@limetech/lime-elements 40.13.1 → 40.14.1

package/dist/cjs/limel-file-viewer.cjs.entry.js

@@ -4406,6 +4406,83 @@ function formatHtmlHeader(message) {
     return template;
 }
 
+/** The token is an operator, a text run otherwise */
+const TOKEN_OPERATOR = 1;
+/** The next character continues the same run without whitespace in between */
+const TOKEN_NO_BREAK = 2;
+/** The text run holds characters its value leaves out or changes, so it is no plain slice */
+const TOKEN_DIRTY = 4;
+/** A backslash escapes the next character in the text run, inside a quoted string or a comment */
+const TOKEN_ESCAPES = 8;
+/** The text run opens on a character an escaping backslash in front of it has escaped */
+const TOKEN_STARTS_ESCAPED = 16;
+/**
+ * The tokens of an address field, kept as offsets into it.
+ *
+ * Every token used to be an object of its own, an operator for every ',' and a value string
+ * for every run of text, and a list of one letter names, 'a,a,a,...', took some 65 times its
+ * size in tokens before any address was read. A token is now three numbers in one typed
+ * array, its kind and the range of the field it covers, and its value is sliced off the field
+ * when it is read. The few text runs whose value differs from their slice, as they hold an
+ * escaping backslash, a line break or a control character, are rebuilt once and kept aside.
+ */
+class TokenList {
+    constructor(str) {
+        this.str = str;
+        this.slots = new Int32Array(48);
+        this.length = 0;
+        this.cleaned = new Map();
+    }
+    /**
+     * Appends a token
+     *
+     * @param kind Kind and flags of the token
+     * @param start Offset of its first character
+     * @param end Offset just past its last character
+     * @return Index of the token
+     */
+    push(kind, start, end) {
+        if ((this.length + 1) * 3 > this.slots.length) {
+            const grown = new Int32Array(this.slots.length * 2);
+            grown.set(this.slots);
+            this.slots = grown;
+        }
+        const at = this.length * 3;
+        this.slots[at] = kind;
+        this.slots[at + 1] = start;
+        this.slots[at + 2] = end;
+        return this.length++;
+    }
+    /**
+     * The character of an operator token, an empty string for a text run
+     */
+    operatorAt(index) {
+        const at = index * 3;
+        return this.slots[at] & TOKEN_OPERATOR ? this.str.charAt(this.slots[at + 1]) : '';
+    }
+    /**
+     * Whether a token is an operator
+     */
+    isOperator(index) {
+        return (this.slots[index * 3] & TOKEN_OPERATOR) !== 0;
+    }
+    /**
+     * Whether the next character continues the run of a token without whitespace in between
+     */
+    noBreak(index) {
+        return (this.slots[index * 3] & TOKEN_NO_BREAK) !== 0;
+    }
+    /**
+     * Value of a token
+     */
+    value(index) {
+        const cleaned = this.cleaned.get(index);
+        if (cleaned !== undefined) {
+            return cleaned;
+        }
+        return this.str.slice(this.slots[index * 3 + 1], this.slots[index * 3 + 2]);
+    }
+}
 /**
  * Any whitespace, the test for an angle-addr that needs recovering
  */
@@ -4419,6 +4496,23 @@ const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
  * One run holding a single '@' and no whitespace, the shape an addr-spec has to have
  */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+ * The same with a domain literal for the domain, which may hold an '@' of its own
+ */
+const LITERAL_ADDR_SPEC = /^[^@\s]+@\[[^[\]\\\s]*\]$/;
+/**
+ * The '@' and domain that follow a quoted local part in the same run
+ */
+const QUOTED_LOCAL_DOMAIN = /^@(?:[^@\s"]+|\[[^[\]\\\s]*\])$/;
+/**
+ * Whether a whitespace free run reads as an addr-spec under the strict grammar
+ *
+ * @param value Run to check
+ * @return true when it does
+ */
+function isAddrSpec(value) {
+    return ADDR_SPEC.test(value) || LITERAL_ADDR_SPEC.test(value);
+}
 /**
  * The looser reading applied once the strict one finds nothing, which tolerates the
  * further '@' that a domain should not have but malformed headers carry anyway
@@ -4429,6 +4523,22 @@ const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
  * on purpose: it is only run at the offset looseAddressStart picks, see there.
  */
 const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
+ * in front of the literal is the one that splits the domain off, not the last one: reading
+ * 'a@[x@evil.com]' at its last '@' made it an address at evil.com.
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Offset of the '@' that splits the domain off an address, or -1 when there is none
+ *
+ * @param address Address to split
+ * @return Offset of the '@'
+ */
+function domainAt(address) {
+    const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+    return literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
+}
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *
@@ -4442,7 +4552,7 @@ const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
  * @return Address with the local part as a quoted-string
  */
 function quoteLocalPart(address) {
-    const lastAt = address.lastIndexOf('@');
+    const lastAt = domainAt(address);
     if (lastAt < 0) {
         // no domain to split off, nothing can be misrouted
         return address;
@@ -4502,6 +4612,62 @@ function indexOfAt(text, from, to) {
     }
     return -1;
 }
+/**
+ * A quoted-string a value opens with
+ */
+const LEADING_QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"/;
+/**
+ * Drops the whitespace on either side of the '@' at an offset.
+ *
+ * obs-local-part and obs-domain allow CFWS around the '@' (RFC 5322 4.4), so 'user @ good.com'
+ * names user@good.com. Kept, the whitespace became part of the address as '"user "@ good.com'.
+ * The scan is by index, a pattern such as /\s+@/ backtracks over a long whitespace run that
+ * no '@' follows.
