@postalsys/email-text-tools 2.4.19 → 2.4.21

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "2.4.19"
+    ".": "2.4.21"
 }

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.4.21](https://github.com/postalsys/email-text-tools/compare/v2.4.20...v2.4.21) (2026-10-16)
+
+
+### Bug Fixes
+
+* bump @postalsys/email-content to 0.1.14 ([c35da4b](https://github.com/postalsys/email-text-tools/commit/c35da4b5da09ea90ae45ea21c1c292ddba474fab))
+
+## [2.4.20](https://github.com/postalsys/email-text-tools/compare/v2.4.19...v2.4.20) (2026-10-16)
+
+
+### Bug Fixes
+
+* bound CSS inlining, guard inlineHtml like mimeHtml and drop style attributes the CSSOM could not parse ([13b2725](https://github.com/postalsys/email-text-tools/commit/13b27254ae31a2aeab56a3edd7dd84737fa016cd))
+* bump @postalsys/email-content to 0.1.13 ([1a8738d](https://github.com/postalsys/email-text-tools/commit/1a8738da39f1adc404f871ab63c8dda5d3733dd2))
+
 ## [2.4.19](https://github.com/postalsys/email-text-tools/compare/v2.4.18...v2.4.19) (2026-10-14)
 
 

package/README.md

@@ -9,7 +9,9 @@ Email text tools
 - elements: `title`, `link`, `meta`, `base`, `basefont`, `frame`, `iframe`, `frameset`, `template`, `script`, `noframes`, `noscript`, `object`, `embed`, `dialog`, `canvas`, `audio`, `video`, `applet`, and forms with their controls (`form`, `input`, `button`, `select`, `textarea`; their text content is kept)
 - attributes: `action`, `formaction`, `popover`, `popovertarget`
 - CSS rules whose selector uses `:is()`, `:where()`, `:has()` or a `:not()` containing another pseudo-class, and any `<style>` text beyond 256 KB per message
+- CSS inlining altogether when the style text holds more than 5,000 selectors, the document more than 50,000 elements, or the product of the two exceeds 5,000,000 (inlining costs one selector match per element). The sanitized HTML is then returned with its `<style>` rules dropped and `data-css-inlining="skipped"` on the wrapper `<div>`
+- a `style` attribute that still names a forbidden property after the CSSOM has filtered it, which means the CSSOM could not parse that declaration: the attribute is reduced to the declarations it did parse, or removed
 
-Input nested more than about 1000 elements deep, or that the parser cannot process, is rendered as escaped plain text instead of throwing.
+Input nested more than about 1000 elements deep, or that the parser cannot process, is rendered as escaped plain text instead of throwing. `inlineHtml()` applies the same depth limit to the quoted message and to the new content, and quotes escaped text instead when it is exceeded.
 
 Reply/forward date headers from `inlineHtml()` and `inlineText()` are formatted with `Intl.DateTimeFormat` (for example `Sat, Jun 15, 2024, 2:30 PM`). An unsupported locale falls back to English and an unknown time zone to UTC. A Node build without full ICU data only has English.

