Body: HTML @import tag-splitting XSS — RoundPress/ZimReaper webmail exploit delivery

type.inbound
and (
  // zimreaper payload id... plain text, then the three base64 alignments of `zmb_pl_`
  // base64 is case-sensitive, so the encoded forms use contains
  strings.icontains(body.html.raw, 'zmb_pl_v')
  or strings.contains(body.html.raw, 'em1iX3BsX', 'ptYl9wbF', '6bWJfcGxf')

  // @import tag-splitting... the sanitizer strips `@import ...;` and the browser rejoins
  // the tag, so @import abuts a tag or attribute name
  // legit css @import follows `<style>`, `;`, `}` or whitespace, never a tag/attribute name
  or regex.icontains(body.html.raw,
                     '<@import[\s"'';(/]',
                     '<[a-z][^<>\s]*@import[\s"'';(/]',
                     '[\s"'']/?[a-z][a-z-]*@import[\s"'';(/]'
  )

  // unsplit payload... a hidden svg that decodes base64 on load
  // html attachments are covered by attachment_html_smuggling_eval_atob.yml
  or regex.icontains(body.html.raw,
                     '<svg[^>]{0,200}onload[^=]{0,10}=.{0,30}eval\s*\(\s*atob\s*\('
  )

  // the same markup in an html attachment... keep in sync with the body arms above
  or any(attachments,
         (
           .file_extension in~ ("html", "htm", "shtml", "dhtml")
           or .file_type == "html"
         )
         and (
           strings.icontains(file.parse_html(.).raw, 'zmb_pl_v')
           or strings.contains(file.parse_html(.).raw,
                               'em1iX3BsX',
                               'ptYl9wbF',
                               '6bWJfcGxf'
           )
           or regex.icontains(file.parse_html(.).raw,
                              '<@import[\s"'';(/]',
                              '<[a-z][^<>\s]*@import[\s"'';(/]',
                              '[\s"'']/?[a-z][a-z-]*@import[\s"'';(/]'
           )
         )
  )
)