@limetech/lime-elements 40.7.0 → 40.7.1

package/dist/cjs/limel-file-viewer.cjs.entry.js

@@ -125,6 +125,8 @@ class Fullscreen {
 }
 
 const textEncoder = new TextEncoder();
+/** SP or HTAB, the only whitespace RFC 5322 and RFC 2045 give a meaning to in a line */
+const isWsp = (c) => c === 0x20 || c === 0x09;
 const base64Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
 // Use a lookup table to find the index.
 const base64Lookup = new Uint8Array(256);
@@ -342,7 +344,10 @@ function tryDecoder(charset) {
 // Every runtime has utf-8, so a decoder is always returned even where windows-1252 is
 // missing, rather than letting the caller fail on a null decoder
 const utf8Decoder = new TextDecoder();
-function getDecoder(charset) {
+/**
+ * Finds the decoder for a charset label, or null when the runtime has no encoding for it
+ */
+function findDecoder(charset) {
     charset = (charset || 'utf8').trim().toLowerCase();
     // Try the label as written first, so the alias table only ever adds to what the
     // runtime already supports instead of shadowing it.
@@ -355,7 +360,136 @@ function getDecoder(charset) {
     // The normalized label is itself the last candidate, which resolves everything that
     // differed from a supported label only by a prefix or a separator, eg. x-big5.
     const alias = (codePage && codePageAliases.get(codePage[1])) || charsetAliases.get(normalized) || normalized;
-    return tryDecoder(alias) || tryDecoder('windows-1252') || utf8Decoder;
+    return tryDecoder(alias);
+}
+function getDecoder(charset) {
+    return findDecoder(charset) || tryDecoder('windows-1252') || utf8Decoder;
+}
+/**
+ * Whether the bytes are well formed UTF-8. A scan rather than a fatal TextDecoder, since
+ * the exception one throws costs more than the decode itself and a message decides how
+ * many lines throw it.
+ */
+function isUtf8(bytes) {
+    for (let i = 0; i < bytes.length;) {
+        const lead = bytes[i];
+        if (lead < 0x80) {
+            i++;
+            continue;
+        }
+        // The number of continuation bytes, and the range the first of them may take,
+        // which is what rules out overlong forms, surrogates and code points past U+10FFFF
+        let count;
+        if (lead >= 0xc2 && lead <= 0xdf) {
+            count = 1;
+        }
+        else if (lead >= 0xe0 && lead <= 0xef) {
+            count = 2;
+        }
+        else if (lead >= 0xf0 && lead <= 0xf4) {
+            count = 3;
+        }
+        else {
+            return false;
+        }
+        if (i + count >= bytes.length) {
+            return false;
+        }
+        const second = bytes[i + 1];
+        const min = lead === 0xe0 ? 0xa0 : lead === 0xf0 ? 0x90 : 0x80;
+        const max = lead === 0xed ? 0x9f : lead === 0xf4 ? 0x8f : 0xbf;
+        if (second < min || second > max) {
+            return false;
+        }
+        for (let k = 2; k <= count; k++) {
+            if ((bytes[i + k] & 0xc0) !== 0x80) {
+                return false;
+            }
+        }
+        i += count + 1;
+    }
+    return true;
+}
+/**
+ * Decodes bytes whose encoding is not known: as UTF-8 when they are well formed UTF-8, as
+ * windows-1252 otherwise.
+ *
+ * A message that declares no charset, or one the runtime has never heard of, usually
+ * predates RFC 6532 or comes from a generator that never heard of it either, and its 8-bit
+ * bytes are a legacy single byte encoding far more often than broken UTF-8. windows-1252
+ * is the fallback the WHATWG Encoding Standard prescribes and what a mail client's default
+ * charset amounts to, and it reads such text rather than filling it with replacement
+ * characters.
+ *
+ * @param bytes Bytes to decode
+ * @param utf8 The UTF-8 decoder to use, header lines bring one that keeps a BOM
+ * @return Decoded text
+ */
+function decodeUtf8OrWindows1252(bytes, utf8 = utf8Decoder) {
+    const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    return isUtf8(view) ? utf8.decode(view) : getDecoder('windows-1252').decode(view);
+}
+/**
+ * Decodes bytes in a named charset. A label the runtime does not know is no charset at
+ * all, see decodeUtf8OrWindows1252.
+ *
+ * @param bytes Bytes to decode
+ * @param charset Charset label
+ * @return Decoded text
+ */
+function decodeCharset(bytes, charset) {
+    const decoder = findDecoder(charset);
+    return decoder ? decoder.decode(bytes) : decodeUtf8OrWindows1252(bytes);
+}
+// The charset an html document names for itself, in a `<meta charset>` or in the
+// Content-Type `<meta http-equiv>`, read from the first 1024 bytes like a browser's prescan.
