@postalsys/email-text-tools 2.4.17 → 2.4.18

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "2.4.17"
+    ".": "2.4.18"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.4.18](https://github.com/postalsys/email-text-tools/compare/v2.4.17...v2.4.18) (2026-09-28)
+
+
+### Bug Fixes
+
+* keep the text of an over-deep HTML body in the fallback rendering ([a2e06b7](https://github.com/postalsys/email-text-tools/commit/a2e06b75878d3763bb35d225a93225aa6a3f18ab))
+
 ## [2.4.17](https://github.com/postalsys/email-text-tools/compare/v2.4.16...v2.4.17) (2026-09-28)
 
 

package/lib/mime-html.js

@@ -11,7 +11,6 @@ const path = require('path');
 const WorkerPool = require('./worker-pool');
 
 const textToHtml = require('./text-to-html');
-const htmlToText = require('./html-to-text');
 
 const FORBID_TAGS = [
     'title',
@@ -275,10 +274,47 @@ function exceedsNestingDepth(html, maxDepth) {
 
 // Rendered in place of the sanitized HTML when the pipeline cannot process the input at all, for
 // example when a hostile nesting depth overflows the stack of the parser or the serializer.
+// The text of an HTML body for the fallback rendering. The fallback runs when the HTML could
+// not be processed (hostile nesting, a parser or serializer overflow), so it cannot lean on a
+// real HTML parser either: html-to-text gives up on a body nested past its own limit and
+// returned nothing for exactly the input that lands here. One pass over the string: tags become
+// a space, style and script blocks are dropped whole, entities are decoded once
+function fallbackText(html) {
+    const lower = html.toLowerCase();
+    const parts = [];
+    let pos = 0;
+    while (pos < html.length) {
+        const lt = html.indexOf('<', pos);
+        if (lt < 0) {
+            parts.push(html.slice(pos));
+            break;
+        }
+        parts.push(html.slice(pos, lt));
+        const gt = html.indexOf('>', lt + 1);
+        if (gt < 0) {
+            // an unterminated tag runs to the end of the input
+            break;
+        }
+        const name = /^(style|script)(?:[\s/]|$)/.exec(lower.slice(lt + 1, gt));
+        if (name) {
+            const close = lower.indexOf('</' + name[1], gt + 1);
+            const closeEnd = close < 0 ? -1 : html.indexOf('>', close);
+            if (closeEnd < 0) {
+                break;
+            }
+            pos = closeEnd + 1;
+        } else {
+            pos = gt + 1;
+        }
+        parts.push(' ');
+    }
+    return he.decode(parts.join(''));
+}
+
 function fallbackHtml(message) {
     let text = message.text;
     if (!text && message.html) {
-        text = htmlToText(message.html.toString());
+        text = fallbackText(message.html.toString());
     }
     return `<div style="overflow: auto;"><div style="white-space: pre-wrap;">${he.encode((text || '').toString(), { useNamedReferences: true })}</div></div>`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@postalsys/email-text-tools",
-    "version": "2.4.17",
+    "version": "2.4.18",
     "description": "Email text tools",
     "main": "index.js",
     "scripts": {

package/test/hardening.test.js

@@ -146,8 +146,8 @@ describe('hostile input hardening', () => {
             assert.ok(result.startsWith(FALLBACK_PREFIX));
             assert.ok(result.includes('hello <img'));
             assert.doesNotMatch(result, /<img/);
-            // text below the html-to-text depth limit is dropped
-            assert.doesNotMatch(result, /deep/);
+            // the fallback strips tags itself, so text below any parser depth limit survives
+            assert.ok(result.includes('deep'));
             assert.ok(ms < 10000, `took ${ms} ms`);
         });
 
@@ -155,6 +155,7 @@ describe('hostile input hardening', () => {
             const { result, ms } = timed(() => mimeHtml({ html: 'shallow' + '<b>'.repeat(50000) + 'bold' }));
             assert.ok(result.startsWith(FALLBACK_PREFIX));
             assert.ok(result.includes('shallow'));
+            assert.ok(result.includes('bold'));
             assert.ok(ms < 15000, `took ${ms} ms`);
         });
 
@@ -198,6 +199,25 @@ describe('hostile input hardening', () => {
             const result = await mimeHtml.async({ html: 'async shallow' + '<div>'.repeat(4000) + 'async deep' });
             assert.ok(result.startsWith(FALLBACK_PREFIX));
             assert.ok(result.includes('async shallow'));
+            assert.ok(result.includes('async deep'));
+        });
+
+        it('the fallback keeps the text of an over-deep body that has no plain part', async () => {
+            const html = '<style>.x{color:red}</style><script>alert(1)</script>' + '<div>'.repeat(4000) + 'only &lt;html&gt; deep' + '</div>'.repeat(4000);
+            const result = await mimeHtml.async({ html });
+            assert.ok(result.startsWith(FALLBACK_PREFIX));
+            assert.ok(result.includes('only &lt;html&gt; deep'));
+            assert.ok(!result.includes('<div>'));
+            assert.ok(!result.includes('color:red'));
+            assert.ok(!result.includes('alert(1)'));
+        });
+
+        it('the fallback drops an unterminated style block and tag instead of rendering them', async () => {
+            const result = await mimeHtml.async({ html: 'kept <style>.x{}' + '<div>'.repeat(4000) });
+            assert.ok(result.includes('kept'));
+            assert.ok(!result.includes('.x{}'));
+            const unterminated = await mimeHtml.async({ html: 'kept <div' + '<div>'.repeat(4000) });
+            assert.ok(unterminated.includes('kept'));
         });
 
         it('mimeHtml.async rejects on hostile nesting with fallbackOnError: false', async () => {