package/lib/html-guard.js

@@ -0,0 +1,127 @@
+'use strict';
+
+const he = require('he');
+
+// jsdom builds a tree in time quadratic to its depth (10,000 unclosed <b> tags take about 9 s) and
+// its serializer overflows the stack a few thousand levels down; node-html-parser spends cubic time
+// on the elements left open at the end of a document. Deeper input is not parsed at all. Real
+// email nests a few dozen levels.
+const MAX_NESTING_DEPTH = 1000;
+
+// Elements that never stay open in HTML content, either void or closed implicitly by a sibling,
+// so they do not add to the depth an HTML parser ends up with. Inside SVG and MathML they can nest,
+// so there every start tag counts.
+const NON_NESTING_TAGS = new Set(
+    'area,base,br,col,embed,hr,img,input,keygen,link,meta,param,source,track,wbr,p,li,dt,dd,td,th,tr,tbody,thead,tfoot,colgroup,caption,option,optgroup,rt,rp'.split(
+        ','
+    )
+);
+
+// A single linear pass estimating how deep the parsed tree would get. An end tag closes the
+// nearest open element of its name together with everything opened inside it, and one that names
+// no open element is ignored, as an HTML parser ignores it: counting every end tag down instead
+// let "<b></i>" repeated nest as deep as the input allowed, and 10,000 copies took jsdom ten
+// seconds. Otherwise the estimate only ever overestimates (tags inside comments, attribute values
+// and raw text count too), which at worst means an extreme message is shown as plain text.
+function exceedsNestingDepth(html, maxDepth) {
+    const tagName = /[a-z][a-z0-9:-]*/iy;
+    const stack = [];
+    const open = new Map();
+    let foreign = 0;
+    let pos = 0;
+    while (pos < html.length) {
+        const tagStart = html.indexOf('<', pos);
+        if (tagStart < 0) {
+            break;
+        }
+        const tagEnd = html.indexOf('>', tagStart + 1);
+        if (tagEnd < 0) {
+            break;
+        }
+        // resume right after the first ">", so no tag the parser would see is ever skipped
+        pos = tagEnd + 1;
+
+        const closing = html.charAt(tagStart + 1) === '/';
+        tagName.lastIndex = tagStart + (closing ? 2 : 1);
+        const nameMatch = tagName.exec(html);
+        if (!nameMatch) {
+            continue;
+        }
+        const name = nameMatch[0].toLowerCase();
+        const isForeignRoot = name === 'svg' || name === 'math';
+
+        if (closing) {
+            if (!open.get(name)) {
+                continue;
+            }
+            let popped;
+            do {
+                popped = stack.pop();
+                open.set(popped, open.get(popped) - 1);
+                if (popped === 'svg' || popped === 'math') {
+                    foreign--;
+                }
+            } while (popped !== name);
+            continue;
+        }
+
+        if (!foreign && NON_NESTING_TAGS.has(name)) {
+            continue;
+        }
+
+        // a self-closing flag is ignored on HTML elements, only SVG and MathML honor it
+        if ((foreign || isForeignRoot) && html.charAt(tagEnd - 1) === '/') {
+            continue;
+        }
+
+        if (isForeignRoot) {
+            foreign++;
+        }
+
+        stack.push(name);
+        open.set(name, (open.get(name) || 0) + 1);
+        if (stack.length > maxDepth) {
+            return true;
+        }
+    }
+    return false;
+}
+
+// The text of an HTML body for a fallback rendering. The fallback runs when the HTML could not be
+// processed (hostile nesting, a parser or serializer overflow), so it cannot lean on a real HTML
+// parser either: html-to-text gives up on a body nested past its own limit and returned nothing
+// for exactly the input that lands here. One pass over the string: tags become a space, style and
+// script blocks are dropped whole, entities are decoded once
+function fallbackText(html) {
+    const lower = html.toLowerCase();
+    const parts = [];
+    let pos = 0;
+    while (pos < html.length) {
+        const lt = html.indexOf('<', pos);
+        if (lt < 0) {
+            parts.push(html.slice(pos));
+            break;
+        }
+        parts.push(html.slice(pos, lt));
+        const gt = html.indexOf('>', lt + 1);
+        if (gt < 0) {
+            // an unterminated tag runs to the end of the input
+            break;
+        }
+        const name = /^(style|script)(?:[\s/]|$)/.exec(lower.slice(lt + 1, gt));
+        if (name) {
+            const close = lower.indexOf('</' + name[1], gt + 1);
+            const closeEnd = close < 0 ? -1 : html.indexOf('>', close);
+            if (closeEnd < 0) {
+                break;
+            }
+            pos = closeEnd + 1;
+        } else {
+            pos = gt + 1;
+        }
+        parts.push(' ');
+    }
+    return he.decode(parts.join(''));
+}
+
+module.exports = { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText };

package/lib/inline-html.js

@@ -4,6 +4,12 @@ const HTMLParser = require('node-html-parser');
 const he = require('he');
 const formatDate = require('./format-date');
 const textToHtml = require('./text-to-html');
+const { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText } = require('./html-guard');
+
+// Escaped text in place of a body that is not worth parsing
+function fallbackBody(html) {
+    return `<div style="white-space: pre-wrap;">${he.encode(fallbackText(html), { useNamedReferences: true })}</div>`;
+}
 
 function getHtmlBody(html) {
     html = ((html && html.toString()) || '').trim();
@@ -11,12 +17,22 @@ function getHtmlBody(html) {
         return '';
     }
 