+// Tags are found with indexOf and the attribute is matched inside one tag at a time: a
+// single pattern over the whole head rescans it once for every `<meta` in it, and a head of
+// nothing but `<meta ` took it quadratic
+const META_PRESCAN_BYTES = 1024;
+const CHARSET_ATTRIBUTE = /charset\s*=\s*["']?\s*([^\s"';>]+)/;
+const UTF16_ENCODINGS = new Set(['utf-16le', 'utf-16be']);
+function sniffHtmlCharset(bytes) {
+    const head = utf8Decoder.decode(bytes.subarray(0, META_PRESCAN_BYTES)).toLowerCase();
+    let pos = 0;
+    while ((pos = head.indexOf('<meta', pos)) >= 0) {
+        let end = head.indexOf('>', pos);
+        if (end < 0) {
+            end = head.length;
+        }
+        const match = CHARSET_ATTRIBUTE.exec(head.slice(pos, end));
+        if (match) {
+            return match[1];
+        }
+        pos = end;
+    }
+    return null;
+}
+/**
+ * Decodes the bytes of a text part: in the declared charset, otherwise in the one an html
+ * part names for itself, otherwise as UTF-8 or windows-1252 depending on what the bytes
+ * turn out to be, see decodeUtf8OrWindows1252.
+ *
+ * @param bytes Decoded body of the part
+ * @param charset The charset parameter of the Content-Type, if any
+ * @param html Whether the part is html, which may name its own charset
+ * @return The text of the part
+ */
+function decodeText(bytes, charset, html) {
+    const view = new Uint8Array(bytes);
+    if (charset) {
+        return decodeCharset(view, charset);
+    }
+    // The HTML prescan has two overrides, and for a reason: a `<meta>` tag that could be
+    // read as ASCII proves the document is not UTF-16, so such a label is read as UTF-8,
+    // and x-user-defined is read as windows-1252. Without them a sender picks the encoding
+    // that turns bytes a scanner sees as inert into markup for this parser alone
+    const sniffed = html ? sniffHtmlCharset(view) : null;
+    const decoder = sniffed ? findDecoder(sniffed) : null;
+    if (!decoder || UTF16_ENCODINGS.has(decoder.encoding)) {
+        return decodeUtf8OrWindows1252(view);
+    }
+    return (decoder.encoding === 'x-user-defined' ? getDecoder('windows-1252') : decoder).decode(view);
 }
 /**
  * Converts a Blob into an ArrayBuffer
@@ -395,6 +529,25 @@ function hexNibble(c) {
     }
     return -1;
 }
+/**
+ * Folds the line breaks of a header value into spaces.
+ *
+ * A header value holds no line breaks. The raw value is folded when the headers are
+ * processed, see processHeaders in mime-node.ts, an RFC 2047 encoded word is folded as it
+ * is decoded, and an RFC 2231 filename is folded where the attachment is built. Otherwise a
+ * decoded name, subject or filename written into a header of an outgoing message by the
+ * consumer ends the header early and starts another one with the rest of the value.
+ *
+ * The RFC 2231 percent decoder itself does not fold: it also produces the boundary, and a
+ * boundary holding a line break can never match a line. That has to stay so, or a message
+ * that has no parts for every other parser would have them here.
+ *
+ * @param str Header value
+ * @return The value with every run of CR and LF replaced by a space
+ */
+function foldLineBreaks(str) {
+    return str.replace(/[\r\n]+/g, ' ');
+}
 /**
  * Decode a complete mime word encoded string
  *
@@ -447,7 +600,7 @@ function decodeWord(charset, encoding, str) {
         // keep as is, convert ArrayBuffer to unicode string, assume utf8
         byteStr = textEncoder.encode(str);
     }
-    return getDecoder(charset).decode(byteStr);
+    return foldLineBreaks(decodeCharset(byteStr, charset));
 }
 // A charset label runs to the next '?' so that labels containing punctuation, eg.
 // ISO_8859-1:1987, are recognised. Whitespace is excluded so a stray '=?' in running text
@@ -591,7 +744,7 @@ function decodeURIComponentWithCharset(encodedStr, charset) {
     for (let i = 0, len = encodedBytes.length; i < len; i++) {
         dataView.setUint8(i, encodedBytes[i]);
     }
-    return getDecoder(charset).decode(byteStr);
+    return decodeCharset(byteStr, charset);
 }
 function decodeParameterValueContinuations(header) {
     // handle parameter value continuations
@@ -658,27 +811,72 @@ function decodeParameterValueContinuations(header) {
     });
 }
 
+// Hands the body through as it is, the line endings included.
+//
+// The line break is written when the next line arrives, not after each line. The CRLF in
+// front of a multipart boundary belongs to the boundary (RFC 2046 5.1.1), so the last line
+// of a part ended by a boundary must not carry one.
