@limetech/lime-elements 39.45.2 → 40.0.0

package/dist/esm/limel-file-viewer.entry.js

@@ -1,5 +1,5 @@
 import { r as registerInstance, c as createEvent, h, F as Fragment, a as getElement } from './index-BGxJfR2f.js';
-import { t as translate } from './translations-Cb9R_zmF.js';
+import { t as translate } from './translations-DgqE77nk.js';
 import { d as defaultSchema, u as unified, r as rehypeParse, a as rehypeSanitize, v as visit, b as rehypeStringify } from './index-CbciMfiU.js';
 import { I as ImageTemplate } from './image.template-BXDvrqGw.js';
 import './_commonjsHelpers-B85MJLTf.js';
@@ -132,25 +132,27 @@ for (let i = 0; i < base64Chars.length; i++) {
 }
 
 function decodeBase64(base64) {
-    let bufferLength = Math.ceil(base64.length / 4) * 3;
-    const len = base64.length;
-
-    let p = 0;
+    // Padding carries no data, so the byte count comes from the payload alone. Sizing the
+    // buffer from the raw length instead treated '=' as a data character and left the
+    // output padded with NUL bytes, which then travelled into subjects and filenames.
+    let len = base64.length;
+    while (len > 0 && base64.charAt(len - 1) === '=') {
+        len--;
+    }
 
-    if (base64.length % 4 === 3) {
-        bufferLength--;
-    } else if (base64.length % 4 === 2) {
-        bufferLength -= 2;
-    } else if (base64[base64.length - 1] === '=') {
-        bufferLength--;
-        if (base64[base64.length - 2] === '=') {
-            bufferLength--;
-        }
+    // A remainder of one character cannot encode a byte, it is a truncated group
+    if (len % 4 === 1) {
+        len--;
     }
 
+    const remainder = len % 4;
+    const bufferLength = Math.floor(len / 4) * 3 + (remainder ? remainder - 1 : 0);
+
     const arrayBuffer = new ArrayBuffer(bufferLength);
     const bytes = new Uint8Array(arrayBuffer);
 
+    let p = 0;
+
     for (let i = 0; i < len; i += 4) {
         let encoded1 = base64Lookup[base64.charCodeAt(i)];
         let encoded2 = base64Lookup[base64.charCodeAt(i + 1)];
@@ -158,37 +160,107 @@ function decodeBase64(base64) {
         let encoded4 = base64Lookup[base64.charCodeAt(i + 3)];
 
         bytes[p++] = (encoded1 << 2) | (encoded2 >> 4);
-        bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
-        bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
+        if (p < bufferLength) {
+            bytes[p++] = ((encoded2 & 15) << 4) | (encoded3 >> 2);
+        }
+        if (p < bufferLength) {
+            bytes[p++] = ((encoded3 & 3) << 6) | (encoded4 & 63);
+        }
     }
 
     return arrayBuffer;
 }
 
-// Charset aliases that the WHATWG Encoding Standard (and thus TextDecoder in
-// browsers and Workers) does not recognize, but that map cleanly to a supported
-// encoding. Node's ICU-backed TextDecoder resolves these natively; strict WHATWG
-// runtimes would otherwise throw and fall back to windows-1252, emitting mojibake.
-// eg. Hebrew bodies declared as the logical (iso-8859-8-i) or explicit (iso-8859-8-e)
-// variants decode to the same code points as iso-8859-8.
+// Charset labels the WHATWG Encoding Standard does not list, but that name an encoding
+// TextDecoder can decode. Without an entry the TextDecoder constructor throws and
+// getDecoder falls back to windows-1252, turning the body into mojibake with nothing to
+// signal that the wrong decoder was used.
+//
+// Keys are normalized (see normalizeCharset), so one entry covers every spelling of a
+// label, eg. `eucjp` also catches `euc_jp`, `x-eucjp` and `x-euc-jp`. Only labels that
+// need real encoding knowledge belong here; anything that differs from a supported
+// label by nothing but an `x-` prefix or a separator is handled by normalization alone.
 const charsetAliases = new Map([
-    ['iso-8859-8-i', 'iso-8859-8'],
-    ['iso-8859-8-e', 'iso-8859-8']
+    // Hebrew. The logical and explicit ordering variants share the iso-8859-8 index.
+    ['iso88598i', 'iso-8859-8'],
+    ['iso88598e', 'iso-8859-8'],
+
+    // Japanese. WHATWG shift_jis is the Windows-31J index, so cp932 text decodes
+    // identically, including the NEC and IBM extension rows.
+    ['shiftjis', 'shift_jis'],
+    ['windows31j', 'shift_jis'],
+    ['mskanji', 'shift_jis'],
+    ['eucjp', 'euc-jp'],
+
+    // ISO-2022-JP, including the -1 / -2 supersets. Escape sequences outside plain
+    // ISO-2022-JP (JIS X 0212, the non-Japanese G2 sets, and the SO/SI katakana shifts
+    // cp50222 uses) decode to replacement characters, but the Japanese text around them
+    // still comes out right.
+    ['iso2022jp', 'iso-2022-jp'],
+    ['iso2022jp1', 'iso-2022-jp'],
+    ['iso2022jp2', 'iso-2022-jp'],
+    ['junet', 'iso-2022-jp'],
+
+    // Korean. The WHATWG euc-kr index is the extended cp949 / UHC index.
+    ['euckr', 'euc-kr'],
+    ['uhc', 'euc-kr'],
+
+    // Thai.
+    ['tis620', 'windows-874']
 ]);
 
-function getDecoder(charset) {
-    charset = (charset || 'utf8').trim().toLowerCase();
-    charset = charsetAliases.get(charset) || charset;
+// Windows and IBM code page numbers, as written in labels like cp932, windows-932, ms932
+// or ibm932. An explicit allowlist rather than a derived one, because plenty of code
+// pages that appear in mail (cp437, cp850, cp1361) have no equivalent to map onto and
+// have to keep falling back.
+const codePageAliases = new Map([
+    ['932', 'shift_jis'],
+    ['936', 'gbk'],
+    ['949', 'euc-kr'],
+    ['950', 'big5'],
+    ['874', 'windows-874'],
+    // Microsoft's EUC-JP and ISO-2022-JP variants. euc-jp and iso-2022-jp cover
+    // everything they can express.
+    ['51932', 'euc-jp'],
+    ['50220', 'iso-2022-jp'],
+    ['50221', 'iso-2022-jp'],
+    ['50222', 'iso-2022-jp']
+]);
 
-    let decoder;
+const codePagePattern = /^(?:cp|windows|ms|ibm)(\d+)$/;
 
