@postalsys/email-text-tools 2.4.18 → 2.4.20

package/.github/VULNERABILITY_REPORT.yml

@@ -0,0 +1,75 @@
+name: '@postalsys/email-text-tools security vulnerability report'
+description: 'Report an exploitable security vulnerability in @postalsys/email-text-tools'
+
+body:
+    - type: markdown
+      attributes:
+          value: |
+              Before reporting, read our
+              [Security Policy](https://github.com/postalsys/email-text-tools/security/policy).
+
+              Reports must demonstrate a credible security impact.
+              Technically valid bugs without a realistic attack
+              scenario belong in the regular issue tracker.
+
+    - type: textarea
+      id: summary
+      attributes:
+          label: Vulnerability summary
+          description: Describe the vulnerability and affected versions.
+      validations:
+          required: true
+
+    - type: textarea
+      id: attacker
+      attributes:
+          label: Attacker capabilities
+          description: |
+              What can an attacker control without already having
+              privileged access to the application or its configuration?
+      validations:
+          required: true
+          min_length: 100
+
+    - type: textarea
+      id: exploit
+      attributes:
+          label: Realistic exploitation scenario
+          description: |
+              Describe how this can be exploited in a real application.
+              Explain the prerequisites and security boundary crossed.
+      validations:
+          required: true
+          min_length: 150
+
+    - type: textarea
+      id: poc
+      attributes:
+          label: Proof of concept
+          description: Provide reproducible steps or working code.
+      validations:
+          required: true
+
+    - type: textarea
+      id: impact
+      attributes:
+          label: Security impact
+          description: |
+              What can the attacker achieve? Who is affected?
+              Explain why this is a security vulnerability rather
+              than an ordinary bug.
+      validations:
+          required: true
+          min_length: 100
+
+    - type: checkboxes
+      id: confirmation
+      attributes:
+          label: Reporting requirements
+          options:
+              - label: I have read the Security Policy.
+                required: true
+              - label: I have verified the finding against a supported version.
+                required: true
+              - label: I have described a credible attacker-controlled scenario.
+                required: true

package/.ncurc.js

@@ -13,6 +13,10 @@ module.exports = {
         // 6.0.0 changed the CommonJS export shape (named bindings instead of the constructor) and,
         // more importantly, stopped linkifying bare domains such as 'example.com' or 'www.example.org'
         // by default, which silently breaks autolinking in plain text emails. Stay on 5.x.
-        'linkify-it'
+        'linkify-it',
+        // 2.0.0 is ESM-only (exports only src/he.mjs) and requires Node >=22, so require('he') throws
+        // and pkg cannot bundle it. 1.2.0 is the last CommonJS release; EmailEngine and mailparser
+        // hold it there too, and a different copy here would be a second he in their trees
+        'he'
     ]
 };

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "2.4.18"
+    ".": "2.4.20"
 }

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.4.20](https://github.com/postalsys/email-text-tools/compare/v2.4.19...v2.4.20) (2026-10-16)
+
+
+### Bug Fixes
+
+* bound CSS inlining, guard inlineHtml like mimeHtml and drop style attributes the CSSOM could not parse ([13b2725](https://github.com/postalsys/email-text-tools/commit/13b27254ae31a2aeab56a3edd7dd84737fa016cd))
+* bump @postalsys/email-content to 0.1.13 ([1a8738d](https://github.com/postalsys/email-text-tools/commit/1a8738da39f1adc404f871ab63c8dda5d3733dd2))
+
+## [2.4.19](https://github.com/postalsys/email-text-tools/compare/v2.4.18...v2.4.19) (2026-10-14)
+
+
+### Bug Fixes
+
+* **deps:** update dompurify to 3.4.17 and hold he on 1.x ([7a900b0](https://github.com/postalsys/email-text-tools/commit/7a900b03f4fbf4001bb21dffa62c659a89917e74))
+
 ## [2.4.18](https://github.com/postalsys/email-text-tools/compare/v2.4.17...v2.4.18) (2026-09-28)
 
 

package/README.md

@@ -9,7 +9,9 @@ Email text tools
 - elements: `title`, `link`, `meta`, `base`, `basefont`, `frame`, `iframe`, `frameset`, `template`, `script`, `noframes`, `noscript`, `object`, `embed`, `dialog`, `canvas`, `audio`, `video`, `applet`, and forms with their controls (`form`, `input`, `button`, `select`, `textarea`; their text content is kept)
 - attributes: `action`, `formaction`, `popover`, `popovertarget`
 - CSS rules whose selector uses `:is()`, `:where()`, `:has()` or a `:not()` containing another pseudo-class, and any `<style>` text beyond 256 KB per message
+- CSS inlining altogether when the style text holds more than 5,000 selectors, the document more than 50,000 elements, or the product of the two exceeds 5,000,000 (inlining costs one selector match per element). The sanitized HTML is then returned with its `<style>` rules dropped and `data-css-inlining="skipped"` on the wrapper `<div>`
+- a `style` attribute that still names a forbidden property after the CSSOM has filtered it, which means the CSSOM could not parse that declaration: the attribute is reduced to the declarations it did parse, or removed
 
-Input nested more than about 1000 elements deep, or that the parser cannot process, is rendered as escaped plain text instead of throwing.
+Input nested more than about 1000 elements deep, or that the parser cannot process, is rendered as escaped plain text instead of throwing. `inlineHtml()` applies the same depth limit to the quoted message and to the new content, and quotes escaped text instead when it is exceeded.
 