+//
+// The break written is the one the line came with. Writing LF for every line rewrote the
+// bytes of every 7bit, 8bit and binary part: an attached message lost each of its CR and a
+// binary attachment came out corrupted. Text is normalized to LF where it is read as text
+// instead, see MimeNode.getTextContent.
+//
+// The lines of a part, breaks included, are one contiguous range of the message, so the
+// decoder keeps the bounds of that range rather than a chunk per line: a Blob of two parts
+// per line took 60 times longer to assemble than one of a single part.
 class PassThroughDecoder {
     constructor() {
         this.chunks = [];
-        this.pendingLineBreak = false;
-    }
-    // The line break is written when the next line arrives, not after each line. The
-    // CRLF in front of a multipart boundary belongs to the boundary (RFC 2046 5.1.1), so
-    // the last line of a part ended by a boundary must not carry one.
-    update(line) {
-        if (this.pendingLineBreak) {
-            this.chunks.push('\n');
+        this.runBuffer = null;
+        this.runStart = 0;
+        this.runEnd = 0;
+        this.pendingLineBreak = null;
+    }
+    // Whether the bytes sit in the run's buffer right at the end of the run
+    continuesRun(bytes) {
+        return bytes.buffer === this.runBuffer && bytes.byteOffset === this.runEnd;
+    }
+    flushRun() {
+        if (this.runBuffer && this.runEnd > this.runStart) {
+            this.chunks.push(new Uint8Array(this.runBuffer, this.runStart, this.runEnd - this.runStart));
+        }
+        this.runBuffer = null;
+    }
+    update(line, lineBreak) {
+        const pending = this.pendingLineBreak;
+        if (pending &&
+            this.continuesRun(pending) &&
+            line.buffer === this.runBuffer &&
+            line.byteOffset === this.runEnd + pending.byteLength) {
+            // the break follows the run and the line follows the break, so the run grows
+            this.runEnd = line.byteOffset + line.byteLength;
+        }
+        else {
+            this.flushRun();
+            if (pending) {
+                this.chunks.push(pending);
+            }
+            this.runBuffer = line.buffer;
+            this.runStart = line.byteOffset;
+            this.runEnd = line.byteOffset + line.byteLength;
         }
-        this.chunks.push(line);
-        this.pendingLineBreak = true;
+        this.pendingLineBreak = lineBreak;
     }
     // A part ended by the end of the message has no boundary to own its final line
     // break, so there it stays content
     finalize(boundaryEnded = false) {
-        if (!boundaryEnded && this.pendingLineBreak) {
-            this.chunks.push('\n');
+        const pending = this.pendingLineBreak;
+        if (!boundaryEnded && pending) {
+            if (this.continuesRun(pending)) {
+                this.runEnd += pending.byteLength;
+            }
+            else {
+                this.flushRun();
+                this.chunks.push(pending);
+            }
         }
+        this.flushRun();
         // convert an array of arraybuffers into a blob and then back into a single arraybuffer
         return blobToArrayBuffer(new Blob(this.chunks, { type: 'application/octet-stream' }));
     }
@@ -727,14 +925,18 @@ class Base64Decoder {
 }
 
 const CHR_EQUALS = 0x3d;
-const CHR_LF = 0x0a;
 class QPDecoder {
     constructor() {
         this.maxChunkSize = 100 * 1024;
         this.buffer = new Uint8Array(this.maxChunkSize);
         this.bufferPos = 0;
         this.chunks = [];
-        this.pendingLineBreak = false;
+        this.pendingLineBreak = null;
+    }
+    writeLineBreak() {
+        if (this.pendingLineBreak) {
+            this.writeBytes(this.pendingLineBreak, 0, this.pendingLineBreak.length);
+        }
     }
     writeByte(byte) {
         if (this.bufferPos >= this.buffer.length) {
@@ -767,12 +969,17 @@ class QPDecoder {
     // content that decoded correctly in base64 came out as mojibake in quoted-printable.
     //
     // As in PassThroughDecoder, a hard line break is only written once the next line
-    // arrives, so the CRLF that belongs to a following boundary is not decoded as content.
-    update(line) {
-        if (this.pendingLineBreak) {
-            this.writeByte(CHR_LF);
-        }
+    // arrives, so the CRLF that belongs to a following boundary is not decoded as content,
+    // and the break written is the one the line came with.
