@nocobase/plugin-notifications 2.4.0-alpha.1 → 2.4.0-alpha.10

package/dist/node_modules/nodemailer/{lib → dist/esm}/mime-node/index.js

@@ -1,70 +1,123 @@
 /* eslint no-undefined: 0, prefer-spread: 0, no-control-regex: 0 */
-
-'use strict';
-
-const crypto = require('crypto');
-const fs = require('fs');
-const punycode = require('punycode');
-const PassThrough = require('stream').PassThrough;
-const shared = require('../shared');
-
-const mimeFuncs = require('../mime-funcs');
-const qp = require('../qp');
-const base64 = require('../base64');
-const addressparser = require('../addressparser');
-const nmfetch = require('../fetch');
-const LastNewline = require('./last-newline');
-
-const LeWindows = require('./le-windows');
-const LeUnix = require('./le-unix');
-
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import * as punycode from '../punycode/index.js';
+import { PassThrough } from 'node:stream';
+import * as shared from '../shared/index.js';
+import urlModule from 'node:url';
+import * as mimeFuncs from '../mime-funcs/index.js';
+import * as qp from '../qp/index.js';
+import * as base64 from '../base64/index.js';
+import addressparser from '../addressparser/index.js';
+import nmfetch from '../fetch/index.js';
+import * as errors from '../errors.js';
+import LastNewline from './last-newline.js';
+import LeWindows from './le-windows.js';
+import LeUnix from './le-unix.js';
+const FORMATTED_HEADERS = ['From', 'Sender', 'To', 'Cc', 'Bcc', 'Reply-To', 'Date', 'References'];
+// RFC 5321 atext, plus the non-ascii bytes that SMTPUTF8 (RFC 6531) adds to it. A local part
+// built from these, with '.' as a separator, is a dot-atom and can be emitted bare
+const ATEXT = "[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]";
+const DOT_ATOM = new RegExp('^' + ATEXT + '+(?:\\.' + ATEXT + '+)*$');
+// A complete quoted-string: everything between the outer quotes is either a plain char or
+// a quoted-pair. Anchored, so a value that only starts and ends with a quote does not pass
+const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
+// An address that carries no special anywhere can be emitted bare in a header, everything
+// else goes into angle brackets so that the header can not be read as more addresses than
+// the envelope carries
+const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+// domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
+// mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
+// controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
+// deliverable 'evil.example', which would turn a value the bundled codec leaves as
+// unroutable garbage into mail for a domain the sender never named. None of these
+// characters are legal in a domain, so keep them away from the mapper.
+const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+/**
+ * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
+ * which is with UTS-46 mapping applied before the Punycode step.
+ *
+ * The bundled codec is plain RFC 3492 and maps nothing, so it disagrees with every
+ * conformant parser on any domain holding a mapped or ignored code point. An invisible
+ * U+00AD in 'compa\u00ADny.com' encoded to 'xn--company-pka.com' where a validator reads
+ * 'company.com', which let an allow-listed domain be checked and a different one mailed.
+ *
+ * Anything the URL parser does not accept as a hostname, an address literal such as
+ * '[127.0.0.1]' included, comes back empty and falls through to the bundled codec, which
+ * leaves those as they were supplied.
+ *
+ * @param domain Domain to encode, already lowercased by the caller
+ * @param toUnicode Return the U-label form instead of the A-label form
+ * @return Encoded domain
+ */
+function normalizeDomain(domain, toUnicode) {
+    // domainToASCII and domainToUnicode landed in Node 7, the bundled codec covers Node 6
+    const mapper = toUnicode ? urlModule.domainToUnicode : urlModule.domainToASCII;
+    if (typeof mapper === 'function' && !URL_PARSER_UNSAFE.test(domain)) {
+        const mapped = mapper(domain);
+        if (mapped) {
+            return mapped;
+        }
+    }
+    return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
+}
+/**
+ * Removes the characters that must never reach a multipart delimiter line.
+ *
+ * A line break splits the delimiter, so the boundary declared in the header can never
+ * match it again and the parts go out as body lines instead. The other C0 controls and
+ * DEL do not split anything but must not be written either: RFC 5321 does not allow a
+ * NUL in DATA at all, and an MTA or a scanner that stops at one reads a different
+ * message than a client that does not, which is the same parser disagreement a split
+ * delimiter creates. Both sides are cleaned together, since the declared value and the
+ * delimiters come from this one result.
+ *
+ * @param value Value to clean
+ * @return Value with every control character removed
+ */
+function _stripBoundaryControls(value) {
+    return value.replace(/[\x00-\x1f\x7f]+/g, '');
+}
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
  * the options, assumes this is the root.
  *
- * @param {String} contentType Define the content type for the node. Can be left blank for attachments (derived from filename)
- * @param {Object} [options] optional options
- * @param {Object} [options.rootNode] root node for this tree
- * @param {Object} [options.parentNode] immediate parent for this node
- * @param {Object} [options.filename] filename for an attachment node
- * @param {String} [options.baseBoundary] shared part of the unique multipart boundary
- * @param {Boolean} [options.keepBcc] If true, do not exclude Bcc from the generated headers
- * @param {Function} [options.normalizeHeaderKey] method to normalize header keys for custom caseing
- * @param {String} [options.textEncoding] either 'Q' (the default) or 'B'
+ * @param contentType Define the content type for the node. Can be left blank for attachments (derived from filename)
+ * @param [options] optional options
+ * @param [options.rootNode] root node for this tree
+ * @param [options.parentNode] immediate parent for this node
+ * @param [options.filename] filename for an attachment node
+ * @param [options.baseBoundary] shared part of the unique multipart boundary
+ * @param [options.keepBcc] If true, do not exclude Bcc from the generated headers
+ * @param [options.normalizeHeaderKey] method to normalize header keys for custom caseing
+ * @param [options.textEncoding] either 'Q' (the default) or 'B'
  */
 class MimeNode {
     constructor(contentType, options) {
         this.nodeCounter = 0;
-
         options = options || {};
-
         /**
-         * shared part of the unique multipart boundary
+         * shared part of the unique multipart boundary. Control characters are dropped
+         * here rather than at the delimiter, see _stripBoundaryControls
          */
-        this.baseBoundary = options.baseBoundary || crypto.randomBytes(8).toString('hex');
-        this.boundaryPrefix = options.boundaryPrefix || '--_NmP';
-
+        this.baseBoundary = _stripBoundaryControls(options.baseBoundary || crypto.randomBytes(8).toString('hex'));
+        this.boundaryPrefix = _stripBoundaryControls(options.boundaryPrefix || '--_NmP');
         this.disableFileAccess = !!options.disableFileAccess;
         this.disableUrlAccess = !!options.disableUrlAccess;
-
         this.normalizeHeaderKey = options.normalizeHeaderKey;
-
         /**
          * If date headers is missing and current node is the root, this value is used instead
          */
-        this.date = new Date();
-
+        this.date = options.parentNode ? null : new Date();
         /**
          * Root node for current mime tree
          */
         this.rootNode = options.rootNode || this;
-
         /**
          * If true include Bcc in generated headers (if available)
          */
         this.keepBcc = !!options.keepBcc;
-
         /**
          * If filename is specified but contentType is not (probably an attachment)
          * detect the content type from filename extension
@@ -78,80 +131,66 @@ class MimeNode {
                 contentType = mimeFuncs.detectMimeType(this.filename.split('.').pop());
             }
         }
-
         /**
          * Indicates which encoding should be used for header strings: "Q" or "B"
          */
         this.textEncoding = (options.textEncoding || '').toString().trim().charAt(0).toUpperCase();
-
         /**
          * Immediate parent for this node (or undefined if not set)
          */
         this.parentNode = options.parentNode;
-
         /**
          * Hostname for default message-id values
          */
         this.hostname = options.hostname;
-
         /**
          * If set to 'win' then uses \r\n, if 'linux' then \n. If not set (or `raw` is used) then newlines are kept as is.