+ *
+ * @param value Value holding the '@'
+ * @param at Offset of the '@', or -1
+ * @return The value with the whitespace beside that '@' removed
+ */
+function joinAtSpacing(value, at) {
+    if (at < 0) {
+        return value;
+    }
+    let start = at;
+    while (start > 0 && isSpaceCode(value.charCodeAt(start - 1))) {
+        start--;
+    }
+    let end = at + 1;
+    while (end < value.length && isSpaceCode(value.charCodeAt(end))) {
+        end++;
+    }
+    return start === at && end === at + 1 ? value : value.slice(0, start) + '@' + value.slice(end);
+}
+/**
+ * Drops the whitespace beside the '@' that splits the domain off a value. That is the '@'
+ * right after a quoted local part the value opens with, or else the only '@' it holds outside
+ * any quoted string. With several it is not clear which one the whitespace belongs to, and
+ * '<x@evil.com @good.com>' is left to the addr-spec recovery to read as it always has.
+ *
+ * @param value Value to clean up
+ * @return The value with the whitespace beside that '@' removed
+ */
+function collapseAtSpacing(value) {
+    const quoted = LEADING_QUOTED_STRING.exec(value);
+    if (quoted) {
+        let at = quoted[0].length;
+        while (at < value.length && isSpaceCode(value.charCodeAt(at))) {
+            at++;
+        }
+        if (value.charAt(at) === '@' && value.indexOf('@', at + 1) < 0) {
+            return joinAtSpacing(value, at);
+        }
+    }
+    const at = value.indexOf('@');
+    if (at < 0 || value.indexOf('@', at + 1) >= 0 || value.lastIndexOf('"') > at) {
+        return value;
+    }
+    return joinAtSpacing(value, at);
+}
 /**
  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
  *
@@ -4591,6 +4757,7 @@ function looseAddressStart(text) {
  * @return The address and the display text, with any leftovers moved to the text
  */
 function recoverAddrSpec(address, text) {
+    address = collapseAtSpacing(address);
     if (!HAS_WHITESPACE.test(address)) {
         return { address, text };
     }
@@ -4616,7 +4783,7 @@ function recoverAddrSpec(address, text) {
             return { address, text };
         }
         const parts = address.split(/\s+/);
-        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        let addrIndex = parts.findIndex(isAddrSpec);
         if (addrIndex < 0) {
             addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
         }
@@ -4641,7 +4808,16 @@ function recoverAddrSpec(address, text) {
  * consumer stripping the comment reads as 'user@example.comevil.com'. A comment is folding
  * whitespace, so it is read as a space that splits two atoms and as nothing next to an '@',
  * the same rule the token walk applies outside the brackets. Quoted strings and domain
- * literals are copied through untouched, a '(' in there is not a comment.
+ * literals are copied through untouched, a '(' in there is not a comment. An unexpected '<'
+ * outside them drops everything in front of it, comments included.
+ *
+ * RFC 822 also let an angle-addr name the relays to go through in front of the mailbox,
+ * '<@relay1,@relay2:user@example.com>', which RFC 5322 still parses as obs-route. The route
+ * is not part of the mailbox, and folded into the local part it made
+ * '"@relay1,@relay2:user"@example.com' a recipient that does not exist. A local part can not
+ * start with '@', so contents that do, up to the first ':' outside a domain literal and in
+ * front of any quoted string, are a route and are dropped, as long as a mailbox with an '@'
+ * of its own follows.
  *
  * @param address Contents of the angle brackets
  * @return The address with the comments removed, and the text of the comments
@@ -4655,6 +4831,16 @@ function stripAddressComments(address) {
     // carried along rather than read back off the growing result, which would flatten it on
     // every comment (see lastChars in _handleAddress)
     let lastChar = '';
+    // A comment that just closed stands for a space, written once the next character shows
+    // whether one is wanted: not beside an '@', and not on top of whitespace that follows.
+    // Deciding on the spot saw only the character right after the ')', so a second comment
+    // in a row hid the '@' behind it and 'a(x)(y)@b' read as 'a @b'
+    let pendingSpace = false;
+    // first character of the result and whether a quoted string has opened since, which
+    // together tell a route from a local part
+    let firstChar = '';
+    let quoteSeen = false;
+    let routeEnd = -1;
     for (let i = 0, len = address.length; i < len; i++) {
         const chr = address.charAt(i);
         if (depth) {
@@ -4668,16 +4854,20 @@ function stripAddressComments(address) {
             else if (chr === ')' && !--depth) {
                 comments.push(comment.trim());
                 comment = '';
-                if (lastChar !== '@' && address.charAt(i + 1) !== '@') {
-                    result += ' ';
-                    lastChar = ' ';
-                }
+                pendingSpace = lastChar !== '@';
             }
             else {
                 comment += chr;
             }
             continue;
         }
+        if (pendingSpace && chr !== '(') {
+            pendingSpace = false;
+            if (chr !== '@' && chr !== '<' && !isSpaceCode(address.charCodeAt(i))) {
+                result += ' ';
+                lastChar = ' ';
+            }
+        }
         if (closer) {
             if (chr === '\\' && closer === '"' && i < len - 1) {
                 result += chr + address.charAt(++i);
@@ -4690,6 +4880,10 @@ function stripAddressComments(address) {
         }
         else if (chr === '"') {
             closer = '"';
+            quoteSeen = true;
+        }
+        else if (chr === ':' && routeEnd < 0 && firstChar === '@' && !quoteSeen) {
+            routeEnd = result.length + 1;
         }
         else if (chr === '[') {
             closer = ']';
@@ -4698,8 +4892,27 @@ function stripAddressComments(address) {
             depth = 1;
             continue;
         }
+        else if (chr === '<') {
+            // Apple Mail drops everything between an unexpected '<' and the address after it.