+    update(line, lineBreak) {
+        this.writeLineBreak();
         let len = line.length;
+        // Trailing white space on an encoded line was added in transit and is deleted (RFC
+        // 2045 6.7 rule 3). Before the soft line break is looked for, since the `=` it
+        // consists of may have had white space appended the same way
+        while (len > 0 && isWsp(line[len - 1])) {
+            len--;
+        }
         // a line ending in '=' is a soft line break, the newline is not part of the content
         const softBreak = len > 0 && line[len - 1] === CHR_EQUALS;
         if (softBreak) {
@@ -795,12 +1002,12 @@ class QPDecoder {
             literalStart = i + 1;
         }
         this.writeBytes(line, literalStart, len);
-        this.pendingLineBreak = !softBreak;
+        this.pendingLineBreak = softBreak ? null : lineBreak;
     }
     // see PassThroughDecoder.finalize
     finalize(boundaryEnded = false) {
-        if (!boundaryEnded && this.pendingLineBreak) {
-            this.writeByte(CHR_LF);
+        if (!boundaryEnded) {
+            this.writeLineBreak();
         }
         this.flushBuffer();
         // convert an array of arraybuffers into a blob and then back into a single arraybuffer
@@ -812,6 +1019,10 @@ class QPDecoder {
 // kept as a character instead of being swallowed. A stripped BOM turns a line a strict
 // parser skips into a genuine header, which is how a second `From:` gets smuggled past
 // anything that inspects the raw message.
+//
+// Raw 8-bit header text is UTF-8 (RFC 6532), and a line that is not is legacy mail in a
+// single byte charset, read as windows-1252 rather than as replacement characters, see
+// decodeUtf8OrWindows1252.
 const headerDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
 // Trims only the whitespace RFC 5322 allows around a field name. String.prototype.trim
 // also strips U+00A0, U+FEFF, U+2028 and the rest of the Unicode spaces, which turns a
@@ -823,7 +1034,6 @@ const headerDecoder = new TextDecoder('utf-8', { ignoreBOM: true });
 // An index scan rather than `/^[ \t]+|[ \t]+$/g`, which retries the trailing branch at
 // every position of a blank run that is followed by other text, so a single header with
 // a long run of spaces in the middle took seconds to trim.
-const isWsp = (c) => c === 0x20 || c === 0x09;
 const trimWsp = (str) => {
     let start = 0;
     let end = str.length;
@@ -835,6 +1045,12 @@ const trimWsp = (str) => {
     }
     return str.slice(start, end);
 };
+// A line of nothing but SP and HTAB, see feed
+const isBlankLine = (line) => line.every(isWsp);
+// The start of a header field: a field name of printable ASCII other than the colon
+// (RFC 5322 3.6.8 ftext) and the colon itself, with the whitespace in between that
+// processHeaders tolerates as well
+const FIELD_START = /^[!-9;-~]+[ \t]*:/;
 // Headers that decide how this part's body is read, see processHeaders
 const CONTENT_HEADERS = new Set([
     'content-type',
@@ -847,6 +1063,12 @@ class MimeNode {
     constructor(options) {
         this.options = options;
         this.postalMime = options.postalMime;
+        // Counted across the whole message like the header size, so that a multipart can
+        // not carry the budget again for every part it declares
+        this.postalMime.partCount++;
+        if (this.postalMime.partCount > options.maxPartCount) {
+            throw new Error(`Maximum MIME part count of ${options.maxPartCount} parts exceeded`);
+        }
         this.childNodes = [];
         // Cursor into childNodes for finalizeChildNodes. Every new part of a multipart
         // finalizes its parent's children, so re-walking the whole array each time is
@@ -865,6 +1087,7 @@ class MimeNode {
         }
         this.state = 'header';
         this.headerLines = [];
+        this.lastLineBlank = false;
         // RFC 2046 Section 5.1.5: multipart/digest defaults to message/rfc822
         const parentMultipartType = options.parentMultipartType || null;
         const defaultContentType = parentMultipartType === 'digest' ? 'message/rfc822' : 'text/plain';
@@ -906,7 +1129,7 @@ class MimeNode {
             return;
         }
         if (this.state === 'header') {
-            this.processHeaders();
+            this.endHeaders();
         }
         // remove self from boundary listing
         let boundaries = this.postalMime.boundaries;
@@ -1157,55 +1380,51 @@ class MimeNode {
         decodeParameterValueContinuations(response);
         return response;
     }
+    // Unfolds format=flowed text (RFC 3676 4.1). A line is read as its quote marks, one
+    // space of stuffing and its content, in that order, and a line whose content ends in a
+    // space is flowed: the next line of the same quote depth continues its paragraph. The
+    // paragraph ends at a fixed line, at a change of quote depth and at the signature
+    // separator, which is neither flowed nor fixed. Joining a quoted paragraph used to
+    // leave the quote marks of the continuation lines inside the text, so a quoted reply
+    // read `> one > two` instead of `> one two`.
