@limetech/lime-elements 40.12.0 → 40.12.2

package/dist/esm/limel-file-viewer.entry.js

@@ -1056,6 +1056,8 @@ class QPDecoder {
 // single byte charset, read as windows-1252 rather than as replacement characters, see
 // decodeUtf8OrWindows1252.
 const headerDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
+// number of pieces decodeFlowedText collects before joining them
+const FLOWED_JOIN_INTERVAL = 4096;
 // Trims only the whitespace RFC 5322 allows around a field name. String.prototype.trim
 // also strips U+00A0, U+FEFF, U+2028 and the rest of the Unicode spaces, which turns a
 // line that a strict parser rejects into a canonical field name: a `From:` line with a
@@ -1424,16 +1426,23 @@ class MimeNode {
     // written, so a fixed quoted line comes out exactly as it went in. An unquoted stuffed
     // line loses its stuffing, which is all the stuffing is for.
     decodeFlowedText(str, delSp) {
-        // Pieces of the result, joined once at the end. Growing a single string instead
-        // flattens the whole paragraph again on each line, which is quadratic in the
-        // length of a paragraph.
-        const parts = [];
+        // Pieces of the result. Growing a single string instead flattens the whole
+        // paragraph again on each line, which is quadratic in the length of a paragraph.
+        // `parts` holds an entry or two per line, so it is joined into `chunks` every few
+        // thousand entries to keep memory following the length of the text rather than
+        // the number of lines. Its last entry stays behind, since delsp trims it when
+        // the next line continues the paragraph.
+        const chunks = [];
+        let parts = [];
         // whether the previous line was flowed, and the quote depth of its paragraph
         let flowed = false;
         let depth = 0;
-        const lines = str.split('\n');
-        for (let i = 0; i < lines.length; i++) {
-            const line = lines[i];
+        for (let lineStart = 0; lineStart <= str.length;) {
+            let lineEnd = str.indexOf('\n', lineStart);
+            if (lineEnd < 0) {
+                lineEnd = str.length;
+            }
+            const line = str.slice(lineStart, lineEnd);
             let quoteDepth = 0;
             while (line.charCodeAt(quoteDepth) === 0x3e /* > */) {
                 quoteDepth++;
@@ -1450,15 +1459,22 @@ class MimeNode {
                 parts.push(content);
             }
             else {
-                if (i) {
+                if (lineStart) {
                     parts.push('\n');
                 }
                 parts.push(quoteDepth ? line : content);
             }
             flowed = !isSignature && content.endsWith(' ');
             depth = quoteDepth;
+            if (parts.length >= FLOWED_JOIN_INTERVAL) {
+                const last = parts.pop();
+                chunks.push(parts.join(''));
+                parts = [last];
+            }
+            lineStart = lineEnd + 1;
         }
-        return parts.join('');
+        chunks.push(parts.join(''));
+        return chunks.join('');
     }
     getTextContent() {
         if (!this.content) {
@@ -3976,6 +3992,19 @@ function createFinder(str, regex) {
         return found;
     };
 }
+/**
+ * Runs `process` on the text up to and including the last `>` and appends the rest as is,
+ * for a pass whose every match ends at a `>`. The text after the last `>` can never match
+ * and is where a failing pattern rescans to the end from each candidate.
+ *
+ * @param str String to process
+ * @param process The pass to run
+ * @return Processed string
+ */
+function throughLastTag(str, process) {
+    const end = str.lastIndexOf('>') + 1;
+    return process(str.slice(0, end)) + str.slice(end);
+}
 /**
  * `str.replace(pattern, replacement)` for a pattern shaped like `<tag\b[^>]*>`.
  *
@@ -3989,8 +4018,7 @@ function createFinder(str, regex) {
  * @return Processed string
  */
 function replaceClosedTags(str, pattern, replacement) {
-    const end = str.lastIndexOf('>') + 1;
-    return str.slice(0, end).replace(pattern, replacement) + str.slice(end);
+    return throughLastTag(str, head => head.replace(pattern, replacement));
 }
 /**
  * `str.replace(pattern, replacement)` for a tag pattern that may fail even when a `>`
@@ -4151,7 +4179,10 @@ function htmlToText(str) {
     str = stripThroughLastTag(str, /<!doctype\b/gi);
     str = stripFromFirstTag(str, /<\/body\b/gi);
     str = stripFromFirstTag(str, /<\/html\b/gi);
