@limetech/lime-elements 40.5.2 → 40.5.4

package/dist/esm/limel-file-viewer.entry.js

@@ -236,12 +236,129 @@ function normalizeCharset(charset) {
     return charset.replace(/^(?:x-ms-|x-|cs)/, '').replace(/[\s._-]+/g, '');
 }
 
+// Every label of the WHATWG Encoding Standard, https://encoding.spec.whatwg.org/encodings.json
+//
+// TextDecoder accepts these and nothing else, so a label outside the list is turned away
+// without constructing a decoder for it. Letting the constructor throw instead costs
+// several times the decode itself, and a message controls how often it happens: once
+// per encoded word, twice when the label also fails after normalization.
+const ENCODING_LABELS = new Set(
+    [
+        // UTF-8
+        'unicode-1-1-utf-8 unicode11utf8 unicode20utf8 utf-8 utf8 x-unicode20utf8',
+        // IBM866
+        '866 cp866 csibm866 ibm866',
+        // ISO-8859-2
+        'csisolatin2 iso-8859-2 iso-ir-101 iso8859-2 iso88592 iso_8859-2 iso_8859-2:1987 l2 latin2',
+        // ISO-8859-3
+        'csisolatin3 iso-8859-3 iso-ir-109 iso8859-3 iso88593 iso_8859-3 iso_8859-3:1988 l3 latin3',
+        // ISO-8859-4
+        'csisolatin4 iso-8859-4 iso-ir-110 iso8859-4 iso88594 iso_8859-4 iso_8859-4:1988 l4 latin4',
+        // ISO-8859-5
+        'csisolatincyrillic cyrillic iso-8859-5 iso-ir-144 iso8859-5 iso88595 iso_8859-5 iso_8859-5:1988',
+        // ISO-8859-6
+        'arabic asmo-708 csiso88596e csiso88596i csisolatinarabic ecma-114 iso-8859-6 iso-8859-6-e',
+        'iso-8859-6-i iso-ir-127 iso8859-6 iso88596 iso_8859-6 iso_8859-6:1987',
+        // ISO-8859-7
+        'csisolatingreek ecma-118 elot_928 greek greek8 iso-8859-7 iso-ir-126 iso8859-7 iso88597 iso_8859-7',
+        'iso_8859-7:1987 sun_eu_greek',
+        // ISO-8859-8
+        'csiso88598e csisolatinhebrew hebrew iso-8859-8 iso-8859-8-e iso-ir-138 iso8859-8 iso88598 iso_8859-8',
+        'iso_8859-8:1988 visual',
+        // ISO-8859-8-I
+        'csiso88598i iso-8859-8-i logical',
+        // ISO-8859-10
+        'csisolatin6 iso-8859-10 iso-ir-157 iso8859-10 iso885910 l6 latin6',
+        // ISO-8859-13
+        'iso-8859-13 iso8859-13 iso885913',
+        // ISO-8859-14
+        'iso-8859-14 iso8859-14 iso885914',
+        // ISO-8859-15
+        'csisolatin9 iso-8859-15 iso8859-15 iso885915 iso_8859-15 l9',
+        // ISO-8859-16
+        'iso-8859-16',
+        // KOI8-R
+        'cskoi8r koi koi8 koi8-r koi8_r',
+        // KOI8-U
+        'koi8-ru koi8-u',
+        // macintosh
+        'csmacintosh mac macintosh x-mac-roman',
+        // windows-874
+        'dos-874 iso-8859-11 iso8859-11 iso885911 tis-620 windows-874',
+        // windows-1250
+        'cp1250 windows-1250 x-cp1250',
+        // windows-1251
+        'cp1251 windows-1251 x-cp1251',
+        // windows-1252
+        'ansi_x3.4-1968 ascii cp1252 cp819 csisolatin1 ibm819 iso-8859-1 iso-ir-100 iso8859-1 iso88591',
+        'iso_8859-1 iso_8859-1:1987 l1 latin1 us-ascii windows-1252 x-cp1252',
+        // windows-1253
+        'cp1253 windows-1253 x-cp1253',
+        // windows-1254
+        'cp1254 csisolatin5 iso-8859-9 iso-ir-148 iso8859-9 iso88599 iso_8859-9 iso_8859-9:1989 l5 latin5',
+        'windows-1254 x-cp1254',
+        // windows-1255
+        'cp1255 windows-1255 x-cp1255',
+        // windows-1256
+        'cp1256 windows-1256 x-cp1256',
+        // windows-1257
+        'cp1257 windows-1257 x-cp1257',
+        // windows-1258
+        'cp1258 windows-1258 x-cp1258',
+        // x-mac-cyrillic
+        'x-mac-cyrillic x-mac-ukrainian',
+        // GBK
+        'chinese csgb2312 csiso58gb231280 gb2312 gb_2312 gb_2312-80 gbk iso-ir-58 x-gbk',
+        // gb18030
+        'gb18030',
+        // Big5
+        'big5 big5-hkscs cn-big5 csbig5 x-x-big5',
+        // EUC-JP
+        'cseucpkdfmtjapanese euc-jp x-euc-jp',
+        // ISO-2022-JP
+        'csiso2022jp iso-2022-jp',
+        // Shift_JIS
+        'csshiftjis ms932 ms_kanji shift-jis shift_jis sjis windows-31j x-sjis',
+        // EUC-KR
+        'cseuckr csksc56011987 euc-kr iso-ir-149 korean ks_c_5601-1987 ks_c_5601-1989 ksc5601 ksc_5601',
+        'windows-949',
+        // replacement
+        'csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement',
+        // UTF-16BE
+        'unicodefffe utf-16be',
+        // UTF-16LE
+        'csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le',
+        // x-user-defined
+        'x-user-defined'
+    ]
+        .join(' ')
+        .split(' ')
+);
+
+// Decoders by label, or null where the runtime refuses the label (the replacement
+// encoding, or an encoding a runtime was built without). Only labels from the list above
+// are stored, so the map can not grow past it however many labels a message makes up.
+//
+// Sharing a decoder is safe because nothing decodes with `stream: true`, so every
+// decode() call starts from a fresh state.
+const decoders = new Map();
+
 function tryDecoder(charset) {
-    try {
-        return new TextDecoder(charset);
-    } catch (err) {
+    if (!ENCODING_LABELS.has(charset)) {
         return null;
     }
+
+    if (!decoders.has(charset)) {
+        let decoder = null;
+        try {
+            decoder = new TextDecoder(charset);
+        } catch (err) {
+            // not supported by this runtime
+        }
+        decoders.set(charset, decoder);
+    }
+
+    return decoders.get(charset);
 }
 