+    //
+    // The quote marks and stuffing of the first line of a paragraph are kept as they were
+    // written, so a fixed quoted line comes out exactly as it went in. An unquoted stuffed
+    // line loses its stuffing, which is all the stuffing is for.
     decodeFlowedText(str, delSp) {
-        // Pieces of the result, joined once at the end. Growing a single string and
-        // calling endsWith() on it for every line flattens the whole paragraph again on
-        // each line, which is quadratic in the length of a paragraph.
-        // Empty pieces are never stored, so the last piece always holds the last
-        // character of the result.
+        // Pieces of the result, joined once at the end. Growing a single string instead
+        // flattens the whole paragraph again on each line, which is quadratic in the
+        // length of a paragraph.
         const parts = [];
-        // The unfolded line being built, ie. everything after the last hard line break,
-        // starts at this index of parts and is this many characters long
-        let lineStart = 0;
-        let lineLength = 0;
-        const lines = str.split(/\r?\n/);
+        // whether the previous line was flowed, and the quote depth of its paragraph
+        let flowed = false;
+        let depth = 0;
+        const lines = str.split('\n');
         for (let i = 0; i < lines.length; i++) {
-            let line = lines[i];
-            // remove whitespace stuffing before anything else
-            // http://tools.ietf.org/html/rfc3676#section-4.4
-            // doing it after the join leaves the stuffed space of a continuation line
-            // sitting in the middle of the joined paragraph
-            if (line.charAt(0) === ' ') {
-                line = line.slice(1);
+            const line = lines[i];
+            let quoteDepth = 0;
+            while (line.charCodeAt(quoteDepth) === 0x3e /* > */) {
+                quoteDepth++;
             }
-            if (i) {
-                const last = parts.length ? parts[parts.length - 1] : '';
-                // soft linebreaks are added after space symbols, except for the signature
-                // separator which is a line of its own
-                const isSignature = lineLength === 3 && parts.slice(lineStart).join('') === '-- ';
-                if (last.endsWith(' ') && !isSignature) {
-                    if (delSp) {
-                        // delsp adds space to text to be able to fold it
-                        // these spaces can be removed once the text is unfolded
-                        if (last.length > 1) {
-                            parts[parts.length - 1] = last.slice(0, -1);
-                        }
-                        else {
-                            parts.pop();
-                        }
-                        lineLength--;
-                    }
+            const contentStart = line.charCodeAt(quoteDepth) === 0x20 ? quoteDepth + 1 : quoteDepth;
+            const content = line.slice(contentStart);
+            const isSignature = content === '-- ';
+            if (flowed && quoteDepth === depth && !isSignature) {
+                if (delSp) {
+                    // delsp adds the space to make the text foldable, so it is not content
+                    const last = parts[parts.length - 1];
+                    parts[parts.length - 1] = last.slice(0, -1);
                 }
-                else {
+                parts.push(content);
+            }
+            else {
+                if (i) {
                     parts.push('\n');
-                    lineStart = parts.length;
-                    lineLength = 0;
                 }
+                parts.push(quoteDepth ? line : content);
             }
-            if (line) {
-                parts.push(line);
-                lineLength += line.length;
-            }
+            flowed = !isSignature && content.endsWith(' ');
+            depth = quoteDepth;
         }
         return parts.join('');
     }
@@ -1213,7 +1432,10 @@ class MimeNode {
         if (!this.content) {
             return '';
         }
-        let str = getDecoder(this.contentType.parsed.params.charset).decode(this.content);
+        // The bytes keep the line endings the part was sent with, see PassThroughDecoder,
+        // which differ from one transfer encoding to the next. Text is normalized to LF so
+        // that a consumer does not get CRLF from one message and LF from another
+        let str = decodeText(this.content, this.contentType.parsed.params.charset, this.contentType.parsed.value === 'text/html').replace(/\r\n/g, '\n');
         if (/^flowed$/i.test(this.contentType.parsed.params.format)) {
             str = this.decodeFlowedText(str, /^yes$/i.test(this.contentType.parsed.params.delsp));
         }
@@ -1259,10 +1481,8 @@ class MimeNode {
             let unfoldedLine = parts.join('');
             sep = unfoldedLine.indexOf(':');
             let key = trimWsp(sep < 0 ? unfoldedLine : unfoldedLine.slice(0, sep));
-            // A bare CR is not legal in a field body. It used to be folded into a space by
-            // the whitespace collapse, and passing it through would hand consumers that
-            // write the value back out a line of their own.