          */
         this.newline = options.newline;
-
         /**
          * An array for possible child nodes
          */
         this.childNodes = [];
-
         /**
          * Used for generating unique boundaries (prepended to the shared base)
          */
         this._nodeId = ++this.rootNode.nodeCounter;
-
         /**
          * A list of header values for this node in the form of [{key:'', value:''}]
          */
         this._headers = [];
-
         /**
          * True if the content only uses ASCII printable characters
          * @type {Boolean}
          */
         this._isPlainText = false;
-
         /**
          * True if the content is plain text but has longer lines than allowed
          * @type {Boolean}
          */
         this._hasLongLines = false;
-
         /**
          * If set, use instead this value for envelopes instead of generating one
          * @type {Boolean}
          */
         this._envelope = false;
-
         /**
          * If set then use this value as the stream content instead of building it
          * @type {String|Buffer|Stream}
          */
         this._raw = false;
-
         /**
          * Additional transform streams that the message will be piped before
          * exposing by createReadStream
          * @type {Array}
          */
         this._transforms = [];
-
         /**
          * Additional process functions that the message will be piped through before
          * exposing by createReadStream. These functions are run after transforms
          * @type {Array}
          */
         this._processFuncs = [];
-
         /**
          * If content type is set (or derived from the filename) add it to headers
          */
@@ -159,82 +198,77 @@ class MimeNode {
             this.setHeader('Content-Type', contentType);
         }
     }
-
     /////// PUBLIC METHODS
-
     /**
      * Creates and appends a child node.Arguments provided are passed to MimeNode constructor
      *
-     * @param {String} [contentType] Optional content type
-     * @param {Object} [options] Optional options object
-     * @return {Object} Created node object
+     * @param [contentType] Optional content type
+     * @param [options] Optional options object
+     * @return Created node object
      */
     createChild(contentType, options) {
         if (!options && typeof contentType === 'object') {
             options = contentType;
             contentType = undefined;
         }
-        let node = new MimeNode(contentType, options);
+        const node = new MimeNode(contentType, options);
         this.appendChild(node);
         return node;
     }
-
     /**
      * Appends an existing node to the mime tree. Removes the node from an existing
      * tree if needed
      *
-     * @param {Object} childNode node to be appended
-     * @return {Object} Appended node object
+     * @param childNode node to be appended
+     * @return Appended node object
      */
     appendChild(childNode) {
+        // Take the node out of the tree it is in first. Leaving it there keeps it in that
+        // parent's childNodes, so it still streams as part of the old tree while parentNode
+        // already points at the new one, and anything read off the parent chain answers for
+        // the wrong tree.
+        if (childNode.parentNode && childNode.parentNode !== this) {
+            childNode.remove();
+        }
         if (childNode.rootNode !== this.rootNode) {
             childNode.rootNode = this.rootNode;
             childNode._nodeId = ++this.rootNode.nodeCounter;
         }
-
         childNode.parentNode = this;
-
         this.childNodes.push(childNode);
         return childNode;
     }
-
     /**
      * Replaces current node with another node
      *
-     * @param {Object} node Replacement node
-     * @return {Object} Replacement node
+     * @param node Replacement node
+     * @return Replacement node
      */
     replace(node) {
         if (node === this) {
             return this;
         }
-
         this.parentNode.childNodes.forEach((childNode, i) => {
             if (childNode === this) {
                 node.rootNode = this.rootNode;
                 node.parentNode = this.parentNode;
                 node._nodeId = this._nodeId;
-
                 this.rootNode = this;
                 this.parentNode = undefined;
-
                 node.parentNode.childNodes[i] = node;
             }
         });
-
         return node;
     }
-
     /**
      * Removes current node from the mime tree
      *
-     * @return {Object} removed node
+     * @return removed node
      */
     remove() {
         if (!this.parentNode) {
             return this;
         }
-
         for (let i = this.parentNode.childNodes.length - 1; i >= 0; i--) {
             if (this.parentNode.childNodes[i] === this) {
                 this.parentNode.childNodes.splice(i, 1);
@@ -244,31 +278,30 @@ class MimeNode {
             }
         }
     }
-
     /**
      * Sets a header value. If the value for selected key exists, it is overwritten.
      * You can set multiple values as well by using [{key:'', value:''}] or
      * {key: 'value'} as the first argument.
      *
-     * @param {String|Array|Object} key Header key or a list of key value pairs
-     * @param {String} value Header value
-     * @return {Object} current node
+     * @param key Header key or a list of key value pairs
+     * @param value Header value
+     * @return current node
      */
     setHeader(key, value) {
-        let added = false,
-            headerValue;
-
+        let added = false;
         // Allow setting multiple headers at once
         if (!value && key && typeof key === 'object') {
             // allow {key:'content-type', value: 'text/plain'}
             if (key.key && 'value' in key) {
                 this.setHeader(key.key, key.value);
-            } else if (Array.isArray(key)) {
+            }
+            else if (Array.isArray(key)) {
                 // allow [{key:'content-type', value: 'text/plain'}]
                 key.forEach(i => {
                     this.setHeader(i.key, i.value);
                 });
-            } else {
+            }
+            else {
                 // allow {'content-type': 'text/plain'}
                 Object.keys(key).forEach(i => {
                     this.setHeader(i, key[i]);
@@ -276,14 +309,11 @@ class MimeNode {
             }
             return this;
         }
-
         key = this._normalizeHeaderKey(key);
-
-        headerValue = {
+        const headerValue = {
             key,
             value
         };
-
         // Check if the value exists and overwrite
         for (let i = 0, len = this._headers.length; i < len; i++) {
             if (this._headers[i].key === key) {
@@ -291,7 +321,8 @@ class MimeNode {
                     // replace the first match
                     this._headers[i] = headerValue;
                     added = true;
-                } else {
+                }
+                else {
                     // remove following matches
                     this._headers.splice(i, 1);
                     i--;
@@ -299,24 +330,21 @@ class MimeNode {
                 }
             }
         }
-
         // match not found, append the value
         if (!added) {
             this._headers.push(headerValue);
         }
-
         return this;
     }
-
     /**
      * Adds a header value. If the value for selected key exists, the value is appended
      * as a new field and old one is not touched.
      * You can set multiple values as well by using [{key:'', value:''}] or
      * {key: 'value'} as the first argument.