 function getDecoder(charset) {
@@ -261,7 +378,7 @@ function getDecoder(charset) {
     // differed from a supported label only by a prefix or a separator, eg. x-big5.
     const alias = (codePage && codePageAliases.get(codePage[1])) || charsetAliases.get(normalized) || normalized;
 
-    return tryDecoder(alias) || new TextDecoder('windows-1252');
+    return tryDecoder(alias) || tryDecoder('windows-1252');
 }
 
 /**
@@ -765,7 +882,22 @@ const headerDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
 // `from` header, and since the first occurrence of a header wins it outranked the real
 // sender. Leaving the character in the key keeps the line visible without letting it
 // collide with a genuine header.
-const trimWsp = str => str.replace(/^[ \t]+|[ \t]+$/g, '');
+//
+// An index scan rather than `/^[ \t]+|[ \t]+$/g`, which retries the trailing branch at
+// every position of a blank run that is followed by other text, so a single header with
+// a long run of spaces in the middle took seconds to trim.
+const isWsp = c => c === 0x20 || c === 0x09;
+const trimWsp = str => {
+    let start = 0;
+    let end = str.length;
+    while (start < end && isWsp(str.charCodeAt(start))) {
+        start++;
+    }
+    while (end > start && isWsp(str.charCodeAt(end - 1))) {
+        end--;
+    }
+    return str.slice(start, end);
+};
 
 // Headers that decide how this part's body is read, see processHeaders
 const CONTENT_HEADERS = new Set([
@@ -892,17 +1024,26 @@ class MimeNode {
         // A parameter value starts at `=` and ends at the `;` that begins the next one
         let inParameterValue = false;
 