 Reply/forward date headers from `inlineHtml()` and `inlineText()` are formatted with `Intl.DateTimeFormat` (for example `Sat, Jun 15, 2024, 2:30 PM`). An unsupported locale falls back to English and an unknown time zone to UTC. A Node build without full ICU data only has English.

package/SECURITY.md

@@ -1,81 +1,156 @@
 # Security Policy
 
-`@postalsys/email-text-tools` converts and sanitizes email content for display -
-turning plain text into HTML, HTML into plain text, and sanitizing/CSS-inlining
-arbitrary (and often untrusted) email HTML into markup that is safe to render.
-Because it processes attacker-controlled input and its output is shown to end
-users, we take security reports seriously and aim to respond quickly.
+`@postalsys/email-text-tools` converts and sanitizes email content for display:
+it turns plain text into HTML, HTML into plain text, and sanitizes and
+CSS-inlines arbitrary (often untrusted) email HTML into markup that is safe to
+render. We welcome responsible reports of vulnerabilities that present a
+credible security risk to users. Please distinguish security vulnerabilities
+from ordinary bugs, unusual edge cases, and hardening suggestions.
 
 ## Supported Versions
 
-Security fixes are released only against the latest version. We do not backport
-patches to older releases - upgrading to the current release line is the
-supported way to receive security updates.
+Security fixes are released only against the latest major version. We do not
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
 | 2.x     | :white_check_mark: |
 | < 2.0   | :x:                |
 
-If you are on an older version, please upgrade. See the release notes at
+If you are on an older major, please upgrade. See the release notes at
 <https://github.com/postalsys/email-text-tools/releases> before updating.
 
-## Reporting a Vulnerability
+## What Qualifies as a Security Vulnerability
 
-**Please do not report security vulnerabilities through public GitHub issues,
-pull requests, or discussions.**
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of `@postalsys/email-text-tools`.
+Unexpected behavior, a failing test, or a technically correct proof of concept
+is not sufficient on its own to establish security impact.
 
-Report privately through one of the following channels:
+In particular, explain:
 
-1. **GitHub Security Advisories (preferred).** Open a private report at
-   <https://github.com/postalsys/email-text-tools/security/advisories/new>. This
-   keeps the discussion private until a fix is published and lets us credit you.
-2. **Email.** Send details to **andris@postalsys.com**. Encrypt sensitive details
-   if possible.
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported public API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain why
+  those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
 
-When reporting, please include as much of the following as you can:
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
 
-- The affected version(s) and environment (package version, Node.js version, OS).
-- The function involved (`mimeHtml`, `textToHtml`, `htmlToText`, `inlineHtml`,
-  `inlineText`).
-- A clear description of the issue and its impact (e.g. XSS / sanitizer bypass,
-  denial of service via catastrophic regex backtracking or CSS that hangs
-  processing, prototype pollution, content or information disclosure).
-- A minimal proof of concept: the input that triggers it and the unsafe output
-  or behavior it produces.
-- Any suggested remediation, if you have one.
+## Reporting a Vulnerability
 
-We are a small team, so there is no guaranteed response time - sometimes reports
-are handled within hours, sometimes they take longer. Accepted issues are fixed
-in a new release and coordinated through a GitHub Security Advisory, and
-reporters who wish to be named are credited.
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the
+maintainers.**
 
-## CVEs
+Report privately through one of the following channels:
 
-We track and disclose vulnerabilities through GitHub Security Advisories. We do
-not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself - for example, through GitHub's own
-CVE request flow on the published advisory, or another CNA.
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/postalsys/email-text-tools/security/advisories/new>.
+2. **Email:** **andris@postalsys.com**. Encrypt sensitive details if possible
+   (PGP key fingerprint `5D952A46E1D8C931F6364E01DC6C83F4D584D364`).
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected `@postalsys/email-text-tools` version or commit, Node.js
+   version, and relevant configuration.
+2. A concise description of the issue and the affected public API or code path
+   (for example `mimeHtml`, `textToHtml`, `htmlToText`, `inlineHtml`, or
+   `inlineText`, with the input that triggers the issue and the unsafe output or
+   behavior it produces).
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects real deployments beyond a
+   deliberately constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of
+exploitability. A complete real-world exploit is not always necessary, but the
+report must make a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside `@postalsys/email-text-tools`'s control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+`@postalsys/email-text-tools` is maintained by a small team, and there is **no
+guaranteed response or resolution time**. Reports are prioritized based on
+demonstrated impact, exploitability, affected usage, and available maintenance
+resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainers.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that
+`@postalsys/email-text-tools` has confirmed a security vulnerability or endorsed
+a CVE assignment. We do not guarantee advisories, CVE identifiers, or public
+credit for reports. For confirmed vulnerabilities disclosed through an advisory,
+substantive reporters may be credited if they wish.
 