+// Strip the decorations mail clients add to an otherwise standard label: an x- vendor
+// prefix, the IANA cs- prefix, and any separators.
+function normalizeCharset(charset) {
+    return charset.replace(/^(?:x-ms-|x-|cs)/, '').replace(/[\s._-]+/g, '');
+}
+
+function tryDecoder(charset) {
     try {
-        decoder = new TextDecoder(charset);
+        return new TextDecoder(charset);
     } catch (err) {
-        decoder = new TextDecoder('windows-1252');
+        return null;
     }
+}
 
-    return decoder;
+function getDecoder(charset) {
+    charset = (charset || 'utf8').trim().toLowerCase();
+
+    // Try the label as written first, so the alias table only ever adds to what the
+    // runtime already supports instead of shadowing it.
+    const decoder = tryDecoder(charset);
+    if (decoder) {
+        return decoder;
+    }
+
+    const normalized = normalizeCharset(charset);
+    const codePage = normalized.match(codePagePattern);
+
+    // The normalized label is itself the last candidate, which resolves everything that
+    // differed from a supported label only by a prefix or a separator, eg. x-big5.
+    const alias = (codePage && codePageAliases.get(codePage[1])) || charsetAliases.get(normalized) || normalized;
+
+    return tryDecoder(alias) || new TextDecoder('windows-1252');
 }
 
 /**
@@ -216,15 +288,23 @@ async function blobToArrayBuffer(blob) {
     });
 }
 
-function getHex(c) {
-    if (
-        (c >= 0x30 /* 0 */ && c <= 0x39) /* 9 */ ||
-        (c >= 0x61 /* a */ && c <= 0x66) /* f */ ||
-        (c >= 0x41 /* A */ && c <= 0x46) /* F */
-    ) {
-        return String.fromCharCode(c);
+/**
+ * Numeric value of an ASCII hex digit
+ *
+ * @param {Number} c Byte to read
+ * @return {Number} Value 0-15, or -1 if the byte is not a hex digit
+ */
+function hexNibble(c) {
+    if (c >= 0x30 /* 0 */ && c <= 0x39 /* 9 */) {
+        return c - 0x30;
+    }
+    if (c >= 0x61 /* a */ && c <= 0x66 /* f */) {
+        return c - 0x61 + 10;
     }
-    return false;
+    if (c >= 0x41 /* A */ && c <= 0x46 /* F */) {
+        return c - 0x41 + 10;
+    }
+    return -1;
 }
 
 /**
@@ -258,11 +338,10 @@ function decodeWord(charset, encoding, str) {
         for (let i = 0, len = buf.length; i < len; i++) {
             let c = buf[i];
             if (i <= len - 2 && c === 0x3d /* = */) {
-                let c1 = getHex(buf[i + 1]);
-                let c2 = getHex(buf[i + 2]);
-                if (c1 && c2) {
-                    let c = parseInt(c1 + c2, 16);
-                    encodedBytes.push(c);
+                let high = hexNibble(buf[i + 1]);
+                let low = hexNibble(buf[i + 2]);
+                if (high >= 0 && low >= 0) {
+                    encodedBytes.push((high << 4) | low);
                     i += 2;
                     continue;
                 }
@@ -284,59 +363,135 @@ function decodeWord(charset, encoding, str) {
     return getDecoder(charset).decode(byteStr);
 }
 
-function decodeWords(str) {
-    let joinString = true;
-
-    while (true) {
-        let result = (str || '')
-            .toString()
-            // find base64 words that can be joined
-            .replace(
-                /(=\?([^?]+)\?[Bb]\?([^?]*)\?=)\s*(?==\?([^?]+)\?[Bb]\?[^?]*\?=)/g,
-                (match, left, chLeft, encodedLeftStr, chRight) => {
-                    if (!joinString) {
-                        return match;
-                    }
-                    // only mark b64 chunks to be joined if charsets match and left side does not end with =
-                    if (chLeft === chRight && encodedLeftStr.length % 4 === 0 && !/=$/.test(encodedLeftStr)) {
-                        // set a joiner marker
-                        return left + '__\x00JOIN\x00__';
-                    }
+// A charset label runs to the next '?' so that labels containing punctuation, eg.
+// ISO_8859-1:1987, are recognised. Whitespace is excluded so a stray '=?' in running text
+// can not swallow the rest of the line.
+const ENCODED_WORD_PATTERN = '=\\?([^?\\s]+)\\?([QqBb])\\?([^?]*)\\?=';
+const ENCODED_WORD_REGEX = new RegExp(ENCODED_WORD_PATTERN, 'g');
 