      *
-     * @param {String|Array|Object} key Header key or a list of key value pairs
-     * @param {String} value Header value
-     * @return {Object} current node
+     * @param key Header key or a list of key value pairs
+     * @param value Header value
+     * @return current node
      */
     addHeader(key, value) {
         // Allow setting multiple headers at once
@@ -324,38 +352,38 @@ class MimeNode {
             // allow {key:'content-type', value: 'text/plain'}
             if (key.key && key.value) {
                 this.addHeader(key.key, key.value);
-            } else if (Array.isArray(key)) {
+            }
+            else if (Array.isArray(key)) {
                 // allow [{key:'content-type', value: 'text/plain'}]
                 key.forEach(i => {
                     this.addHeader(i.key, i.value);
                 });
-            } else {
+            }
+            else {
                 // allow {'content-type': 'text/plain'}
                 Object.keys(key).forEach(i => {
                     this.addHeader(i, key[i]);
                 });
             }
             return this;
-        } else if (Array.isArray(value)) {
+        }
+        else if (Array.isArray(value)) {
             value.forEach(val => {
                 this.addHeader(key, val);
             });
             return this;
         }
-
         this._headers.push({
             key: this._normalizeHeaderKey(key),
             value
         });
-
         return this;
     }
-
     /**
      * Retrieves the first mathcing value of a selected key
      *
-     * @param {String} key Key to search for
-     * @retun {String} Value for the key
+     * @param key Key to search for
+     * @retun Value for the key
      */
     getHeader(key) {
         key = this._normalizeHeaderKey(key);
@@ -365,14 +393,13 @@ class MimeNode {
             }
         }
     }
-
     /**
      * Sets body content for current node. If the value is a string, charset is added automatically
      * to Content-Type (if it is text/*). If the value is a Buffer, you need to specify
      * the charset yourself
      *
-     * @param (String|Buffer) content Body content
-     * @return {Object} current node
+     * @param content Body content
+     * @return current node
      */
     setContent(content) {
         this.content = content;
@@ -384,7 +411,8 @@ class MimeNode {
                 this.content = err;
             };
             this.content.once('error', this._contentErrorHandler);
-        } else if (typeof this.content === 'string') {
+        }
+        else if (typeof this.content === 'string') {
             this._isPlainText = mimeFuncs.isPlainText(this.content);
             if (this._isPlainText && mimeFuncs.hasLongerLines(this.content, 76)) {
                 // If there are lines longer than 76 symbols/bytes do not use 7bit
@@ -393,59 +421,48 @@ class MimeNode {
         }
         return this;
     }
-
     build(callback) {
         let promise;
-
         if (!callback) {
             promise = new Promise((resolve, reject) => {
                 callback = shared.callbackPromise(resolve, reject);
             });
         }
-
-        let stream = this.createReadStream();
-        let buf = [];
+        const done = callback;
+        const stream = this.createReadStream();
+        const buf = [];
         let buflen = 0;
         let returned = false;
-
         stream.on('readable', () => {
             let chunk;
-
             while ((chunk = stream.read()) !== null) {
                 buf.push(chunk);
                 buflen += chunk.length;
             }
         });
-
         stream.once('error', err => {
             if (returned) {
                 return;
             }
             returned = true;
-
-            return callback(err);
+            return done(err);
         });
-
-        stream.once('end', chunk => {
+        stream.once('end', (chunk) => {
             if (returned) {
                 return;
             }
             returned = true;
-
             if (chunk && chunk.length) {
                 buf.push(chunk);
                 buflen += chunk.length;
             }
-            return callback(null, Buffer.concat(buf, buflen));
+            return done(null, Buffer.concat(buf, buflen));
         });
-
         return promise;
     }
-
     getTransferEncoding() {
         let transferEncoding = false;
-        let contentType = (this.getHeader('Content-Type') || '').toString().toLowerCase().trim();
-
+        const contentType = (this.getHeader('Content-Type') || '').toString().toLowerCase().trim();
         if (this.content) {
             transferEncoding = (this.getHeader('Content-Transfer-Encoding') || '').toString().toLowerCase().trim();
             if (!transferEncoding || !['base64', 'quoted-printable'].includes(transferEncoding)) {
@@ -453,82 +470,83 @@ class MimeNode {
                     // If there are no special symbols, no need to modify the text
                     if (this._isPlainText && !this._hasLongLines) {
                         transferEncoding = '7bit';
-                    } else if (typeof this.content === 'string' || this.content instanceof Buffer) {
+                    }
+                    else if (typeof this.content === 'string' || this.content instanceof Buffer) {
                         // detect preferred encoding for string value
                         transferEncoding = this._getTextEncoding(this.content) === 'Q' ? 'quoted-printable' : 'base64';
-                    } else {
+                    }
+                    else {
                         // we can not check content for a stream, so either use preferred encoding or fallback to QP
                         transferEncoding = this.textEncoding === 'B' ? 'base64' : 'quoted-printable';
                     }
-                } else if (!/^(multipart|message)\//i.test(contentType)) {
+                }
+                else if (!/^(multipart|message)\//i.test(contentType)) {
                     transferEncoding = transferEncoding || 'base64';
                 }
             }
         }
         return transferEncoding;
     }
-
     /**
      * Builds the header block for the mime node. Append \r\n\r\n before writing the content
      *
-     * @returns {String} Headers
+     * @returns Headers
      */
     buildHeaders() {
-        let transferEncoding = this.getTransferEncoding();
-        let headers = [];
-
+        const transferEncoding = this.getTransferEncoding();
+        const headers = [];
         if (transferEncoding) {
             this.setHeader('Content-Transfer-Encoding', transferEncoding);
         }
-
         if (this.filename && !this.getHeader('Content-Disposition')) {
             this.setHeader('Content-Disposition', 'attachment');
         }
-
         // Ensure mandatory header fields
         if (this.rootNode === this) {
             if (!this.getHeader('Date')) {
                 this.setHeader('Date', this.date.toUTCString().replace(/GMT/, '+0000'));
             }
-
             // ensure that Message-Id is present
             this.messageId();
-
             if (!this.getHeader('MIME-Version')) {
                 this.setHeader('MIME-Version', '1.0');
             }
+            // Ensure that Content-Type is the last header for the root node
+            for (let i = this._headers.length - 2; i >= 0; i--) {
+                const header = this._headers[i];
+                if (header.key === 'Content-Type') {
+                    this._headers.splice(i, 1);
+                    this._headers.push(header);
+                }
+            }
         }
-
         this._headers.forEach(header => {
             let key = header.key;
             let value = header.value;
             let structured;
             let param;
-            let options = {};
-            let formattedHeaders = ['From', 'Sender', 'To', 'Cc', 'Bcc', 'Reply-To', 'Date', 'References'];
-
+            const options = {};
+            const formattedHeaders = FORMATTED_HEADERS;
             if (value && typeof value === 'object' && !formattedHeaders.includes(key)) {
-                Object.keys(value).forEach(key => {
-                    if (key !== 'value') {
-                        options[key] = value[key];
-                    }
-                });
+                // the keys come from a caller supplied header object and `options.prepared`
+                // below decides whether the value is emitted raw, so an own "__proto__" key
+                // here would turn an unfolded value into header injection
+                shared.copyOwnKeys(options, value, optionKey => optionKey === 'value');
                 value = (value.value || '').toString();
                 if (!value.trim()) {
                     return;
                 }
             }
-
             if (options.prepared) {
                 // header value is
                 if (options.foldLines) {
                     headers.push(mimeFuncs.foldLines(key + ': ' + value));
-                } else {
+                }
+                else {
                     headers.push(key + ': ' + value);
                 }
                 return;
             }
-
             switch (header.key) {
                 case 'Content-Disposition':
                     structured = mimeFuncs.parseHeaderValue(value);
@@ -537,32 +555,38 @@ class MimeNode {
                     }
                     value = mimeFuncs.buildHeaderValue(structured);