 ## Scope
 
-In scope: the library source in this repository - in particular:
-
-- Sanitizer bypasses in `mimeHtml` that let active content (scripts, event
-  handler attributes, dangerous URL schemes, or other executable markup) survive
-  into the sanitized output.
-- Denial of service in any conversion path - input that causes catastrophic
-  regex backtracking or makes CSS inlining hang or exhaust resources.
-- Prototype pollution or similar object-integrity issues reachable through the
-  public API.
+In scope: the library source in this repository, in particular sanitizer
+bypasses in `mimeHtml` that let active content (scripts, event handler
+attributes, dangerous URL schemes, or other executable markup) survive into the
+sanitized output, denial of service in any conversion path from catastrophic
+regex backtracking or CSS inlining that hangs or exhausts resources, and
+prototype pollution reachable through the public API.
 
 Out of scope:
 
-- Vulnerabilities in your own application that consumes this library - for
-  example, rendering the output without a Content Security Policy, or trusting
+- Vulnerabilities in your own application that consumes this library, for
+  example rendering the output without a Content Security Policy, or trusting
   the output in a non-HTML context.
 - Issues in third-party dependencies that are already publicly known; report
   those upstream (we will still pick up the dependency fix in a release).
-- Missing security hardening without a demonstrated, concrete impact.
+- Social-engineering reports.
 
-Thank you for helping keep email-text-tools and its users safe.
+Thank you for helping keep `@postalsys/email-text-tools` and its users safe.

package/lib/html-guard.js

@@ -0,0 +1,127 @@
+'use strict';
+
+const he = require('he');
+
+// jsdom builds a tree in time quadratic to its depth (10,000 unclosed <b> tags take about 9 s) and
+// its serializer overflows the stack a few thousand levels down; node-html-parser spends cubic time
+// on the elements left open at the end of a document. Deeper input is not parsed at all. Real
+// email nests a few dozen levels.
+const MAX_NESTING_DEPTH = 1000;
+
+// Elements that never stay open in HTML content, either void or closed implicitly by a sibling,
+// so they do not add to the depth an HTML parser ends up with. Inside SVG and MathML they can nest,
+// so there every start tag counts.
+const NON_NESTING_TAGS = new Set(
+    'area,base,br,col,embed,hr,img,input,keygen,link,meta,param,source,track,wbr,p,li,dt,dd,td,th,tr,tbody,thead,tfoot,colgroup,caption,option,optgroup,rt,rp'.split(
+        ','
+    )
+);
+
+// A single linear pass estimating how deep the parsed tree would get. An end tag closes the
+// nearest open element of its name together with everything opened inside it, and one that names
+// no open element is ignored, as an HTML parser ignores it: counting every end tag down instead
+// let "<b></i>" repeated nest as deep as the input allowed, and 10,000 copies took jsdom ten
+// seconds. Otherwise the estimate only ever overestimates (tags inside comments, attribute values
+// and raw text count too), which at worst means an extreme message is shown as plain text.
+function exceedsNestingDepth(html, maxDepth) {
+    const tagName = /[a-z][a-z0-9:-]*/iy;
+    const stack = [];
+    const open = new Map();
+    let foreign = 0;
+    let pos = 0;
+    while (pos < html.length) {
+        const tagStart = html.indexOf('<', pos);
+        if (tagStart < 0) {
+            break;
+        }
+        const tagEnd = html.indexOf('>', tagStart + 1);
+        if (tagEnd < 0) {
+            break;
+        }
+        // resume right after the first ">", so no tag the parser would see is ever skipped
+        pos = tagEnd + 1;
+
+        const closing = html.charAt(tagStart + 1) === '/';
+        tagName.lastIndex = tagStart + (closing ? 2 : 1);
+        const nameMatch = tagName.exec(html);
+        if (!nameMatch) {
+            continue;
+        }
+        const name = nameMatch[0].toLowerCase();
+        const isForeignRoot = name === 'svg' || name === 'math';
+
+        if (closing) {
+            if (!open.get(name)) {
+                continue;
+            }
+            let popped;
+            do {
+                popped = stack.pop();
+                open.set(popped, open.get(popped) - 1);
+                if (popped === 'svg' || popped === 'math') {
+                    foreign--;
+                }
+            } while (popped !== name);
+            continue;
+        }
+
+        if (!foreign && NON_NESTING_TAGS.has(name)) {
+            continue;
+        }
+
+        // a self-closing flag is ignored on HTML elements, only SVG and MathML honor it
+        if ((foreign || isForeignRoot) && html.charAt(tagEnd - 1) === '/') {
+            continue;
+        }
+
+        if (isForeignRoot) {
+            foreign++;
+        }
+
+        stack.push(name);
+        open.set(name, (open.get(name) || 0) + 1);
+        if (stack.length > maxDepth) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// The text of an HTML body for a fallback rendering. The fallback runs when the HTML could not be
+// processed (hostile nesting, a parser or serializer overflow), so it cannot lean on a real HTML
+// parser either: html-to-text gives up on a body nested past its own limit and returned nothing
+// for exactly the input that lands here. One pass over the string: tags become a space, style and
+// script blocks are dropped whole, entities are decoded once
+function fallbackText(html) {
+    const lower = html.toLowerCase();
+    const parts = [];
+    let pos = 0;
+    while (pos < html.length) {
+        const lt = html.indexOf('<', pos);
+        if (lt < 0) {
+            parts.push(html.slice(pos));
+            break;
+        }
+        parts.push(html.slice(pos, lt));
+        const gt = html.indexOf('>', lt + 1);
+        if (gt < 0) {
+            // an unterminated tag runs to the end of the input
+            break;
+        }
+        const name = /^(style|script)(?:[\s/]|$)/.exec(lower.slice(lt + 1, gt));
+        if (name) {
+            const close = lower.indexOf('</' + name[1], gt + 1);
+            const closeEnd = close < 0 ? -1 : html.indexOf('>', close);
+            if (closeEnd < 0) {
+                break;
+            }
+            pos = closeEnd + 1;
+        } else {
+            pos = gt + 1;
+        }
+        parts.push(' ');
+    }
+    return he.decode(parts.join(''));
+}
+
+module.exports = { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText };

package/lib/inline-html.js

@@ -4,6 +4,12 @@ const HTMLParser = require('node-html-parser');
 const he = require('he');
 const formatDate = require('./format-date');
 const textToHtml = require('./text-to-html');
+const { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText } = require('./html-guard');
+
+// Escaped text in place of a body that is not worth parsing
+function fallbackBody(html) {
+    return `<div style="white-space: pre-wrap;">${he.encode(fallbackText(html), { useNamedReferences: true })}</div>`;
+}
 
 function getHtmlBody(html) {
     html = ((html && html.toString()) || '').trim();
@@ -11,12 +17,22 @@ function getHtmlBody(html) {
         return '';
     }
 
-    const root = HTMLParser.parse(html);
-    let body = root.querySelector('body');
-    if (!body) {
-        body = root.querySelector('html') || root;
+    // node-html-parser spends cubic time removing the elements left open at the end of a document
+    // (16 KB of unclosed <b> tags took ten seconds), so the depth check that guards mimeHtml()
+    // refuses the obvious shapes before parsing. The parse option leaves whatever is still open in
+    // place instead of reparenting it, so a shape the check underestimates (it follows the HTML
+    // parsing rules, node-html-parser ignores more end tags) costs linear time and at worst a stack
+    // overflow in the serializer, caught below
+    if (exceedsNestingDepth(html, MAX_NESTING_DEPTH)) {
+        return fallbackBody(html);
+    }
+    try {
+        const root = HTMLParser.parse(html, { parseNoneClosedTags: true });
+        const body = root.querySelector('body') || root.querySelector('html') || root;
+        return (body.innerHTML || '').trim();
+    } catch (_err) {
+        return fallbackBody(html);
     }
-    return ((body && body.innerHTML) || '').trim();
 }
 
 function formatAddressHtml(addr) {

package/lib/mime-html.js

@@ -9,6 +9,7 @@ const he = require('he');
 const { Worker } = require('worker_threads');
 const path = require('path');
 const WorkerPool = require('./worker-pool');
+const { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText } = require('./html-guard');
 
 const textToHtml = require('./text-to-html');
 
@@ -74,6 +75,10 @@ const FORBID_STYLES = [
 // Matches the style text of any element that could carry one of FORBID_STYLES
 const FORBID_STYLES_HINT = /position|float|clip|zoom|anim|offset|scrollbar|paint|clear|\ball\b/i;
 
+// A forbidden property in declaration position: at the start, or after any character that cannot
+// be part of a longer property name, so "background-position" is not one
+const FORBID_STYLES_DECLARATION = new RegExp('(?:^|[^a-z0-9-])(?:' + FORBID_STYLES.join('|') + ')\\s*:', 'i');
+
 // Resolves CSS escape sequences (\6F, \o) the way a browser does before it matches a property
 // name, so that a forbidden property cannot hide behind an escaped character
 function decodeCssEscapes(value) {
@@ -198,119 +203,49 @@ blockquote blockquote blockquote blockquote{
 // filter below scale with it, and no legitimate email needs more.
 const MAX_STYLE_TEXT = 256 * 1024;
 
