From ae74714f38ff1184b90392d4ef6ac3da0177ddd5 Mon Sep 17 00:00:00 2001
From: MDLeom <2809763-curben@users.noreply.gitlab.com>
Date: Sun, 23 Mar 2025 03:25:26 +0000
Subject: [PATCH] fix(clean_url): extract domain from sophos

closes #92
---
 src/clean_url.js | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/clean_url.js b/src/clean_url.js
index b6b1ed01..aff6ccff 100644
--- a/src/clean_url.js
+++ b/src/clean_url.js
@@ -39,11 +39,14 @@ for await (const line of createInterface({ input: process.stdin, terminal: false
     if (URL.canParse(line)) {
       let url = new URL(line)
 
-      // Decode O365 Safelinks
-      // https://support.microsoft.com/en-us/office/advanced-outlook-com-security-for-microsoft-365-subscribers-882d2243-eab9-4545-a58a-b36fee4a46e2
+      // O365 Safelinks
       if (url.hostname.endsWith('safelinks.protection.outlook.com')) {
         url = new URL(url.searchParams.get('url'))
       }
+      // #92
+      if (url.hostname.endsWith('.protection.sophos.com')) {
+        url = new URL(`http://${url.searchParams.get('d')}`)
+      }
 
       url.host = url.host.replace(/^www\./, '')