+        // Whether result ends in SP or HTAB. Kept up to date on every append, because
+        // testing `/[ \t]$/` against result flattens the whole string on each `(` and is
+        // quadratic in the length of the header.
+        let endsWithWsp = false;
+        const append = c => {
+            result += c;
+            endsWithWsp = c === ' ' || c === '\t';
+        };
+
         // A comment may only appear where linear whitespace is allowed, so inside a
         // parameter value the parenthesis has to follow whitespace to open one. Outside
         // one, eg. after the type itself, anything goes.
-        const opensComment = () => !inParameterValue || !result.length || /[ \t]$/.test(result);
+        const opensComment = () => !inParameterValue || !result.length || endsWithWsp;
 
         for (let i = 0; i < str.length; i++) {
             const chr = str.charAt(i);
 
             if (escaped) {
                 if (depth === 0) {
-                    result += chr;
+                    append(chr);
                 }
                 escaped = false;
                 continue;
@@ -911,14 +1052,14 @@ class MimeNode {
             if (chr === '\\') {
                 escaped = true;
                 if (depth === 0) {
-                    result += chr;
+                    append(chr);
                 }
                 continue;
             }
 
             if (chr === '"' && depth === 0) {
                 inQuote = !inQuote;
-                result += chr;
+                append(chr);
                 continue;
             }
 
@@ -944,7 +1085,7 @@ class MimeNode {
             }
 
             if (depth === 0) {
-                result += chr;
+                append(chr);
             }
         }
 
@@ -1101,30 +1242,61 @@ class MimeNode {
     }
 
     decodeFlowedText(str, delSp) {
-        return (
-            str
-                .split(/\r?\n/)
-                // remove whitespace stuffing before anything else
-                // http://tools.ietf.org/html/rfc3676#section-4.4
-                // doing it after the join leaves the stuffed space of a continuation line
-                // sitting in the middle of the joined paragraph
-                .map(line => (line.charAt(0) === ' ' ? line.slice(1) : line))
-                // remove soft linebreaks
-                // soft linebreaks are added after space symbols
-                .reduce((previousValue, currentValue) => {
-                    if (previousValue.endsWith(' ') && previousValue !== '-- ' && !previousValue.endsWith('\n-- ')) {
-                        if (delSp) {
-                            // delsp adds space to text to be able to fold it
-                            // these spaces can be removed once the text is unfolded
-                            return previousValue.slice(0, -1) + currentValue;
+        // Pieces of the result, joined once at the end. Growing a single string and
+        // calling endsWith() on it for every line flattens the whole paragraph again on
+        // each line, which is quadratic in the length of a paragraph.
+        // Empty pieces are never stored, so the last piece always holds the last
+        // character of the result.
+        const parts = [];
+        // The unfolded line being built, ie. everything after the last hard line break,
+        // starts at this index of parts and is this many characters long
+        let lineStart = 0;
+        let lineLength = 0;
+
+        const lines = str.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i++) {
+            let line = lines[i];
+
+            // remove whitespace stuffing before anything else
+            // http://tools.ietf.org/html/rfc3676#section-4.4
+            // doing it after the join leaves the stuffed space of a continuation line
+            // sitting in the middle of the joined paragraph
+            if (line.charAt(0) === ' ') {
+                line = line.slice(1);
+            }
+
+            if (i) {
+                const last = parts.length ? parts[parts.length - 1] : '';
+
+                // soft linebreaks are added after space symbols, except for the signature
+                // separator which is a line of its own
+                const isSignature = lineLength === 3 && parts.slice(lineStart).join('') === '-- ';
+
+                if (last.endsWith(' ') && !isSignature) {
+                    if (delSp) {
+                        // delsp adds space to text to be able to fold it
+                        // these spaces can be removed once the text is unfolded
+                        if (last.length > 1) {
+                            parts[parts.length - 1] = last.slice(0, -1);
                         } else {
-                            return previousValue + currentValue;
+                            parts.pop();
                         }
-                    } else {
-                        return previousValue + '\n' + currentValue;
+                        lineLength--;
                     }
-                })
-        );
+                } else {
+                    parts.push('\n');
+                    lineStart = parts.length;
+                    lineLength = 0;
+                }
+            }
+
+            if (line) {
+                parts.push(line);
+                lineLength += line.length;
+            }
+        }
+
+        return parts.join('');
     }
 
     getTextContent() {
@@ -3565,31 +3737,251 @@ function textToHtml(str) {
     return '<div>' + html + '</div>';
 }
 