-// jsdom builds a tree in time quadratic to its depth (10,000 unclosed <b> tags take about 9 s) and
-// its serializer overflows the stack a few thousand levels down, so deeper input is not parsed at all.
-// Real email nests a few dozen levels.
-const MAX_NESTING_DEPTH = 1000;
-
-// Elements that never stay open in HTML content, either void or closed implicitly by a sibling,
-// so they do not add to the depth an HTML parser ends up with. Inside SVG and MathML they can nest,
-// so there every start tag counts.
-const NON_NESTING_TAGS = new Set(
-    'area,base,br,col,embed,hr,img,input,keygen,link,meta,param,source,track,wbr,p,li,dt,dd,td,th,tr,tbody,thead,tfoot,colgroup,caption,option,optgroup,rt,rp'.split(
-        ','
-    )
-);
-
-// A single linear pass estimating how deep the parsed tree would get. It only ever overestimates
-// (tags inside comments, attribute values and raw text count too), which at worst means an
-// extreme message is shown as plain text.
-function exceedsNestingDepth(html, maxDepth) {
-    const tagName = /[a-z][a-z0-9:-]*/iy;
+// juice matches every selector against every element, so its cost is the product of the two
+// counts: 1,000 rules on 10,000 paragraphs took 2.7 s and 10,000 on 10,000 took 25 s, on the
+// calling thread, and the style text cap alone leaves the body unbounded. Each bound sits well
+// above real mail (an Outlook thread of fifty replies is a few hundred selectors on some fifteen
+// thousand elements, a heavy newsletter a thousand on a few thousand) and the product bound keeps
+// the worst case around a second: 0.25 us per pair measured when every selector matches every
+// element, a quarter of that when none does. Past any of them the sanitized HTML is returned
+// without inlined CSS, and the wrapper says so.
+const MAX_INLINE_SELECTORS = 5000;
+const MAX_INLINE_ELEMENTS = 50000;
+const MAX_INLINE_WORK = 5000000;
+
+// Selectors juice would match against the document: every selector of every rule at the top level
+// of the style text. A rule nested in an at-rule is not inlined (juice keeps media queries as rules),
+// so it only costs its parse and is not counted. One linear pass
+function countSelectors(css) {
+    let count = 0;
     let depth = 0;
-    let foreign = 0;
-    let pos = 0;
-    while (pos < html.length) {
-        const tagStart = html.indexOf('<', pos);
-        if (tagStart < 0) {
-            break;
-        }
-        const tagEnd = html.indexOf('>', tagStart + 1);
-        if (tagEnd < 0) {
-            break;
-        }
-        // resume right after the first ">", so no tag the parser would see is ever skipped
-        pos = tagEnd + 1;
-
-        const closing = html.charAt(tagStart + 1) === '/';
-        tagName.lastIndex = tagStart + (closing ? 2 : 1);
-        const nameMatch = tagName.exec(html);
-        if (!nameMatch) {
-            continue;
-        }
-        const name = nameMatch[0].toLowerCase();
-        const isForeignRoot = name === 'svg' || name === 'math';
-
-        if (closing) {
-            if (isForeignRoot && foreign > 0) {
-                foreign--;
+    let commas = 0;
+    for (let i = 0; i < css.length; i++) {
+        const c = css.charAt(i);
+        if (c === '{') {
+            if (depth === 0) {
+                count += commas + 1;
+                commas = 0;
             }
-            if (depth > 0 && (foreign || !NON_NESTING_TAGS.has(name))) {
+            depth++;
+        } else if (c === '}') {
+            if (depth > 0) {
                 depth--;
             }
-            continue;
-        }
-
-        if (!foreign && NON_NESTING_TAGS.has(name)) {
-            continue;
-        }
-
-        // a self-closing flag is ignored on HTML elements, only SVG and MathML honor it
-        if ((foreign || isForeignRoot) && html.charAt(tagEnd - 1) === '/') {
-            continue;
-        }
-
-        if (isForeignRoot) {
-            foreign++;
-        }
-
-        depth++;
-        if (depth > maxDepth) {
-            return true;
+            commas = 0;
+        } else if (c === ';' && depth === 0) {
+            commas = 0;
+        } else if (c === ',' && depth === 0) {
+            commas++;
         }
     }
-    return false;
+    return count;
 }
 
