过滤 AWS 资源访问验证成功通知

aws-email-check/tests/test_extraction.py

@@ -83,8 +83,91 @@ class ExtractionTests(unittest.TestCase):
         )
         self.assertEqual(record["type"], "账户验证或暂停")
 
-    def test_local_forwarded_login_code_is_filtered(self):
-        self.assertIsNone(sample("*.eml", "过滤邮件"))
+    def test_local_forwarded_login_code_is_filtered(self):
+        self.assertIsNone(sample("*FW__*.eml", "过滤邮件"))
+
+    def test_local_forwarded_access_validated_notice_is_filtered(self):
+        self.assertIsNone(sample("*Resources_Has_Been_Validated.eml", "过滤邮件"))
+
+    def test_access_validated_notices_are_filtered(self):
+        cases = [
+            ("您访问 AWS 资源的请求已得到验证", "您的 AWS 资源访问请求已完成核验，现在可以访问资源。", False),
+            ("AWS: Your Request For Accessing AWS Resources Has Been Validated",
+             "The request is complete. You may access AWS resources.", False),
+            ("Fw: 您访问 AWS 资源的请求已得到验证 / "
+             "Your Request For Accessing AWS Resources Has Been Validated",
+             "AWS 资源访问现已恢复。如果您有任何问题，请联系支持。", False),
+            ("Fwd: AWS notification", "Forwarded message:\nSubject: Your Request For Accessing "
+             "AWS Resources Has Been Validated\nYou may access resources again.", False),
+            ("FW: AWS notification", "<div>Your Request For Accessing</div><p>AWS Resources "
+             "Has Been Successfully Validated</p><p>You may access AWS resources.</p>", True),
+            ("Fw: AWS 通知", "<p>您访问 AWS 资源的请求已得到验证</p><p>现在可以访问资源。</p>", True),
+        ]
+        for subject, body, rich in cases:
+            with self.subTest(subject=subject, rich=rich):
+                self.assertIsNone(synthetic(subject, body, rich))
+
+    def test_success_notice_does_not_hide_actual_risk_or_required_documents(self):
+        success = "Your Request For Accessing AWS Resources Has Been Validated"
+        risks = [
+            "Your AWS account has been suspended.",
+            "Your AWS account is restricted.",
+            "Your AWS account is disabled.",
+            "Your AWS account has been terminated.",
+            "Your AWS account is closed.",
+            "Your access key has been compromised.",
+            "Your AWS resource has been implicated in hosting a phishing website.",
+            "We detected potentially unwanted activity in your AWS account.",
+            "Please upload your identity documents.",
+            "If you fail to respond, your account will be suspended.",
+            "您的 AWS 账户已受限。",
+            "您的账户已暂停。请提交身份证明材料。",
+        ]
+        for body in risks:
+            with self.subTest(body=body):
+                self.assertIsNotNone(synthetic(success, body))
+        for subject in ("AWS Abuse Report", "AWS Suspicious Activity", "AWS Account Permanent Closure Confirmation"):
+            with self.subTest(subject=subject):
+                self.assertIsNotNone(synthetic(subject, success))
+
+    def test_other_validation_notices_remain_reported(self):
+        cases = [
+            ("AWS Identity Validated", "Contact support regarding your identity verification."),
+            ("AWS 验证您的身份", "请上传身份证核验材料。"),
+            ("Your Request For Accessing AWS Resources Has Not Been Validated",
+             "We could not validate important details. Please upload proof of identity."),
+            ("AWS notification", "Your Request For Accessing AWS Resources Has Been Validated? "
+             "Your account has been placed on hold."),
+        ]
+        for subject, body in cases:
+            with self.subTest(subject=subject):
+                self.assertIsNotNone(synthetic(subject, body))
+
+    def test_access_success_keeps_explicit_resource_risk_actions(self):
+        subject = "Your Request For Accessing AWS Resources Has Been Validated"
+        cases = [
+            "Please take action immediately to remove phishing content from your AWS resource.",
+            "Please delete malicious content hosted on your AWS resource.",
+            "You must stop abusive traffic from your AWS resource.",
+            "请立即删除您的 AWS 资源上的钓鱼内容。",
+            "必须停止 AWS 资源上的滥用行为。",
+        ]
+        for body in cases:
+            with self.subTest(body=body):
+                self.assertIsNotNone(synthetic(subject, body))
+
+    def test_access_success_security_tips_are_still_filtered(self):
+        subject = "Your Request For Accessing AWS Resources Has Been Validated"
+        cases = [
+            "If you find phishing content, please remove phishing content from your AWS resource.",
+            "If you have questions, please take action to contact AWS support.",
+            "如果您发现钓鱼内容，请立即删除 AWS 资源上的钓鱼内容。",
+            "如果您有任何问题，请联系支持团队。",
+            "Please contact AWS support if you need help accessing resources.",
+        ]
+        for body in cases:
+            with self.subTest(body=body):
+                self.assertIsNone(synthetic(subject, body))
 
     def test_login_codes_with_security_boilerplate_are_filtered(self):
         cases = [