-                    return match;
-                }
-            )
-            // find QP words that can be joined
-            .replace(
-                /(=\?([^?]+)\?[Qq]\?[^?]*\?=)\s*(?==\?([^?]+)\?[Qq]\?[^?]*\?=)/g,
-                (match, left, chLeft, chRight) => {
-                    if (!joinString) {
-                        return match;
-                    }
-                    // only mark QP chunks to be joined if charsets match
-                    if (chLeft === chRight) {
-                        // set a joiner marker
-                        return left + '__\x00JOIN\x00__';
-                    }
-                    return match;
-                }
-            )
-            // join base64 encoded words
-            .replace(/(\?=)?__\x00JOIN\x00__(=\?([^?]+)\?[QqBb]\?)?/g, '')
-            // remove spaces between mime encoded words
-            .replace(/(=\?[^?]+\?[QqBb]\?[^?]*\?=)\s+(?==\?[^?]+\?[QqBb]\?[^?]*\?=)/g, '$1')
-            // decode words
-            .replace(/=\?([\w_\-*]+)\?([QqBb])\?([^?]*)\?=/g, (m, charset, encoding, text) =>
-                decodeWord(charset, encoding, text)
-            );
-
-        if (joinString && result.indexOf('\ufffd') >= 0) {
-            // text contains \ufffd (EF BF BD), so unicode conversion failed, retry without joining strings
-            joinString = false;
-        } else {
-            return result;
+// Only linear whitespace separates encoded words, the rest is content
+const WORD_SEPARATOR_REGEX = /^[ \t\r\n]+$/;
+
+const ENCODED_WORDS_ONLY_REGEX = new RegExp(`^(?:${ENCODED_WORD_PATTERN}\\s*)+$`);
+
+/**
+ * Checks whether a string is nothing but RFC 2047 encoded words. Kept next to the grammar
+ * it depends on, so the pattern has a single definition.
+ *
+ * @param {String} str String to check
+ * @return {Boolean} true if the string holds encoded words and nothing else
+ */
+function isEncodedWordsOnly(str) {
+    return ENCODED_WORDS_ONLY_REGEX.test(str);
+}
+
+/**
+ * Splits a string into encoded words and the literal text around them.
+ *
+ * Working on a token list rather than marking joinable words with an in band sentinel
+ * means the input can not contain the marker, which previously let a sender delete text
+ * from a subject or a display name by writing the marker into the header themselves.
+ *
+ * @param {String} str String to split
+ * @return {Array} Array of `{text}` and `{charset, encoding, encodedText}` tokens
+ */
+function splitEncodedWords(str) {
+    const tokens = [];
+
+    ENCODED_WORD_REGEX.lastIndex = 0;
+
+    let pos = 0;
+    let match;
+
+    while ((match = ENCODED_WORD_REGEX.exec(str))) {
+        if (match.index > pos) {
+            tokens.push({ text: str.substring(pos, match.index) });
+        }
+        tokens.push({ charset: match[1], encoding: match[2], encodedText: match[3] });
+        pos = match.index + match[0].length;
+    }
+
+    if (pos < str.length) {
+        tokens.push({ text: str.substring(pos) });
+    }
+
+    return tokens;
+}
+
+/**
+ * Checks if two adjacent encoded words may be decoded as a single unit. A multi byte
+ * character is often split across two words, so the bytes have to be concatenated before
+ * they are decoded. Base64 additionally needs the left chunk to end on a group boundary,
+ * otherwise the concatenation shifts every byte that follows.
+ */
+function canJoinWords(left, right) {
+    const encoding = left.encoding.toUpperCase();
+
+    if (left.charset !== right.charset || encoding !== right.encoding.toUpperCase()) {
+        return false;
+    }
+
+    if (encoding === 'B') {
+        return left.encodedText.length % 4 === 0 && !/=$/.test(left.encodedText);
+    }
+
+    return true;
+}
+
+/**
+ * Decodes a token list into a string, optionally merging adjacent encoded words.
+ *
+ * @param {Array} tokens Tokens from splitEncodedWords
+ * @param {Boolean} joinWords Whether adjacent encoded words may be decoded as one unit
+ * @return {String} Decoded string
+ */
+function renderTokens(tokens, joinWords) {
+    let result = '';
+    let pending = null;
+
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+
+        if (token.text !== undefined) {
+            // whitespace between two encoded words is a folding artifact, not content
+            const nextToken = tokens[i + 1];
+            if (pending && nextToken && nextToken.text === undefined && WORD_SEPARATOR_REGEX.test(token.text)) {
+                continue;
+            }
+            if (pending) {
+                result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
+                pending = null;
+            }
+            result += token.text;
+            continue;
         }
+
+        if (pending && joinWords && canJoinWords(pending, token)) {
+            pending.encodedText += token.encodedText;
+            continue;
+        }
+
+        if (pending) {
+            result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
+        }
+        pending = { charset: token.charset, encoding: token.encoding, encodedText: token.encodedText };
+    }
+
+    if (pending) {
+        result += decodeWord(pending.charset, pending.encoding, pending.encodedText);
     }
+
+    return result;
+}
+
+function decodeWords(str) {
+    const tokens = splitEncodedWords((str || '').toString());
+
+    const result = renderTokens(tokens, true);
+
+    // A replacement character means the bytes did not decode, which happens when two
+    // words were joined that should have stayed apart. Retry keeping them separate.
+    return result.indexOf('\ufffd') < 0 ? result : renderTokens(tokens, false);
 }
 
 function decodeURIComponentWithCharset(encodedStr, charset) {
@@ -399,25 +554,45 @@ function decodeParameterValueContinuations(header) {
         }
 
         let value = header.params[key];
-        if (nr === 0 && match[0].charAt(match[0].length - 1) === '*' && (match = value.match(/^([^']*)'[^']*'(.*)$/))) {
+        // RFC 2231 section 4.1: only a section whose name ends in '*' is percent encoded.
+        // A plain `name*0=` section is literal text, so decoding it invents characters
+        // that never appeared on the wire, turning `a%2F..%2Fetc` into a path traversal.
+        let encoded = match[0].charAt(match[0].length - 1) === '*';
+
+        if (nr === 0 && encoded && (match = value.match(/^([^']*)'[^']*'(.*)$/))) {
             paramVal.charset = match[1] || 'utf-8';
             value = match[2];
         }
 
-        paramVal.values.push({ nr, value });
+        paramVal.values.push({ nr, value, encoded });
 
         // remove the old reference
         delete header.params[key];
     });
 
     paramKeys.forEach((paramVal, key) => {
-        header.params[key] = decodeURIComponentWithCharset(
-            paramVal.values
-                .sort((a, b) => a.nr - b.nr)
-                .map(a => a.value)
-                .join(''),
-            paramVal.charset
-        );
+        let result = '';
+        // Adjacent encoded sections are decoded together, because a single multi byte
+        // character may be percent encoded across a section boundary.
+        let pending = '';
+
+        for (let part of paramVal.values.sort((a, b) => a.nr - b.nr)) {
+            if (part.encoded) {
+                pending += part.value;
+                continue;
+            }
+            if (pending) {
+                result += decodeURIComponentWithCharset(pending, paramVal.charset);
+                pending = '';
+            }
+            result += part.value;
+        }
+
+        if (pending) {
+            result += decodeURIComponentWithCharset(pending, paramVal.charset);
+        }
+
+        header.params[key] = result;
     });
 }
 
@@ -450,162 +625,155 @@ class Base64Decoder {
         this.remainder = '';
     }
 
-    update(buffer) {
-        let str = this.decoder.decode(buffer);
-
-        str = str.replace(/[^a-zA-Z0-9+\/]+/g, '');
-
-        this.remainder += str;
+    pushChunk(base64Str) {
+        if (base64Str.length) {
+            this.chunks.push(decodeBase64(base64Str));
+        }
+    }
 
-        if (this.remainder.length >= this.maxChunkSize) {
-            let allowedBytes = Math.floor(this.remainder.length / 4) * 4;
-            let base64Str;
+    flushRemainder() {
+        this.pushChunk(this.remainder);
+        this.remainder = '';
+    }
 
-            if (allowedBytes === this.remainder.length) {
-                base64Str = this.remainder;
-                this.remainder = '';
-            } else {
-                base64Str = this.remainder.substr(0, allowedBytes);
-                this.remainder = this.remainder.substr(allowedBytes);
+    update(buffer) {
+        let str = this.decoder.decode(buffer).replace(/[^a-zA-Z0-9+/=]+/g, '');
+
+        // '=' terminates a base64 unit. Some mailers pad every line, and erasing the
+        // padding used to concatenate the units, which knocked everything after the first
+        // embedded pad out of 4 character alignment and decoded it to garbage.
+        const units = str.split(/=+/);
+        for (let i = 0; i < units.length; i++) {
+            this.remainder += units[i];
+            // the trailing piece is not followed by padding, so it stays open
+            if (i < units.length - 1) {
+                this.flushRemainder();
             }
+        }
 