-            let value = sep < 0 ? '' : trimWsp(unfoldedLine.slice(sep + 1).replace(/[\r\n]+/g, ' '));
+            // A bare CR is not legal in a field body, see foldLineBreaks
+            let value = sep < 0 ? '' : trimWsp(foldLineBreaks(unfoldedLine.slice(sep + 1)));
             this.headers.push({ key: key.toLowerCase(), originalKey: key, value });
             // A header that decides how the body is read must resolve the same way every
             // time it is duplicated, otherwise a message can present one Content-Type to a
@@ -1294,7 +1514,15 @@ class MimeNode {
         this.contentType.multipart = /^multipart\//i.test(this.contentType.parsed.value)
             ? this.contentType.parsed.value.slice(this.contentType.parsed.value.indexOf('/') + 1)
             : false;
-        if (this.contentType.multipart && this.contentType.parsed.params.boundary) {
+        if (this.contentType.multipart && !this.contentType.parsed.params.boundary) {
+            // A multipart without the boundary RFC 2046 5.1.1 requires has no parts to find,
+            // and its body used to be dropped without a trace. RFC 2045 5.2 recommends
+            // reading an invalid Content-Type as plain text, which is also what the body of
+            // such a message usually is
+            this.contentType.parsed.value = 'text/plain';
+            this.contentType.multipart = false;
+        }
+        if (this.contentType.multipart) {
             // add self to boundary terminator listing
             this.postalMime.boundaries.push({
                 value: textEncoder.encode(this.contentType.parsed.params.boundary),
@@ -1311,13 +1539,20 @@ class MimeNode {
             .match(/[\w-]+/) || [''])[0];
         this.setupContentDecoder(this.contentTransferEncoding.encoding);
     }
-    feed(line) {
+    // Ends the header section and sets up the body
+    endHeaders() {
+        this.state = 'body';
+        this.processHeaders();
+    }
+    // Returns true when the line was not consumed: the headers ended with the line before
+    // it, and the parser has to read it again, since the boundary this part declares was
+    // not known yet when the line was checked for one
+    feed(line, lineBreak) {
         switch (this.state) {
-            case 'header':
+            case 'header': {
                 if (!line.length) {
-                    this.state = 'body';
-                    this.processHeaders();
-                    return;
+                    this.endHeaders();
+                    return false;
                 }
                 // Counted across the whole message, not per part. A per-node budget lets a
                 // multipart carry the limit again for every part it declares, so a message
@@ -1327,17 +1562,34 @@ class MimeNode {
                     let error = new Error(`Maximum header size of ${this.options.maxHeadersSize} bytes exceeded`);
                     throw error;
                 }
-                this.headerLines.push(headerDecoder.decode(line));
+                const text = decodeUtf8OrWindows1252(line, headerDecoder);
+                // A line of nothing but whitespace is legal folding (RFC 5322 4.2, obs-FWS),
+                // but broken generators also put one where the empty line that ends the
+                // headers belongs, and reading it as a fold then turned the whole body into
+                // one more header. So the next line decides what it was: a continuation or
+                // another header keep it a fold, anything else means the headers ended with
+                // it, and it is taken back out of the header lines. Python and Go read such
+                // a line as the end of the headers outright, so the body is where the other
+                // parsers find it.
+                if (this.lastLineBlank && !isWsp(line[0]) && !FIELD_START.test(text)) {
+                    this.headerLines.pop();
+                    this.endHeaders();
+                    return true;
+                }
+                this.headerLines.push(text);
+                this.lastLineBlank = isBlankLine(line);
                 break;
+            }
             case 'body':
                 // add line to body. processHeaders installs a decoder before the state
                 // becomes body, and the only time the decoder is released is finalize,
                 // which moves the state on to finished, so the guard only narrows the type
                 if (this.contentDecoder) {
-                    this.contentDecoder.update(line);
+                    this.contentDecoder.update(line, lineBreak);
                 }
                 break;
         }
+        return false;
     }
 }
 
@@ -3576,6 +3828,39 @@ const htmlEntities = {
     '&zwnj;': '\u200C'
 };
 
+// What a numeric character reference to the C1 control range stands for, per the HTML
+// numeric character reference end state: the windows-1252 character at that byte. This is
+// how Outlook and Word write their curly quotes and dashes (`&#146;`, `&#150;`), and the
+// raw control character they decoded to otherwise is invisible in the text.