-    const root = HTMLParser.parse(html);
-    let body = root.querySelector('body');
-    if (!body) {
-        body = root.querySelector('html') || root;
+    // node-html-parser spends cubic time removing the elements left open at the end of a document
+    // (16 KB of unclosed <b> tags took ten seconds), so the depth check that guards mimeHtml()
+    // refuses the obvious shapes before parsing. The parse option leaves whatever is still open in
+    // place instead of reparenting it, so a shape the check underestimates (it follows the HTML
+    // parsing rules, node-html-parser ignores more end tags) costs linear time and at worst a stack
+    // overflow in the serializer, caught below
+    if (exceedsNestingDepth(html, MAX_NESTING_DEPTH)) {
+        return fallbackBody(html);
+    }
+    try {
+        const root = HTMLParser.parse(html, { parseNoneClosedTags: true });
+        const body = root.querySelector('body') || root.querySelector('html') || root;
+        return (body.innerHTML || '').trim();
+    } catch (_err) {
+        return fallbackBody(html);
     }
-    return ((body && body.innerHTML) || '').trim();
 }
 
 function formatAddressHtml(addr) {

package/lib/mime-html.js

@@ -9,6 +9,7 @@ const he = require('he');
 const { Worker } = require('worker_threads');
 const path = require('path');
 const WorkerPool = require('./worker-pool');
+const { MAX_NESTING_DEPTH, exceedsNestingDepth, fallbackText } = require('./html-guard');
 
 const textToHtml = require('./text-to-html');
 
@@ -74,6 +75,10 @@ const FORBID_STYLES = [
 // Matches the style text of any element that could carry one of FORBID_STYLES
 const FORBID_STYLES_HINT = /position|float|clip|zoom|anim|offset|scrollbar|paint|clear|\ball\b/i;
 
+// A forbidden property in declaration position: at the start, or after any character that cannot
+// be part of a longer property name, so "background-position" is not one
+const FORBID_STYLES_DECLARATION = new RegExp('(?:^|[^a-z0-9-])(?:' + FORBID_STYLES.join('|') + ')\\s*:', 'i');
+
 // Resolves CSS escape sequences (\6F, \o) the way a browser does before it matches a property
 // name, so that a forbidden property cannot hide behind an escaped character
 function decodeCssEscapes(value) {
@@ -198,119 +203,49 @@ blockquote blockquote blockquote blockquote{
 // filter below scale with it, and no legitimate email needs more.
 const MAX_STYLE_TEXT = 256 * 1024;
 
