@nocobase/plugin-workflow-mailer 2.2.20 → 2.2.21

package/dist/node_modules/nodemailer/{lib → dist/esm}/addressparser/index.js

@@ -1,5 +1,3 @@
-'use strict';
-
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *
@@ -10,12 +8,12 @@
  * recipient separator once the consumer puts the address back into a header.
  *
  * This module has no dependencies so that it can ship on its own, which is why the two
- * grammar tests below are spelled out here instead of shared with lib/mime-node. Keeping
+ * grammar tests below are spelled out here instead of shared with src/mime-node. Keeping
  * only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
  * dot-atom rule on top of this when it emits an address.
  *
- * @param {String} address Address with an unquoted local part
- * @return {String} Address with the local part as a quoted-string
+ * @param address Address with an unquoted local part
+ * @return Address with the local part as a quoted-string
  */
 function _quoteLocalPart(address) {
     const lastAt = address.lastIndexOf('@');
@@ -23,39 +21,160 @@ function _quoteLocalPart(address) {
         // no domain to split off, nothing can be misrouted
         return address;
     }
-
     const user = address.substr(0, lastAt);
     if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
         // a local part that carries no special reads the same with or without the quotes,
         // and one that is already a complete quoted-string needs nothing either
         return address;
     }
-
     return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
 }
-
 /**
  * Reached for every parsed address, so it is built once rather than per call.
  */
 const HAS_WHITESPACE = /\s/;
-
 /**
  * An addr-spec that carries its whitespace legally, inside a quoted local part. The
  * optional tail is the malformed shape: a real mailbox with wreckage trailing it.
  */
 const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
-
 /**
  * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
  */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
-
 /**
  * The looser reading applied once the strict one finds nothing, which tolerates the
  * further '@' that a domain should not have but malformed headers carry anyway.
  */
 const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
-
+/**
+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let
+ * loose to search, see there.
+ */
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * The characters JS `\s` matches, which the scan below has to agree with to land on the
+ * same match the pattern would.
+ */
+function _isSpaceCode(code) {
+    return (code === 0x20 ||
+        (code >= 0x09 && code <= 0x0d) ||
+        code === 0xa0 ||
+        code === 0x1680 ||
+        (code >= 0x2000 && code <= 0x200a) ||
+        code === 0x2028 ||
+        code === 0x2029 ||
+        code === 0x202f ||
+        code === 0x205f ||
+        code === 0x3000 ||
+        code === 0xfeff);
+}
+/**
+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in
+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+ * which compares false throughout, so out of range reads as the non-word the pattern
+ * treats them as.
+ */
+function _isWordCode(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;
+}
+/**
+ * Whether `\b` holds at an offset
+ */
+function _isBoundary(text, at) {
+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
+}
+/**
+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+ *
+ * indexOf would scan on to the end of the value, and the value here is a whole header. The
+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits
+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per
+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a
+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left
+ * the probe unbounded behind it.
+ *
+ * @param text Text to look in
+ * @param from Offset to start at
+ * @param to Offset to stop before
+ * @return Offset of the '@', or -1
+ */
+function _indexOfAt(text, from, to) {
+    for (let i = from; i < to; i++) {
+        if (text.charCodeAt(i) === 0x40) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
+ *
+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no
+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.
+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of
+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters
+ * back until it lands on a boundary, so the only end it can take in that run is the last
+ * boundary in it. Both are found in one pass, and the pattern is then run at that single
+ * offset.
