@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/mail-server-pop3.js

@@ -103,7 +103,7 @@
  */
 
 var net = require("node:net");
-var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var C = require("./constants");
 var bCrypto = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -111,11 +111,12 @@ var validateOpts = require("./validate-opts");
 var guardPop3Command = require("./guard-pop3-command");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var safeSmtp = require("./safe-smtp");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerPop3Error = defineClass("MailServerPop3Error", { alwaysPermanent: true });
 
@@ -229,40 +230,18 @@ function create(opts) {
     }
   }
 
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
-  var tcpServer = null;
-  var listening = false;
   var connections = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action: action,
-        outcome: outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      _emit("mail.server.pop3.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try { rawSocket.write("-ERR Too many connections from your IP\r\n"); }
-      catch (_e) { /* socket may be down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.pop3.rate_limit_refused",
+      refusalLine:  "-ERR Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     var connectionId = "pop3conn-" + bCrypto.generateToken(8);                                       // connection-id length
     var socket = rawSocket;
     connections.add(socket);
@@ -312,7 +291,7 @@ function create(opts) {
     while (true) {
       var crlf = state.lineBuffer.indexOf("\r\n");
       if (crlf === -1) {
-        if (state.lineBuffer.length > maxLineBytes) {
+        if (safeBuffer.byteLengthOf(state.lineBuffer) > maxLineBytes) {
           _writeErr(socket, "Line too long (cap " + maxLineBytes + ")");
           _close(socket);
         }
@@ -398,22 +377,18 @@ function create(opts) {
     // Drain pre-handshake buffer (RFC 2595 §4 + CVE-2021-33515 class
     // STLS-injection defense — any pipelined commands the client
     // queued before the upgrade are discarded; post-TLS reads fresh).
-    // Listener-removal + idle-timeout re-arm live in the shared
-    // upgradeSocket helper (b.mail.server.tls.upgradeSocket).
-    state.lineBuffer = Buffer.alloc(0);
-    // POP3 doesn't have an authPending shape (the SASL state is local
-    // to _handleAuth), but reset tentativeUser so a USER pipelined
-    // pre-handshake cannot bind a post-handshake PASS.
-    state.tentativeUser = null;
-    mailServerTls.upgradeSocket({
-      plainSocket:   socket,
+    // POP3 has no authPending shape (SASL state is local to
+    // _handleAuth), but tentativeUser is reset so a USER pipelined
+    // pre-handshake cannot bind a post-handshake PASS. The shared
+    // upgradeLineProtocol helper owns the lineBuffer drain + listener-
+    // strip + idle re-arm + read-pump.
+    mailServerTls.upgradeLineProtocol({
+      state:         state,
+      socket:        socket,
       secureContext: opts.tlsContext,
       idleTimeoutMs: idleTimeoutMs,
-      onSecure: function (_tlsSocket) { state.tls = true; },
-      onData: function (tlsSocket, chunk) {
-        state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
-        _drainBuffer(state, tlsSocket);
-      },
+      clearFields:   ["tentativeUser"],
+      drain:         _drainBuffer,
       onError: function (err) {
         _emit("mail.server.pop3.tls_handshake_failed",
           { connectionId: state.id, error: (err && err.message) || String(err) }, "failure");
@@ -870,43 +845,15 @@ function create(opts) {
   }
 
   // ---- Lifecycle ----------------------------------------------------------
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerPop3Error("mail-server-pop3/already-listening",
-        "listen: already listening");
-    }
-    var port    = listenOpts.port    === undefined ? 110 : listenOpts.port;                          // RFC 1939 POP3 port (IANA)
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.pop3.listening", { port: port, address: address });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
-
-  async function close() {
-    if (!listening) return;
-    listening = false;
-    for (var s of connections) { try { s.destroy(); } catch (_e) { /* idempotent */ } }
-    connections.clear();
-    return new Promise(function (resolve) {
-      tcpServer.close(function () {
-        _emit("mail.server.pop3.closed", {});
-        resolve();
-      });
-    });
-  }
-
-  return {
-    listen:               listen,
-    close:                close,
-  };
+  return mailServerNet.createStoreServer(net, {
+    defaultPort:      110,                                                                            // RFC 1939 POP3 port (IANA)
+    handleConnection: _handleConnection,
+    errorClass:       MailServerPop3Error,
+    errorCodePrefix:  "mail-server-pop3/",
+    emit:             _emit,
+    connections:      connections,
+    eventBase:        "mail.server.pop3",
+  });
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/mail-server-rate-limit.js