+            // Read here rather than off the raw brackets so that a '<' inside a quoted string,
+            // a comment or a domain literal stays where it is: '<"a<b"@victim.com>' cut at
+            // the first '<' left the address 'b"@victim.com'
+            result = '';
+            lastChar = '';
+            comments.length = 0;
+            firstChar = '';
+            quoteSeen = false;
+            routeEnd = -1;
+            continue;
+        }
         result += chr;
         lastChar = chr;
+        if (!firstChar && !isSpaceCode(address.charCodeAt(i))) {
+            firstChar = chr;
+        }
+    }
+    if (routeEnd >= 0 && result.indexOf('@', routeEnd) >= 0) {
+        result = result.slice(routeEnd);
     }
     if (depth) {
         // an unterminated comment runs to the end of the address
@@ -4742,37 +4955,43 @@ function hasAngleAddress(text) {
     return false;
 }
 /**
- * Converts tokens for a single address into an address object
+ * Walks the tokens of one entry of an address list and sorts them into the runs of display
+ * text, angle-addr and comment they belong to
  *
- * @param tokens Tokens object
- * @param depth Current recursion depth for nested group protection
- * @return Address objects
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of the entry
+ * @param to Index just past the last token of the entry
+ * @return The collected runs, and whether the display text came out of a comment
  */
-function _handleAddress(tokens, depth) {
-    let isGroup = false;
+function collectAddressParts(tokens, from, to) {
     let state = 'text';
-    let addresses = [];
     let data = {
         address: [],
         comment: [],
-        group: [],
         text: [],
-        textWasQuoted: [] // Track which text tokens came from inside quotes
+        textWasQuoted: [], // Track which text tokens came from inside quotes
+        // For a text run that is a quoted local part followed by the unquoted '@' and domain
+        // of an addr-spec, '"user"@example.com', the length of the local part, -1 otherwise
+        quotedLocalAt: []
     };
+    // whether the last text run holds nothing but quoted text so far, which is what a quoted
+    // local part is until the '@' after it joins the run
+    let lastTextPureQuoted = false;
     let i;
-    let len;
     let insideQuotes = false; // Track if we're currently inside a quoted string
     // Last character of the run each state is currently accumulating. Reading it back off
     // the accumulator with slice(-1) makes the engine flatten the whole growing string on
     // every token, which is quadratic over an address built from many comment-joined atoms.
     // A run only ever grows by the token appended below, so the character is carried along.
-    const lastChars = { address: '', comment: '', group: '', text: '' };
+    const lastChars = { address: '', comment: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
-    for (i = 0, len = tokens.length; i < len; i++) {
-        let token = tokens[i];
-        let prevToken = i ? tokens[i - 1] : null;
-        if (token.type === 'operator') {
-            switch (token.value) {
+    for (i = from; i < to; i++) {
+        const value = tokens.value(i);
+        // the operator in front of this token, if there is one, and whether it runs on into it
+        const prevOperator = i > from ? tokens.operatorAt(i - 1) : '';
+        const prevNoBreak = i > from && tokens.noBreak(i - 1);
+        if (tokens.isOperator(i)) {
+            switch (value) {
                 case '<':
                     state = 'address';
                     insideQuotes = false;
@@ -4781,11 +5000,6 @@ function _handleAddress(tokens, depth) {
                     state = 'comment';
                     insideQuotes = false;
                     break;
-                case ':':
-                    state = 'group';
-                    isGroup = true;
-                    insideQuotes = false;
-                    break;
                 case '"':
                     // Track quote state for text tokens
                     insideQuotes = !insideQuotes;
@@ -4797,205 +5011,225 @@ function _handleAddress(tokens, depth) {
                     break;
             }
         }
-        else if (token.value) {
+        else {
             // An empty quoted string is dropped by the tokenizer, leaving no text token of its
             // own to record the quoting on, so the pair of quote operators right in front of
             // this token is all that is left of it and the run it opens carries the quoting
             // instead. Without this '""@example.com' reads as the bare '@example.com'. It only
             // ever opens a run: a run already holding unquoted text is not a quoted string
-            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
-            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
-                prevToken.value === '"' &&
-                !!prevToken.noBreak &&
-                prevPrevToken?.type === 'operator' &&
-                prevPrevToken.value === '"';
-            if (state === 'address') {
-                // handle use case where unquoted name includes a "<"
-                // Apple Mail truncates everything between an unexpected < and an address
-                // and so will we
-                token.value = token.value.replace(/^[^<]*<\s*/, '');
-            }
+            const opensAfterEmptyQuotedString = prevOperator === '"' && prevNoBreak && i > from + 1 && tokens.operatorAt(i - 2) === '"';
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
             // name a domain the sender never wrote.