+ *
+ * @param text Free text to look in
+ * @return Offset to match at, or -1
+ */
+function _looseAddressStart(text) {
+    const len = text.length;
+    let pos = 0;
+    while (pos < len) {
+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos >= len) {
+            break;
+        }
+        const runStart = pos;
+        let runEnd = pos;
+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
+            runEnd++;
+        }
+        let at = _indexOfAt(text, runStart, runEnd);
+        if (at >= 0) {
+            let lastBoundary = -1;
+            for (let k = runEnd; k > runStart; k--) {
+                if (_isBoundary(text, k)) {
+                    lastBoundary = k;
+                    break;
+                }
+            }
+            let atomStart = runStart;
+            while (lastBoundary >= 0 && at >= 0) {
+                // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
+                // and the boundary that ends the match has to sit past both
+                if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+                    for (let start = atomStart; start < at; start++) {
+                        if (_isBoundary(text, start)) {
+                            if (start > runStart) {
+                                return start;
+                            }
+                            // the leading '\s*' is greedy, so a match that begins at the run
+                            // takes the whitespace in front of it along
+                            let padded = runStart;
+                            while (padded > 0 && _isSpaceCode(text.charCodeAt(padded - 1))) {
+                                padded--;
+                            }
+                            return padded;
+                        }
+                    }
+                }
+                atomStart = at + 1;
+                at = _indexOfAt(text, atomStart, runEnd);
+            }
+        }
+        pos = runEnd;
+    }
+    return -1;
+}
 /**
  * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
  *
@@ -75,28 +194,26 @@ const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
  * A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
  * '<"user name"@example.com>' is well formed and means exactly what it says.
  *
- * @param {Object} data Collected address parts, mutated in place
+ * @param data Collected address parts, mutated in place
  */
 function _recoverAddrSpec(data) {
     if (!HAS_WHITESPACE.test(data.address)) {
         return;
     }
-
     let address;
     let rest;
-
     const quoted = data.address.match(QUOTED_LOCAL_ADDR);
     if (quoted) {
         if (!quoted[2]) {
             // the whitespace sits inside the quoted local part, this is a well formed mailbox
             return;
         }
-
         // a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
         // than splitting into the quotes
         address = quoted[1];
         rest = [quoted[2]];
-    } else {
+    }
+    else {
         if (data.address.indexOf('"') >= 0) {
             // Splitting on whitespace loses track of where the quoted string starts and ends,
             // and this module does not take addresses out of quoted strings: the run picked out
@@ -105,36 +222,105 @@ function _recoverAddrSpec(data) {
             // left is wreckage either way and the original is the honest answer
             return;
         }
-
         const parts = data.address.split(/\s+/);
-
         let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
         if (addrIndex < 0) {
             addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
         }
-
         if (addrIndex < 0) {
             // nothing in there reads as an address, there is no better answer than the original
             return;
         }
-
         address = parts.splice(addrIndex, 1)[0];
         rest = parts;
     }
-
     data.address = address;
     data.text = [data.text]
         .concat(rest)
         .filter(part => part)
         .join(' ');
 }
-
+/**
+ * Takes the RFC 5322 comments out of the contents of an angle-addr.
+ *
+ * The tokenizer tracks a single open operator, so once '<' is open a '(' is plain text and
+ * a comment inside the brackets reached the address verbatim: 'Name <user@example.com(x)evil.com>'
+ * put 'user@example.com(x)evil.com' into the envelope, a value that is no mailbox and that a
+ * receiver stripping the comment reads as 'user@example.comevil.com' (GHSA-g73g-hqqh-jr95).
+ * A comment is folding whitespace, so it is read as a space that splits two atoms and as
+ * nothing next to an '@', the same rule the token walk applies outside the brackets. Quoted
+ * strings and domain literals are copied through untouched, a '(' in there is not a comment.