+const C1_ENTITY_REPLACEMENTS = new Map([
+    [0x80, 0x20ac],
+    [0x82, 0x201a],
+    [0x83, 0x0192],
+    [0x84, 0x201e],
+    [0x85, 0x2026],
+    [0x86, 0x2020],
+    [0x87, 0x2021],
+    [0x88, 0x02c6],
+    [0x89, 0x2030],
+    [0x8a, 0x0160],
+    [0x8b, 0x2039],
+    [0x8c, 0x0152],
+    [0x8e, 0x017d],
+    [0x91, 0x2018],
+    [0x92, 0x2019],
+    [0x93, 0x201c],
+    [0x94, 0x201d],
+    [0x95, 0x2022],
+    [0x96, 0x2013],
+    [0x97, 0x2014],
+    [0x98, 0x02dc],
+    [0x99, 0x2122],
+    [0x9a, 0x0161],
+    [0x9b, 0x203a],
+    [0x9c, 0x0153],
+    [0x9e, 0x017e],
+    [0x9f, 0x0178]
+]);
 function decodeHTMLEntities(str) {
     return str.replace(/&(#\d+|#x[a-f0-9]+|[a-z]+\d*);?/gi, (match, entity) => {
         if (typeof htmlEntities[match] === 'string') {
@@ -3586,19 +3871,23 @@ function decodeHTMLEntities(str) {
             return match;
         }
         let codePoint;
-        if (entity.charAt(1) === 'x') {
-            // hex
+        // The pattern matches the marker in either case, so the test has to as well. Reading
+        // `&#X41;` as decimal gave NaN, which passes every range check below and comes out
+        // of String.fromCharCode as a NUL character
+        if (entity.charAt(1).toLowerCase() === 'x') {
             codePoint = parseInt(entity.slice(2), 16);
         }
         else {
-            // dec
             codePoint = parseInt(entity.slice(1), 10);
         }
         let output = '';
-        if ((codePoint >= 0xd800 && codePoint <= 0xdfff) || codePoint > 0x10ffff) {
-            // Invalid range, return a replacement character instead
+        // A NUL reference, a surrogate or a code point out of range is a replacement
+        // character, like in a browser. A NUL in particular would truncate the text in
+        // whatever reads it next
+        if (codePoint === 0 || (codePoint >= 0xd800 && codePoint <= 0xdfff) || codePoint > 0x10ffff) {
             return '\ufffd';
         }
+        codePoint = C1_ENTITY_REPLACEMENTS.get(codePoint) ?? codePoint;
         if (codePoint > 0xffff) {
             codePoint -= 0x10000;
             output += String.fromCharCode(((codePoint >>> 10) & 0x3ff) | 0xd800);
@@ -3697,13 +3986,17 @@ function replaceTags(str, prefix, pattern, replacement) {
             break;
         }
         const start = candidate.index;
+        // Looked up before the pattern runs. The engine finds out on its own that there is
+        // no `>` to close on, but only after it has retried the tail of the pattern at every
+        // `href` in the rest of the input and rescanned to the end each time, which made an
+        // html part of many unclosed `<a href` tags quadratic to convert
+        const gt = str.indexOf('>', start);
+        if (gt < 0) {
+            break;
+        }
         pattern.lastIndex = start;
         const match = pattern.exec(str);
         if (!match) {
-            const gt = str.indexOf('>', start);
-            if (gt < 0) {
-                break;
-            }
             searchFrom = gt + 1;
             continue;
         }
@@ -4729,7 +5022,11 @@ class Tokenizer {
             this.escaped = false;
             return;
         }
-        else if (this.operatorExpecting === '"' && chr === '\\') {
+        else if ((this.operatorExpecting === '"' || this.operatorExpecting === ')') && chr === '\\') {
+            // A backslash escapes the next character inside a quoted string and inside a
+            // comment alike (RFC 5322 3.2.2, ccontent includes quoted-pair). Honouring it
+            // only in quoted strings let an escaped parenthesis close the comment, which
+            // released the rest of it, an address included, into the header
             this.escaped = true;
             return;
         }
@@ -4914,8 +5211,14 @@ function renderEntry(textEntry, textType, convert) {
     }
     return textType === 'html' ? textToHtml(textEntry.value) : htmlToText(textEntry.value);
 }
+// The line break given to the last line of a message that ends without one, see readLine
+const LINE_FEED = new Uint8Array([0x0a]);
 const MAX_NESTING_DEPTH = 256;
 const MAX_HEADERS_SIZE = 2 * 1024 * 1024;
+// The depth limit does not bound the size of the tree. An empty part costs six bytes of
+// input (`--b` and a blank line) and over a kilobyte of parser state at its peak, so a
+// flat multipart of a million empty parts took a 7 MB message to 1.4 GB of memory.
+const MAX_PART_COUNT = 10000;
 // Inline message/rfc822 parts are parsed recursively. Without a dedicated limit
 // each nesting level spawns a new parser that retains the full nested message,
 // so a small crafted email can exhaust memory (OOM crash). Cap the recursion and
@@ -4953,7 +5256,8 @@ class PostalMime {
         this.options = options || {};
         this.mimeOptions = {
             maxNestingDepth: parseLimitOption(this.options.maxNestingDepth, MAX_NESTING_DEPTH, 'maxNestingDepth'),
-            maxHeadersSize: parseLimitOption(this.options.maxHeadersSize, MAX_HEADERS_SIZE, 'maxHeadersSize')
+            maxHeadersSize: parseLimitOption(this.options.maxHeadersSize, MAX_HEADERS_SIZE, 'maxHeadersSize'),
+            maxPartCount: parseLimitOption(this.options.maxPartCount, MAX_PART_COUNT, 'maxPartCount')
         };
         // A limit of 0 disables inline parsing entirely, so every message/rfc822 part
         // becomes an attachment.