-            const joins = prevToken &&
-                prevToken.noBreak &&
+            const joins = prevNoBreak &&
                 data[state].length &&
-                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
+                (prevOperator !== ')' || lastChars[state] === '@' || value.charAt(0) === '@');
             if (joins) {
                 // join values
-                data[state][data[state].length - 1] += token.value;
+                const last = data[state].length - 1;
+                if (state === 'text' && !insideQuotes) {
+                    if (lastTextPureQuoted && value.charAt(0) === '@') {
+                        data.quotedLocalAt[last] = data.text[last].length;
+                    }
+                    lastTextPureQuoted = false;
+                }
+                data[state][last] += value;
                 if (state === 'text' && insideQuotes) {
-                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+                    data.textWasQuoted[last] = true;
                 }
             }
             else {
-                data[state].push(token.value);
+                data[state].push(value);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+                    // an empty quoted string leaves no text of its own, so the '@' opens the run
+                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && value.charAt(0) === '@' ? 0 : -1);
+                    lastTextPureQuoted = insideQuotes;
                 }
             }
-            lastChars[state] = token.value.charAt(token.value.length - 1);
+            lastChars[state] = value.charAt(value.length - 1);
         }
     }
-    // If there is no text but a comment, replace the two
+    // If there is no text but a comment, replace the two. A comment is never part of a
+    // mailbox, so text that came out of one only ever names it: reading an address out of it
+    // made '(a@evil.com)' a recipient where no conformant reading has a mailbox at all
+    let textFromComment = false;
     if (!data.text.length && data.comment.length) {
         data.text = data.comment;
         data.comment = [];
+        textFromComment = true;
     }
-    if (isGroup) {
-        // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
-        const text = data.text.join(' ');
-        // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
-        let groupMembers = [];
-        if (data.group.length) {
-            let parsedGroup = parseAddressList(data.group.join(','), depth + 1);
-            // Flatten: if any member is itself a group, extract its members into the sequence
-            parsedGroup.forEach(member => {
-                if (member.group) {
-                    // Nested group detected - flatten it by adding its members directly
-                    for (const nestedMember of member.group) {
-                        groupMembers.push(nestedMember);
-                    }
-                }
-                else {
-                    groupMembers.push(member);
-                }
-            });
-        }
-        addresses.push({
-            name: decodeWords(text),
-            group: groupMembers
-        });
-    }
-    else {
-        // Comments come out of the angle-addr before anything asks whether one was found, so
-        // that brackets holding nothing but a comment read the same as empty ones
-        const addressComments = [];
-        const addressParts = [];
-        for (const part of data.address) {
-            if (part.indexOf('(') < 0) {
-                addressParts.push(part);
-                continue;
-            }
-            const stripped = stripAddressComments(part);
-            for (const comment of stripped.comments) {
-                addressComments.push(comment);
-            }
-            if (stripped.address) {
-                addressParts.push(stripped.address);
+    return { data, textFromComment };
+}
+/**
+ * Name of a group, from the tokens in front of its ':'. A comment names it when no text
+ * does, as it names a mailbox.
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token in front of the ':'
+ * @param to Index of the ':'
+ * @return Decoded name of the group
+ */
+function groupName(tokens, from, to) {
+    // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
+    return decodeWords(collectAddressParts(tokens, from, to).data.text.join(' '));
+}
+/**
+ * Converts tokens for a single address into an address object. An address that is nothing
+ * but an encoded word holding an angle-addr is parsed again once decoded, which can give
+ * more than one entry.
+ *
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of this address
+ * @param to Index just past the last token of this address
+ * @param depth Current recursion depth of the encoded word re-parse
+ * @return Address objects
+ */
+function _handleAddress(tokens, from, to, depth) {
+    const collected = collectAddressParts(tokens, from, to);
+    const data = collected.data;
+    let textFromComment = collected.textFromComment;
+    let i;
+    // Comments come out of the angle-addr before anything asks whether one was found, so
+    // that brackets holding nothing but a comment read the same as empty ones
+    const addressComments = [];
+    const addressParts = [];
+    for (const part of data.address) {
+        const stripped = stripAddressComments(part);
+        for (const comment of stripped.comments) {
+            addressComments.push(comment);
+        }
+        if (stripped.address) {
+            addressParts.push(stripped.address);
+        }
+    }
+    data.address = addressParts;
+    // If no address was found, try to detect one from regular text
+    if (!data.address.length && data.text.length && !textFromComment) {
+        // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
+        // tiers read the collapsed runs, and only a run an address comes out of is replaced
+        // by its collapsed form, the display text keeps its spacing
+        const candidates = data.text.map(part => collapseAtSpacing(part));
+        // The first addr-spec in the text is the mailbox, as it is for a conformant parser
+        // reading as far as it can. Taking the last one let a comment part two of them and
+        // pick the second, 'user@good.com (x) evil@evil.com' named evil.com, while the
+        // same two without the comment, one run, named good.com
+        for (i = 0; i < data.text.length; i++) {
+            // Security fix: Do not extract email addresses from quoted strings
+            // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com
+            // Extracting emails from quoted text leads to misrouting vulnerabilities
+            // A run that is a quoted local part with its '@' and domain is an addr-spec of
+            // its own, with the quoting put back on, and takes its turn like any other
+            const local = data.quotedLocalAt[i];
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
+                ? quoteLocalPart(data.text[i])
+                : '';
+            if (quotedLocal || (!data.textWasQuoted[i] && isAddrSpec(candidates[i]))) {
+                data.address = [quotedLocal || candidates[i]];
+                data.text.splice(i, 1);
+                data.textWasQuoted.splice(i, 1);
+                data.quotedLocalAt.splice(i, 1);
+                break;
             }
         }
-        data.address = addressParts;
-        // If no address was found, try to detect one from regular text
-        if (!data.address.length && data.text.length) {
-            for (i = data.text.length - 1; i >= 0; i--) {
+        // still no address
+        if (!data.address.length) {
+            for (i = 0; i < data.text.length; i++) {
                 // Security fix: Do not extract email addresses from quoted strings