                     break;
-
                 case 'Content-Type':
                     structured = mimeFuncs.parseHeaderValue(value);
-
+                    // the type token decides multipart and charset below, so clean it before
+                    // those run and not just on the way out, otherwise a control char makes
+                    // the checks miss and the header ends up claiming a type it is not set up for
+                    structured.value = (structured.value || '').toString().replace(/[\x00-\x1f\x7f]/g, '');
                     this._handleContentType(structured);
-
-                    if (structured.value.match(/^text\/plain\b/) && typeof this.content === 'string' && /[\u0080-\uFFFF]/.test(this.content)) {
+                    if (structured.value.match(/^text\/plain\b/) &&
+                        typeof this.content === 'string' &&
+                        /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
-
                     value = mimeFuncs.buildHeaderValue(structured);
-
                     if (this.filename) {
                         // add support for non-compliant clients like QQ webmail
                         // we can't build the value with buildHeaderValue as the value is non standard and
                         // would be converted to parameter continuation encoding that we do not want
-                        param = this._encodeWords(this.filename);
-
+                        // control chars can not be quoted here: HT is a fold point that unfolding would
+                        // turn into a space, CR/LF can not appear in a header at all and DEL is not
+                        // qtext, so force the mime encoded word that a non-ascii filename would get anyway
+                        param = /[\x00-\x1f\x7f]/.test(this.filename)
+                            ? mimeFuncs.encodeWord(this.filename, this._getTextEncoding(this.filename), 52)
+                            : this._encodeWords(this.filename);
                         if (param !== this.filename || /[\s'"\\;:/=(),<>@[\]?]|^-/.test(param)) {
-                            // include value in quotes if needed
-                            param = '"' + param + '"';
+                            // include value in quotes if needed, escaping backslashes and quotes as
+                            // quoted-pairs exactly like buildHeaderValue does for filename=, otherwise
+                            // a trailing backslash would escape the closing quote
+                            param = JSON.stringify(param);
                         }
                         value += '; name=' + param;
                     }
                     break;
-
                 case 'Bcc':
                     if (!this.keepBcc) {
                         // skip BCC values
@@ -570,40 +594,36 @@ class MimeNode {
                     }
                     break;
             }
-
             value = this._encodeHeaderValue(key, value);
-
             // skip empty lines
             if (!(value || '').toString().trim()) {
                 return;
             }
-
             if (typeof this.normalizeHeaderKey === 'function') {
-                let normalized = this.normalizeHeaderKey(key, value);
-                if (normalized && typeof normalized === 'string' && normalized.length) {
-                    key = normalized;
+                const normalized = this.normalizeHeaderKey(key, value);
+                // the result replaces the key on the way into the header, so it gets the same
+                // treatment the key it replaces already had. a line break here would end the
+                // header and start one of the caller's own
+                const cleaned = typeof normalized === 'string' ? normalized.replace(/[\x00-\x1f\x7f]/g, '') : '';
+                if (cleaned) {
+                    key = cleaned;
                 }
             }
-
             headers.push(mimeFuncs.foldLines(key + ': ' + value, 76));
         });
-
         return headers.join('\r\n');
     }
-
     /**
      * Streams the rfc2822 message from the current node. If this is a root node,
      * mandatory header fields are set if missing (Date, Message-Id, MIME-Version)
      *
-     * @return {String} Compiled message
+     * @return Compiled message
      */
     createReadStream(options) {
         options = options || {};
-
-        let stream = new PassThrough(options);
+        const stream = new PassThrough(options);
         let outputStream = stream;
         let transform;
-
         this.stream(stream, options, err => {
             if (err) {
                 outputStream.emit('error', err);
@@ -611,87 +631,77 @@ class MimeNode {
             }
             stream.end();
         });
-
         for (let i = 0, len = this._transforms.length; i < len; i++) {
-            transform = typeof this._transforms[i] === 'function' ? this._transforms[i]() : this._transforms[i];
+            transform =
+                typeof this._transforms[i] === 'function' ? this._transforms[i]() : this._transforms[i];
             outputStream.once('error', err => {
                 transform.emit('error', err);
             });
             outputStream = outputStream.pipe(transform);
         }
-
         // ensure terminating newline after possible user transforms
         transform = new LastNewline();
         outputStream.once('error', err => {
             transform.emit('error', err);
         });
         outputStream = outputStream.pipe(transform);
-
         // dkim and stuff
         for (let i = 0, len = this._processFuncs.length; i < len; i++) {
             transform = this._processFuncs[i];
             outputStream = transform(outputStream);
         }
-
         if (this.newline) {
             const winbreak = ['win', 'windows', 'dos', '\r\n'].includes(this.newline.toString().toLowerCase());
             const newlineTransform = winbreak ? new LeWindows() : new LeUnix();
-
             const stream = outputStream.pipe(newlineTransform);
             outputStream.on('error', err => stream.emit('error', err));
             return stream;
         }
-
         return outputStream;
     }
-
     /**
      * Appends a transform stream object to the transforms list. Final output
      * is passed through this stream before exposing
      *
-     * @param {Object} transform Read-Write stream
+     * @param transform Read-Write stream
      */
     transform(transform) {
         this._transforms.push(transform);
     }
-
     /**
      * Appends a post process function. The functon is run after transforms and
      * uses the following syntax
      *
      *   processFunc(input) -> outputStream
      *
-     * @param {Object} processFunc Read-Write stream
+     * @param processFunc Read-Write stream
      */
     processFunc(processFunc) {
         this._processFuncs.push(processFunc);
     }
-
     stream(outputStream, options, done) {
-        let transferEncoding = this.getTransferEncoding();
+        const transferEncoding = this.getTransferEncoding();
         let contentStream;
         let localStream;
-
         // protect actual callback against multiple triggering
         let returned = false;
-        let callback = err => {
+        const callback = (err) => {
             if (returned) {
                 return;
             }
             returned = true;
             done(err);
         };
-
         // for multipart nodes, push child nodes
         // for content nodes end the stream
-        let finalize = () => {
+        const finalize = () => {
             let childId = 0;
-            let processChildNode = () => {
+            const processChildNode = () => {
                 if (childId >= this.childNodes.length) {
                     outputStream.write('\r\n--' + this.boundary + '--\r\n');
                     return callback();
                 }
-                let child = this.childNodes[childId++];
+                const child = this.childNodes[childId++];
                 outputStream.write((childId > 1 ? '\r\n' : '') + '--' + this.boundary + '\r\n');
                 child.stream(outputStream, options, err => {
                     if (err) {
@@ -700,41 +710,37 @@ class MimeNode {
                     setImmediate(processChildNode);
                 });
             };
-
             if (this.multipart) {
                 setImmediate(processChildNode);
-            } else {
+            }
+            else {
                 return callback();
             }
         };
-
         // pushes node content
-        let sendContent = () => {
+        const sendContent = () => {
             if (this.content) {
                 if (Object.prototype.toString.call(this.content) === '[object Error]') {
                     // content is already errored
                     return callback(this.content);
                 }
-
                 if (typeof this.content.pipe === 'function') {
                     this.content.removeListener('error', this._contentErrorHandler);
                     this._contentErrorHandler = err => callback(err);
                     this.content.once('error', this._contentErrorHandler);
                 }
-
-                let createStream = () => {
+                const createStream = () => {
                     if (['quoted-printable', 'base64'].includes(transferEncoding)) {
                         contentStream = new (transferEncoding === 'base64' ? base64 : qp).Encoder(options);
