A python cross-platform cli Outlook Safelinks decoder

CLI Outlook Safelinks Decoder.py

#!/usr/bin/env python3
# Usage: ./path_to_script.py 'outlook url 1' 'outlook url 2' ...  
# Returns: <decoded url 1> \n <decoded url 2> ...
# GPL v3 
import re
import base64
import argparse
import urllib.parse

outlook_regex = re.compile(r'https:\/\/\w+\.safelinks\.protection\.outlook\.com\/\?url=((\.?[^&.,:\s]+)*)(&(\.?[-+a-zA-Z0-9%/=;]+)*)*', re.IGNORECASE)
proofpoint_regex = re.compile(r'https://urldefense(?:\.proofpoint)?\.com/(v[0-9])/([.:]?[-+a-zA-Z0-9%&/=;_!?*$]+)+', re.IGNORECASE)
length_codes = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_'

def safelink_decoder(url):
    match = outlook_regex.search(url)
    if not match:
        return url
    return urllib.parse.unquote(match.group(1))

def proofpoint_decoder(url):
    match = proofpoint_regex.search(url)
    if not match:
        return url

    version = match.group(1)
    if version == 'v1':
        v1_pattern = re.compile(r'https://urldefense(?:\.proofpoint)?\.com/v1/url\?u=([^&]*)&k=.*')
        outurl = urllib.parse.unquote(v1_pattern.search(url).group(1))
    elif version == 'v2':
        v2_pattern = re.compile(r'https://urldefense(?:\.proofpoint)?\.com/v2/url\?u=([^&]*)&[dc]=.*')
        url_part = v2_pattern.search(url).group(1).replace('-', '%').replace('_', '/')
        outurl = urllib.parse.unquote(url_part)
    elif version == 'v3':
        v3_pattern = re.compile(r'https://urldefense(?:\.proofpoint)?\.com/v3/__(.+)__;([^\!]*).*')
        v3_token_pattern = re.compile(r'\*(\*.)?')
        url_match = v3_pattern.search(url)
        if not url_match:
            return url

        url_part, encoded = url_match.groups()
        encoded_bytes = base64.b64decode(encoded.replace('_', '/').replace('-', '+'))
        encbytes_off = 0

        def replace_token(chunk):
            nonlocal encbytes_off
            length = 1
            if len(chunk) > 1:
                length = length_codes.index(chunk[1]) + 2
            result = encoded_bytes[encbytes_off:encbytes_off + length].decode('utf-8')
            encbytes_off += length
            return result

        outurl = v3_token_pattern.sub(replace_token, url_part)
    else:
        outurl = url

    return outurl

def decode_url(url):
    decoded_url = safelink_decoder(url)
    if decoded_url == url:
        decoded_url = proofpoint_decoder(url)
    return decoded_url

def main():
    parser = argparse.ArgumentParser(description="Decode obfuscated safelinks.")
    parser.add_argument('urls', metavar='URL', type=str, nargs='+', help='one or more URLs to decode')
    args = parser.parse_args()

    for url in args.urls:
        print(decode_url(url))

if __name__ == "__main__":
    main()