-                // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com
-                // Extracting emails from quoted text leads to misrouting vulnerabilities
-                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
-                    data.address = data.text.splice(i, 1);
-                    data.textWasQuoted.splice(i, 1);
-                    break;
-                }
-            }
-            // still no address
-            if (!data.address.length) {
-                for (i = data.text.length - 1; i >= 0; i--) {
-                    // Security fix: Do not extract email addresses from quoted strings
-                    if (!data.textWasQuoted[i]) {
-                        // handles an email address that has more than one @
-                        const part = data.text[i];
-                        const start = looseAddressStart(part);
-                        if (start >= 0) {
-                            LOOSE_TEXT_ADDR.lastIndex = start;
-                            const match = LOOSE_TEXT_ADDR.exec(part);
-                            if (match) {
-                                data.address = [match[0].trim()];
-                                // the match takes the whitespace around the address along, so
-                                // the text on either side is joined with a single space
-                                data.text[i] = (part.slice(0, start) +
-                                    ' ' +
-                                    part.slice(start + match[0].length)).trim();
-                                break;
-                            }
+                if (!data.textWasQuoted[i]) {
+                    // handles an email address that has more than one @. The strict tier
+                    // found nothing, so it spliced nothing and the indexes still line up
+                    const part = candidates[i];
+                    const start = looseAddressStart(part);
+                    if (start >= 0) {
+                        LOOSE_TEXT_ADDR.lastIndex = start;
+                        const match = LOOSE_TEXT_ADDR.exec(part);
+                        if (match) {
+                            data.address = [match[0].trim()];
+                            // the match takes the whitespace around the address along, so
+                            // the text on either side is joined with a single space
+                            data.text[i] = (part.slice(0, start) + ' ' + part.slice(start + match[0].length)).trim();
+                            break;
                         }
-                        data.text[i] = part.trim();
                     }
+                    data.text[i] = data.text[i].trim();
                 }
             }
         }
-        // If there's still no text but a comment exists, replace the two
-        if (!data.text.length && data.comment.length) {
-            data.text = data.comment;
-            data.comment = [];
-        }
-        // Keep only the first address occurrence, push others to regular text
-        if (data.address.length > 1) {
-            data.text = data.text.concat(data.address.splice(1));
-        }
-        // An address is only taken from unquoted text, so anything left in the text at this
-        // point that still has to serve as the address carries its quoting in this flag
-        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
-        // Join values with spaces
-        let text = data.text.join(' ');
-        let addressValue = data.address.join(' ');
-        // `^=\?[^=]+?=$` could not match a base64 word whose padding puts an '=' inside it,
-        // so whether a bare encoded word was decoded or left to become the address itself
-        // came down to whether its payload happened to need padding.
-        if (!addressValue && isEncodedWordsOnly(text.trim())) {
-            // try to extract words from text content
-            const decodedText = decodeWords(text);
-            // Security: only re-parse if decoded text contains angle-bracket addresses.
-            // Without this, a bare encoded email (e.g. =?utf-8?B?dGVzdEBldmlsLmNv?=)
-            // would be fabricated into an address from attacker-controlled input. A quoted
-            // encoded word is never re-parsed, addresses are not taken out of quoted strings
-            if (!addressFromQuotedText && hasAngleAddress(decodedText)) {
-                const parsedSubAddresses = parseAddressList(decodedText, depth + 1);
-                if (parsedSubAddresses.length) {
-                    return parsedSubAddresses;
-                }
-            }
-            // No usable address found - treat decoded text as display name only
-            return [{ address: '', name: decodedText }];
-        }
-        if (addressFromQuotedText && text.indexOf('@') >= 0) {
-            // The mailbox is still sitting in the text, so it moves over here and is quoted
-            // before the recovery below rather than after it. Anything else the text holds
-            // came along with it: a comment ends the domain but leaves the atoms behind it in
-            // the same text, so '"user"@example.com(x)evil.com' would otherwise hand on
-            // 'user@example.com evil.com', a second domain riding along in a value that is no
-            // addr-spec at all. Putting the quotes back first is what lets the recovery tell
-            // the whitespace a quoted local part may carry from the wreckage trailing one
-            addressValue = quoteLocalPart(text);
-            text = '';
-        }
-        ({ address: addressValue, text } = recoverAddrSpec(addressValue, text));
-        // a comment names the mailbox only when nothing else does, as one outside the brackets
-        if (!text && addressComments.length) {
-            text = addressComments.join(' ');
-        }
-        const rawName = text || addressValue || '';
-        const address = {
-            address: addressValue || text || '',
-            name: decodeWords(rawName)
-        };
-        // The raw comparison is the check Nodemailer makes, it holds when a single source
-        // filled both fields. The decoded one is added because postal-mime decodes names,
-        // which also catches a name that decodes to the address itself. Comparing only the
-        // decoded name kept a name that mixes an encoded word with plain text as the address
-        if (address.address === rawName || address.address === address.name) {
-            if (address.address.match(/@/)) {
-                address.name = '';
-            }
-            else {
-                address.address = '';
+    }
+    // If there's still no text but a comment exists, replace the two
+    if (!data.text.length && data.comment.length) {
+        data.text = data.comment;
+        data.comment = [];
+    }
+    // Keep only the first address occurrence, push others to regular text
+    if (data.address.length > 1) {
+        data.text = data.text.concat(data.address.splice(1));
+    }
+    // An address is only taken from unquoted text, so anything left in the text at this
+    // point that still has to serve as the address carries its quoting in this flag
+    const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
+    // Join values with spaces
+    let text = data.text.join(' ');
+    let addressValue = data.address.join(' ');
+    // `^=\?[^=]+?=$` could not match a base64 word whose padding puts an '=' inside it,
+    // so whether a bare encoded word was decoded or left to become the address itself
+    // came down to whether its payload happened to need padding.
+    if (!addressValue && isEncodedWordsOnly(text.trim())) {
+        // try to extract words from text content
+        const decodedText = decodeWords(text);
+        // Security: only re-parse if decoded text contains angle-bracket addresses.