+ *
+ * @param address Contents of the angle brackets
+ * @return The address with the comments removed, and the text of the comments
+ */
+function _stripAddressComments(address) {
+    const comments = [];
+    let result = '';
+    let comment = '';
+    let depth = 0;
+    let closer = '';
+    // carried along rather than read back off the growing result, which would flatten it on
+    // every comment (see lastChars in _handleAddress)
+    let lastChar = '';
+    for (let i = 0, len = address.length; i < len; i++) {
+        const chr = address.charAt(i);
+        if (depth) {
+            if (chr === '\\' && i < len - 1) {
+                comment += address.charAt(++i);
+            }
+            else if (chr === '(') {
+                depth++;
+                comment += chr;
+            }
+            else if (chr === ')' && !--depth) {
+                comments.push(comment.trim());
+                comment = '';
+                if (lastChar !== '@' && address.charAt(i + 1) !== '@') {
+                    result += ' ';
+                    lastChar = ' ';
+                }
+            }
+            else {
+                comment += chr;
+            }
+            continue;
+        }
+        if (closer) {
+            if (chr === '\\' && closer === '"' && i < len - 1) {
+                result += chr + address.charAt(++i);
+                lastChar = address.charAt(i);
+                continue;
+            }
+            if (chr === closer) {
+                closer = '';
+            }
+        }
+        else if (chr === '"') {
+            closer = '"';
+        }
+        else if (chr === '[') {
+            closer = ']';
+        }
+        else if (chr === '(') {
+            depth = 1;
+            continue;
+        }
+        result += chr;
+        lastChar = chr;
+    }
+    if (depth) {
+        // an unterminated comment runs to the end of the address
+        comments.push(comment.trim());
+    }
+    return { address: result.trim(), comments: comments.filter(text => text) };
+}
 /**
  * Converts tokens for a single address into an address object
  *
- * @param {Array} tokens Tokens object
- * @param {Number} depth Current recursion depth for nested group protection
- * @return {Object} Address object
+ * @param tokens Tokens object
+ * @param depth Current recursion depth for nested group protection
+ * @return Address object
  */
 function _handleAddress(tokens, depth) {
     let isGroup = false;
@@ -148,7 +334,12 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
-
+    // Last character of the run each state is currently accumulating. Reading it back off
+    // the accumulator with slice(-1) makes the engine flatten the whole growing string on
+    // every token, which is quadratic over an address built from many comment-joined atoms
+    // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
+    // character is carried along instead of re-read.
+    const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -177,66 +368,98 @@ function _handleAddress(tokens, depth) {
                     insideQuotes = false;
                     break;
             }
-        } else if (token.value) {
+        }
+        else if (token.value) {
+            // An empty quoted string is dropped by the tokenizer, leaving no text token of its
+            // own for textWasQuoted to be recorded on, so the pair of quote operators right in
+            // front of this token is all that is left of it and the run it opens carries the
+            // quoting instead. Without this '""@example.com' reads as the bare '@example.com',
+            // the quotes never go back on, and the value is no longer an addr-spec a trailing
+            // comment can be peeled off of. It only ever opens a run: a run that already holds
+            // material collected outside the quotes is not a quoted string, whatever follows it
+            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
+                prevToken.value === '"' &&
+                !!prevToken.noBreak &&
+                prevPrevToken?.type === 'operator' &&
+                prevPrevToken.value === '"';
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
                 token.value = token.value.replace(/^[^<]*<\s*/, '');
             }
-
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
             // deliver to a domain the sender never named.