-            if (base64Str.length) {
-                this.chunks.push(decodeBase64(base64Str));
-            }
+        if (this.remainder.length >= this.maxChunkSize) {
+            const alignedLength = Math.floor(this.remainder.length / 4) * 4;
+            this.pushChunk(this.remainder.substring(0, alignedLength));
+            this.remainder = this.remainder.substring(alignedLength);
         }
     }
 
     finalize() {
-        if (this.remainder && !/^=+$/.test(this.remainder)) {
-            this.chunks.push(decodeBase64(this.remainder));
-        }
+        this.flushRemainder();
 
         return blobToArrayBuffer(new Blob(this.chunks, { type: 'application/octet-stream' }));
     }
 }
 
-// Regex patterns compiled once for performance
-const VALID_QP_REGEX = /^=[a-f0-9]{2}$/i;
-const QP_SPLIT_REGEX = /(?==[a-f0-9]{2})/i;
-const SOFT_LINE_BREAK_REGEX = /=\r?\n/g;
-const PARTIAL_QP_ENDING_REGEX = /=[a-fA-F0-9]?$/;
+const CHR_EQUALS = 0x3d;
+const CHR_LF = 0x0a;
 
 class QPDecoder {
-    constructor(opts) {
-        opts = opts || {};
-
-        this.decoder = opts.decoder || new TextDecoder();
-
+    constructor() {
         this.maxChunkSize = 100 * 1024;
 
-        this.remainder = '';
+        this.buffer = new Uint8Array(this.maxChunkSize);
+        this.bufferPos = 0;
 
         this.chunks = [];
     }
 
-    decodeQPBytes(encodedBytes) {
-        let buf = new ArrayBuffer(encodedBytes.length);
-        let dataView = new DataView(buf);
-        for (let i = 0, len = encodedBytes.length; i < len; i++) {
-            dataView.setUint8(i, parseInt(encodedBytes[i], 16));
+    writeByte(byte) {
+        if (this.bufferPos >= this.buffer.length) {
+            this.flushBuffer();
         }
-        return buf;
+        this.buffer[this.bufferPos++] = byte;
     }
 
-    decodeChunks(str) {
-        // unwrap newlines
-        str = str.replace(SOFT_LINE_BREAK_REGEX, '');
-
-        let list = str.split(QP_SPLIT_REGEX);
-        let encodedBytes = [];
-        for (let part of list) {
-            if (part.charAt(0) !== '=') {
-                if (encodedBytes.length) {
-                    this.chunks.push(this.decodeQPBytes(encodedBytes));
-                    encodedBytes = [];
-                }
-                this.chunks.push(part);
-                continue;
-            }
-
-            if (part.length === 3) {
-                // Validate that this is actually a valid QP sequence
-                if (VALID_QP_REGEX.test(part)) {
-                    encodedBytes.push(part.substr(1));
-                } else {
-                    // Not a valid QP sequence, treat as literal text
-                    if (encodedBytes.length) {
-                        this.chunks.push(this.decodeQPBytes(encodedBytes));
-                        encodedBytes = [];
-                    }
-                    this.chunks.push(part);
-                }
-                continue;
-            }
-
-            if (part.length > 3) {
-                // First 3 chars should be a valid QP sequence
-                const firstThree = part.substr(0, 3);
-                if (VALID_QP_REGEX.test(firstThree)) {
-                    encodedBytes.push(part.substr(1, 2));
-                    this.chunks.push(this.decodeQPBytes(encodedBytes));
-                    encodedBytes = [];
-
-                    part = part.substr(3);
-                    this.chunks.push(part);
-                } else {
-                    // Not a valid QP sequence, treat entire part as literal
-                    if (encodedBytes.length) {
-                        this.chunks.push(this.decodeQPBytes(encodedBytes));
-                        encodedBytes = [];
-                    }
-                    this.chunks.push(part);
-                }
+    // Literal text is the bulk of a typical body, so it is copied in runs rather than a
+    // byte at a time
+    writeBytes(line, start, end) {
+        while (start < end) {
+            if (this.bufferPos >= this.buffer.length) {
+                this.flushBuffer();
             }
-        }
-        if (encodedBytes.length) {
-            this.chunks.push(this.decodeQPBytes(encodedBytes));
+            const count = Math.min(end - start, this.buffer.length - this.bufferPos);
+            this.buffer.set(line.subarray(start, start + count), this.bufferPos);
+            this.bufferPos += count;
+            start += count;
         }
     }
 
-    update(buffer) {
-        // expect full lines, so add line terminator as well
-        let str = this.decoder.decode(buffer) + '\n';
+    flushBuffer() {
+        if (this.bufferPos) {
+            this.chunks.push(this.buffer.slice(0, this.bufferPos));
+            this.bufferPos = 0;
+        }
+    }
 
-        str = this.remainder + str;
+    // Quoted-printable source is 7 bit by definition, so it is decoded byte by byte and
+    // the result is handed on as bytes. Running the body charset over the encoded source
+    // instead corrupted every part whose charset was not ASCII compatible: the same
+    // content that decoded correctly in base64 came out as mojibake in quoted-printable.
+    update(line) {
+        let len = line.length;
 
-        if (str.length < this.maxChunkSize) {
-            this.remainder = str;
-            return;
+        // a line ending in '=' is a soft line break, the newline is not part of the content
+        const softBreak = len > 0 && line[len - 1] === CHR_EQUALS;
+        if (softBreak) {
+            len--;
         }
 
-        this.remainder = '';
+        let literalStart = 0;
+        for (let i = 0; i < len; i++) {
+            if (line[i] !== CHR_EQUALS || i + 2 >= len) {
+                continue;
+            }
 
-        let partialEnding = str.match(PARTIAL_QP_ENDING_REGEX);
-        if (partialEnding) {
-            if (partialEnding.index === 0) {
-                this.remainder = str;
-                return;
+            const high = hexNibble(line[i + 1]);
+            const low = hexNibble(line[i + 2]);
+            if (high < 0 || low < 0) {
+                // not a valid escape sequence, keep it as literal text
+                continue;
             }
-            this.remainder = str.substr(partialEnding.index);
-            str = str.substr(0, partialEnding.index);
+
+            this.writeBytes(line, literalStart, i);
+            this.writeByte((high << 4) | low);
+            i += 2;
+            literalStart = i + 1;
         }
+        this.writeBytes(line, literalStart, len);
 
-        this.decodeChunks(str);
+        if (!softBreak) {
+            this.writeByte(CHR_LF);
+        }
     }
 
     finalize() {
-        if (this.remainder.length) {
-            this.decodeChunks(this.remainder);
-            this.remainder = '';
-        }
+        this.flushBuffer();
 
         // convert an array of arraybuffers into a blob and then back into a single arraybuffer
         return blobToArrayBuffer(new Blob(this.chunks, { type: 'application/octet-stream' }));
     }
 }
 