+        // Without this, a bare encoded email (e.g. =?utf-8?B?dGVzdEBldmlsLmNv?=)
+        // would be fabricated into an address from attacker-controlled input. A quoted
+        // encoded word is never re-parsed, addresses are not taken out of quoted strings
+        // and neither is one that came out of a comment
+        if (!addressFromQuotedText && !textFromComment && hasAngleAddress(decodedText)) {
+            const parsedSubAddresses = parseAddressList(decodedText, depth + 1);
+            if (parsedSubAddresses.length) {
+                return parsedSubAddresses;
             }
         }
-        addresses.push(address);
+        // No usable address found - treat decoded text as display name only
+        return [{ address: '', name: decodedText }];
+    }
+    if (addressFromQuotedText && text.indexOf('@') >= 0) {
+        // The mailbox is still sitting in the text, so it moves over here and is quoted
+        // before the recovery below rather than after it. Anything else the text holds
+        // came along with it: a comment ends the domain but leaves the atoms behind it in
+        // the same text, so '"user"@example.com(x)evil.com' would otherwise hand on
+        // 'user@example.com evil.com', a second domain riding along in a value that is no
+        // addr-spec at all. Putting the quotes back first is what lets the recovery tell
+        // the whitespace a quoted local part may carry from the wreckage trailing one
+        // The quotes are gone at this point, so the '@' the domain splits off at is the
+        // last one, not the single one collapseAtSpacing insists on
+        addressValue = quoteLocalPart(joinAtSpacing(text, domainAt(text)));
+        text = '';
+    }
+    ({ address: addressValue, text } = recoverAddrSpec(addressValue, text));
+    // a comment names the mailbox only when nothing else does, as one outside the brackets
+    if (!text && addressComments.length) {
+        text = addressComments.join(' ');
+        textFromComment = true;
+    }
+    const rawName = text || addressValue || '';
+    const address = {
+        address: addressValue || (textFromComment ? '' : text) || '',
+        name: decodeWords(rawName)
+    };
+    // The raw comparison is the check Nodemailer makes, it holds when a single source
+    // filled both fields. The decoded one is added because postal-mime decodes names,
+    // which also catches a name that decodes to the address itself. Comparing only the
+    // decoded name kept a name that mixes an encoded word with plain text as the address
+    if (address.address === rawName || address.address === address.name) {
+        if (address.address.match(/@/)) {
+            address.name = '';
+        }
+        else {
+            address.address = '';
+        }
     }
-    return addresses;
+    return [address];
 }
 /**
  * Tokenizer for address field strings
@@ -5008,17 +5242,24 @@ class Tokenizer {
         this.str = (str || '').toString();
         this.operatorCurrent = '';
         this.operatorExpecting = '';
-        this.node = null;
+        this.node = -1;
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
-        this.list = [];
+        this.inGroup = false;
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
+        this.list = new TokenList(this.str);
         this.operators = {
             '"': '"',
             '(': ')',
             '<': '>',
             ',': '',
-            ':': ';',
+            // A group is read in the same pass as the rest of the list, so its ':' only marks
+            // where the name ends and its members are tokenized like any other address
+            ':': '',
             // Semicolons are not a legal delimiter per the RFC2822 grammar other
             // than for terminating a group, but they are also not valid for any
             // other use in this context.  Given that some mail clients have
@@ -5034,27 +5275,96 @@ class Tokenizer {
      * @return An array of operator|text tokens
      */
     tokenize() {
-        let list = [];
-        for (let i = 0, len = this.str.length; i < len; i++) {
-            let chr = this.str.charAt(i);
-            let nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
-            this.checkChar(chr, nextChr);
-        }
-        this.list.forEach(node => {
-            node.value = (node.value || '').toString().trim();
-            if (node.value) {
-                list.push(node);
+        const str = this.str;
+        const len = str.length;
+        for (let i = 0; i < len; i++) {
+            this.checkChar(str.charAt(i), i);
+        }
+        this.closeText(len);
+        // Compacted in place: a text run is trimmed to its value and one left empty is
+        // dropped, and the value of a run that is no plain slice is rebuilt and kept aside
+        const list = this.list;
+        const slots = list.slots;
+        let kept = 0;
+        for (let i = 0, count = list.length; i < count; i++) {
+            const kind = slots[i * 3];
+            let start = slots[i * 3 + 1];
+            let end = slots[i * 3 + 2];
+            if (kind & TOKEN_DIRTY) {
+                const value = this.cleanValue(start, end, kind).trim();
+                if (!value) {
+                    continue;
+                }
+                list.cleaned.set(kept, value);
             }
-        });
+            else if (!(kind & TOKEN_OPERATOR)) {
+                while (start < end && isSpaceCode(str.charCodeAt(start))) {
+                    start++;
+                }
+                while (end > start && isSpaceCode(str.charCodeAt(end - 1))) {
+                    end--;
+                }
+                if (start === end) {
+                    continue;
+                }
+            }
+            slots[kept * 3] = kind;
+            slots[kept * 3 + 1] = start;
+            slots[kept * 3 + 2] = end;
+            kept++;
+        }
+        list.length = kept;
         return list;
     }
+    /**
+     * Ends the text run being collected, if there is one
+     *
+     * @param end Offset just past its last character
+     */
+    closeText(end) {
+        if (this.node >= 0) {
+            this.list.slots[this.node * 3 + 2] = end;
+            this.node = -1;
+        }
+    }
+    /**
+     * Rebuilds the value of a text run that is no plain slice of the field, applying the
+     * rules checkChar collects characters by: an escaping backslash is dropped, a line break
+     * reads as a space and any other control character is left out
+     *
+     * @param start Offset of the first character of the run
+     * @param end Offset just past its last character
+     * @param kind Kind and flags of the run
+     * @return Value of the run
+     */
+    cleanValue(start, end, kind) {
+        const str = this.str;
+        const escapes = (kind & TOKEN_ESCAPES) !== 0;
+        let escaped = (kind & TOKEN_STARTS_ESCAPED) !== 0;
+        let value = '';
+        for (let i = start; i < end; i++) {
+            const chr = str.charAt(i);
+            if (escapes && !escaped && chr === '\\') {
+                escaped = true;
+                continue;
+            }
+            escaped = false;
+            if (chr === '\n') {
+                value += ' ';
+            }
+            else if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+                value += chr;
+            }
+        }
+        return value;
+    }
     /**
      * Checks if a character is an operator or text and acts accordingly
      *
      * @param chr Character from the address field
