com>"
+        mail.set_content("<p>现在可以访问 AWS 资源。</p>", subtype="html")
+        with patch.object(check_mail.imaplib, "IMAP4_SSL", return_value=FakeIMAP(mail.as_bytes(), uid=b"43")):
+            self.assertEqual(self.run_main(), check_mail.NO_NEW + "\n")
+        after = json.loads(self.state.read_text(encoding="utf-8"))
+        self.assertEqual(after["report_history"], before["report_history"])
+        self.assertEqual(after["last_report"], before["last_report"])
+        self.assertEqual(self.run_main("--replay-last"), first)
+
 
 if __name__ == "__main__":
     unittest.main()