-const defaultDecoder = getDecoder();
+// Header lines are decoded with ignoreBOM so that a U+FEFF at the start of a line is
+// kept as a character instead of being swallowed. A stripped BOM turns a line a strict
+// parser skips into a genuine header, which is how a second `From:` gets smuggled past
+// anything that inspects the raw message.
+const headerDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+
+// Trims only the whitespace RFC 5322 allows around a field name. String.prototype.trim
+// also strips U+00A0, U+FEFF, U+2028 and the rest of the Unicode spaces, which turns a
+// line that a strict parser rejects into a canonical field name: ` From:` became a
+// `from` header, and since the first occurrence of a header wins it outranked the real
+// sender. Leaving the character in the key keeps the line visible without letting it
+// collide with a genuine header.
+const trimWsp = str => str.replace(/^[ \t]+|[ \t]+$/g, '');
+
+// Headers that decide how this part's body is read, see processHeaders
+const CONTENT_HEADERS = new Set([
+    'content-type',
+    'content-transfer-encoding',
+    'content-disposition',
+    'content-id',
+    'content-description'
+]);
 
 class MimeNode {
     constructor(options) {
@@ -613,8 +781,11 @@ class MimeNode {
 
         this.postalMime = this.options.postalMime;
 
-        this.root = !!this.options.parentNode;
         this.childNodes = [];
+        // Cursor into childNodes for finalizeChildNodes. Every new part of a multipart
+        // finalizes its parent's children, so re-walking the whole array each time is
+        // quadratic in the number of parts.
+        this.finalizedChildCount = 0;
 
         if (this.options.parentNode) {
             this.parentNode = this.options.parentNode;
@@ -632,15 +803,15 @@ class MimeNode {
         this.state = 'header';
 
         this.headerLines = [];
-        this.headerSize = 0;
 
         // RFC 2046 Section 5.1.5: multipart/digest defaults to message/rfc822
         const parentMultipartType = this.options.parentMultipartType || null;
         const defaultContentType = parentMultipartType === 'digest' ? 'message/rfc822' : 'text/plain';
 
+        // Replaced by the first matching header, see the CONTENT_HEADERS pass in
+        // processHeaders
         this.contentType = {
-            value: defaultContentType,
-            default: true
+            value: defaultContentType
         };
 
         this.contentTransferEncoding = {
@@ -660,7 +831,7 @@ class MimeNode {
         if (/base64/i.test(transferEncoding)) {
             this.contentDecoder = new Base64Decoder();
         } else if (/quoted-printable/i.test(transferEncoding)) {
-            this.contentDecoder = new QPDecoder({ decoder: getDecoder(this.contentType.parsed.params.charset) });
+            this.contentDecoder = new QPDecoder();
         } else {
             this.contentDecoder = new PassThroughDecoder();
         }
@@ -698,17 +869,32 @@ class MimeNode {
     }
 
     async finalizeChildNodes() {
-        for (let childNode of this.childNodes) {
-            await childNode.finalize();
+        // Children are only ever appended, so everything before the cursor is already
+        // finished and re-visiting it only costs time.
+        while (this.finalizedChildCount < this.childNodes.length) {
+            await this.childNodes[this.finalizedChildCount++].finalize();
         }
     }
 
-    // Strip RFC 822 comments (parenthesized text) from structured header values
+    // Strip RFC 822 comments (parenthesized text) from structured header values.
+    //
+    // Inside an unquoted parameter value a parenthesis that continues the current token is
+    // content, because `filename=Invoice(1).pdf` is a filename and not a token followed by
+    // a comment, and deleting the parens silently renames the attachment.
     stripComments(str) {
         let result = '';
         let depth = 0;
         let escaped = false;
         let inQuote = false;
+        // where the outermost comment opened, for the unbalanced case below
+        let commentStart = -1;
+        // A parameter value starts at `=` and ends at the `;` that begins the next one
+        let inParameterValue = false;
+
+        // A comment may only appear where linear whitespace is allowed, so inside a
+        // parameter value the parenthesis has to follow whitespace to open one. Outside
+        // one, eg. after the type itself, anything goes.
+        const opensComment = () => !inParameterValue || !result.length || /[ \t]$/.test(result);
 
         for (let i = 0; i < str.length; i++) {
             const chr = str.charAt(i);
@@ -736,7 +922,10 @@ class MimeNode {
             }
 
             if (!inQuote) {
-                if (chr === '(') {
+                if (chr === '(' && opensComment()) {
+                    if (depth === 0) {
+                        commentStart = i;
+                    }
                     depth++;
                     continue;
                 }
@@ -744,6 +933,13 @@ class MimeNode {
                     depth--;
                     continue;
                 }
+                if (depth === 0) {
+                    if (chr === '=') {
+                        inParameterValue = true;
+                    } else if (chr === ';') {
+                        inParameterValue = false;
+                    }
+                }
             }
 
             if (depth === 0) {
@@ -751,7 +947,14 @@ class MimeNode {
             }
         }
 
-        return result;
+        if (depth === 0) {
+            return result;
+        }
+
+        // An unbalanced `(` is not a comment. Dropping everything after it would take any
+        // parameter that follows with it, including the boundary that holds the message
+        // together, so the dangling text is only discarded when nothing follows it.
+        return str.indexOf(';', commentStart) < 0 ? result : str;
     }
 
     parseStructuredHeader(str) {
@@ -767,62 +970,123 @@ class MimeNode {
         let value = '';
         let stage = 'value';
 
+        // Whitespace seen outside a quoted string is held back until a significant
+        // character follows it, so surrounding whitespace can be dropped without
+        // trimming spaces the sender quoted on purpose. Trimming the stored value
+        // instead loses the trailing space in `filename*0="Annual Report "`, which the
+        // next continuation section is meant to be appended to.
+        let pendingSpace = '';
+        let quoteClosed = false;
+
         let quote = false;
         let escaped = false;
         let chr;
 
