{"id":17675978,"url":"https://github.com/cardi/proofpoint-url-decoder","last_synced_at":"2026-03-05T22:09:11.777Z","repository":{"id":59633184,"uuid":"51888162","full_name":"cardi/proofpoint-url-decoder","owner":"cardi","description":"tools to mess around with proofpoint URLs","archived":false,"fork":false,"pushed_at":"2024-07-02T19:25:30.000Z","size":96,"stargazers_count":20,"open_issues_count":7,"forks_count":5,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-12T21:46:08.129Z","etag":null,"topics":["cc0","decoder","privacy","proofpoint","proofpoint-urls","python","urldefense"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cardi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-02-17T02:35:41.000Z","updated_at":"2024-12-24T07:42:22.000Z","dependencies_parsed_at":"2023-11-23T09:27:11.781Z","dependency_job_id":"a70ed1c5-7282-4cb4-9587-79e8341cb590","html_url":"https://github.com/cardi/proofpoint-url-decoder","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/cardi/proofpoint-url-decoder","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cardi%2Fproofpoint-url-decoder","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cardi%2Fproofpoint-url-decoder/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cardi%2Fproofpoint-url-decoder/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cardi%2Fproofpoint-url-decoder/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cardi","download_url":"https://codeload.github.com/cardi/proofpoint-url-decoder/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cardi%2Fproofpoint-url-decoder/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30152099,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T21:15:50.531Z","status":"ssl_error","status_checked_at":"2026-03-05T21:15:11.173Z","response_time":93,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cc0","decoder","privacy","proofpoint","proofpoint-urls","python","urldefense"],"created_at":"2024-10-24T07:24:03.869Z","updated_at":"2026-03-05T22:09:11.761Z","avatar_url":"https://github.com/cardi.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# proofpoint-url-decoder\n\n*proofpoint-url-decoder* is a collection of various Python scripts to\nunmangle Proofpoint \"protected\" emails.\n\n## Proofpoint Considered Harmful\n\nSome reasons why Proofpoint is harmful (a non-exhaustive list):\n\n1. Proofpoint makes it **harder** to read email: by mangling URLs, the\n   user can no longer see what the actual URL is and must blindly trust in\n   a third-party.\n\n   * URLs are visibly mangled and filled with garbage when reading email on\n     the command line using `mutt`, `alpine`, or `emacs`.\n\n2. Proofpoint **erodes your privacy**: in addition to someone else\n   scanning your email there are unique identifiers embedded in each\n   mangled URL that tie each URL to an individual user, and Proofpoint will\n   independently *visit* (and possibly even *crawl*) the URL after the user\n   has clicked on it.\n\n## Usage\n\nEach program can be used standalone: pick and use the Python script that\nis most relevant to your use case.\n\nThere are several files of note:\n\n* `decode.py`: reads a URL as an input parameter, outputs a clean URL to `STDOUT`\n\n  Example:\n  ```shell\n  $ set +H   # disable ! history substitution\n  $ ./decode.py \"https://urldefense.com/v3/__http://www.example.com__;!!foo!bar$\"\n  http://www.example.com\n  ```\n* `get_urls.py`: reads as input an email (from `STDIN`), extracts and\n  outputs clean URLs to `STDOUT`\n* `decode_email.py`: reads as input an email (from `STDIN`), and\n  outputs the same email with clean URLs to `STDOUT`\n\n  Example:\n  ```shell\n  $ cat email_message | ./decode_email.py \u003e email_message.cleaned\n  ```\n\n### `decode_email.py`\n\n```\nusage: decode_email.py [-h] [--plaintext] [--preserve-mbox-from]\n\ndecode proofpoint-mangled URLs in emails\n\noptions:\n  -h, --help            show this help message and exit\n  --plaintext, -p       decode URLs in plaintext input (not an email message)\n  --preserve-mbox-from, -m\n                        Preserve the mbox format email separator (From \u003caddr\u003e \u003ctimestamp\u003e) on the first line\n```\n\n## Integrating with Mail Delivery Agents\n\n`decode_email.py` can be integrated with [fdm](#fdm) and [procmail](#procmail)\nto automatically filter and unmangle URLs before being delivered to your inbox.\n\n### fdm\n\nAdd the following rules to your `.fdm.conf`:\n\n```\n# An action to save to the maildir ~/Mail/inbox.\naction \"inbox\" maildir \"%h/Mail/inbox\"\naction \"backup\" maildir \"%h/Mail/backup\"\n\n# Un-mangle ProofPoint URLs\naction \"unmangle\" rewrite \"/path/to/proofpoint-url-decoder/decode_email.py\"\n\n# (optional) keep a backup of all email\nmatch all action \"backup\" continue\n\n# 1. match all mail\n# 2. run the \"unmangle\" action on each message (rewrite URLs)\n# 3. run the \"inbox\" action on the resulting message (deliver to Maildir)\nmatch all action \"unmangle\" continue\nmatch all action \"inbox\"\n```\n\nWatch your log file (`.fdm.log`) for any issues. If you're processing a lot of\nmail at any one time, you may have to configure additional settings in `.fdm.conf`:\nsee `man 5 fdm.conf` for more information.\n\n### procmail\n\nAdd the following rule near the beginning of your `.procmailrc`:\n\n```\n:0 fw\n| /path/to/proofpoint-url-decoder/decode_email.py\n```\n\nYou could match on and filter emails containing the `X-Proofpoint-*` header\n(which would be all emails on systems), but sometimes you will get emails\nforwarded to you that might not have this header and still contain the\nmangled URLs.\n\nIt's a good idea to keep a backup copy of the emails, in case something\nin the processing pipeline goes wrong:\n\n```\n# copy all mail to the \"backup\" Maildir\n:0c\nbackup/\n\n# pipe message through decode_email.py\n:0 fw\n| /path/to/proofpoint-url-decoder/decode_email.py\n\n# write resulting email into \"inbox\" Maildir\n:0:\ninbox/\n```\n\nYou could also run `decode_email.py` on a copy of the email to test its\nfunctionality:\n\n```\n# create a working copy\n:0c\n{\n    # pipe message through decode_email.py\n    :0 fw\n    | /path/to/proofpoint-url-decoder/decode_email.py\n\n    # write resulting email into \"testing\" Maildir\n    :0:\n    testing/\n}\n```\n\n### Tests\n\nThere are some unit tests, with some [library dependencies](./requirements.txt):\n\n```shell\npip install -r requirements.txt\npython3 -v decode_test.py\n```\n\nThere are also some `procmail` tests: see [`procmail/`](procmail/).\n\n## Contributing\n\nFeel free to contribute code or send comments, suggestions, bugs to\n\u003ccalvin@isi.edu\u003e.\n\n## Development Notes and Roadmap\n\nFor now, to keep each script independent, `decode_ppv2()` and\n`decode_ppv3` are duplicated in each script.\n\n## LICENSE\n\n[CC0 1.0 Universal](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcardi%2Fproofpoint-url-decoder","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcardi%2Fproofpoint-url-decoder","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcardi%2Fproofpoint-url-decoder/lists"}