+// htmlToText strips tags with regexes like `<br\b[^>]*>` and `<!--.*?-->`. Handed to
+// String#replace as they are, the engine tries every candidate in turn and a candidate
+// that does not close scans on to the next `>`, the end of the line or the end of the
+// input before giving up, so an html part holding many unclosed `<`, `<a ` or `<!--`
+// took seconds to minutes to convert. The helpers below give the same results in linear
+// time.
+
+// Characters that `.` does not match, so a `.*` can not run across them
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/g;
+
+function lastLineTerminator(str) {
+    return Math.max(str.lastIndexOf('\n'), str.lastIndexOf('\r'), str.lastIndexOf('\u2028'), str.lastIndexOf('\u2029'));
+}
+
+/**
+ * Returns a function that finds the next match of a global regex at or after a position.
+ *
+ * Callers only ever ask about positions that move forward, so a match stays the answer
+ * until a position passes it, and no match stays the answer for good. That way every part
+ * of the string is scanned once, however many times it is asked about.
+ *
+ * @param {String} str String to search
+ * @param {RegExp} regex Global regex to look for
+ * @return {Function} `pos => match` of the next match, or null if there is none
+ */
+function createFinder(str, regex) {
+    let searchedFrom = Infinity;
+    let found = null;
+
+    return pos => {
+        if (pos < searchedFrom || (found && pos > found.index)) {
+            regex.lastIndex = pos;
+            found = regex.exec(str);
+            searchedFrom = pos;
+        }
+        return found;
+    };
+}
+
+/**
+ * `str.replace(pattern, replacement)` for a pattern shaped like `<tag\b[^>]*>`.
+ *
+ * Such a pattern only fails at a candidate that has no `>` after it, so the text after
+ * the last `>` can never match and is where every rescan happened. Leaving it out keeps
+ * the native replace, and its speed, for everything else.
+ *
+ * @param {String} str String to process
+ * @param {RegExp} pattern Global regex that ends on the first `>` after its start
+ * @param {String} replacement Replacement text
+ * @return {String} Processed string
+ */
+function replaceClosedTags(str, pattern, replacement) {
+    const end = str.lastIndexOf('>') + 1;
+    return str.slice(0, end).replace(pattern, replacement) + str.slice(end);
+}
+
+/**
+ * `str.replace(pattern, replacement)` for a tag pattern that may fail even when a `>`
+ * follows, like `<a\b[^>]*href...>`, or that runs on past its `>`.
+ *
+ * A candidate with no `>` after it ends the search, since no later candidate can close
+ * either. A candidate that does not match skips every other candidate before the same
+ * `>`, since those see the same tag body and fail the same way.
+ *
+ * @param {String} str String to process
+ * @param {RegExp} prefix Global regex for the start of a candidate, which can not contain `>`
+ * @param {RegExp} pattern The whole pattern as a sticky regex
+ * @param {Function} replacement Function given the match and its groups
+ * @return {String} Processed string
+ */
+function replaceTags(str, prefix, pattern, replacement) {
+    const parts = [];
+    // everything before this index is already in parts
+    let copied = 0;
+    let searchFrom = 0;
+
+    while (true) {
+        prefix.lastIndex = searchFrom;
+        const candidate = prefix.exec(str);
+        if (!candidate) {
+            break;
+        }
+
+        const start = candidate.index;
+        pattern.lastIndex = start;
+        const match = pattern.exec(str);
+        if (!match) {
+            const gt = str.indexOf('>', start);
+            if (gt < 0) {
+                break;
+            }
+            searchFrom = gt + 1;
+            continue;
+        }
+
+        parts.push(str.slice(copied, start), replacement(...match));
+        copied = searchFrom = start + match[0].length;
+    }
+
+    parts.push(str.slice(copied));
+    return parts.join('');
+}
+
+/**
+ * `str.replace(pattern, replacement)` for a pattern like `<!--.*?-->` or
+ * `<script\b[^>]*>.*?<\/script\b[^>]*>`, ie. an opener and a closer, either of which may
+ * continue with `[^>]*>`, and a lazy `.*?` between them. The engine rescans to the end of