@@ -88,6 +88,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -206,8 +207,7 @@ function create(opts) {
         { reason: "concurrent-per-ip", ip: ip, cap: cfg.maxConcurrentConnectionsPerIp });
       return { ok: false, reason: "concurrent-per-ip" };
     }
-    var times = connectionTimes.get(ip);
-    if (!times) { times = []; connectionTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(connectionTimes, ip, function () { return []; });
     _pruneWindow(times, CONNECTION_RATE_WINDOW_MS);
     if (times.length >= cfg.connectionsPerIpPerMinute) {
       _audit("mail.server.rate_limit.refused", "denied",
@@ -258,8 +258,7 @@ function create(opts) {
 
   function noteAuthFailure(ip) {
     if (cfg.disabled) return;
-    var times = authFailureTimes.get(ip);
-    if (!times) { times = []; authFailureTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(authFailureTimes, ip, function () { return []; });
     times.push(Date.now());
   }
 
@@ -288,8 +287,7 @@ function create(opts) {
 
   function noteRcptFailure(ip) {
     if (cfg.disabled) return;
-    var times = rcptFailureTimes.get(ip);
-    if (!times) { times = []; rcptFailureTimes.set(ip, times); }
+    var times = boundedMap.getOrInsert(rcptFailureTimes, ip, function () { return []; });
     times.push(Date.now());
   }
 
@@ -308,8 +306,34 @@ function create(opts) {
   };
 }
 
+/**
+ * @primitive b.mail.server.rateLimit.resolve
+ * @signature b.mail.server.rateLimit.resolve(spec)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.mail.server.rateLimit.create
+ *
+ * Resolve a rate-limit `spec` into a limiter. `false` disables limiting
+ * (a disabled limiter that always admits), an already-built limiter — one
+ * exposing `admitConnection` — passes through unchanged, and anything else
+ * is treated as `create()` options. Every mail server (IMAP / POP3 / SMTP
+ * MX / Submission / ManageSieve) composes this at the top of its `create()`
+ * so the spec contract is identical across protocols.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   var rl = b.mail.server.rateLimit.resolve(false);   // disabled
+ *   // → a limiter whose admitConnection always admits
+ */
+function resolve(spec) {
+  if (spec === false) return create({ disabled: true });
+  if (spec && typeof spec.admitConnection === "function") return spec;
+  return create(spec || {});
+}
+
 module.exports = {
   create:                       create,
+  resolve:                      resolve,
   MailServerRateLimitError:     MailServerRateLimitError,
   DEFAULTS:                     DEFAULTS,
 };

package/lib/vendor/blamejs/lib/mail-server-submission.js

@@ -103,7 +103,6 @@
 
 var net   = require("node:net");
 var nodeTls   = require("node:tls");
-var lazyRequire = require("./lazy-require");
 var C         = require("./constants");
 var bCrypto   = require("./crypto");
 var numericBounds = require("./numeric-bounds");
@@ -115,9 +114,10 @@ var guardSmtpCommand = require("./guard-smtp-command");
 var guardDomain = require("./guard-domain");
 var mailServerRateLimit = require("./mail-server-rate-limit");
 var mailServerTls = require("./mail-server-tls");
+var mailServerNet = require("./mail-server-net");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailServerSubmissionError = defineClass("MailServerSubmissionError", { alwaysPermanent: true });
 
@@ -341,14 +341,7 @@ function create(opts) {
   // Default-on per-IP rate limit (see lib/mail-server-rate-limit.js).
   // Operators pass `rateLimit: false` to disable, a rate-limit handle
   // to share across listeners, or an opts object to override defaults.
-  var rateLimit;
-  if (opts.rateLimit === false) {
-    rateLimit = mailServerRateLimit.create({ disabled: true });
-  } else if (opts.rateLimit && typeof opts.rateLimit.admitConnection === "function") {
-    rateLimit = opts.rateLimit;
-  } else {
-    rateLimit = mailServerRateLimit.create(opts.rateLimit || {});
-  }
+  var rateLimit = mailServerRateLimit.resolve(opts.rateLimit);
 