-// jsdom builds a tree in time quadratic to its depth (10,000 unclosed <b> tags take about 9 s) and
-// its serializer overflows the stack a few thousand levels down, so deeper input is not parsed at all.
-// Real email nests a few dozen levels.
-const MAX_NESTING_DEPTH = 1000;
-
-// Elements that never stay open in HTML content, either void or closed implicitly by a sibling,
-// so they do not add to the depth an HTML parser ends up with. Inside SVG and MathML they can nest,
-// so there every start tag counts.
-const NON_NESTING_TAGS = new Set(
-    'area,base,br,col,embed,hr,img,input,keygen,link,meta,param,source,track,wbr,p,li,dt,dd,td,th,tr,tbody,thead,tfoot,colgroup,caption,option,optgroup,rt,rp'.split(
-        ','
-    )
-);
-
-// A single linear pass estimating how deep the parsed tree would get. It only ever overestimates
-// (tags inside comments, attribute values and raw text count too), which at worst means an
-// extreme message is shown as plain text.
-function exceedsNestingDepth(html, maxDepth) {
-    const tagName = /[a-z][a-z0-9:-]*/iy;
+// juice matches every selector against every element, so its cost is the product of the two
+// counts: 1,000 rules on 10,000 paragraphs took 2.7 s and 10,000 on 10,000 took 25 s, on the
+// calling thread, and the style text cap alone leaves the body unbounded. Each bound sits well
+// above real mail (an Outlook thread of fifty replies is a few hundred selectors on some fifteen
+// thousand elements, a heavy newsletter a thousand on a few thousand) and the product bound keeps
+// the worst case around a second: 0.25 us per pair measured when every selector matches every
+// element, a quarter of that when none does. Past any of them the sanitized HTML is returned
+// without inlined CSS, and the wrapper says so.
+const MAX_INLINE_SELECTORS = 5000;
+const MAX_INLINE_ELEMENTS = 50000;
+const MAX_INLINE_WORK = 5000000;
+
+// Selectors juice would match against the document: every selector of every rule at the top level
+// of the style text. A rule nested in an at-rule is not inlined (juice keeps media queries as rules),
+// so it only costs its parse and is not counted. One linear pass
+function countSelectors(css) {
+    let count = 0;
     let depth = 0;
-    let foreign = 0;
-    let pos = 0;
-    while (pos < html.length) {
-        const tagStart = html.indexOf('<', pos);
-        if (tagStart < 0) {
-            break;
-        }
-        const tagEnd = html.indexOf('>', tagStart + 1);
-        if (tagEnd < 0) {
-            break;
-        }
-        // resume right after the first ">", so no tag the parser would see is ever skipped
-        pos = tagEnd + 1;
-
-        const closing = html.charAt(tagStart + 1) === '/';
-        tagName.lastIndex = tagStart + (closing ? 2 : 1);
-        const nameMatch = tagName.exec(html);
-        if (!nameMatch) {
-            continue;
-        }
-        const name = nameMatch[0].toLowerCase();
-        const isForeignRoot = name === 'svg' || name === 'math';
-
-        if (closing) {
-            if (isForeignRoot && foreign > 0) {
-                foreign--;
+    let commas = 0;
+    for (let i = 0; i < css.length; i++) {
+        const c = css.charAt(i);
+        if (c === '{') {
+            if (depth === 0) {
+                count += commas + 1;
+                commas = 0;
             }
-            if (depth > 0 && (foreign || !NON_NESTING_TAGS.has(name))) {
+            depth++;
+        } else if (c === '}') {
+            if (depth > 0) {
                 depth--;
             }
-            continue;
-        }
-
-        if (!foreign && NON_NESTING_TAGS.has(name)) {
-            continue;
-        }
-
-        // a self-closing flag is ignored on HTML elements, only SVG and MathML honor it
-        if ((foreign || isForeignRoot) && html.charAt(tagEnd - 1) === '/') {
-            continue;
-        }
-
-        if (isForeignRoot) {
-            foreign++;
-        }
-
-        depth++;
-        if (depth > maxDepth) {
-            return true;
+            commas = 0;
+        } else if (c === ';' && depth === 0) {
+            commas = 0;
+        } else if (c === ',' && depth === 0) {
+            commas++;
         }
     }
-    return false;
+    return count;
 }
 
 // Rendered in place of the sanitized HTML when the pipeline cannot process the input at all, for
 // example when a hostile nesting depth overflows the stack of the parser or the serializer.
-// The text of an HTML body for the fallback rendering. The fallback runs when the HTML could
-// not be processed (hostile nesting, a parser or serializer overflow), so it cannot lean on a
-// real HTML parser either: html-to-text gives up on a body nested past its own limit and
-// returned nothing for exactly the input that lands here. One pass over the string: tags become
-// a space, style and script blocks are dropped whole, entities are decoded once
-function fallbackText(html) {
-    const lower = html.toLowerCase();
-    const parts = [];
-    let pos = 0;
-    while (pos < html.length) {
-        const lt = html.indexOf('<', pos);
-        if (lt < 0) {
-            parts.push(html.slice(pos));
-            break;
-        }
-        parts.push(html.slice(pos, lt));
-        const gt = html.indexOf('>', lt + 1);
-        if (gt < 0) {
-            // an unterminated tag runs to the end of the input
-            break;
-        }
-        const name = /^(style|script)(?:[\s/]|$)/.exec(lower.slice(lt + 1, gt));
-        if (name) {
-            const close = lower.indexOf('</' + name[1], gt + 1);
-            const closeEnd = close < 0 ? -1 : html.indexOf('>', close);
-            if (closeEnd < 0) {
-                break;
-            }
-            pos = closeEnd + 1;
-        } else {
-            pos = gt + 1;
-        }
-        parts.push(' ');
-    }
-    return he.decode(parts.join(''));
-}
-
 function fallbackHtml(message) {
     let text = message.text;
     if (!text && message.html) {
@@ -405,6 +340,7 @@ function prepareHtml(message) {
     // Process remaining style tags to remove known problematic selectors
     let styleBudget = MAX_STYLE_TEXT;
     let hasStyle = false;
+    let selectors = 0;
     root.querySelectorAll('style').forEach(styleTag => {
         let cssContent = styleTag.textContent || '';
         if (cssContent.length > styleBudget) {
@@ -416,14 +352,24 @@ function prepareHtml(message) {
         styleTag.textContent = cssContent;
         if (cssContent.trim()) {
             hasStyle = true;
+            selectors += countSelectors(cssContent);
         }
     });
 
