type.inbound
and any(attachments,
(
.file_extension == "svg"
or .content_type in ("image/svg+xml")
or .file_type == "svg"
)
and any(file.explode(.), any(.scan.xml.tags, . == "a"))
and regex.icontains(file.parse_text(., encodings=["ascii", "utf8"]).text,
'cursor\s*=\s*["\x27]pointer'
)
)
Playground
Test against your own EMLs or sample data.