   // Default-on guardDomain hardening for HELO / MAIL FROM / RCPT TO.
   // Same posture as mail-server-mx — IDN homograph / Punycode-spoof
@@ -367,45 +360,25 @@ function create(opts) {
     });
   }
   function _validateDomainHardened(d, label) {
-    if (!guardDomainProfile) return { ok: true };
-    var verdict = guardDomain.validate(d, guardDomainProfile);
-    if (!verdict.ok) {
-      _emit("mail.server.submission.domain_refused", {
-        reason: verdict.issues && verdict.issues[0] && verdict.issues[0].kind,
-        domain: d,
-        label:  label,
-      }, "denied");
-    }
-    return verdict;
+    return mailServerNet.validateDomainHardened(d, label, {
+      guardDomainProfile: guardDomainProfile,
+      guardDomain:        guardDomain,
+      emit:               _emit,
+      refusedEvent:       "mail.server.submission.domain_refused",
+    });
   }
 
-  var tcpServer    = null;
-  var listening    = false;
   var connections  = new Set();
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emit = auditEmit.emit;
 
   function _handleConnection(rawSocket) {
-    var remoteAddress = rawSocket.remoteAddress || "0.0.0.0";
-    var admit = rateLimit.admitConnection(remoteAddress);
-    if (!admit.ok) {
-      // 421 4.7.0 — transient; sender retries elsewhere.
-      _emit("mail.server.submission.rate_limit_refused",
-        { remoteAddress: remoteAddress, reason: admit.reason }, "denied");
-      try {
-        rawSocket.write("421 4.7.0 Too many connections from your IP\r\n");
-      } catch (_e) { /* socket may already be torn down */ }
-      try { rawSocket.destroy(); } catch (_e2) { /* idempotent */ }
-      return;
-    }
+    // 421 4.7.0 — transient; sender retries elsewhere.
+    var remoteAddress = mailServerNet.admitConnection(rawSocket, rateLimit, _emit, {
+      refusedEvent: "mail.server.submission.rate_limit_refused",
+      refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+    });
+    if (remoteAddress === null) return;
     rawSocket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
 
     var connectionId = "submitconn-" + bCrypto.generateToken(8);                                      // connection-id length
@@ -570,7 +543,7 @@ function create(opts) {
       }
 
       lineBuffer = lineBuffer.length === 0 ? chunk : Buffer.concat([lineBuffer, chunk]);
-      if (lineBuffer.length > maxLineBytes * 4) {
+      if (safeBuffer.byteLengthOf(lineBuffer) > maxLineBytes * 4) {
         _writeReply(socket, REPLY_500_SYNTAX,
           "5.5.6 Line too long (>" + maxLineBytes + " bytes)");
         _closeConnection(socket);
@@ -1310,37 +1283,25 @@ function create(opts) {
     }
   }
 
-  async function listen(listenOpts) {
-    listenOpts = listenOpts || {};
-    if (listening) {
-      throw new MailServerSubmissionError("mail-server-submission/already-listening",
-        "listen: already listening");
-    }
-    // Port 0 (ephemeral, test mode) must NOT fall back to the protocol
-    // default — the `|| <default>` short-circuit was a footgun on the
-    // test path.
-    var defaultPort = implicitTls ? 465 : 587;                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
-    var port    = listenOpts.port    === undefined ? defaultPort : listenOpts.port;
-    var address = listenOpts.address || "0.0.0.0";
-    tcpServer = net.createServer(function (socket) { _handleConnection(socket); });
-    return new Promise(function (resolve, reject) {
-      tcpServer.once("error", reject);
-      tcpServer.listen(port, address, function () {
-        listening = true;
-        tcpServer.removeListener("error", reject);
-        _emit("mail.server.submission.listening",
-          { port: port, address: address, implicitTls: implicitTls });
-        resolve({ port: tcpServer.address().port, address: address });
-      });
-    });
-  }
+  // Port 0 (ephemeral, test mode) must NOT fall back to the protocol default —
+  // the `|| <default>` short-circuit was a footgun on the test path;
+  // createTcpListener honors an explicit 0 (only an OMITTED port defaults). The
+  // listening event reports implicitTls so an operator can confirm the wire mode.
+  var _tcpListener = mailServerNet.createTcpListener(net, {
+    defaultPort:      implicitTls ? 465 : 587,                                                        // RFC 8314 implicit-TLS / RFC 6409 submission ports
+    handleConnection: _handleConnection,
+    errorFactory:     function (code, message) { return new MailServerSubmissionError("mail-server-submission/" + code, message); },
+    emit:             _emit,
+    listeningEvent:   "mail.server.submission.listening",
+    listeningExtra:   function () { return { implicitTls: implicitTls }; },
+  });
 