-
                         contentStream.pipe(outputStream, {
                             end: false
                         });
                         contentStream.once('end', finalize);
                         contentStream.once('error', err => callback(err));
-
                         localStream = this._getStream(this.content);
                         localStream.pipe(contentStream);
-                    } else {
+                    }
+                    else {
                         // anything that is not QP or Base54 passes as-is
                         localStream = this._getStream(this.content);
                         localStream.pipe(outputStream, {
@@ -742,15 +748,13 @@ class MimeNode {
                         });
                         localStream.once('end', finalize);
                     }
-
                     localStream.once('error', err => callback(err));
                 };
-
                 if (this.content._resolve) {
-                    let chunks = [];
+                    const chunks = [];
                     let chunklen = 0;
                     let returned = false;
-                    let sourceStream = this._getStream(this.content);
+                    const sourceStream = this._getStream(this.content);
                     sourceStream.on('error', err => {
                         if (returned) {
                             return;
@@ -774,136 +778,125 @@ class MimeNode {
                         this.content._resolvedValue = Buffer.concat(chunks, chunklen);
                         setImmediate(createStream);
                     });
-                } else {
+                }
+                else {
                     setImmediate(createStream);
                 }
                 return;
-            } else {
-                return setImmediate(finalize);
             }
+            return setImmediate(finalize);
         };
-
         if (this._raw) {
             setImmediate(() => {
                 if (Object.prototype.toString.call(this._raw) === '[object Error]') {
                     // content is already errored
                     return callback(this._raw);
                 }
-
                 // remove default error handler (if set)
                 if (typeof this._raw.pipe === 'function') {
                     this._raw.removeListener('error', this._contentErrorHandler);
                 }
-
-                let raw = this._getStream(this._raw);
+                const raw = this._getStream(this._raw);
                 raw.pipe(outputStream, {
                     end: false
                 });
                 raw.on('error', err => outputStream.emit('error', err));
                 raw.on('end', finalize);
             });
-        } else {
+        }
+        else {
             outputStream.write(this.buildHeaders() + '\r\n\r\n');
             setImmediate(sendContent);
         }
     }
-
     /**
      * Sets envelope to be used instead of the generated one
      *
-     * @return {Object} SMTP envelope in the form of {from: 'from@example.com', to: ['to@example.com']}
+     * @return SMTP envelope in the form of {from: 'from@example.com', to: ['to@example.com']}
      */
     setEnvelope(envelope) {
         let list;
-
         this._envelope = {
             from: false,
             to: []
         };
-
         if (envelope.from) {
             list = [];
-            this._convertAddresses(this._parseAddresses(envelope.from), list);
+            this._convertAddresses(this._parseEnvelopeAddresses(envelope.from), list);
             list = list.filter(address => address && address.address);
             if (list.length && list[0]) {
                 this._envelope.from = list[0].address;
             }
         }
+        const seenRecipients = new Set();
+        const recipients = [];
         ['to', 'cc', 'bcc'].forEach(key => {
             if (envelope[key]) {
-                this._convertAddresses(this._parseAddresses(envelope[key]), this._envelope.to);
+                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), recipients, seenRecipients);
             }
         });
-
-        this._envelope.to = this._envelope.to.map(to => to.address).filter(address => address);
-
-        let standardFields = ['to', 'cc', 'bcc', 'from'];
-        Object.keys(envelope).forEach(key => {
-            if (!standardFields.includes(key)) {
-                this._envelope[key] = envelope[key];
-            }
-        });
-
+        this._envelope.to = recipients.map(to => to.address).filter(address => address);
+        const standardFields = ['to', 'cc', 'bcc', 'from'];
+        shared.copyOwnKeys(this._envelope, envelope, key => standardFields.includes(key));
         return this;
     }
-
     /**
      * Generates and returns an object with parsed address fields
      *
-     * @return {Object} Address object
+     * @return Address object
      */
     getAddresses() {
-        let addresses = {};
-
+        const addresses = {};
+        const seenByKey = new Map();
         this._headers.forEach(header => {
-            let key = header.key.toLowerCase();
+            const key = header.key.toLowerCase();
             if (['from', 'sender', 'reply-to', 'to', 'cc', 'bcc'].includes(key)) {
                 if (!Array.isArray(addresses[key])) {
                     addresses[key] = [];
+                    seenByKey.set(key, new Set());
                 }
-
-                this._convertAddresses(this._parseAddresses(header.value), addresses[key]);
+                this._convertAddresses(this._parseAddresses(header.value), addresses[key], seenByKey.get(key));
             }
         });
-
         return addresses;
     }
-
     /**
      * Generates and returns SMTP envelope with the sender address and a list of recipients addresses
      *
-     * @return {Object} SMTP envelope in the form of {from: 'from@example.com', to: ['to@example.com']}
+     * @return SMTP envelope in the form of {from: 'from@example.com', to: ['to@example.com']}
      */
     getEnvelope() {
         if (this._envelope) {
             return this._envelope;
         }
-
-        let envelope = {
+        const envelope = {
             from: false,
             to: []
         };
+        // Built once and carried across the headers. Letting _convertAddresses seed it per
+        // call would cost O(headers x recipients), and a message can carry many address
+        // headers: `headers: { to: [...] }` emits one To per entry.
+        const seenRecipients = new Set();
+        const recipients = [];
         this._headers.forEach(header => {
-            let list = [];
+            const list = [];
             if (header.key === 'From' || (!envelope.from && ['Reply-To', 'Sender'].includes(header.key))) {
                 this._convertAddresses(this._parseAddresses(header.value), list);
                 if (list.length && list[0]) {
                     envelope.from = list[0].address;
                 }
-            } else if (['To', 'Cc', 'Bcc'].includes(header.key)) {
-                this._convertAddresses(this._parseAddresses(header.value), envelope.to);
+            }
+            else if (['To', 'Cc', 'Bcc'].includes(header.key)) {
+                this._convertAddresses(this._parseAddresses(header.value), recipients, seenRecipients);
             }
         });
-
-        envelope.to = envelope.to.map(to => to.address);
-
+        envelope.to = recipients.map(to => to.address);
         return envelope;
     }
-
     /**
      * Returns Message-Id value. If it does not exist, then creates one
      *
-     * @return {String} Message-Id value
+     * @return Message-Id value
      */
     messageId() {
         let messageId = this.getHeader('Message-ID');
@@ -914,15 +907,13 @@ class MimeNode {
         }
         return messageId;
     }
-
     /**
      * Sets pregenerated content that will be used as the output of this node
      *
-     * @param {String|Buffer|Stream} Raw MIME contents
+     * @param raw Raw MIME contents
      */
     setRaw(raw) {
         this._raw = raw;
-
         if (this._raw && typeof this._raw.pipe === 'function') {
             // pre-stream handler. might be triggered if a stream is set as content
             // and 'error' fires before anything is done with this stream
@@ -932,147 +923,271 @@ class MimeNode {
             };
             this._raw.once('error', this._contentErrorHandler);
         }
-
         return this;
     }
-
     /////// PRIVATE METHODS
-
+    /**
+     * Checks an access policy flag for this node and every node above it. The flags are set
+     * from the options the node was built with, and createChild only ever sees the options
+     * the caller passed, so a child of a closed tree starts out open. Reading the answer off
+     * the parent chain keeps it right whatever order the tree was assembled in.
+     *
+     * @param flag Either 'disableFileAccess' or 'disableUrlAccess'
+     * @return true if this node or an ancestor closed that access
+     * @internal
+     */
+    _accessDisabled(flag) {
+        // eslint-disable-next-line @typescript-eslint/no-this-alias
+        let node = this;
+        while (node) {
+            if (node[flag]) {
+                return true;
+            }
+            node = node.parentNode;
+        }
+        return false;
+    }
     /**
      * Detects and returns handle to a stream related with the content.