-     * @param nextChr The character that follows, or null at the end of the field
+     * @param i Offset of the character in the field
      */
-    checkChar(chr, nextChr) {
+    checkChar(chr, i) {
         // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6 address-literal
         // (user@[IPv6:2001:db8::1]) is dtext and must not be read as the group delimiter while
         // inside the brackets. That is the only operator the literal hides: letting it hide
@@ -5074,37 +5384,67 @@ class Tokenizer {
                 this.inDomainLiteral = false;
             }
         }
-        if (this.escaped) ;
-        else if (chr === this.operatorExpecting) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
-                this.node.noBreak = true;
+        // The closer of an angle-addr is only read outside the quoted strings, comments and
+        // domain literals it holds. Looking for nothing but the closer let a '>' inside a
+        // quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read as an
+        // address at evil.com. The characters are still collected as they are, the angle-addr
+        // is read again later
+        let nested = false;
+        if (this.operatorExpecting === '>') {
+            nested = this.trackInner(chr);
+            if (!nested && chr === ';' && this.inGroup) {
+                // The ';' of a group ends an angle-addr left open inside it, as it always did
+                // when a group was cut out of the field at its ';' and parsed on its own. Read
+                // as text instead, an unclosed '<' swallowed the end of the group and every
+                // recipient after it
+                this.closeText(i);
+                this.operatorExpecting = '';
+                this.resetInner();
             }
-            this.list.push(this.node);
-            this.node = null;
+        }
+        else if (this.operatorExpecting === ')' && !this.escaped) {
+            // Comments nest (RFC 5322 3.2.2). Ending one at the first ')' let the ')' of a
+            // nested comment close the outer one and released the rest of it, an address
+            // included, into the header
+            if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')' && this.innerComment) {
+                this.innerComment--;
+                nested = true;
+            }
+        }
+        if (this.escaped) ;
+        else if (chr === this.operatorExpecting && !nested) {
+            const nextChr = this.str.charAt(i + 1);
+            this.closeText(i);
+            this.list.push(nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)
+                ? TOKEN_OPERATOR | TOKEN_NO_BREAK
+                : TOKEN_OPERATOR, i, i + 1);
             if (chr !== ')') {
                 // a comment is folding whitespace, it does not part the "@" from the "["
                 this.afterAt = false;
             }
             this.operatorExpecting = '';
             this.escaped = false;
+            this.resetInner();
             return;
         }
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            this.list.push(this.node);
-            this.node = null;
+            this.closeText(i);
+            this.list.push(TOKEN_OPERATOR, i, i + 1);
+            if (chr === ':') {
+                this.inGroup = true;
+            }
+            else if (chr === ';') {
+                this.inGroup = false;
+            }
             if (chr !== '(') {
                 this.afterAt = false;
             }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
+            this.resetInner();
             return;
         }
         else if ((this.operatorExpecting === '"' || this.operatorExpecting === ')') && chr === '\\') {
@@ -5113,96 +5453,209 @@ class Tokenizer {
             // only in quoted strings let an escaped parenthesis close the comment, which
             // released the rest of it, an address included, into the header
             this.escaped = true;
+            if (this.node >= 0) {
+                // the backslash is left out of the value
+                this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+            }
             return;
         }
-        if (!this.node) {
-            this.node = {
-                type: 'text',
-                value: ''
-            };
-            this.list.push(this.node);
+        if (this.node < 0) {
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
+                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
             // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
             chr = ' ';
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
         }
-        if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
-            // skip command bytes
-            this.node.value += chr;
+        if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+            // the character is part of the value, which is read off the field later
             // text inside a quoted string or a comment is not part of an addr-spec. Tracked
             // as it goes rather than read back off the value (see lastChars in _handleAddress)
             if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
                 this.afterAt = chr === '@';
             }
         }
+        else {
+            // skip command bytes
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+        }
         this.escaped = false;
     }
+    /**
+     * Tracks the quoted strings, comments and domain literals inside an angle-addr, which its
+     * closer must not be read from. A backslash escapes the next character inside a quoted
+     * string and a comment. A domain literal opens right after an "@" and ends at the "]".
+     * dtext holds the list separators as well, and inside the brackets they never split the
+     * list anyway.
+     *
+     * @param chr Character from the address field
+     * @return true while the character sits inside one of them, the one that closes it included
+     */
+    trackInner(chr) {
+        if (this.innerEscaped) {
+            this.innerEscaped = false;
+            return true;
+        }
+        if (this.innerQuoted) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '"') {
+                this.innerQuoted = false;
+            }
+            return true;
+        }
+        if (this.innerComment) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')') {
+                this.innerComment--;
+            }
+            return true;
+        }
+        if (this.innerLiteral) {
+            if (chr === ']') {
+                this.innerLiteral = false;
+            }
+            return true;
+        }
+        if (chr === '"') {
+            this.innerQuoted = true;
+            return true;
+        }
+        if (chr === '(') {
+            this.innerComment = 1;
+            return true;
+        }
+        if (chr === '[' && this.afterAt) {
+            this.innerLiteral = true;
+            return true;
+        }
+        // afterAt is otherwise only kept outside the operators and is cleared when one opens
+        // or ends, so inside an angle-addr it serves the literal tracked here
+        if (!isSpaceCode(chr.charCodeAt(0))) {
+            this.afterAt = chr === '@';
+        }
+        return false;
+    }
+    /**
+     * Forgets the nesting collected for the operator that just opened or ended
+     */
+    resetInner() {
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
+    }
 }
 /**
- * Maximum recursion depth for parsing nested groups.