   async function close(closeOpts) {
     closeOpts = closeOpts || {};
-    if (!listening) return;
+    if (!_tcpListener.isListening()) return;
     var timeoutMs = closeOpts.timeoutMs || C.TIME.seconds(30);
-    listening = false;
-    tcpServer.close();
+    _tcpListener.markClosed();
+    _tcpListener.getServer().close();
     connections.forEach(function (sock) {
       try { _writeReply(sock, REPLY_421_SERVICE_NOT_AVAIL, "4.3.0 Server shutting down"); }
       catch (_e) { /* socket already gone */ }
@@ -1359,10 +1320,10 @@ function create(opts) {
   function connectionCount() { return connections.size; }
 
   return {
-    listen:           listen,
+    listen:           _tcpListener.listen,
     close:            close,
     connectionCount:  connectionCount,
-    _portForTest:     function () { return tcpServer ? tcpServer.address().port : null; },
+    _portForTest:     function () { var s = _tcpListener.getServer(); return s ? s.address().port : null; },
   };
 }
 

package/lib/vendor/blamejs/lib/mail-server-tls.js

@@ -438,8 +438,97 @@ function upgradeSocket(opts) {
   return tlsSocket;
 }
 
+/**
+ * @primitive b.mail.server.tls.upgradeLineProtocol
+ * @signature b.mail.server.tls.upgradeLineProtocol(opts)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.mail.server.tls.upgradeSocket
+ *
+ * STARTTLS / STLS completion for the line-buffered store listeners
+ * (IMAP / POP3 / ManageSieve), layered over `upgradeSocket`. The
+ * caller has already validated protocol state and written its
+ * "begin TLS" response; this owns the steps that recur identically
+ * across the three:
+ *
+ *   1. Drop the pre-handshake `state.lineBuffer` (always) plus any
+ *      protocol-specific half-parsed command / literal / auth fields
+ *      (`clearFields`) so bytes the peer pipelined before the upgrade
+ *      cannot survive into the post-TLS session (CVE-2021-33515 /
+ *      CVE-2021-38371 STARTTLS-injection class). Centralizing the
+ *      `lineBuffer` reset makes it impossible for a listener to forget.
+ *   2. Mark `state.tls = true` on the secure event, then run the
+ *      caller's optional `onSecure` for protocol-specific work (e.g.
+ *      ManageSieve re-emitting its capability banner per RFC 5804).
+ *   3. Feed every post-handshake chunk through the caller's `drain`
+ *      via the standard `state.lineBuffer` append.
+ *
+ * The transfer listeners (MX / submission) ingest via a serialized
+ * feed pump, not the line buffer, so they call `upgradeSocket`
+ * directly.
+ *
+ * @opts
+ *   state:         object,                       // connection state ({ lineBuffer, tls, … })
+ *   socket:        net.Socket,                   // pre-upgrade plain socket
+ *   secureContext: tls.SecureContext,            // from b.mail.server.tls.context
+ *   idleTimeoutMs: number,                       // re-armed post-handshake
+ *   clearFields:   Array<string>,                // extra state fields to null pre-upgrade
+ *   drain:         function(state, tlsSocket),   // the protocol line drainer
+ *   onSecure:      function(tlsSocket),          // optional post-secure work
+ *   onError:       function(err),                // handshake / runtime error
+ *   onTimeout:     function(tlsSocket),          // optional idle-timeout handler
+ *
+ * @example
+ *   b.mail.server.tls.upgradeLineProtocol({
+ *     state: state, socket: socket, secureContext: opts.tlsContext,
+ *     idleTimeoutMs: idleTimeoutMs, clearFields: ["pendingLiteral"],
+ *     drain: _drainBuffer,
+ *     onError: function (err) { _emit("imap.tls_failed", { err: err.message }); _close(socket, state); },
+ *   });
+ */
+function upgradeLineProtocol(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-opts",
+      "upgradeLineProtocol: opts required");
+  }
+  var state = opts.state;
+  if (!state || typeof state !== "object") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-state",
+      "upgradeLineProtocol: opts.state object required");
+  }
+  if (typeof opts.drain !== "function") {
+    throw new MailServerTlsError("mail-server-tls/bad-upgrade-line-drain",
+      "upgradeLineProtocol: opts.drain(state, tlsSocket) required");
+  }
+  // CVE-2021-33515 / CVE-2021-38371 injection defense: discard the
+  // pre-handshake line buffer plus every protocol-specific half-parsed
+  // field so nothing the peer pipelined pre-upgrade survives the TLS
+  // boundary.
+  state.lineBuffer = Buffer.alloc(0);
+  var clearFields = opts.clearFields;
+  if (clearFields) {
+    for (var i = 0; i < clearFields.length; i += 1) state[clearFields[i]] = null;
+  }
+  return upgradeSocket({
+    plainSocket:   opts.socket,
+    secureContext: opts.secureContext,
+    idleTimeoutMs: opts.idleTimeoutMs,
+    onSecure: function (tlsSocket) {
+      state.tls = true;
+      if (typeof opts.onSecure === "function") opts.onSecure(tlsSocket);
+    },
+    onData: function (tlsSocket, chunk) {
+      state.lineBuffer = Buffer.concat([state.lineBuffer, chunk]);
+      opts.drain(state, tlsSocket);
+    },
+    onError:   opts.onError,
+    onTimeout: opts.onTimeout,
+  });
+}
+
 module.exports = {
   context:             context,
   upgradeSocket:       upgradeSocket,
+  upgradeLineProtocol: upgradeLineProtocol,
   MailServerTlsError:  MailServerTlsError,
 };