@@ -4962,13 +5266,15 @@ class PostalMime {
         // It is deliberately not an option, so that forwarding a caller supplied options
         // object can not seed it and switch the recursion limit off.
         this.rfc822NestingDepth = 0;
+        // Header bytes seen across every part of this message, see MimeNode.feed, and the
+        // number of parts created for it, the root included, see the MimeNode constructor
+        this.headerSize = 0;
+        this.partCount = 0;
         this.root = this.currentNode = new MimeNode({
             postalMime: this,
             ...this.mimeOptions
         });
         this.boundaries = [];
-        // Header bytes seen across every part of this message, see MimeNode.feed
-        this.headerSize = 0;
         this.textContent = {};
         this.textMap = new Map();
         this.textTypes = new Set();
@@ -4988,7 +5294,7 @@ class PostalMime {
         await this.root.finalize();
     }
     /** @internal */
-    async processLine(line, isFinal) {
+    async processLine(line, lineBreak, isFinal) {
         let boundaries = this.boundaries;
         // check if this is a mime boundary
         if (boundaries.length && line.length > 2 && line[0] === 0x2d && line[1] === 0x2d) {
@@ -5022,7 +5328,7 @@ class PostalMime {
                 // RFC 2046: boundary line may have trailing whitespace (space/tab) before CRLF
                 let hasValidTrailing = true;
                 for (let j = boundaryEnd; j < line.length; j++) {
-                    if (line[j] !== 0x20 && line[j] !== 0x09) {
+                    if (!isWsp(line[j])) {
                         hasValidTrailing = false;
                         break;
                     }
@@ -5050,11 +5356,18 @@ class PostalMime {
                 return;
             }
         }
-        this.currentNode.feed(line);
+        if (this.currentNode.feed(line, lineBreak)) {
+            // The headers ended with the line before this one, so the boundary this part
+            // declares was not registered when the line was checked above. Read it again
+            return this.processLine(line, lineBreak, isFinal);
+        }
         if (isFinal) {
             return this.finalize();
         }
     }
+    // Reads the next line without its line break. The break itself, the exact bytes between
+    // the line and the next one, is returned alongside, because the body decoders write it
+    // back out: a part has to keep the line endings it was sent with, see PassThroughDecoder.
     /** @internal */
     readLine() {
         let startPos = this.readPos;
@@ -5067,12 +5380,16 @@ class PostalMime {
             if (c === 0x0a) {
                 return {
                     bytes: new Uint8Array(this.buf, startPos, endPos - startPos),
+                    lineBreak: this.av.subarray(endPos, this.readPos),
                     done: this.readPos >= this.av.length
                 };
             }
         }
+        // A message that ends without a line break still gets one after its last line, the
+        // decoders write it out unless a boundary ended the part
         return {
             bytes: new Uint8Array(this.buf, startPos, endPos - startPos),
+            lineBreak: LINE_FEED,
             done: this.readPos >= this.av.length
         };
     }
@@ -5153,7 +5470,9 @@ class PostalMime {
         const filename = node.contentDisposition.parsed.params.filename || node.contentType.parsed.params.name || null;
         // `content` is filled in below once the part type is known, hence the cast
         const attachment = {
-            filename: filename ? decodeWords(filename) : null,
+            // An RFC 2231 filename is percent decoded without folding, since the same decoder
+            // produces the boundary, so the fold happens here, see foldLineBreaks
+            filename: filename ? decodeWords(foldLineBreaks(filename)) : null,
             mimeType: node.contentType.parsed.value,
             disposition: node.contentDisposition.parsed.value || null
         };
@@ -5186,7 +5505,7 @@ class PostalMime {
                 // Enforce into unicode, ending in exactly one newline. The trailing
                 // newlines are counted rather than replaced with `/\n*$/`, which
                 // retries at every newline of a run that does not end the text.
-                const decodedText = node.getTextContent().replace(/\r?\n/g, '\n');
+                const decodedText = node.getTextContent();
                 let end = decodedText.length;
                 while (end > 0 && decodedText.charCodeAt(end - 1) === 0x0a) {
                     end--;
@@ -5435,7 +5754,7 @@ class PostalMime {
         this.readPos = 0;
         while (this.readPos < this.av.length) {
             const line = this.readLine();
-            await this.processLine(line.bytes, line.done);
+            await this.processLine(line.bytes, line.lineBreak, line.done);
         }
         this.forceRfc822Attachments = Boolean(this.options.forceRfc822Attachments) || this.hasReportParts();
         await this.collectNode(this.root, false, false);