+        const addChr = c => {
+            if (value.length) {
+                value += pendingSpace;
+            }
+            pendingSpace = '';
+            value += c;
+        };
+
+        const takeValue = () => {
+            const result = value;
+            value = '';
+            pendingSpace = '';
+            quoteClosed = false;
+            return result;
+        };
+
+        // A duplicated parameter resolves to its first occurrence, matching how duplicated
+        // headers are resolved. Letting the last one win means `boundary="b"; boundary="c"`
+        // registers a boundary that no delimiter in the message matches, which drops the
+        // body without an error. hasOwnProperty, because a parameter may be named
+        // `constructor` or `toString`.
+        const storeParam = (name, result) => {
+            if (!Object.prototype.hasOwnProperty.call(response.params, name)) {
+                response.params[name] = result;
+            }
+        };
+
+        const storeValue = () => {
+            const result = takeValue();
+            if (key === false) {
+                response.value = result;
+            } else {
+                storeParam(key, result);
+            }
+        };
+
+        // A parameter name with no `=` is a valueless parameter, not the start of the
+        // next one. Without this the name would keep growing across the `;` and swallow
+        // whatever followed, which is how `x=1; flag; boundary="AAA"` loses its boundary.
+        const storeEmptyKey = () => {
+            const name = takeValue().trim();
+            if (name) {
+                storeParam(name.toLowerCase(), '');
+            }
+        };
+
         for (let i = 0, len = str.length; i < len; i++) {
             chr = str.charAt(i);
             switch (stage) {
                 case 'key':
                     if (chr === '=') {
-                        key = value.trim().toLowerCase();
+                        key = takeValue().trim().toLowerCase();
                         stage = 'value';
-                        value = '';
+                        break;
+                    }
+                    if (chr === ';') {
+                        storeEmptyKey();
                         break;
                     }
                     value += chr;
                     break;
                 case 'value':
                     if (escaped) {
-                        value += chr;
-                    } else if (chr === '\\') {
+                        addChr(chr);
+                    } else if (quote && chr === '\\') {
+                        // backslash only escapes inside a quoted string, everywhere else
+                        // it is an ordinary character. Treating it as an escape turns
+                        // `filename=C:\Users\me\a.txt` into `C:Usersmea.txt`.
                         escaped = true;
                         continue;
                     } else if (quote && chr === quote) {
                         quote = false;
+                        quoteClosed = true;
                     } else if (!quote && chr === '"') {
                         quote = chr;
-                    } else if (!quote && chr === ';') {
-                        if (key === false) {
-                            response.value = value.trim();
-                        } else {
-                            response.params[key] = value.trim();
+                        // whitespace before a quote that opens the value is padding, but
+                        // between a token and a quoted string it is content
+                        if (value.length) {
+                            value += pendingSpace;
                         }
+                        pendingSpace = '';
+                    } else if (!quote && chr === ';') {
+                        storeValue();
                         stage = 'key';
-                        value = '';
-                    } else {
-                        value += chr;
+                    } else if (!quote && (chr === ' ' || chr === '\t')) {
+                        pendingSpace += chr;
+                    } else if (!quoteClosed) {
+                        addChr(chr);
                     }
+                    // Anything else is trailing junk after a closed quoted string. RFC 2045
+                    // says a parameter value is a token or a quoted string, not both, and
+                    // appending the junk is how `boundary="AAA" (unterminated comment`
+                    // turned into a boundary that no delimiter in the message matches.
                     escaped = false;
                     break;
             }
         }
 
         // finalize remainder
-        value = value.trim();
         if (stage === 'value') {
-            if (key === false) {
-                // default value
-                response.value = value;
-            } else {
-                // subkey value
-                response.params[key] = value;
-            }
-        } else if (value) {
+            storeValue();
+        } else {
             // treat as key without value, see emptykey:
             // Header-Key: somevalue; key=value; emptykey
-            response.params[value.toLowerCase()] = '';
+            storeEmptyKey();
         }
 
         if (response.value) {
@@ -839,6 +1103,11 @@ class MimeNode {
         return (
             str
                 .split(/\r?\n/)
+                // remove whitespace stuffing before anything else
+                // http://tools.ietf.org/html/rfc3676#section-4.4
+                // doing it after the join leaves the stuffed space of a continuation line
+                // sitting in the middle of the joined paragraph
+                .map(line => (line.charAt(0) === ' ' ? line.slice(1) : line))
                 // remove soft linebreaks
                 // soft linebreaks are added after space symbols
                 .reduce((previousValue, currentValue) => {
@@ -854,9 +1123,6 @@ class MimeNode {
                         return previousValue + '\n' + currentValue;
                     }
                 })
-                // remove whitespace stuffing
-                // http://tools.ietf.org/html/rfc3676#section-4.4
-                .replace(/^ /gm, '')
         );
     }
 
@@ -875,27 +1141,38 @@ class MimeNode {
     }
 
     processHeaders() {
-        // First pass: merge folded headers (backward iteration)
-        for (let i = this.headerLines.length - 1; i >= 0; i--) {
-            let line = this.headerLines[i];
-            if (i && /^\s/.test(line)) {
-                this.headerLines[i - 1] += '\n' + line;
-                this.headerLines.splice(i, 1);
+        // First pass: group folded continuation lines with the header they belong to.
+        //
+        // Only SP and HTAB continue a header (RFC 5322 3.2.2 WSP). JS `\s` also matches
+        // NBSP, vertical tab, form feed and U+2028, so a line starting with one of those
+        // used to be absorbed into the header above it and disappear from both `headers`
+        // and `headerLines` while a strict parser still sees it as a header of its own.
+        //
+        // Collecting into an array and joining once keeps this linear. Appending onto the
+        // previous string in a backward pass re-scans the joined value on every line,
+        // which is quadratic in the number of folds and lets a message that fits inside
+        // maxHeadersSize burn seconds of CPU.
+        let foldedLines = [];
+        for (let line of this.headerLines) {
+            if (foldedLines.length && /^[ \t]/.test(line)) {
+                foldedLines[foldedLines.length - 1].push(line);
+            } else {
+                foldedLines.push([line]);
             }
         }
 
         // Initialize rawHeaderLines to store unmodified lines
         this.rawHeaderLines = [];
 
-        // Second pass: process headers (MUST be backward to maintain this.headers order)
-        // The existing code iterates backward and postal-mime.js calls .reverse()
-        // We must preserve this behavior to avoid breaking changes
-        for (let i = this.headerLines.length - 1; i >= 0; i--) {
-            let rawLine = this.headerLines[i];
+        let seenContentHeaders = new Set();
+
+        // Second pass: process headers in document order
+        for (let parts of foldedLines) {
+            let rawLine = parts.join('\n');
 
             // Extract key from raw line for rawHeaderLines
             let sep = rawLine.indexOf(':');
-            let rawKey = sep < 0 ? rawLine.trim() : rawLine.substr(0, sep).trim();
+            let rawKey = trimWsp(sep < 0 ? rawLine : rawLine.substr(0, sep));
 
             // Store raw line with lowercase key
             this.rawHeaderLines.push({
@@ -903,31 +1180,44 @@ class MimeNode {
                 line: rawLine
             });
 