package/lib/vendor/blamejs/lib/mail-spam-score.js

@@ -71,6 +71,7 @@ var { defineClass }   = require("./framework-error");
 var lazyRequire       = require("./lazy-require");
 var validateOpts      = require("./validate-opts");
 var gateContract      = require("./gate-contract");
+var codepointClass    = require("./codepoint-class");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -131,7 +132,7 @@ function create(opts) {
     throw new MailSpamScoreError("mail-spam-score/bad-scorer",
       "mail.spamScore.create.scorer must be a function; got " + (typeof opts.scorer));
   }
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new MailSpamScoreError("mail-spam-score/bad-profile",
       "mail.spamScore.create.profile: unknown '" + profile +
@@ -250,13 +251,11 @@ function _sanitizeReasons(reasons, caps) {
     // Refuse control bytes (CR / LF / NUL / etc.) — a compromised
     // scorer could try to smuggle CRLF into an outbound X-Spam-Status
     // header.
-    for (var c = 0; c < r.length; c += 1) {
-      var cc = r.charCodeAt(c);
-      if (cc < 0x20 || cc === 0x7f) {                                                              // RFC 5234 CTL refusal range
-        throw new MailSpamScoreError("mail-spam-score/control-byte",
-          "mail.spamScore.score: reasons[" + i + "] contains control byte 0x" +
-          cc.toString(16));                                                                        // hex radix
-      }
+    var _ctlOff = codepointClass.firstControlCharOffset(r, { forbidTab: true });
+    if (_ctlOff !== -1) {
+      throw new MailSpamScoreError("mail-spam-score/control-byte",
+        "mail.spamScore.score: reasons[" + i + "] contains control byte 0x" +
+        r.charCodeAt(_ctlOff).toString(16));                                                       // hex radix
     }
     out.push(r);
   }