+ * the line for every opener that is not closed.
+ *
+ * @param {String} str String to process
+ * @param {RegExp} open Global regex for the opener
+ * @param {Boolean} openToGt Whether the opener continues with `[^>]*>`
+ * @param {RegExp} close Global regex for the closer
+ * @param {Boolean} closeToGt Whether the closer continues with `[^>]*>`
+ * @param {String} replacement Replacement text
+ * @return {String} Processed string
+ */
+function replaceBlocks(str, open, openToGt, close, closeToGt, replacement) {
+    const nextGt = createFinder(str, />/g);
+    const nextClose = createFinder(str, close);
+    const nextLineEnd = createFinder(str, LINE_TERMINATOR);
+    const parts = [];
+    let copied = 0;
+    let searchFrom = 0;
+
+    while (true) {
+        open.lastIndex = searchFrom;
+        const opener = open.exec(str);
+        if (!opener) {
+            break;
+        }
+
+        const start = opener.index;
+        searchFrom = start + 1;
+
+        // where the lazy `.*?` starts
+        let from = start + opener[0].length;
+        if (openToGt) {
+            const gt = nextGt(from);
+            if (!gt) {
+                // neither this opener nor any later one can close
+                break;
+            }
+            from = gt.index + 1;
+        }
+
+        const closer = nextClose(from);
+        if (!closer) {
+            // no closer follows this opener, so none follows a later one either
+            break;
+        }
+
+        // `.*?` can not reach the closer across a line terminator
+        const lineEnd = nextLineEnd(from);
+        if (lineEnd && lineEnd.index < closer.index) {
+            continue;
+        }
+
+        let end = closer.index + closer[0].length;
+        if (closeToGt) {
+            const gt = nextGt(end);
+            if (!gt) {
+                // this is the first closer after the opener, and any other one comes
+                // later, so none of them is followed by `>`
+                break;
+            }
+            end = gt.index + 1;
+        }
+
+        parts.push(str.slice(copied, start), replacement);
+        copied = searchFrom = end;
+    }
+
+    parts.push(str.slice(copied));
+    return parts.join('');
+}
+
+/**
+ * `str.replace(pattern, '')` for `^.*<tag\b[^>]*>`, ie. drops everything up to and
+ * including the last such tag on the first line.
+ *
+ * @param {String} str String to process
+ * @param {RegExp} prefix Global regex for the start of the tag, which can not contain `>`
+ * @return {String} Processed string
+ */
+function stripThroughLastTag(str, prefix) {
+    const lineEnd = str.search(LINE_TERMINATOR);
+    // `.*` stops at the first line terminator, and `[^>]*>` needs a `>` after the tag
+    const limit = Math.min(lineEnd < 0 ? str.length : lineEnd, str.lastIndexOf('>'));
+
+    let last = -1;
+    prefix.lastIndex = 0;
+    let match;
+    while ((match = prefix.exec(str)) && match.index < limit) {
+        last = match.index;
+    }
+
+    return last < 0 ? str : str.slice(str.indexOf('>', last) + 1);
+}
+
+/**
+ * `str.replace(pattern, '')` for `<tag\b[^>]*>.*$`, ie. drops the first such tag whose
+ * `>` is on the last line, and everything after it.
+ *
+ * @param {String} str String to process
+ * @param {RegExp} prefix Global regex for the start of the tag, which can not contain `>`
+ * @return {String} Processed string
+ */
+function stripFromFirstTag(str, prefix) {
+    // `.*$` has to reach the end of the string without crossing a line terminator, so the
+    // tag has to start after the last `>` that comes before the last line terminator
+    const lineEnd = lastLineTerminator(str);
+    prefix.lastIndex = lineEnd < 0 ? 0 : str.lastIndexOf('>', lineEnd) + 1;
+
+    const match = prefix.exec(str);
+    return match && match.index < str.lastIndexOf('>') ? str.slice(0, match.index) : str;
+}
+
 function htmlToText(str) {
-    str = str
-        // we can't process tags on multiple lines so remove newlines first
-        .replace(/\r?\n/g, '\u0001')
-        .replace(/<\!\-\-.*?\-\->/gi, ' ')
+    // we can't process tags on multiple lines so remove newlines first
+    str = str.replace(/\r?\n/g, '\u0001');
 
