-- To be called from a Mail (or other email client) rule per incoming message
-- Depends upon:
--   default installation of ClamXav
--   installation of clamd - clamscan performance unacceptable
-- Will tag infected email subject lines with "[**VIRUS** - ClamAV]" 
-- Credits to ClamXav forum members Nichol and DWatson for the original script and contributions

-- WILL NOT RUN AS IS!!!
-- You must replace XXXXXXXXXX below with the path to your clamd.conf file

using terms from application "Mail"
	testing() -- uncomment to test-run from script editor
	on testing()
		set theList to the selection of application "Mail"
		do_viruscheck(theList)
	end testing
	on perform mail action with messages ruleMessages for rule theRule
		do_viruscheck(ruleMessages)
	end perform mail action with messages
	on do_viruscheck(theMessages)
		tell application "Mail"
			repeat with thisMessage in theMessages
				set msgSource to source of thisMessage
				-- display dialog "Message content = " & words 1 thru 20 of msgSource
				tell application "System Events"
					-- get a free name for a temporary file
					set tmpdir to (path to "temp" from user domain as text)
					set tmpnam to "tmp-clamAVscan"
					set tmpfil to tmpdir & tmpnam as text
					-- should usually be ok, but now add counter if file still exists
					set tmp to tmpfil
					set c to 0
					set ok to false
					repeat while (exists file tmpfil)
						set c to c + 1
						set tmpfil to (tmp & c) as text
					end repeat
					-- copy message to temporary file
					set f to (open for access file tmpfil with write permission)
					set eof of f to 0 -- overwrite file
					write msgSource to f as string
					close access f
				end tell
				
				try
					set commandline to "/usr/local/clamXav/bin/clamdscan --quiet --stdout --config-file=/XXXXXXXXXX/clamd.conf  " & POSIX path of file tmpfil
					-- display dialog "Clamd command line = " & commandline
					do shell script commandline
				on error errMsg number exitCode
					if (exitCode = 1) then
						set currentSubject to subject of thisMessage
						set subject of thisMessage to "[**VIRUS** - ClamAV] " & currentSubject
						-- set junk mail status of thisMessage to true
						-- set accountName to name of account of mailbox of thisMessage
						-- set mailbox of thisMessage to mailbox "Junk" of account accountName
					else
						-- ?? should we add something to the subject to say clamscan had trouble?
						display dialog "Clamd error: Exit Code = " & exitCode & ", Message = " & errMsg
						-- if user cancels script here, the temporary file will not be removed
					end if
				end try
				
				-- clean up temporary file
				tell application "System Events" to delete file tmpfil
			end repeat
		end tell
	end do_viruscheck
end using terms from