-    str = replaceTags(str, /<a\b/gi, /<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/iy, (match, href) => ` (${href}) `);
+    // The href capture also matches `>`, so after a link a run with no whitespace or quote
+    // is taken to the end of the input and given back one character at a time, retrying
+    // `[^>]*>` to the end from each, which is quadratic when no `>` follows
+    str = throughLastTag(str, head => replaceTags(head, /<a\b/gi, /<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/iy, (match, href) => ` (${href}) `));
     str = replaceClosedTags(str, /<\/?(span|em|i|strong|b|u|a)\b[^>]*>/gi, '');
     // the whitespace after the tag may run on past the last `>`
     str = replaceTags(str, /<li\b/gi, /<li\b[^>]*>[\n\u0001\s]*/iy, () => '* ');
@@ -5256,6 +5287,23 @@ const MAX_PART_COUNT = 10000;
 // so a small crafted email can exhaust memory (OOM crash). Cap the recursion and
 // treat deeper nested messages as regular attachments instead.
 const MAX_RFC822_NESTING_DEPTH = 10;
+// The From, To, Cc and Bcc of every inline message/rfc822 part are rendered into the
+// text and html of the parent, an address of one or two bytes as some 60 characters of
+// html. maxHeadersSize bounds the header bytes of each nested message on its own, so
+// without a limit counted across all of them the output grows with the number of forwards.
+const MAX_FORWARDED_ADDRESSES = 10000;
+// the number of entries the header formatters render for a list of addresses, a group
+// counted along with each of its members
+function countAddresses(addresses) {
+    if (!addresses) {
+        return 0;
+    }
+    let count = 0;
+    for (const address of Array.isArray(addresses) ? addresses : [addresses]) {
+        count += 1 + (address.group ? address.group.length : 0);
+    }
+    return count;
+}
 // Limit options must be validated rather than falsy-coalesced. `0` would silently
 // restore the default, and a string or NaN disables the limit altogether, because
 // every `size > limit` comparison against such a value is false. Callers that
@@ -5298,6 +5346,10 @@ class PostalMime {
         // It is deliberately not an option, so that forwarding a caller supplied options
         // object can not seed it and switch the recursion limit off.
         this.rfc822NestingDepth = 0;
+        this.maxForwardedAddresses = parseLimitOption(this.options.maxForwardedAddresses, MAX_FORWARDED_ADDRESSES, 'maxForwardedAddresses');
+        // Like rfc822NestingDepth, a nested parser gets the counter of its parent rather
+        // than an option, so that the count runs across the whole message
+        this.forwardedAddresses = { count: 0 };
         // Header bytes seen across every part of this message, see MimeNode.feed, and the
         // number of parts created for it, the root included, see the MimeNode constructor
         this.headerSize = 0;
@@ -5478,11 +5530,22 @@ class PostalMime {
             // is classified stay with the parser that was configured.
             ...this.mimeOptions,
             maxRfc822NestingDepth: this.maxRfc822NestingDepth,
+            maxForwardedAddresses: this.maxForwardedAddresses,
             // attachments are encoded by the parent parser, keep raw buffers here
             attachmentEncoding: 'arraybuffer'
         });
         subParser.rfc822NestingDepth = this.rfc822NestingDepth + 1;
+        subParser.forwardedAddresses = this.forwardedAddresses;
         const subMessage = (node.subMessage = await subParser.parse(node.content || new ArrayBuffer(0)));
+        // counted before the header block below is rendered into the text and html
+        this.forwardedAddresses.count +=
+            countAddresses(subMessage.from) +
+                countAddresses(subMessage.to) +
+                countAddresses(subMessage.cc) +
+                countAddresses(subMessage.bcc);
+        if (this.forwardedAddresses.count > this.maxForwardedAddresses) {
+            throw new Error(`Maximum forwarded address count of ${this.maxForwardedAddresses} addresses exceeded`);
+        }
         // default to text if there is no content
         if (subMessage.text || !subMessage.html) {
             this.addTextEntry(node, 'plain', { type: 'subMessage', value: subMessage });

package/dist/esm/limel-helper-line_3.entry.js

@@ -2,7 +2,7 @@ import { r as registerInstance, h, H as Host, c as createEvent, a as getElement
 import { a as MDCList, s as strings } from './component-kP1jCDLp.js';
 import './ponyfill-6YuZiAPi.js';
 