- * RFC 5322 doesn't allow nested groups, so this is a safeguard against
- * malicious input that could cause stack overflow.
+ * Maximum depth of the re-parse of an address that is nothing but an encoded word holding
+ * an angle-addr. Groups no longer recurse, but a decoded word could hold another one, so this
+ * still bounds that.
  */
-const MAX_NESTED_GROUP_DEPTH = 50;
+const MAX_NESTED_GROUP_DEPTH = 10;
 /**
- * Parses an address list, recursing into groups. The depth is threaded through the
- * calls rather than taken from an option, so a caller supplied options object can not
- * seed it and lift the recursion limit.
+ * Folds the fragments an unquoted display name holding a comma is split into back together.
+ *
+ * "Joe Foo, PhD <joe@example.com>" is split on the comma into
+ * [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}]. A name-only entry
+ * followed by an entry with both name and address is recombined. Walked back to front so
+ * that a run of fragments folds into one entry in a single pass. Splicing each fragment out
+ * of the list instead would be quadratic.
+ *
+ * @param list Parsed entries, in order
+ * @return The entries with the fragments folded in
+ */
+function mergeNameFragments(list) {
+    const merged = [];
+    for (let i = list.length - 1; i >= 0; i--) {
+        const current = list[i];
+        const next = merged.length ? merged[merged.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
+            next.name = current.name + ', ' + next.name;
+        }
+        else {
+            merged.push(current);
+        }
+    }
+    return merged.reverse();
+}
+/**
+ * Parses an address list, groups included, in a single pass over its tokens.
+ *
+ * A group used to be cut out of the field at the ';' that ends it and parsed again as an
+ * address list of its own, recursively, so every level of nesting parsed what was left of
+ * the field once more. RFC 5322 does not nest groups at all, and the nested ones were
+ * flattened anyway. The tokens are now walked once: a ':' opens a group, its members are
+ * read as they come, a ';' closes it. A ':' inside an open group stands for a group nested
+ * in it, whose name is dropped and whose members belong to the outer one, and the first ';'
+ * ends the group, nested or not, as before.
  *
  * @param str Address field
- * @param depth Current recursion depth for nested group protection
+ * @param depth Current depth of the encoded word re-parse
  * @return An array of address objects
  */
 function parseAddressList(str, depth) {
-    // Prevent stack overflow from deeply nested groups (DoS protection)
+    // Prevent stack overflow from encoded words decoding to more of them (DoS protection)
     if (depth > MAX_NESTED_GROUP_DEPTH) {
         return [];
     }
-    let tokenizer = new Tokenizer(str);
-    let tokens = tokenizer.tokenize();
-    let addresses = [];
-    let address = [];
+    const tokens = new Tokenizer(str).tokenize();
     const parsedAddresses = [];
-    tokens.forEach(token => {
-        if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
-            if (address.length) {
-                addresses.push(address);
-            }
-            address = [];
+    let group = null;
+    let members = [];
+    // Every address is handed over as the range of the token list it covers, as soon as the
+    // separator after it is seen. Copying the tokens of each address into an array of its own,
+    // and collecting those before handling any, held a second structure as large as the token
+    // list for the whole parse, and an array that receives a single push is allocated room for
+    // seventeen: a list of one letter names took some 80 times its size in that alone
+    let from = 0;
+    for (let i = 0, len = tokens.length; i <= len; i++) {
+        const operator = i < len ? tokens.operatorAt(i) : '';
+        if (i < len && operator !== ',' && operator !== ';' && operator !== ':') {
+            continue;
         }
-        else {
-            address.push(token);
+        if (operator === ':') {
+            if (!group) {
+                group = { name: groupName(tokens, from, i), group: [] };
+                members = [];
+            }
+            from = i + 1;
+            continue;
         }
-    });
-    if (address.length) {
-        addresses.push(address);
-    }
-    // Appended in place. Rebuilding the list with concat() for every address copies
-    // everything parsed so far and is quadratic in the number of addresses.
-    for (const tokens of addresses) {
-        for (const address of _handleAddress(tokens, depth)) {
-            parsedAddresses.push(address);
-        }
-    }
-    // Merge fragments produced when unquoted display names contain commas.
-    // "Joe Foo, PhD <joe@example.com>" is split on the comma into
-    // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
-    // Recombine: a name-only entry followed by an entry with both name and address.
-    // Walked back to front so that a run of fragments folds into one entry in a single
-    // pass. Splicing each fragment out of the list instead would be quadratic.
-    const mergedAddresses = [];
-    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
-        const current = parsedAddresses[i];
-        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
-        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
-            next.name = current.name + ', ' + next.name;
+        if (i > from) {
+            // Appended in place. Rebuilding the list with concat() for every address copies
+            // everything parsed so far and is quadratic in the number of addresses.
+            for (const address of _handleAddress(tokens, from, i, depth)) {
+                if (!group) {
+                    parsedAddresses.push(address);
+                }
+                else if (address.group) {
+                    // an encoded word inside a group decoded to a group of its own, which is
+                    // flattened into this one as a nested group is
+                    for (const member of address.group) {
+                        members.push(member);
+                    }
+                }
+                else {
+                    members.push(address);
+                }
+            }
         }
-        else {
-            mergedAddresses.push(current);
+        from = i + 1;
+        if (group && (operator === ';' || i === len)) {
+            group.group = mergeNameFragments(members);
+            parsedAddresses.push(group);
+            group = null;
         }
     }
-    return mergedAddresses.reverse();
+    return mergeNameFragments(parsedAddresses);
 }
 /**
  * Parses structured e-mail addresses from an address field