 // Rendered in place of the sanitized HTML when the pipeline cannot process the input at all, for
 // example when a hostile nesting depth overflows the stack of the parser or the serializer.
-// The text of an HTML body for the fallback rendering. The fallback runs when the HTML could
-// not be processed (hostile nesting, a parser or serializer overflow), so it cannot lean on a
-// real HTML parser either: html-to-text gives up on a body nested past its own limit and
-// returned nothing for exactly the input that lands here. One pass over the string: tags become
-// a space, style and script blocks are dropped whole, entities are decoded once
-function fallbackText(html) {
-    const lower = html.toLowerCase();
-    const parts = [];
-    let pos = 0;
-    while (pos < html.length) {
-        const lt = html.indexOf('<', pos);
-        if (lt < 0) {
-            parts.push(html.slice(pos));
-            break;
-        }
-        parts.push(html.slice(pos, lt));
-        const gt = html.indexOf('>', lt + 1);
-        if (gt < 0) {
-            // an unterminated tag runs to the end of the input
-            break;
-        }
-        const name = /^(style|script)(?:[\s/]|$)/.exec(lower.slice(lt + 1, gt));
-        if (name) {
-            const close = lower.indexOf('</' + name[1], gt + 1);
-            const closeEnd = close < 0 ? -1 : html.indexOf('>', close);
-            if (closeEnd < 0) {
-                break;
-            }
-            pos = closeEnd + 1;
-        } else {
-            pos = gt + 1;
-        }
-        parts.push(' ');
-    }
-    return he.decode(parts.join(''));
-}
-
 function fallbackHtml(message) {
     let text = message.text;
     if (!text && message.html) {
@@ -405,6 +340,7 @@ function prepareHtml(message) {
     // Process remaining style tags to remove known problematic selectors
     let styleBudget = MAX_STYLE_TEXT;
     let hasStyle = false;
+    let selectors = 0;
     root.querySelectorAll('style').forEach(styleTag => {
         let cssContent = styleTag.textContent || '';
         if (cssContent.length > styleBudget) {
@@ -416,14 +352,24 @@ function prepareHtml(message) {
         styleTag.textContent = cssContent;
         if (cssContent.trim()) {
             hasStyle = true;
+            selectors += countSelectors(cssContent);
         }
     });
 
-    return { html: root.outerHTML, hasStyle };
+    let inliningSkipped = false;
+    if (hasStyle) {
+        const elements = root.getElementsByTagName('*').length;
+        if (selectors > MAX_INLINE_SELECTORS || elements > MAX_INLINE_ELEMENTS || selectors * elements > MAX_INLINE_WORK) {
+            hasStyle = false;
+            inliningSkipped = true;
+        }
+    }
+
+    return { html: root.outerHTML, hasStyle, inliningSkipped };
 }
 
 // Second sanitization pass and post-processing of the juice output.
-function finishHtml(html) {
+function finishHtml(html, inliningSkipped) {
     // second pass, outputs a BODY DOM element
     const dom = DOMPurify.sanitize(html, {
         RETURN_DOM: true,
@@ -465,13 +411,28 @@ function finishHtml(html) {
             for (let disallowedStyle of FORBID_STYLES) {
                 node.style.removeProperty(disallowedStyle);
             }
+            // removeProperty() rewrites the attribute from the CSSOM, which only holds the
+            // declarations cssstyle managed to parse. A forbidden property still named in the
+            // attribute after that was never parsed and would go out verbatim for the browser to
+            // read its own way: cssstyle 5 parses nothing from an attribute whose "background:
+            // url()" shorthand is followed by more declarations, a browser reads every one of
+            // them. Keep only what the CSSOM parsed, which may be nothing
+            if (FORBID_STYLES_DECLARATION.test(node.getAttribute('style') || '')) {
+                const parsed = node.style.cssText;
+                if (parsed) {
+                    node.setAttribute('style', parsed);
+                } else {
+                    node.removeAttribute('style');
+                }
+            }
         }
     }
 
     let bodyStyles = (dom.getAttribute('style') || '').toString().trim();
 
-    // embed into a styled container
-    return `<div style="${he.encode(bodyStyles)}">${dom.innerHTML.trim()}</div>`;
+    // embed into a styled container; the attribute tells the caller the CSS inlining caps were hit
+    const marker = inliningSkipped ? ' data-css-inlining="skipped"' : '';
+    return `<div style="${he.encode(bodyStyles)}"${marker}>${dom.innerHTML.trim()}</div>`;
 }
 
 // Runs the pipeline and renders the plain text fallback when it fails, for example when a
@@ -494,7 +455,7 @@ function guarded(fn, message, rethrow) {
 function mimeHtmlSync(message) {
     return guarded(
         () => {
-            let { html, hasStyle } = prepareHtml(message);
+            let { html, hasStyle, inliningSkipped } = prepareHtml(message);
             if (hasStyle) {
                 try {
                     // Run juice synchronously - risky but backwards compatible
@@ -503,7 +464,7 @@ function mimeHtmlSync(message) {
                     // not so important, so we'll ignore if style inlining fails
                 }
             }
-            return finishHtml(html);
+            return finishHtml(html, inliningSkipped);
         },
         message,
         false
@@ -513,7 +474,7 @@ function mimeHtmlSync(message) {
 async function mimeHtmlAsync(message, options = {}) {
     return guarded(
         async () => {
-            let { html, hasStyle } = prepareHtml(message);
+            let { html, hasStyle, inliningSkipped } = prepareHtml(message);
             if (hasStyle) {
                 try {
                     // Use worker thread with timeout for juice - provides protection against ANY
@@ -526,7 +487,7 @@ async function mimeHtmlAsync(message, options = {}) {
                     }
                 }
             }
-            return finishHtml(html);
+            return finishHtml(html, inliningSkipped);
         },
         message,
         options.fallbackOnError === false