             const parts = data[state];
-            const joins =
-                prevToken &&
+            const joins = prevToken &&
                 prevToken.noBreak &&
                 parts.length &&
-                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
-
+                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
                 data[state][data[state].length - 1] += token.value;
+                if (token.value) {
+                    lastChars[state] = token.value.charAt(token.value.length - 1);
+                }
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
-            } else {
+            }
+            else {
                 data[state].push(token.value);
+                lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
-                    data.textWasQuoted.push(insideQuotes);
+                    data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                 }
             }
         }
     }
-
     // If there is no text but a comment, replace the two
     if (!data.text.length && data.comment.length) {
         data.text = data.comment;
         data.comment = [];
     }
-
     if (isGroup) {
         // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
         data.text = data.text.join(' ');
-
         // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
         let groupMembers = [];
         if (data.group.length) {
-            const parsedGroup = addressparser(data.group.join(','), { _depth: depth + 1 });
+            const parsedGroup = _parseAddressList(data.group.join(','), depth + 1);
             parsedGroup.forEach(member => {
                 if (member.group) {
                     groupMembers = groupMembers.concat(member.group);
-                } else {
+                }
+                else {
                     groupMembers.push(member);
                 }
             });
         }
-
         addresses.push({
             name: data.text || '',
             group: groupMembers
         });
-    } else {
+    }
+    else {
+        // Comments come out of the angle-addr before anything asks whether one was found, so
+        // that brackets holding nothing but a comment read the same as empty ones
+        const addressComments = [];
+        const addressParts = [];
+        for (const part of data.address) {
+            if (part.indexOf('(') < 0) {
+                addressParts.push(part);
+                continue;
+            }
+            const stripped = _stripAddressComments(part);
+            for (const comment of stripped.comments) {
+                addressComments.push(comment);
+            }
+            if (stripped.address) {
+                addressParts.push(stripped.address);
+            }
+        }
+        data.address = addressParts;
         // If no address was found, try to detect one from regular text
         if (!data.address.length && data.text.length) {
             for (let i = data.text.length - 1; i >= 0; i--) {
@@ -249,23 +472,25 @@ function _handleAddress(tokens, depth) {
                     break;
                 }
             }
-
             // Try a looser regex match if strict match found nothing
             if (!data.address.length) {
                 let extracted = false;
                 for (let i = data.text.length - 1; i >= 0; i--) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, match => {
-                                if (!extracted) {
-                                    data.address = [match.trim()];
-                                    extracted = true;
-                                    return ' ';
-                                }
-                                return match;
-                            })
-                            .trim();
+                        const part = data.text[i];
+                        let remainder = part;
+                        const at = _looseAddressStart(part);
+                        if (at >= 0) {
+                            LOOSE_TEXT_ADDR.lastIndex = at;
+                            const match = LOOSE_TEXT_ADDR.exec(part);
+                            if (match) {
+                                data.address = [match[0].trim()];
+                                extracted = true;
+                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
+                            }
+                        }
+                        data.text[i] = remainder.trim();
                         if (extracted) {
                             break;
                         }
@@ -273,56 +498,65 @@ function _handleAddress(tokens, depth) {
                 }
             }
         }
-
         // If there's still no text but a comment exists, replace the two
         if (!data.text.length && data.comment.length) {
             data.text = data.comment;
             data.comment = [];
         }
-
         // Keep only the first address occurrence, push others to regular text
         if (data.address.length > 1) {
             data.text = data.text.concat(data.address.splice(1));
         }
-
         // An address is only taken from unquoted text, so anything left in the text at this
         // point that still has to serve as the address carries its quoting in this flag
         const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
-
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
-
+        if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
+            // A quoted run with no '@' in it is a display name and nothing else, so it stays
+            // where it is. Moving it over anyway made a comment the mailbox was read from:
+            // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
+            // comment as the name, and a quoted name holding a ',' or a ';' became an address
+            // that reads as two recipients once a consumer writes it back into a header.