-        .replace(/<br\b[^>]*>/gi, '\n')
-        .replace(/<\/?(p|div|table|tr|td|th)\b[^>]*>/gi, '\n\n')
-        .replace(/<script\b[^>]*>.*?<\/script\b[^>]*>/gi, ' ')
-        .replace(/^.*<body\b[^>]*>/i, '')
-        .replace(/^.*<\/head\b[^>]*>/i, '')
-        .replace(/^.*<\!doctype\b[^>]*>/i, '')
-        .replace(/<\/body\b[^>]*>.*$/i, '')
-        .replace(/<\/html\b[^>]*>.*$/i, '')
+    str = replaceBlocks(str, /<!--/g, false, /-->/g, false, ' ');
 
-        .replace(/<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/gi, ' ($1) ')
+    str = replaceClosedTags(str, /<br\b[^>]*>/gi, '\n');
+    str = replaceClosedTags(str, /<\/?(p|div|table|tr|td|th)\b[^>]*>/gi, '\n\n');
+    str = replaceBlocks(str, /<script\b/gi, true, /<\/script\b/gi, true, ' ');
+    str = stripThroughLastTag(str, /<body\b/gi);
+    str = stripThroughLastTag(str, /<\/head\b/gi);
+    str = stripThroughLastTag(str, /<!doctype\b/gi);
+    str = stripFromFirstTag(str, /<\/body\b/gi);
+    str = stripFromFirstTag(str, /<\/html\b/gi);
 
-        .replace(/<\/?(span|em|i|strong|b|u|a)\b[^>]*>/gi, '')
+    str = replaceTags(str, /<a\b/gi, /<a\b[^>]*href\s*=\s*["']?([^\s"']+)[^>]*>/iy, (match, href) => ` (${href}) `);
 
-        .replace(/<li\b[^>]*>[\n\u0001\s]*/gi, '* ')
+    str = replaceClosedTags(str, /<\/?(span|em|i|strong|b|u|a)\b[^>]*>/gi, '');
 
-        .replace(/<hr\b[^>]*>/g, '\n-------------\n')
+    // the whitespace after the tag may run on past the last `>`
+    str = replaceTags(str, /<li\b/gi, /<li\b[^>]*>[\n\u0001\s]*/iy, () => '* ');
 
-        .replace(/<[^>]*>/g, ' ')
+    str = replaceClosedTags(str, /<hr\b[^>]*>/g, '\n-------------\n');
 
+    str = replaceClosedTags(str, /<[^>]*>/g, ' ');
+
+    str = str
         // convert linebreak placeholders back to newlines
         .replace(/\u0001/g, '\n')
 