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@postalsys/email-text-tools",
-    "version": "2.4.18",
+    "version": "2.4.20",
     "description": "Email text tools",
     "main": "index.js",
     "scripts": {
@@ -29,12 +29,13 @@
     "homepage": "https://github.com/postalsys/email-text-tools#readme",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "eslint": "10.11.0",
+        "eslint": "10.12.0",
         "eslint-config-prettier": "10.1.8",
-        "prettier": "3.9.9"
+        "prettier": "3.9.10"
     },
     "dependencies": {
-        "dompurify": "3.4.16",
+        "@postalsys/email-content": "0.1.13",
+        "dompurify": "3.4.17",
         "he": "1.2.0",
         "html-to-text": "10.0.1",
         "jsdom": "27.0.0",

package/test/hardening.test.js

@@ -231,6 +231,19 @@ describe('hostile input hardening', () => {
             assert.equal(mimeHtml.getWorkerPoolStats(), null);
         });
 
+        it('mimeHtml depth check is not bypassed by end tags that close nothing', () => {
+            // the check counted every end tag down, so "<b></i>" repeated passed it while the
+            // parser, which ignores the </i>, nested the <b> tags: 10,000 copies took 9.7 s
+            const { result, ms } = timed(() => mimeHtml({ html: '<b></i>'.repeat(10000) + 'deep' }));
+            assert.ok(result.startsWith(FALLBACK_PREFIX));
+            assert.ok(result.includes('deep'));
+            assert.ok(ms < 1500, `took ${ms} ms`);
+            // an end tag still closes what it names, including what was opened inside it
+            const nested = mimeHtml({ html: '<div><span><b>x</div>'.repeat(2000) + 'shallow' });
+            assert.ok(!nested.startsWith(FALLBACK_PREFIX));
+            assert.ok(nested.includes('shallow'));
+        });
+
         it('htmlToText does not overflow the stack on deep nesting', () => {
             for (const tag of ['div', 'b', 'blockquote']) {
                 const html = 'hello &amp; <b>world</b>' + `<${tag}>`.repeat(20000) + 'deep' + `</${tag}>`.repeat(20000) + 'after';
@@ -243,6 +256,104 @@ describe('hostile input hardening', () => {
         });
     });
 