-    return { html: root.outerHTML, hasStyle };
+    let inliningSkipped = false;
+    if (hasStyle) {
+        const elements = root.getElementsByTagName('*').length;
+        if (selectors > MAX_INLINE_SELECTORS || elements > MAX_INLINE_ELEMENTS || selectors * elements > MAX_INLINE_WORK) {
+            hasStyle = false;
+            inliningSkipped = true;
+        }
+    }
+
+    return { html: root.outerHTML, hasStyle, inliningSkipped };
 }
 
 // Second sanitization pass and post-processing of the juice output.
-function finishHtml(html) {
+function finishHtml(html, inliningSkipped) {
     // second pass, outputs a BODY DOM element
     const dom = DOMPurify.sanitize(html, {
         RETURN_DOM: true,
@@ -465,13 +411,28 @@ function finishHtml(html) {
             for (let disallowedStyle of FORBID_STYLES) {
                 node.style.removeProperty(disallowedStyle);
             }
+            // removeProperty() rewrites the attribute from the CSSOM, which only holds the
+            // declarations cssstyle managed to parse. A forbidden property still named in the
+            // attribute after that was never parsed and would go out verbatim for the browser to
+            // read its own way: cssstyle 5 parses nothing from an attribute whose "background:
+            // url()" shorthand is followed by more declarations, a browser reads every one of
+            // them. Keep only what the CSSOM parsed, which may be nothing
+            if (FORBID_STYLES_DECLARATION.test(node.getAttribute('style') || '')) {
+                const parsed = node.style.cssText;
+                if (parsed) {
+                    node.setAttribute('style', parsed);
+                } else {
+                    node.removeAttribute('style');
+                }
+            }
         }
     }
 
     let bodyStyles = (dom.getAttribute('style') || '').toString().trim();
 
-    // embed into a styled container
-    return `<div style="${he.encode(bodyStyles)}">${dom.innerHTML.trim()}</div>`;
+    // embed into a styled container; the attribute tells the caller the CSS inlining caps were hit
+    const marker = inliningSkipped ? ' data-css-inlining="skipped"' : '';
+    return `<div style="${he.encode(bodyStyles)}"${marker}>${dom.innerHTML.trim()}</div>`;
 }
 
 // Runs the pipeline and renders the plain text fallback when it fails, for example when a
@@ -494,7 +455,7 @@ function guarded(fn, message, rethrow) {
 function mimeHtmlSync(message) {
     return guarded(
         () => {
-            let { html, hasStyle } = prepareHtml(message);
+            let { html, hasStyle, inliningSkipped } = prepareHtml(message);
             if (hasStyle) {
                 try {
                     // Run juice synchronously - risky but backwards compatible
@@ -503,7 +464,7 @@ function mimeHtmlSync(message) {
                     // not so important, so we'll ignore if style inlining fails
                 }
             }
-            return finishHtml(html);
+            return finishHtml(html, inliningSkipped);
         },
         message,
         false
@@ -513,7 +474,7 @@ function mimeHtmlSync(message) {
 async function mimeHtmlAsync(message, options = {}) {
     return guarded(
         async () => {
-            let { html, hasStyle } = prepareHtml(message);
+            let { html, hasStyle, inliningSkipped } = prepareHtml(message);
             if (hasStyle) {
                 try {
                     // Use worker thread with timeout for juice - provides protection against ANY
@@ -526,7 +487,7 @@ async function mimeHtmlAsync(message, options = {}) {
                     }
                 }
             }
-            return finishHtml(html);
+            return finishHtml(html, inliningSkipped);
         },
         message,
         options.fallbackOnError === false