      *
-     * @param {Mixed} content Node content
-     * @returns {Object} Stream object
+     * @param content Node content
+     * @returns Stream object
+     * @internal
      */
     _getStream(content) {
         let contentStream;
-
         if (content._resolvedValue) {
             // pass string or buffer content as a stream
             contentStream = new PassThrough();
-
             setImmediate(() => {
                 try {
                     contentStream.end(content._resolvedValue);
-                } catch (err) {
-                    contentStream.emit('error', err);
+                }
+                catch (_err) {
+                    contentStream.emit('error', _err);
                 }
             });
-
             return contentStream;
-        } else if (typeof content.pipe === 'function') {
+        }
+        if (typeof content.pipe === 'function') {
             // assume as stream
             return content;
-        } else if (content && typeof content.path === 'string' && !content.href) {
-            if (this.disableFileAccess) {
+        }
+        if (content && typeof content.path === 'string' && !content.href) {
+            if (this._accessDisabled('disableFileAccess')) {
                 contentStream = new PassThrough();
-                setImmediate(() => contentStream.emit('error', new Error('File access rejected for ' + content.path)));
+                setImmediate(() => {
+                    const err = new Error('File access rejected for ' + content.path);
+                    err.code = errors.EFILEACCESS;
+                    contentStream.emit('error', err);
+                });
                 return contentStream;
             }
             // read file
             return fs.createReadStream(content.path);
-        } else if (content && typeof content.href === 'string') {
-            if (this.disableUrlAccess) {
+        }
+        if (content && typeof content.href === 'string') {
+            if (this._accessDisabled('disableUrlAccess')) {
                 contentStream = new PassThrough();
-                setImmediate(() => contentStream.emit('error', new Error('Url access rejected for ' + content.href)));
+                setImmediate(() => {
+                    const err = new Error('Url access rejected for ' + content.href);
+                    err.code = errors.EURLACCESS;
+                    contentStream.emit('error', err);
+                });
                 return contentStream;
             }
-            // fetch URL
-            return nmfetch(content.href, { headers: content.httpHeaders });
-        } else {
-            // pass string or buffer content as a stream
-            contentStream = new PassThrough();
-
-            setImmediate(() => {
-                try {
-                    contentStream.end(content || '');
-                } catch (err) {
-                    contentStream.emit('error', err);
-                }
-            });
-            return contentStream;
+            // fetch URL. nmfetch refuses any scheme that is not http(s), and it decides
+            // that on the parsed URL. Testing the raw string here instead would reject
+            // forms the parser accepts, such as a leading space or a slash-less authority
+            return nmfetch(content.href, { headers: content.httpHeaders, tls: content.tls });
         }
+        // pass string or buffer content as a stream
+        contentStream = new PassThrough();
+        setImmediate(() => {
+            try {
+                contentStream.end(content || '');
+            }
+            catch (_err) {
+                contentStream.emit('error', _err);
+            }
+        });
+        return contentStream;
     }
-
     /**
      * Parses addresses. Takes in a single address or an array or an
      * array of address arrays (eg. To: [[first group], [second group],...])
      *
-     * @param {Mixed} addresses Addresses to be parsed
-     * @return {Array} An array of address objects
+     * @param addresses Addresses to be parsed
+     * @return An array of address objects
+     * @internal
      */
     _parseAddresses(addresses) {
-        return [].concat.apply(
-            [],
-            [].concat(addresses).map(address => {
-                // eslint-disable-line prefer-spread
-                if (address && address.address) {
-                    address.address = this._normalizeAddress(address.address);
-                    address.name = address.name || '';
-                    return [address];
+        const flattened = [];
+        // Nested arrays are flattened iteratively. concat.apply throws once a recipient list
+        // is long enough to pass the argument limit, and an array handed to addressparser is
+        // stringified, which recurses once per nesting level and exhausts the call stack on
+        // a deep enough value. Every array is walked once, which also ends a self-referential
+        // input
+        const seen = new WeakSet();
+        const stack = [];
+        const enter = (list) => {
+            if (!seen.has(list)) {
+                seen.add(list);
+                stack.push({ list, pos: 0 });
+            }
+        };
+        enter(Array.isArray(addresses) ? addresses : [addresses]);
+        while (stack.length) {
+            const frame = stack[stack.length - 1];
+            if (frame.pos >= frame.list.length) {
+                stack.pop();
+                continue;
+            }
+            const address = frame.list[frame.pos++];
+            if (Array.isArray(address)) {
+                enter(address);
+                continue;
+            }
+            if (address && address.address) {
+                const normalized = this._normalizeAddress(address.address);
+                if (normalized === address.address && typeof address.name === 'string') {
+                    // there is nothing to rewrite, so there is nothing to keep off the original
+                    flattened.push(address);
+                    continue;
                 }
-                return addressparser(address);
-            })
-        );
+                // rewriting would land on the object the caller passed in and might
+                // still hold a reference to, so rewrite a copy of it instead. An own
+                // "__proto__" key would make the copy inherit from caller data, and
+                // _convertAddresses reads `group` off it straight into the envelope
+                const copy = shared.copyOwnKeys({}, address);
+                copy.address = normalized;
+                copy.name = address.name || '';
+                flattened.push(copy);
+                continue;
+            }
+            const parsed = this._normalizeParsedAddresses(addressparser(address));
+            for (let i = 0; i < parsed.length; i++) {
+                flattened.push(parsed[i]);
+            }
+        }
+        return flattened;
+    }
+    /**
+     * Normalizes the addresses of a freshly parsed address list, groups included.
+     *
+     * Everything this method returns carries a normalized address, whether it arrived as an
+     * object or was parsed out of a header value. Without this the two shapes disagree, and
+     * a consumer reading the parsed form back is handed the ambiguous
+     * 'user@evil.com@good.com' that the header and the envelope no longer carry.
+     *
+     * @param parsed An array of address objects, as returned by addressparser
+     * @return The same array, with every address normalized
+     * @internal
+     */
+    _normalizeParsedAddresses(parsed) {
+        // addressparser builds these objects, so no caller holds a reference to rewrite around
+        parsed.forEach(entry => {
+            if (entry.address) {
+                entry.address = this._normalizeAddress(entry.address);
+            }
+            else if (entry.group) {
+                this._normalizeParsedAddresses(entry.group);
+            }
+        });
+        return parsed;
+    }
+    /**
+     * Parses the addresses of an explicitly set envelope.
+     *
+     * An envelope value is an addr-spec and never a display name, so a bare local username
+     * such as 'root' is the address here. Header parsing has to read the same value as a
+     * display name, as a value with no '@' in it can not be an addr-spec in a header.
+     *
+     * @param addresses Addresses to be parsed
+     * @return An array of address objects
+     * @internal
+     */
+    _parseEnvelopeAddresses(addresses) {
+        return this._parseAddresses(addresses).map(entry => {
+            if (entry.address || entry.group || !entry.name || /[\s@]/.test(entry.name)) {
+                return entry;
+            }
+            return { address: this._normalizeAddress(entry.name), name: '' };
+        });
     }
-
     /**
      * Normalizes a header key, uses Camel-Case form, except for uppercase MIME-
      *
-     * @param {String} key Key to be normalized
-     * @return {String} key in Camel-Case form
+     * @param key Key to be normalized
+     * @return key in Camel-Case form
+     * @internal
      */
     _normalizeHeaderKey(key) {
         key = (key || '')
             .toString()
             // no newlines in keys
             .replace(/\r?\n|\r/g, ' ')
+            // a field name is printable ascii without the colon, so a control char or DEL
+            // can only be dropped, there is no quoting construct around a field name
+            .replace(/[\x00-\x1f\x7f]/g, '')
             .trim()
             .toLowerCase()
             // use uppercase words, except MIME
             .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
             // special case
             .replace(/^Content-Features$/i, 'Content-features');
-
         return key;
     }
-
     /**
      * Checks if the content type is multipart and defines boundary if needed.
      * Doesn't return anything, modifies object argument instead.
