Package: mail-parser
mail-parsermail-parser is not only a wrapper foremailPython Standard Library.
It give you an easy way to pass from raw mail to Python object that you can use in your code.
It's the key module ofSpamScope.mail-parser can parse Outlook email format (.msg). To use this feature, you need to installlibemail-outlook-message-perlpackage. For Debian based systems:$ apt-get install libemail-outlook-message-perlFor more details:$ apt-cache show libemail-outlook-message-perlmail-parser supports Python 3.Apache 2 Open Source Licensemail-parser can be downloaded, used, and modified free of charge. It is available under the Apache 2 license.If you want support the project:mail-parser on WebSplunk appFreeBSD portArch User RepositoryDescriptionmail-parser takes as input a raw email and generates a parsed object. The properties of this object are the same name ofRFC headers:bccccdatedelivered_tofrom_ (notfrombecause is a keyword of Python)message_idreceivedreply_tosubjecttoThere are other properties to get:bodybody htmlbody plainheadersattachmentssender IP addressto domainstimezoneTheattachmentsproperty is a list of objects. Every object has the following keys:binary: it's true if the attachment is a binarycharsetcontent_transfer_encodingcontent-dispositioncontent-idfilenamemail_content_typepayload: attachment payload in base64To get custom headers you should replace "-" with "_".
Example for headerX-MSMail-Priority:$ mail.X_MSMail_PriorityThereceivedheader is parsed and splitted in hop. The fields supported are:bydatedate_utcdelay (between two hop)envelope_fromenvelope_senderforfromhopwithmail-parser can detect defect in mail:defects: mail with some not compliance RFC partAll properties have a JSON and raw property that you can get with:name_jsonname_rawExample:$ mail.to (Python object)
$ mail.to_json (JSON)
$ mail.to_raw (raw header)The command line tool use the JSON format.DefectsThese defects can be used to evade the antispam filter. An example are the mails with a malformed boundary that can hide a not legitimate epilogue (often malware).
This library can take these epilogues.AuthorsMain AuthorFedele Mantuano:LinkedInInstallationClone repositorygit clone https://github.com/SpamScope/mail-parser.gitand install mail-parser withsetup.py:$ cd mail-parser

$ python setup.py installor usepip:$ pip install mail-parserUsage in a projectImportmailparsermodule:import mailparser

mail = mailparser.parse_from_bytes(byte_mail)
mail = mailparser.parse_from_file(f)
mail = mailparser.parse_from_file_msg(outlook_mail)
mail = mailparser.parse_from_file_obj(fp)
mail = mailparser.parse_from_string(raw_mail)Then you can get all partsmail.attachments: list of all attachments
mail.body
mail.date: datetime object in UTC
mail.defects: defect RFC not compliance
mail.defects_categories: only defects categories
mail.delivered_to
mail.from_
mail.get_server_ipaddress(trust="my_server_mail_trust")
mail.headers
mail.mail: tokenized mail in a object
mail.message: email.message.Message object
mail.message_as_string: message as string
mail.message_id
mail.received
mail.subject
mail.text_plain: only text plain mail parts in a list
mail.text_html: only text html mail parts in a list
mail.text_not_managed: all not managed text (check the warning logs to find content subtype)
mail.to
mail.to_domains
mail.timezone: returns the timezone, offset from UTC
mail.mail_partial: returns only the mains parts of emailsIt's possible to write the attachments on disk with the method:mail.write_attachments(base_path)Usage from command-lineIf you installed mailparser withpiporsetup.pyyou can use it with command-line.These are all swithes:usage: mailparser [-h] (-f FILE | -s STRING | -k)
                   [-l {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}] [-j] [-b]
                   [-a] [-r] [-t] [-dt] [-m] [-u] [-c] [-d] [-o]
                   [-i Trust mail server string] [-p] [-z] [-v]

Wrapper for email Python Standard Library

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  Raw email file (default: None)
  -s STRING, --string STRING
                        Raw email string (default: None)
  -k, --stdin           Enable parsing from stdin (default: False)
  -l {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}, --log-level {CRITICAL,ERROR,WARNING,INFO,DEBUG,NOTSET}
                        Set log level (default: WARNING)
  -j, --json            Show the JSON of parsed mail (default: False)
  -b, --body            Print the body of mail (default: False)
  -a, --attachments     Print the attachments of mail (default: False)
  -r, --headers         Print the headers of mail (default: False)
  -t, --to              Print the to of mail (default: False)
  -dt, --delivered-to   Print the delivered-to of mail (default: False)
  -m, --from            Print the from of mail (default: False)
  -u, --subject         Print the subject of mail (default: False)
  -c, --receiveds       Print all receiveds of mail (default: False)
  -d, --defects         Print the defects of mail (default: False)
  -o, --outlook         Analyze Outlook msg (default: False)
  -i Trust mail server string, --senderip Trust mail server string
                        Extract a reliable sender IP address heuristically
                        (default: None)
  -p, --mail-hash       Print mail fingerprints without headers (default:
                        False)
  -z, --attachments-hash
                        Print attachments with fingerprints (default: False)
  -sa, --store-attachments
                        Store attachments on disk (default: False)
  -ap ATTACHMENTS_PATH, --attachments-path ATTACHMENTS_PATH
                        Path where store attachments (default: /tmp)
  -v, --version         show program's version number and exit

It takes as input a raw mail and generates a parsed object.Example:$mailparser-fexample_mail-jThis example will show you the tokenized mail in a JSON pretty format.Fromraw mailtoparsed mail.ExceptionsExceptions hierarchy of mail-parser:MailParserError: Base MailParser Exception
|
\── MailParserOutlookError: Raised with Outlook integration errors
|
\── MailParserEnvironmentError: Raised when the environment is not correct
|
\── MailParserOSError: Raised when there is an OS error
|
\── MailParserReceivedParsingError: Raised when a received header cannot be parsed