-const helperLineCss = () => `:host(limel-helper-line){transition:opacity 0.2s ease;box-sizing:border-box;display:grid;min-width:0;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;font-size:0.6875rem;line-height:normal;color:rgb(var(--contrast-1200))}div{display:flex;justify-content:space-between;gap:0.75rem;overflow:hidden;padding:0 1rem}:host(limel-helper-line.invalid){--limel-h-l-grid-template-rows-transition-speed:0.46s;--limel-h-l-grid-template-rows:1fr}:host(limel-helper-line.invalid) .helper-text{color:var(--limel-theme-error-color)}.counter{flex-shrink:0;margin-left:auto}.helper-text,.counter{padding-top:0.125rem}:host(limel-helper-line){transition:grid-template-rows var(--limel-h-l-grid-template-rows-transition-speed, 0.46s) cubic-bezier(1, 0.09, 0, 0.89);grid-template-rows:var(--limel-h-l-grid-template-rows, 1fr)}:host(limel-helper-line.hide){--limel-h-l-grid-template-rows-transition-speed:0.3s;--limel-h-l-grid-template-rows:0fr}`;
+const helperLineCss = () => `limel-helper-line{box-sizing:border-box;display:grid;min-width:0;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;font-size:0.6875rem;line-height:normal;color:rgb(var(--contrast-1200));transition:grid-template-rows var(--limel-h-l-grid-template-rows-transition-speed, 0.46s) cubic-bezier(1, 0.09, 0, 0.89);grid-template-rows:var(--limel-h-l-grid-template-rows, 1fr)}limel-helper-line>div{display:flex;justify-content:space-between;gap:0.75rem;overflow:hidden;padding:0 1rem}limel-helper-line.invalid{--limel-h-l-grid-template-rows-transition-speed:0.46s;--limel-h-l-grid-template-rows:1fr}limel-helper-line.invalid .helper-text{color:var(--limel-theme-error-color)}limel-helper-line .counter{flex-shrink:0;margin-left:auto}limel-helper-line .helper-text,limel-helper-line .counter{padding-top:0.125rem}limel-helper-line.hide{--limel-h-l-grid-template-rows-transition-speed:0.3s;--limel-h-l-grid-template-rows:0fr}`;
 
 const HelperLine = class {
     constructor(hostRef) {
@@ -32,9 +32,9 @@ const HelperLine = class {
         };
     }
     render() {
-        return (h(Host, { key: '69872d6dcdbecf1d703a9fb441f118f9389596bc', tabIndex: -1, class: {
+        return (h(Host, { key: 'ac3dcfadd4d281bf64bce4124602279eef598d87', tabIndex: -1, class: {
                 invalid: this.invalid,
-            }, style: this.hasContent() ? {} : { display: 'none' }, "aria-hidden": !this.hasContent() }, h("div", { key: 'bf63441b2481b1d91fae50d7f85630e361fb2089' }, this.renderHelperText(), this.renderCharacterCounter())));
+            }, style: this.hasContent() ? {} : { display: 'none' }, "aria-hidden": !this.hasContent() }, h("div", { key: '80aaa762e38841ed13a880cc5444c8aa23025130' }, this.renderHelperText(), this.renderCharacterCounter())));
     }
 };
 HelperLine.style = helperLineCss();

package/dist/esm/limel-list-item.entry.js

@@ -2,7 +2,7 @@ import { r as registerInstance, h, H as Host } from './index-BU9IJqli.js';
 import { g as getIconName } from './get-icon-props-CgNJbSP4.js';
 import { c as createRandomString } from './random-string-BrjD-ITe.js';
 import { r as renderListComponent } from './render-list-component-J1IzNpbv.js';
-import { C as CheckboxTemplate } from './checkbox.template-IDyv2bgn.js';
+import { C as CheckboxTemplate } from './checkbox.template-BFL4SMzl.js';
 import { t as translations } from './translations-UrIr-5_D.js';
 import { I as ImageTemplate } from './image.template-BGjw97m_.js';
 import './language-ChagAaNf.js';