+            //
+            // The mailbox is still sitting in the text, so it moves over here and is quoted
+            // before the recovery below rather than after it. Anything else the text holds
+            // came along with it: a comment ends the domain but leaves the atoms behind it in
+            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+            // 'user@example.com evil.com', a second domain riding into the envelope recipient
+            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+            // back first is what lets the recovery tell the whitespace an addr-spec may carry
+            // from the wreckage trailing one, as only a quoted local part may hold whitespace
+            data.address = _quoteLocalPart(data.text);
+            data.text = '';
+        }
         _recoverAddrSpec(data);
-
+        // a comment names the mailbox only when nothing else does, as one outside the brackets
+        if (!data.text && addressComments.length) {
+            data.text = addressComments.join(' ');
+        }
         const address = {
             address: data.address || data.text || '',
             name: data.text || data.address || ''
         };
-
         if (address.address === address.name) {
             if (/@/.test(address.address || '')) {
                 address.name = '';
-            } else {
+            }
+            else {
                 address.address = '';
             }
         }
-
-        if (addressFromQuotedText && address.address) {
-            address.address = _quoteLocalPart(address.address);
-        }
-
         addresses.push(address);
     }
-
     return addresses;
 }
-
 /**
  * Creates a Tokenizer object for tokenizing address field strings
  *
  * @constructor
- * @param {String} str Address field string
+ * @param str Address field string
  */
 class Tokenizer {
     constructor(str) {
@@ -332,7 +566,7 @@ class Tokenizer {
         this.node = null;
         this.escaped = false;
         this.inDomainLiteral = false;
-
+        this.afterAt = false;
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -352,85 +586,92 @@ class Tokenizer {
             ';': ''
         };
     }
-
     /**
      * Tokenizes the original input string
      *
-     * @return {Array} An array of operator|text tokens
+     * @return An array of operator|text tokens
      */
     tokenize() {
         const list = [];
-
         for (let i = 0, len = this.str.length; i < len; i++) {
             const chr = this.str.charAt(i);
             const nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
             this.checkChar(chr, nextChr);
         }
-
         this.list.forEach(node => {
             node.value = (node.value || '').toString().trim();
             if (node.value) {
                 list.push(node);
             }
         });
-
         return list;
     }
-
     /**
      * Checks if a character is an operator or text and acts accordingly
      *
-     * @param {String} chr Character from the address field
+     * @param chr Character from the address field
+     * @param nextChr Character following chr, null at the end of the field
      */
     checkChar(chr, nextChr) {
-        // Track RFC 5322 domain-literals ("[" *dtext "]"). Operator characters such
-        // as the ":" of an IPv6 address-literal (user@[IPv6:2001:db8::1]) are dtext
-        // and must not be treated as the group delimiter while inside the brackets.
-        // Quoted strings and comments are handled separately via operatorExpecting,
-        // so only enter this state when no operator is open. The list separators ","
-        // and ";" are the exception: they always end the literal (and split the
-        // address list) so that an unclosed "[" cannot swallow later recipients.
+        // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6
+        // address-literal (user@[IPv6:2001:db8::1]) is dtext and must not be treated as
+        // the group delimiter while inside the brackets. That is the only operator the
+        // literal hides: letting it hide the others as well meant a "[" could turn the
+        // comment, quoted string or angle-addr after it into text and pick a different
+        // mailbox, '[ ( ] <a@victim.com> ) <b@evil.com>' yielded a@victim.com where
+        // RFC 5322 reads b@evil.com. A "[" also only opens a literal right after the "@"
+        // of an addr-spec, so the group delimiter of a display name holding one stays
+        // intact. Quoted strings and comments are handled separately via
+        // operatorExpecting, so only enter this state when no operator is open. The list
+        // separators "," and ";" always end the literal (and split the address list) so
+        // that an unclosed "[" cannot swallow later recipients.
         if (!this.escaped && !this.operatorExpecting) {
-            if (!this.inDomainLiteral && chr === '[') {
+            if (!this.inDomainLiteral && chr === '[' && this.afterAt) {
                 this.inDomainLiteral = true;
-            } else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
+            }
+            else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
                 this.inDomainLiteral = false;
             }
         }
-
         if (this.escaped) {
             // ignore next condition blocks
-        } else if (chr === this.operatorExpecting) {
+        }
+        else if (chr === this.operatorExpecting) {
             this.node = {
                 type: 'operator',
                 value: chr
             };
-
             if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
                 this.node.noBreak = true;
             }
-
             this.list.push(this.node);
             this.node = null;
+            if (chr !== ')') {
+                // a comment is folding whitespace, it does not part the "@" from the "["
+                this.afterAt = false;
+            }
             this.operatorExpecting = '';
             this.escaped = false;
-
             return;
-        } else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
+        }
+        else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
             this.node = {
                 type: 'operator',
                 value: chr
             };
             this.list.push(this.node);
             this.node = null;
+            if (chr !== '(') {
+                this.afterAt = false;
+            }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
             return;
-        } else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+        }
+        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
             this.escaped = true;
             return;
         }
-
         if (!this.node) {
             this.node = {
                 type: 'text',
@@ -438,76 +679,65 @@ class Tokenizer {
             };
             this.list.push(this.node);
         }
-
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
             // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
             chr = ' ';
         }
-
         if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
             // skip command bytes
             this.node.value += chr;
+            // text inside a quoted string or a comment is not part of an addr-spec. Tracked
+            // as it goes rather than read back off the value (see lastChars in _handleAddress)
+            if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
+                this.afterAt = chr === '@';
+            }
         }
-
         this.escaped = false;
     }
 }
-
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
  * malicious input that could cause stack overflow.