-            // Normalize for this.headers (existing behavior - order preserved)
-            let normalizedLine = rawLine.replace(/\s+/g, ' ');
-            sep = normalizedLine.indexOf(':');
-            let key = sep < 0 ? normalizedLine.trim() : normalizedLine.substr(0, sep).trim();
-            let value = sep < 0 ? '' : normalizedLine.substr(sep + 1).trim();
+            // Unfolding removes the line break and keeps the folding whitespace, so
+            // `Subject: Hello\r\n    World` stays `Hello    World`. Collapsing every
+            // whitespace run instead also rewrote boundary values and filenames, and it
+            // replaced the non-ASCII spaces that raw UTF-8 headers (RFC 6532) may carry.
+            let unfoldedLine = parts.join('');
+            sep = unfoldedLine.indexOf(':');
+            let key = trimWsp(sep < 0 ? unfoldedLine : unfoldedLine.substr(0, sep));
+            // A bare CR is not legal in a field body. It used to be folded into a space by
+            // the whitespace collapse, and passing it through would hand consumers that
+            // write the value back out a line of their own.
+            let value = sep < 0 ? '' : trimWsp(unfoldedLine.substr(sep + 1).replace(/[\r\n]+/g, ' '));
             this.headers.push({ key: key.toLowerCase(), originalKey: key, value });
 
-            switch (key.toLowerCase()) {
-                case 'content-type':
-                    if (this.contentType.default) {
+            // A header that decides how the body is read must resolve the same way every
+            // time it is duplicated, otherwise a message can present one Content-Type to a
+            // scanner and a different one here. Every one of these takes the first
+            // occurrence and later copies are ignored.
+            const lowerKey = key.toLowerCase();
+            if (CONTENT_HEADERS.has(lowerKey) && !seenContentHeaders.has(lowerKey)) {
+                seenContentHeaders.add(lowerKey);
+
+                switch (lowerKey) {
+                    case 'content-type':
                         this.contentType = { value, parsed: {} };
-                    }
-                    break;
-                case 'content-transfer-encoding':
-                    this.contentTransferEncoding = { value, parsed: {} };
-                    break;
-                case 'content-disposition':
-                    this.contentDisposition = { value, parsed: {} };
-                    break;
-                case 'content-id':
-                    this.contentId = value;
-                    break;
-                case 'content-description':
-                    this.contentDescription = value;
-                    break;
+                        break;
+                    case 'content-transfer-encoding':
+                        this.contentTransferEncoding = { value, parsed: {} };
+                        break;
+                    case 'content-disposition':
+                        this.contentDisposition = { value, parsed: {} };
+                        break;
+                    case 'content-id':
+                        this.contentId = value;
+                        break;
+                    case 'content-description':
+                        this.contentDescription = value;
+                        break;
+                }
             }
         }
 
@@ -946,10 +1236,13 @@ class MimeNode {
 
         this.contentDisposition.parsed = this.parseStructuredHeader(this.contentDisposition.value);
 
-        this.contentTransferEncoding.encoding = this.contentTransferEncoding.value
+        // Take the first token rather than splitting on the first non-token character.
+        // `split()` returns an empty string for anything that does not start with a word
+        // character, so `(comment) base64` and `"base64"` used to fall through to the
+        // pass-through decoder and hand the caller undecoded base64 as the message body.
+        this.contentTransferEncoding.encoding = (this.stripComments(this.contentTransferEncoding.value)
             .toLowerCase()
-            .split(/[^\w-]/)
-            .shift();
+            .match(/[\w-]+/) || [''])[0];
 
         this.setupContentDecoder(this.contentTransferEncoding.encoding);
     }
@@ -962,14 +1255,17 @@ class MimeNode {
                     return this.processHeaders();
                 }
 
-                this.headerSize += line.length;
+                // Counted across the whole message, not per part. A per-node budget lets a
+                // multipart carry the limit again for every part it declares, so a message
+                // many times over the limit still parses.
+                this.postalMime.headerSize += line.length;
 
-                if (this.headerSize > this.options.maxHeadersSize) {
+                if (this.postalMime.headerSize > this.options.maxHeadersSize) {
                     let error = new Error(`Maximum header size of ${this.options.maxHeadersSize} bytes exceeded`);
                     throw error;
                 }
 
-                this.headerLines.push(defaultDecoder.decode(line));
+                this.headerLines.push(headerDecoder.decode(line));
                 break;
             case 'body': {
                 // add line to body
@@ -3309,6 +3605,30 @@ function htmlToText(str) {
     return str;
 }
 
+// A message date is not always a date. PostalMime keeps the raw header value when it does
+// not parse, and Intl.DateTimeFormat throws a RangeError on that, which used to reject the
+// whole parse of any message carrying a forwarded copy with a broken Date header.
+function formatDate(date) {
+    if (typeof Intl === 'undefined') {
+        return date;
+    }
+
+    const parsed = new Date(date);
+    if (isNaN(parsed.getTime())) {
+        return date;
+    }
+
+    return new Intl.DateTimeFormat('default', {
+        year: 'numeric',
+        month: 'numeric',
+        day: 'numeric',
+        hour: 'numeric',
+        minute: 'numeric',
+        second: 'numeric',
+        hour12: false
+    }).format(parsed);
+}
+
 function formatTextAddress(address) {
     return []
         .concat(address.name || [])
@@ -3414,7 +3734,9 @@ function formatTextHeader(message) {
     let rows = [];
 
     if (message.from) {
-        rows.push({ key: 'From', val: formatTextAddress(message.from) });
+        // through the plural formatter, because `From:` may hold RFC 5322 group syntax
+        // and a group has no address of its own
+        rows.push({ key: 'From', val: formatTextAddresses([message.from]) });
     }
 
     if (message.subject) {
@@ -3422,22 +3744,7 @@ function formatTextHeader(message) {
     }
 
     if (message.date) {
-        let dateOptions = {
-            year: 'numeric',
-            month: 'numeric',
-            day: 'numeric',
-            hour: 'numeric',
-            minute: 'numeric',
-            second: 'numeric',
-            hour12: false
-        };
-
-        let dateStr =
-            typeof Intl === 'undefined'
-                ? message.date
-                : new Intl.DateTimeFormat('default', dateOptions).format(new Date(message.date));
-
-        rows.push({ key: 'Date', val: dateStr });
+        rows.push({ key: 'Date', val: formatDate(message.date) });
     }
 
     if (message.to && message.to.length) {
@@ -3504,7 +3811,9 @@ function formatHtmlHeader(message) {
 
     if (message.from) {
         rows.push(
-            `<div class="postal-email-header-key">From</div><div class="postal-email-header-value">${formatHtmlAddress(message.from)}</div>`
+            // through the plural formatter, because `From:` may hold RFC 5322 group syntax
+            // and a group has no address of its own
+            `<div class="postal-email-header-key">From</div><div class="postal-email-header-value">${formatHtmlAddresses([message.from])}</div>`
         );
     }
 