      *
-     * @param {Object} structured Parsed header value for 'Content-Type' key
+     * @param structured Parsed header value for 'Content-Type' key
+     * @internal
      */
     _handleContentType(structured) {
         this.contentType = structured.value.trim().toLowerCase();
-
         this.multipart = /^multipart\//i.test(this.contentType) ? this.contentType.substr(this.contentType.indexOf('/') + 1) : false;
-
         if (this.multipart) {
-            this.boundary = structured.params.boundary = structured.params.boundary || this.boundary || this._generateBoundary();
-        } else {
+            // The declared value and the delimiters are assigned from the same expression
+            // here, so whatever the header emitter then does with it, the two sides cannot
+            // disagree about which characters the boundary is made of.
+            //
+            // Stripping runs before the fallback rather than over the whole chain: a
+            // boundary made only of control characters would otherwise strip to '' and
+            // leave the node declaring no boundary and streaming bare '--' delimiters.
+            // _generateBoundary cleans what it builds, but this is the one place the boundary
+            // is written, so it cleans the value it is about to write rather than trusting
+            // where it came from. MimeNode is exported and subclassable, so the generator is
+            // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
+            const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
+            this.boundary = structured.params.boundary =
+                declared || _stripBoundaryControls(this._generateBoundary());
+        }
+        else {
             this.boundary = false;
         }
     }
-
     /**
      * Generates a multipart boundary value
      *
-     * @return {String} boundary value
+     * @return boundary value
+     * @internal
      */
     _generateBoundary() {
-        return this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary + '-Part_' + this._nodeId;
+        // baseBoundary and boundaryPrefix are public, so they may hold something the
+        // constructor never cleaned, and the -Part_ suffix keeps the result non empty
+        return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
-
     /**
      * Encodes a header value for use in the generated rfc2822 email.
      *
-     * @param {String} key Header key
-     * @param {String} value Header value
+     * @param key Header key
+     * @param value Header value
+     * @internal
      */
     _encodeHeaderValue(key, value) {
         key = this._normalizeHeaderKey(key);
-
         switch (key) {
             // Structured headers
             case 'From':
@@ -1082,172 +1197,206 @@ class MimeNode {
             case 'Bcc':
             case 'Reply-To':
                 return this._convertAddresses(this._parseAddresses(value));
-
             // values enclosed in <>
             case 'Message-ID':
             case 'In-Reply-To':
             case 'Content-Id':
-                value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-
+                // a msg-id is structured, so an encoded word inside the angle brackets would
+                // be read as literal text. drop the characters that can not appear in a header
+                // at all, but leave HT alone, it separates the ids of a multi id value
+                value = (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
                 if (value.charAt(0) !== '<') {
                     value = '<' + value;
                 }
-
                 if (value.charAt(value.length - 1) !== '>') {
                     value = value + '>';
                 }
                 return value;
-
             // space separated list of values enclosed in <>
             case 'References':
                 value = [].concat
-                    .apply(
-                        [],
-                        [].concat(value || '').map(elm => {
-                            // eslint-disable-line prefer-spread
-                            elm = (elm || '')
-                                .toString()
-                                .replace(/\r?\n|\r/g, ' ')
-                                .trim();
-                            return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
-                        })
-                    )
+                    .apply([], [].concat(value || '').map(elm => {
+                    elm = (elm || '')
+                        .toString()
+                        .replace(/\r?\n|\r/g, ' ')
+                        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
+                        .trim();
+                    return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
+                }))
                     .map(elm => {
-                        if (elm.charAt(0) !== '<') {
-                            elm = '<' + elm;
-                        }
-                        if (elm.charAt(elm.length - 1) !== '>') {
-                            elm = elm + '>';
-                        }
-                        return elm;
-                    });
-
+                    if (elm.charAt(0) !== '<') {
+                        elm = '<' + elm;
+                    }
+                    if (elm.charAt(elm.length - 1) !== '>') {
+                        elm = elm + '>';
+                    }
+                    return elm;
+                });
                 return value.join(' ').trim();
-
             case 'Date':
                 if (Object.prototype.toString.call(value) === '[object Date]') {
                     return value.toUTCString().replace(/GMT/, '+0000');
                 }
-
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                return this._encodeWords(value);
-
+                return this._encodeHeaderText(value);
             case 'Content-Type':
             case 'Content-Disposition':
                 // if it includes a filename then it is already encoded
                 return (value || '').toString().replace(/\r?\n|\r/g, ' ');
-
             default:
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                // encodeWords only encodes if needed, otherwise the original string is returned
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
         }
     }
-
     /**
      * Rebuilds address object using punycode and other adjustments
      *
-     * @param {Array} addresses An array of address objects
-     * @param {Array} [uniqueList] An array to be populated with addresses
-     * @return {String} address string
+     * @param addresses An array of address objects
+     * @param [uniqueList] An array to be populated with addresses
+     * @param [seenAddresses] Addresses already added to uniqueList, shared with recursive calls to keep deduplication linear
+     * @return address string
+     * @internal
      */
-    _convertAddresses(addresses, uniqueList) {
-        let values = [];
-
+    _convertAddresses(addresses, uniqueList, seenAddresses) {
+        const values = [];
         uniqueList = uniqueList || [];
-
+        // Membership is checked once per address, so scanning uniqueList itself would make
+        // a recipient list cost O(n^2). Groups recurse with the same set so that a nested
+        // group still dedupes against the addresses collected around it, and a caller that
+        // passes a partly filled list (To, then Cc, then Bcc) keeps deduping across headers.
+        if (!seenAddresses) {
+            seenAddresses = new Set();
+            for (let i = 0; i < uniqueList.length; i++) {
+                seenAddresses.add(uniqueList[i].address);
+            }
+        }
         [].concat(addresses || []).forEach(address => {
             if (address.address) {
                 address.address = this._normalizeAddress(address.address);
-
                 if (!address.name) {
-                    values.push(address.address.indexOf(' ') >= 0 ? `<${address.address}>` : `${address.address}`);
-                } else if (address.name) {
+                    // an address that carries a special, be it a quoted local part or a domain
+                    // that could not be normalized, is only unambiguous inside angle brackets.
+                    // Without them a ',' or a ';' anywhere in it reads as a recipient separator
+                    // and the header would list more recipients than the envelope carries
+                    values.push(PLAIN_ADDRESS.test(address.address) ? address.address : `<${address.address}>`);
+                }
+                else {
                     values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
-
-                if (address.address) {
-                    if (!uniqueList.filter(a => a.address === address.address).length) {
-                        uniqueList.push(address);
-                    }
+                if (!seenAddresses.has(address.address)) {
+                    seenAddresses.add(address.address);
+                    uniqueList.push(address);
                 }
-            } else if (address.group) {
-                let groupListAddresses = (address.group.length ? this._convertAddresses(address.group, uniqueList) : '').trim();
+            }
+            else if (address.group) {
+                const groupListAddresses = (address.group.length ? this._convertAddresses(address.group, uniqueList, seenAddresses) : '').trim();
                 values.push(`${this._encodeAddressName(address.name)}:${groupListAddresses};`);
             }
         });
-
         return values.join(', ');
     }
-
     /**
      * Normalizes an email address
      *
-     * @param {Array} address An array of address objects
-     * @return {String} address string
+     * @param address An array of address objects
+     * @return address string
+     * @internal
      */
     _normalizeAddress(address) {
         address = (address || '')
             .toString()
-            .replace(/[\x00-\x1F<>]+/g, ' ') // remove unallowed characters
+            .replace(/[\x00-\x1F\x7F<>]+/g, ' ') // remove unallowed characters
             .trim();
-
-        let lastAt = address.lastIndexOf('@');
-        if (lastAt < 0) {
-            // Bare username
+        if (!address) {
+            // callers use an empty value to detect a missing address
             return address;
         }
-
-        let user = address.substr(0, lastAt);
-        let domain = address.substr(lastAt + 1);
-
-        // Usernames are not touched and are kept as is even if these include unicode
-        // Domains are punycoded by default
-        // 'jõgeva.ee' will be converted to 'xn--jgeva-dua.ee'
-        // non-unicode domains are left as is
-
-        let encodedDomain;
-
+        const lastAt = address.lastIndexOf('@');
+        if (lastAt < 0) {
+            // Bare username, there is no domain to split off
+            return this._normalizeLocalPart(address);
+        }
+        const user = address.substr(0, lastAt);
+        const domain = address.substr(lastAt + 1);
+        // Unicode in the local part is kept as is, see _normalizeLocalPart for the rest of it.