  */
 const MAX_NESTED_GROUP_DEPTH = 50;
-
 /**
- * Parses structured e-mail addresses from an address field
- *
- * Example:
- *
- *    'Name <address@domain>'
- *
- * will be converted to
+ * Parses an address list, recursing into the groups it holds.
  *
- *     [{name: 'Name', address: 'address@domain'}]
+ * The depth is threaded through the calls rather than carried in an options object, so a
+ * caller supplied one can not seed it and lift the recursion limit: `{ _depth: -1e9 }`
+ * bought a billion levels of nesting and turned the guard below into the stack overflow it
+ * is there to prevent.
  *
- * @param {String} str Address field
- * @param {Object} options Optional options object
- * @param {Number} options._depth Internal recursion depth counter (do not set manually)
- * @return {Array} An array of address objects
+ * @param str Address field
+ * @param depth Current recursion depth for nested group protection
+ * @return An array of address objects
  */
-function addressparser(str, options) {
-    options = options || {};
-    const depth = options._depth || 0;
-
+function _parseAddressList(str, depth) {
     // Prevent stack overflow from deeply nested groups (DoS protection)
     if (depth > MAX_NESTED_GROUP_DEPTH) {
         return [];
     }
-
     const tokenizer = new Tokenizer(str);
     const tokens = tokenizer.tokenize();
-
     const addresses = [];
     let address = [];
-    let parsedAddresses = [];
-
+    const parsedAddresses = [];
     tokens.forEach(token => {
         if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
             if (address.length) {
                 addresses.push(address);
             }
             address = [];
-        } else {
+        }
+        else {
             address.push(token);
         }
     });
-
     if (address.length) {
         addresses.push(address);
     }
-
     addresses.forEach(addr => {
         const handled = _handleAddress(addr, depth);
         // Appended in place. Rebuilding the accumulator with concat() would copy every
@@ -516,7 +746,6 @@ function addressparser(str, options) {
             parsedAddresses.push(handled[i]);
         }
     });
-
     // Merge fragments produced when unquoted display names contain commas.
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
@@ -529,16 +758,19 @@ function addressparser(str, options) {
         const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
         if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
             next.name = current.name + ', ' + next.name;
-        } else {
+        }
+        else {
             mergedAddresses.push(current);
         }
     }
     mergedAddresses.reverse();
-    parsedAddresses = mergedAddresses;
-
-    if (options.flatten) {
+    return mergedAddresses;
+}
+function addressparser(str, options) {
+    const parsedAddresses = _parseAddressList(str, 0);
+    if (options?.flatten) {
         const flatAddresses = [];
-        const walkAddressList = list => {
+        const walkAddressList = (list) => {
             list.forEach(entry => {
                 if (entry.group) {
                     return walkAddressList(entry.group);
@@ -549,8 +781,6 @@ function addressparser(str, options) {
         walkAddressList(parsedAddresses);
         return flatAddresses;
     }
-
     return parsedAddresses;
 }
-
-module.exports = addressparser;
+export default addressparser;