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@postalsys/email-text-tools",
-    "version": "2.4.19",
+    "version": "2.4.21",
     "description": "Email text tools",
     "main": "index.js",
     "scripts": {
@@ -34,6 +34,7 @@
         "prettier": "3.9.10"
     },
     "dependencies": {
+        "@postalsys/email-content": "0.1.14",
         "dompurify": "3.4.17",
         "he": "1.2.0",
         "html-to-text": "10.0.1",

package/test/hardening.test.js

@@ -231,6 +231,19 @@ describe('hostile input hardening', () => {
             assert.equal(mimeHtml.getWorkerPoolStats(), null);
         });
 
+        it('mimeHtml depth check is not bypassed by end tags that close nothing', () => {
+            // the check counted every end tag down, so "<b></i>" repeated passed it while the
+            // parser, which ignores the </i>, nested the <b> tags: 10,000 copies took 9.7 s
+            const { result, ms } = timed(() => mimeHtml({ html: '<b></i>'.repeat(10000) + 'deep' }));
+            assert.ok(result.startsWith(FALLBACK_PREFIX));
+            assert.ok(result.includes('deep'));
+            assert.ok(ms < 1500, `took ${ms} ms`);
+            // an end tag still closes what it names, including what was opened inside it
+            const nested = mimeHtml({ html: '<div><span><b>x</div>'.repeat(2000) + 'shallow' });
+            assert.ok(!nested.startsWith(FALLBACK_PREFIX));
+            assert.ok(nested.includes('shallow'));
+        });
+
         it('htmlToText does not overflow the stack on deep nesting', () => {
             for (const tag of ['div', 'b', 'blockquote']) {
                 const html = 'hello &amp; <b>world</b>' + `<${tag}>`.repeat(20000) + 'deep' + `</${tag}>`.repeat(20000) + 'after';
@@ -243,6 +256,104 @@ describe('hostile input hardening', () => {
         });
     });
 