@@ -3909,6 +4301,41 @@ function findAddressInText(text) {
     return null;
 }
 
+/**
+ * Checks whether text holds an angle bracket address, ie. `<` and `>` around a run
+ * without other angle brackets that has an '@' with at least one character on each side.
+ *
+ * Same answer as `/<[^<>]+@[^<>]+>/.test(text)`, which backtracks quadratically on a `<`
+ * followed by a long run of '@' and no closing `>`.
+ *
+ * @param {String} text Text to check
+ * @return {Boolean} true if an angle bracket address is present
+ */
+function hasAngleAddress(text) {
+    // position right after the `<` that opened the current bracket, or -1
+    let start = -1;
+    // first '@' inside the bracket that has a character before it, or -1
+    let at = -1;
+
+    for (let i = 0; i < text.length; i++) {
+        const chr = text.charAt(i);
+        if (chr === '<') {
+            start = i + 1;
+            at = -1;
+        } else if (chr === '>') {
+            if (at >= 0 && at < i - 1) {
+                return true;
+            }
+            start = -1;
+            at = -1;
+        } else if (chr === '@' && start >= 0 && at < 0 && i > start) {
+            at = i;
+        }
+    }
+
+    return false;
+}
+
 /**
  * Converts tokens for a single address into an address object
  *
@@ -4002,7 +4429,9 @@ function _handleAddress(tokens, depth) {
             parsedGroup.forEach(member => {
                 if (member.group) {
                     // Nested group detected - flatten it by adding its members directly
-                    groupMembers = groupMembers.concat(member.group);
+                    for (const nestedMember of member.group) {
+                        groupMembers.push(nestedMember);
+                    }
                 } else {
                     groupMembers.push(member);
                 }
@@ -4036,11 +4465,13 @@ function _handleAddress(tokens, depth) {
                         const found = findAddressInText(data.text[i]);
                         if (found) {
                             data.address = [found.value];
-                            // the address and the whitespace around it collapse to one space
+                            // the address and the whitespace around it collapse to one space.
+                            // trimEnd rather than `/\s+$/`, which retries at every position of
+                            // a whitespace run that is not at the end and is quadratic in it.
                             data.text[i] = (
-                                data.text[i].substring(0, found.index).replace(/\s+$/, '') +
+                                data.text[i].substring(0, found.index).trimEnd() +
                                 ' ' +
-                                data.text[i].substring(found.index + found.length).replace(/^\s+/, '')
+                                data.text[i].substring(found.index + found.length).trimStart()
                             ).trim();
                             break;
                         }
@@ -4074,7 +4505,7 @@ function _handleAddress(tokens, depth) {
             // Security: only re-parse if decoded text contains angle-bracket addresses.
             // Without this, a bare encoded email (e.g. =?utf-8?B?dGVzdEBldmlsLmNv?=)
             // would be fabricated into an address from attacker-controlled input.
-            if (/<[^<>]+@[^<>]+>/.test(decodedText)) {
+            if (hasAngleAddress(decodedText)) {
                 const parsedSubAddresses = addressParser(decodedText);
                 if (parsedSubAddresses && parsedSubAddresses.length) {
                     return parsedSubAddresses;
@@ -4258,7 +4689,7 @@ function addressParser(str, options) {
 
     let addresses = [];
     let address = [];
-    let parsedAddresses = [];
+    const parsedAddresses = [];
 
     tokens.forEach(token => {
         if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
@@ -4275,12 +4706,13 @@ function addressParser(str, options) {
         addresses.push(address);
     }
 
-    addresses.forEach(address => {
-        address = _handleAddress(address, depth);
-        if (address.length) {
-            parsedAddresses = parsedAddresses.concat(address);
+    // Appended in place. Rebuilding the list with concat() for every address copies
+    // everything parsed so far and is quadratic in the number of addresses.
+    for (const tokens of addresses) {
+        for (const address of _handleAddress(tokens, depth)) {
+            parsedAddresses.push(address);
         }
-    });
+    }
 
     if (options.flatten) {
         let addresses = [];
@@ -4684,9 +5116,15 @@ class PostalMime {
                                     .trim();
                             }
 
-                            // Enforce into unicode
-                            const decodedText = node.getTextContent().replace(/\r?\n/g, '\n').replace(/\n*$/, '\n');
-                            attachment.content = textEncoder.encode(decodedText);
+                            // Enforce into unicode, ending in exactly one newline. The trailing
+                            // newlines are counted rather than replaced with `/\n*$/`, which
+                            // retries at every newline of a run that does not end the text.
+                            const decodedText = node.getTextContent().replace(/\r?\n/g, '\n');
+                            let end = decodedText.length;
+                            while (end > 0 && decodedText.charCodeAt(end - 1) === 0x0a) {
+                                end--;
+                            }
+                            attachment.content = textEncoder.encode(decodedText.slice(0, end) + '\n');
                             break;
                         }
 
@@ -4937,15 +5375,17 @@ class PostalMime {
         }
 
         for (const key of ['to', 'cc', 'bcc', 'reply-to']) {
-            const addressHeaders = this.root.headers.filter(line => line.key === key);
-            let addresses = [];
-
-            addressHeaders
-                .filter(entry => entry && entry.value)
-                .map(entry => addressParser(entry.value))
-                .forEach(parsed => (addresses = addresses.concat(parsed || [])));
+            // Appended in place, concat() copies the whole list for every header
+            const addresses = [];
+            for (const entry of this.root.headers) {
+                if (entry.key === key && entry.value) {
+                    for (const address of addressParser(entry.value)) {
+                        addresses.push(address);
+                    }
+                }
+            }
 
-            if (addresses && addresses.length) {
+            if (addresses.length) {
                 const camelKey = toCamelCase(key);
                 message[camelKey] = addresses;
             }