@@ -3517,25 +3826,10 @@ function formatHtmlHeader(message) {
     }
 
     if (message.date) {
-        let dateOptions = {
-            year: 'numeric',
-            month: 'numeric',
-            day: 'numeric',
-            hour: 'numeric',
-            minute: 'numeric',
-            second: 'numeric',
-            hour12: false
-        };
-
-        let dateStr =
-            typeof Intl === 'undefined'
-                ? message.date
-                : new Intl.DateTimeFormat('default', dateOptions).format(new Date(message.date));
-
         rows.push(
             `<div class="postal-email-header-key">Date</div><div class="postal-email-header-value postal-email-header-date" data-date="${escapeHtml(
                 message.date
-            )}">${escapeHtml(dateStr)}</div>`
+            )}">${escapeHtml(formatDate(message.date))}</div>`
         );
     }
 
@@ -3564,6 +3858,56 @@ function formatHtmlHeader(message) {
     return template;
 }
 
+const WORD_CHAR_REGEX = /\w/;
+const NON_SPACE_TOKEN_REGEX = /[^\s]+/g;
+
+/**
+ * Finds the first address looking token in a run of text.
+ *
+ * This replaces a `\s*\b[^@\s]+@[^\s]+\b\s*` scan over the whole string, which backtracks
+ * quadratically: the leading `\s*` makes every position inside a whitespace run a viable
+ * start, and `[^@\s]+` then gives back one character at a time looking for an '@'. A
+ * single header well inside the default size limit could hold a core busy for minutes.
+ *
+ * Scanning whitespace delimited tokens instead is linear and keeps the word boundary
+ * semantics of the regex: the local part has to open on a word character and the domain
+ * has to end on one.
+ *
+ * @param {String} text Text to search
+ * @return {Object|null} `{index, length, value}` of the address, or null if there is none
+ */
+function findAddressInText(text) {
+    NON_SPACE_TOKEN_REGEX.lastIndex = 0;
+
+    let match;
+    while ((match = NON_SPACE_TOKEN_REGEX.exec(text))) {
+        const token = match[0];
+        const at = token.indexOf('@');
+
+        // `\b[^@\s]+@` needs at least one character before the '@'
+        let start = 0;
+        while (start < at && !WORD_CHAR_REGEX.test(token.charAt(start))) {
+            start++;
+        }
+        if (start >= at) {
+            continue;
+        }
+
+        // `[^\s]+\b` needs at least one character after the '@', ending on a word character
+        let end = token.length;
+        while (end > at + 1 && !WORD_CHAR_REGEX.test(token.charAt(end - 1))) {
+            end--;
+        }
+        if (end <= at + 1) {
+            continue;
+        }
+
+        return { index: match.index + start, length: end - start, value: token.substring(start, end) };
+    }
+
+    return null;
+}
+
 /**
  * Converts tokens for a single address into an address object
  *
@@ -3682,25 +4026,24 @@ function _handleAddress(tokens, depth) {
                 }
             }
 
-            let _regexHandler = function (address) {
-                if (!data.address.length) {
-                    data.address = [address.trim()];
-                    return ' ';
-                } else {
-                    return address;
-                }
-            };
-
             // still no address
             if (!data.address.length) {
                 for (i = data.text.length - 1; i >= 0; i--) {
                     // Security fix: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        // fixed the regex to parse email address correctly when email address has more than one @
-                        data.text[i] = data.text[i].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, _regexHandler).trim();
-                        if (data.address.length) {
+                        // handles an email address that has more than one @
+                        const found = findAddressInText(data.text[i]);
+                        if (found) {
+                            data.address = [found.value];
+                            // the address and the whitespace around it collapse to one space
+                            data.text[i] = (
+                                data.text[i].substring(0, found.index).replace(/\s+$/, '') +
+                                ' ' +
+                                data.text[i].substring(found.index + found.length).replace(/^\s+/, '')
+                            ).trim();
                             break;
                         }
+                        data.text[i] = data.text[i].trim();
                     }
                 }
             }
@@ -3721,7 +4064,10 @@ function _handleAddress(tokens, depth) {
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
 
-        if (!data.address && /^=\?[^=]+?=$/.test(data.text.trim())) {
+        // `^=\?[^=]+?=$` could not match a base64 word whose padding puts an '=' inside it,
+        // so whether a bare encoded word was decoded or left to become the address itself
+        // came down to whether its payload happened to need padding.
+        if (!data.address && isEncodedWordsOnly(data.text.trim())) {
             // try to extract words from text content
             const decodedText = decodeWords(data.text);
             // Security: only re-parse if decoded text contains angle-bracket addresses.
@@ -4085,6 +4431,9 @@ class PostalMime {
         });
         this.boundaries = [];
 
+        // Header bytes seen across every part of this message, see MimeNode.feed
+        this.headerSize = 0;
+
         this.textContent = {};
         this.attachments = [];
 
@@ -4314,7 +4663,9 @@ class PostalMime {
                     }
 
                     if (node.contentDescription) {
-                        attachment.description = node.contentDescription;
+                        // decoded like filename, it is an unstructured header that may
+                        // carry encoded words
+                        attachment.description = decodeWords(node.contentDescription);
                     }
 
                     if (node.contentId) {
@@ -4534,9 +4885,12 @@ class PostalMime {
             buf = await blobToArrayBuffer(buf);
         }
 
-        // Cast Node.js Buffer object or Uint8Array into ArrayBuffer
-        if (buf.buffer instanceof ArrayBuffer) {
-            buf = new Uint8Array(buf).buffer;
+        // Cast a Node.js Buffer, a typed array or a DataView into an ArrayBuffer.
+        // `new Uint8Array(view)` only works for array-likes, so a DataView produced an
+        // empty buffer and the message parsed to nothing without an error. Slicing off
+        // byteOffset also keeps views over a larger buffer from reading their neighbours.
+        if (ArrayBuffer.isView(buf)) {
+            buf = buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
         }
 
         this.buf = buf;
@@ -4553,9 +4907,11 @@ class PostalMime {
         await this.processNodeTree();
 
         const message = {
-            headers: this.root.headers
-                .map(entry => ({ key: entry.key, originalKey: entry.originalKey, value: entry.value }))
-                .reverse()
+            headers: this.root.headers.map(entry => ({
+                key: entry.key,
+                originalKey: entry.originalKey,
+                value: entry.value
+            }))
         };
 
         for (const key of ['from', 'sender']) {
@@ -4624,8 +4980,8 @@ class PostalMime {
 
         message.attachments = this.attachments;
 
-        // Expose raw header lines (reversed to match headers array order)
-        message.headerLines = (this.root.rawHeaderLines || []).slice().reverse();
+        // Expose raw header lines, in the same order as the headers array
+        message.headerLines = (this.root.rawHeaderLines || []).slice();
 
         switch (this.attachmentEncoding) {
             case 'arraybuffer':