+    describe('CSS inlining caps', () => {
+        const SKIPPED_PREFIX = '<div style="overflow: auto;" data-css-inlining="skipped">';
+
+        function styled(css, body) {
+            return `<html><head><style>${css}</style></head><body>${body}</body></html>`;
+        }
+
+        function rules(count, selector) {
+            let css = '';
+            for (let i = 0; i < count; i++) {
+                css += `${selector || '.c' + i} { color: #${(i % 4096).toString(16).padStart(3, '0')}; }\n`;
+            }
+            return css;
+        }
+
+        it('skips inlining when the selectors times the elements is too much work', () => {
+            // 10,000 rules on 10,000 paragraphs took 25 s in juice, on the calling thread
+            const html = styled(rules(10000, 'p'), '<p>x</p>'.repeat(10000));
+            const { result, ms } = timed(() => mimeHtml({ html }));
+            assert.ok(ms < 3000, `took ${ms} ms`);
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+            assert.ok(result.includes('<p>x</p>'));
+            assert.doesNotMatch(result, /color:/);
+        });
+
+        it('counts every selector of a rule, not every rule', () => {
+            const html = styled(`${'p, '.repeat(9999)}p { color: red; }`, '<p>x</p>'.repeat(10000));
+            const result = mimeHtml({ html });
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+        });
+
+        it('skips inlining past the selector cap or the element cap on their own', () => {
+            const manyRules = mimeHtml({ html: styled(rules(5001), '<p class="c1">x</p>') });
+            assert.ok(manyRules.startsWith(SKIPPED_PREFIX), manyRules.slice(0, 80));
+            const manyElements = mimeHtml({ html: styled('p { color: red; }', '<i></i>'.repeat(50001)) });
+            assert.ok(manyElements.startsWith(SKIPPED_PREFIX), manyElements.slice(0, 80));
+        });
+
+        it('inlines a large but ordinary message', () => {
+            // rules nested in a media query are not matched against elements and do not count
+            const css = `${rules(2000)}p.x { color: blue; }\n@media screen { ${rules(4000)} }`;
+            const result = mimeHtml({ html: styled(css, '<p class="x">y</p>'.repeat(2000)) });
+            assert.ok(result.startsWith('<div style="overflow: auto;"><p'), result.slice(0, 80));
+            assert.match(result, /color: blue/);
+        });
+
+        it('mimeHtml.async skips the same way', async () => {
+            const html = styled(rules(10000, 'p'), '<p>x</p>'.repeat(10000));
+            const result = await mimeHtml.async({ html });
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+            assert.ok(result.includes('<p>x</p>'));
+        });
+    });
+
+    describe('inlineHtml parse guard', () => {
+        const FALLBACK_BODY = '<div style="white-space: pre-wrap;">';
+
+        it('does not spend seconds on tags left open in the quoted message', () => {
+            // 16 KB of "<b>x" took node-html-parser 10.6 s to clean up
+            const { result, ms } = timed(() => inlineHtml('reply', '<p>my reply</p>', { html: '<b>x'.repeat(4000) }));
+            assert.ok(ms < 1000, `took ${ms} ms`);
+            assert.ok(result.includes('my reply'));
+            assert.ok(result.includes(FALLBACK_BODY));
+            assert.ok(!result.includes('<b>'));
+            assert.ok(/x x x/.test(result));
+        });
+
+        for (const [label, html] of [
+            ['end tags that close nothing', '<b></i>'.repeat(5000) + 'deep'],
+            ['end tags the parser ignores', '<td><font>x</td>'.repeat(3000)],
+            ['padded end tags', '<a><b><c>y</a></b>'.repeat(3000)],
+            ['rows left open', '<table>' + '<tr><td>cell'.repeat(5000)]
+        ]) {
+            it(`stays fast on ${label}`, () => {
+                const { result, ms } = timed(() => inlineHtml('forward', '<p>fyi</p>', { html }));
+                assert.ok(ms < 1000, `took ${ms} ms`);
+                assert.ok(result.includes('fyi'));
+                assert.ok(result.includes('<blockquote'));
+            });
+        }
+
+        it('guards the new content the same way', () => {
+            const { result, ms } = timed(() => inlineHtml('reply', '<b>x'.repeat(4000), { html: '<p>Original</p>' }));
+            assert.ok(ms < 1000, `took ${ms} ms`);
+            assert.ok(result.includes('<p>Original</p>'));
+            assert.ok(result.includes(FALLBACK_BODY));
+        });
+
+        it('keeps the quoted body of ordinary and sloppy markup', () => {
+            const result = inlineHtml('reply', '<p>r</p>', { html: '<html><body><div><b>bold text<p>para</body></html>' });
+            assert.ok(result.includes('bold text'));
+            assert.ok(result.includes('<b>'));
+            // only the reply template's own body element is left
+            assert.equal((result.match(/<body/g) || []).length, 1);
+            assert.ok(!result.includes(FALLBACK_BODY));
+        });
+    });
+
     describe('sanitizer policy', () => {
         it('removes forms and form controls but keeps their text', () => {
             const html =
@@ -362,3 +473,32 @@ describe('forbidden style properties behind CSS escapes', () => {
         assert.ok(/color:\s*red/i.test(out), out);
     });
 });
+
+describe('forbidden style properties the CSSOM could not parse', () => {
+    it('drops a style attribute cssstyle rejected that names a forbidden property', () => {
+        // cssstyle 5 parses nothing from an attribute whose background shorthand with a url() is
+        // followed by more declarations, so the raw text went out verbatim and a browser, which
+        // parses it fine, honored the position
+        const out = mimeHtml({ html: '<div style="background:url(https://example.com/x.gif) no-repeat; position:fixed; top:0">x</div>' });
+        assert.ok(!/position|fixed|top:/i.test(out), out);
+        assert.ok(out.includes('<div>x</div>'), out);
+    });
+
+    it('keeps the declarations the CSSOM parsed around one it could not', () => {
+        const out = mimeHtml({ html: '<div style="color:red;}position:fixed;top:0">x</div>' });
+        assert.ok(!/position|fixed/i.test(out), out);
+        assert.match(out, /color: red/);
+        assert.match(out, /top: 0/);
+    });
+
+    it('leaves an attribute that names no forbidden property as it was, parsed or not', () => {
+        const out = mimeHtml({ html: '<div style="background:url(clear.gif); color:red">x</div>' });
+        assert.ok(out.includes('style="background:url(clear.gif); color:red"'), out);
+    });
+
+    it('does not take a longer property name for a forbidden one', () => {
+        const out = mimeHtml({ html: '<div style="background-position: center top; text-underline-offset: 2px; color:red">x</div>' });
+        assert.ok(out.includes('background-position: center top'), out);
+        assert.ok(out.includes('text-underline-offset: 2px'), out);
+    });
+});