+        // A domain has no quoting construct to fall back on, so whatever is not a valid domain
+        // is kept as supplied and it is _convertAddresses that keeps such an address unambiguous.
+        // Domains are punycoded when the local part is ASCII ('safe@jõgeva.ee' -> 'safe@xn--jgeva-dua.ee').
+        // When the local part contains non-ASCII bytes the address already requires SMTPUTF8,
+        // so the domain is kept (or decoded back) as UTF-8 for symmetry on both sides of '@'.
+        let encodedDomain = domain;
+        // A non-ASCII local part already requires SMTPUTF8, so the domain stays UTF-8 for
+        // symmetry on both sides of the '@' rather than being encoded to an A-label
+        const smtputf8 = /[\x80-\uFFFF]/.test(user);
         try {
-            encodedDomain = punycode.toASCII(domain.toLowerCase());
-        } catch (err) {
-            // keep as is?
+            encodedDomain = normalizeDomain(domain.toLowerCase(), smtputf8);
         }
-
-        if (user.indexOf(' ') >= 0) {
-            if (user.charAt(0) !== '"') {
-                user = '"' + user;
-            }
-            if (user.substr(-1) !== '"') {
-                user = user + '"';
-            }
+        catch (_err) {
+            // keep domain as supplied
         }
-
-        return `${user}@${encodedDomain}`;
+        return `${this._normalizeLocalPart(user)}@${encodedDomain}`;
+    }
+    /**
+     * Normalizes the local part of an address into a form that can be emitted as is.
+     *
+     * A local part is either a dot-atom or a quoted-string, anything else is not a valid
+     * addr-spec. The quotes of a quoted local part get lost along the way, and a bare
+     * 'user@evil.com@good.com' leaves it to the receiver which '@' splits the domain off,
+     * while the split here is always at the last one. So whatever is not already one of
+     * the two valid forms goes back out as a quoted-string.
+     *
+     * @param user Local part of an address
+     * @return Local part as a dot-atom or as a quoted-string
+     * @internal
+     */
+    _normalizeLocalPart(user) {
+        if (DOT_ATOM.test(user) || QUOTED_STRING.test(user)) {
+            return user;
+        }
+        return mimeFuncs.quoteString(user);
     }
-
     /**
      * If needed, mime encodes the name part
      *
-     * @param {String} name Name part of an address
-     * @returns {String} Mime word encoded string if needed
+     * @param name Name part of an address
+     * @returns Mime word encoded string if needed
+     * @internal
      */
     _encodeAddressName(name) {
-        if (!/^[\w ']*$/.test(name)) {
+        if (!/^[\w ]*$/.test(name)) {
             if (/^[\x20-\x7e]*$/.test(name)) {
-                return '"' + name.replace(/([\\"])/g, '\\$1') + '"';
-            } else {
+                return mimeFuncs.quoteString(name);
+            }
+            else {
                 return mimeFuncs.encodeWord(name, this._getTextEncoding(name), 52);
             }
         }
         return name;
     }
-
+    /**
+     * Encodes an unstructured header value. Such a value can only carry VCHAR and WSP, so a
+     * control char or DEL has to be forced into the mime encoded word that a non-ascii value
+     * would get anyway. HT stays as it is, it is valid folding whitespace here.
+     *
+     * @param value Header value to encode
+     * @returns Mime word encoded string if needed
+     * @internal
+     */
+    _encodeHeaderText(value) {
+        return /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)
+            ? mimeFuncs.encodeWord(value, this._getTextEncoding(value), 52)
+            : // encodeWords only encodes if needed, otherwise the original string is returned
+                this._encodeWords(value);
+    }
     /**
      * If needed, mime encodes the name part
      *
-     * @param {String} name Name part of an address
-     * @returns {String} Mime word encoded string if needed
+     * @param value Name part of an address
+     * @returns Mime word encoded string if needed
+     * @internal
      */
     _encodeWords(value) {
         // set encodeAll parameter to true even though it is against the recommendation of RFC2047,
@@ -1255,51 +1404,50 @@ class MimeNode {
         // but some clients (eg. Zimbra) do not handle it properly and remove surrounding whitespace
         return mimeFuncs.encodeWords(value, this._getTextEncoding(value), 52, true);
     }
-
     /**
      * Detects best mime encoding for a text value
      *
-     * @param {String} value Value to check for
-     * @return {String} either 'Q' or 'B'
+     * @param value Value to check for
+     * @return either 'Q' or 'B'
+     * @internal
      */
     _getTextEncoding(value) {
         value = (value || '').toString();
-
-        let encoding = this.textEncoding;
-        let latinLen;
-        let nonLatinLen;
-
-        if (!encoding) {
-            // count latin alphabet symbols and 8-bit range symbols + control symbols
-            // if there are more latin characters, then use quoted-printable
-            // encoding, otherwise use base64
-            nonLatinLen = (value.match(/[\x00-\x08\x0B\x0C\x0E-\x1F\u0080-\uFFFF]/g) || []).length; // eslint-disable-line no-control-regex
-            latinLen = (value.match(/[a-z]/gi) || []).length;
-            // if there are more latin symbols than binary/unicode, then prefer Q, otherwise B
-            encoding = nonLatinLen < latinLen ? 'Q' : 'B';
+        if (this.textEncoding) {
+            return this.textEncoding;
+        }
+        // count latin alphabet symbols and 8-bit range symbols + control symbols
+        // if there are more latin characters, then use quoted-printable
+        // encoding, otherwise use base64
+        let nonLatinLen = 0;
+        let latinLen = 0;
+        for (let i = 0, len = value.length; i < len; i++) {
+            const code = value.charCodeAt(i);
+            if ((code >= 0x00 && code <= 0x08) || code === 0x0b || code === 0x0c || (code >= 0x0e && code <= 0x1f) || code >= 0x80) {
+                nonLatinLen++;
+            }
+            else if ((code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a)) {
+                latinLen++;
+            }
         }
-        return encoding;
+        // if there are more latin symbols than binary/unicode, then prefer Q, otherwise B
+        return nonLatinLen < latinLen ? 'Q' : 'B';
     }
-
     /**
      * Generates a message id
      *
-     * @return {String} Random Message-ID value
+     * @return Random Message-ID value
+     * @internal
      */
     _generateMessageId() {
-        return (
-            '<' +
+        return ('<' +
             [2, 2, 2, 6].reduce(
-                // crux to generate UUID-like random strings
-                (prev, len) => prev + '-' + crypto.randomBytes(len).toString('hex'),
-                crypto.randomBytes(4).toString('hex')
-            ) +
+            // crux to generate UUID-like random strings
+            (prev, len) => prev + '-' + crypto.randomBytes(len).toString('hex'), crypto.randomBytes(4).toString('hex')) +
             '@' +
             // try to use the domain of the FROM address or fallback to server hostname
             (this.getEnvelope().from || this.hostname || 'localhost').split('@').pop() +
-            '>'
-        );
+            '>');
     }
 }
-
-module.exports = MimeNode;
+export default MimeNode;