package/lib/vendor/blamejs/lib/mail-store.js

@@ -61,6 +61,7 @@ var C = require("./constants");
 var bCrypto = require("./crypto");
 var cryptoField = require("./crypto-field");
 var vault = require("./vault");
+var safeBuffer = require("./safe-buffer");
 var safeMime = require("./safe-mime");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
@@ -798,7 +799,7 @@ function _appendMessage(args) {
       "appendMessage: rawBytes must be Buffer or string");
   }
   var buf = Buffer.isBuffer(rawBytes) ? rawBytes : Buffer.from(rawBytes, "utf8");
-  if (buf.length > args.maxMessageBytes) {
+  if (safeBuffer.byteLengthOf(buf) > args.maxMessageBytes) {
     throw new MailStoreError("mail-store/oversize-message",
       "appendMessage: " + buf.length + " bytes exceeds maxMessageBytes=" + args.maxMessageBytes);
   }
@@ -854,7 +855,7 @@ function _appendMessage(args) {
   var bodyText = textPart ? textPart.body : "";
   var bodyHtml = htmlPart && htmlPart.contentType === "text/html" ? htmlPart.body : "";
 
-  if (bodyText.length > args.maxBodyBytes || bodyHtml.length > args.maxBodyBytes) {
+  if (safeBuffer.byteLengthOf(bodyText) > args.maxBodyBytes || safeBuffer.byteLengthOf(bodyHtml) > args.maxBodyBytes) {
     throw new MailStoreError("mail-store/oversize-body",
       "appendMessage: body exceeds maxBodyBytes=" + args.maxBodyBytes);
   }

package/lib/vendor/blamejs/lib/mail.js

@@ -57,6 +57,8 @@
  */
 var C = require("./constants");
 var bCrypto = require("./crypto");
+var codepointClass = require("./codepoint-class");
+var markupEscape = require("./markup-escape").markupEscape;
 var lazyRequire = require("./lazy-require");
 var safeBuffer = require("./safe-buffer");
 var guardDomain = require("./guard-domain");
@@ -388,11 +390,7 @@ function _renderPostalAddressHtml(addr) {
 }
 
 function _htmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
+  return markupEscape(s);
 }
 
 function _hasUnsubscribe(message) {
@@ -1920,12 +1918,9 @@ function feedbackId(opts) {
     // Refuse CR/LF (header-injection) + control chars. Walk codepoints
     // manually because eslint's no-control-regex refuses control-char
     // ranges in regex literals regardless of escape form.
-    for (var ci = 0; ci < f.value.length; ci += 1) {
-      var code = f.value.charCodeAt(ci);
-      if (code < 32 || code === 127) {                                                             // C0 + DEL codepoint range
-        throw new MailError("mail/bad-feedback-id-field",
-          "feedbackId: " + f.key + " contains control characters");
-      }
+    if (codepointClass.firstControlCharOffset(f.value, { forbidTab: true }) !== -1) {              // C0 + DEL codepoint range
+      throw new MailError("mail/bad-feedback-id-field",
+        "feedbackId: " + f.key + " contains control characters");
     }
     parts.push(f.value);
   }

package/lib/vendor/blamejs/lib/markup-escape.js

@@ -0,0 +1,31 @@
+"use strict";
+
+// markup-escape — the shared XML/HTML text + attribute escaper used wherever
+// the framework SERIALIZES a value into markup (mail report / DAV / autoconfig
+// XML, the Azure blob XML API, and — once routed — the b.guardHtml / b.guardSvg
+// sanitizer output). Distinct from markup-tokenizer (which LEXES markup for the
+// sanitizers) and xml-c14n (which canonicalizes for XMLDSig with a different
+// escape set, e.g. \r\n\t and NO ">").
+//
+// markupEscape(str, opts) escapes the four always-dangerous markup
+// metacharacters — & < > " — to their entity forms, with "&" first so the
+// entities it emits are not double-escaped. The one axis that genuinely varies
+// across callers is the apostrophe, so it is a parameter:
+//   opts.apos omitted / falsy → "'" is left as-is (element content and
+//     double-quoted attributes don't require it escaped)
+//   opts.apos === "&#39;"     → HTML numeric form
+//   opts.apos === "&apos;"    → XML named form
+// Input COERCION stays with the caller (some map null/undefined or any
+// non-string to "" before serializing); markupEscape String()s defensively so
+// a stray number/boolean still escapes rather than throwing.
+function markupEscape(str, opts) {
+  var s = String(str)
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+  var apos = opts && opts.apos;
+  return apos ? s.replace(/'/g, apos) : s;
+}
+
+module.exports = { markupEscape: markupEscape };