+    describe('CSS inlining caps', () => {
+        const SKIPPED_PREFIX = '<div style="overflow: auto;" data-css-inlining="skipped">';
+
+        function styled(css, body) {
+            return `<html><head><style>${css}</style></head><body>${body}</body></html>`;
+        }
+
+        function rules(count, selector) {
+            let css = '';
+            for (let i = 0; i < count; i++) {
+                css += `${selector || '.c' + i} { color: #${(i % 4096).toString(16).padStart(3, '0')}; }\n`;
+            }
+            return css;
+        }
+
+        it('skips inlining when the selectors times the elements is too much work', () => {
+            // 10,000 rules on 10,000 paragraphs took 25 s in juice, on the calling thread
+            const html = styled(rules(10000, 'p'), '<p>x</p>'.repeat(10000));
+            const { result, ms } = timed(() => mimeHtml({ html }));
+            assert.ok(ms < 3000, `took ${ms} ms`);
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+            assert.ok(result.includes('<p>x</p>'));
+            assert.doesNotMatch(result, /color:/);
+        });
+
+        it('counts every selector of a rule, not every rule', () => {
+            const html = styled(`${'p, '.repeat(9999)}p { color: red; }`, '<p>x</p>'.repeat(10000));
+            const result = mimeHtml({ html });
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+        });
+
+        it('skips inlining past the selector cap or the element cap on their own', () => {
+            const manyRules = mimeHtml({ html: styled(rules(5001), '<p class="c1">x</p>') });
+            assert.ok(manyRules.startsWith(SKIPPED_PREFIX), manyRules.slice(0, 80));
+            const manyElements = mimeHtml({ html: styled('p { color: red; }', '<i></i>'.repeat(50001)) });
+            assert.ok(manyElements.startsWith(SKIPPED_PREFIX), manyElements.slice(0, 80));
+        });
+
+        it('inlines a large but ordinary message', () => {
+            // rules nested in a media query are not matched against elements and do not count
+            const css = `${rules(2000)}p.x { color: blue; }\n@media screen { ${rules(4000)} }`;
+            const result = mimeHtml({ html: styled(css, '<p class="x">y</p>'.repeat(2000)) });
+            assert.ok(result.startsWith('<div style="overflow: auto;"><p'), result.slice(0, 80));
+            assert.match(result, /color: blue/);
+        });
+
+        it('mimeHtml.async skips the same way', async () => {
+            const html = styled(rules(10000, 'p'), '<p>x</p>'.repeat(10000));
+            const result = await mimeHtml.async({ html });
+            assert.ok(result.startsWith(SKIPPED_PREFIX), result.slice(0, 80));
+            assert.ok(result.includes('<p>x</p>'));
+        });
+    });
+
+    describe('inlineHtml parse guard', () => {
+        const FALLBACK_BODY = '<div style="white-space: pre-wrap;">';
+
+        it('does not spend seconds on tags left open in the quoted message', () => {
+            // 16 KB of "<b>x" took node-html-parser 10.6 s to clean up
+            const { result, ms } = timed(() => inlineHtml('reply', '<p>my reply</p>', { html: '<b>x'.repeat(4000) }));
+            assert.ok(ms < 1000, `took ${ms} ms`);
+            assert.ok(result.includes('my reply'));
+            assert.ok(result.includes(FALLBACK_BODY));
+            assert.ok(!result.includes('<b>'));
+            assert.ok(/x x x/.test(result));
+        });
+
+        for (const [label, html] of [
+            ['end tags that close nothing', '<b></i>'.repeat(5000) + 'deep'],
+            ['end tags the parser ignores', '<td><font>x</td>'.repeat(3000)],
+            ['padded end tags', '<a><b><c>y</a></b>'.repeat(3000)],
+            ['rows left open', '<table>' + '<tr><td>cell'.repeat(5000)]
+        ]) {
+            it(`stays fast on ${label}`, () => {
+                const { result, ms } = timed(() => inlineHtml('forward', '<p>fyi</p>', { html }));
+                assert.ok(ms < 1000, `took ${ms} ms`);
+                assert.ok(result.includes('fyi'));
+                assert.ok(result.includes('<blockquote'));
+            });
+        }
+
+        it('guards the new content the same way', () => {
+            const { result, ms } = timed(() => inlineHtml('reply', '<b>x'.repeat(4000), { html: '<p>Original</p>' }));
+            assert.ok(ms < 1000, `took ${ms} ms`);
+            assert.ok(result.includes('<p>Original</p>'));
+            assert.ok(result.includes(FALLBACK_BODY));
+        });
+
+        it('keeps the quoted body of ordinary and sloppy markup', () => {
+            const result = inlineHtml('reply', '<p>r</p>', { html: '<html><body><div><b>bold text<p>para</body></html>' });
+            assert.ok(result.includes('bold text'));
+            assert.ok(result.includes('<b>'));
+            // only the reply template's own body element is left
+            assert.equal((result.match(/<body/g) || []).length, 1);
+            assert.ok(!result.includes(FALLBACK_BODY));
+        });
+    });
+
     describe('sanitizer policy', () => {
         it('removes forms and form controls but keeps their text', () => {
             const html =
@@ -362,3 +473,32 @@ describe('forbidden style properties behind CSS escapes', () => {
         assert.ok(/color:\s*red/i.test(out), out);
     });
 });
+
+describe('forbidden style properties the CSSOM could not parse', () => {
+    it('drops a style attribute cssstyle rejected that names a forbidden property', () => {
+        // cssstyle 5 parses nothing from an attribute whose background shorthand with a url() is
+        // followed by more declarations, so the raw text went out verbatim and a browser, which
+        // parses it fine, honored the position
+        const out = mimeHtml({ html: '<div style="background:url(https://example.com/x.gif) no-repeat; position:fixed; top:0">x</div>' });
+        assert.ok(!/position|fixed|top:/i.test(out), out);
+        assert.ok(out.includes('<div>x</div>'), out);
+    });
+
+    it('keeps the declarations the CSSOM parsed around one it could not', () => {
+        const out = mimeHtml({ html: '<div style="color:red;}position:fixed;top:0">x</div>' });
+        assert.ok(!/position|fixed/i.test(out), out);
+        assert.match(out, /color: red/);
+        assert.match(out, /top: 0/);
+    });
+
+    it('leaves an attribute that names no forbidden property as it was, parsed or not', () => {
+        const out = mimeHtml({ html: '<div style="background:url(clear.gif); color:red">x</div>' });
+        assert.ok(out.includes('style="background:url(clear.gif); color:red"'), out);
+    });
+
+    it('does not take a longer property name for a forbidden one', () => {
+        const out = mimeHtml({ html: '<div style="background-position: center top; text-underline-offset: 2px; color:red">x</div>' });
+        assert.ok(out.includes('background-position: center top'), out);
+        assert.ok(out.includes('text-underline-offset: 2px'), out);
+    });
+});