@rapidmx/web-client 0.29.0 → 0.31.0

package/lib/crypto/messageSecurity.ts

@@ -123,8 +123,11 @@ export interface MessageSecurityResult {
      * recovered and it carried a protected Subject. */
     subject?: string;
     /** Every protected header recovered from inside the signed/decrypted entity - present only when that entity
-     * carries RFC 9788 protected headers (a protected `From`). Absent for a legacy S/MIME sender's signed-only
-     * message: its outer Subject/To/Cc were then never signed, and a UI should not present them as verified. */
+     * carries RFC 9788 protected headers (a protected `From`) AND a signature over them verified (so also for a
+     * `"verified_at_first_open"` result). Absent for a legacy S/MIME sender's signed-only message (its outer
+     * Subject/To/Cc were then never signed, and a UI should not present them as verified), and for an encrypted
+     * message without a verified signature: anyone holding the reader's public certificate can encrypt headers of their
+     * own choosing, so they are never exposed. */
     protectedHeaders?: MessageProtectedHeaders;
     /** The attachments inside the verified/decrypted entity - for a signed-only message the only attachments the
      * signature covers, so a UI showing a verified badge should list these rather than the server's attachment
@@ -189,7 +192,7 @@ function isEncryptedContentType(contentType: { value: string; params: Record<str
 
 const NO_KEY_ERROR = "This device doesn't have the key needed to decrypt this message.";
 const UNSUPPORTED_ENCRYPTION_ERROR =
-    "This message uses an older, unauthenticated encryption algorithm that RapidMX doesn't accept, so it can't be opened safely.";
+    "This message uses an older, unauthenticated encryption algorithm, or an encryption format, that RapidMX doesn't accept, so it can't be opened safely.";
 
 function renderDisplayBody(display: DisplayBody | undefined): Pick<MessageSecurityResult, "html" | "text"> {
     if (display?.html !== undefined) {
@@ -219,7 +222,7 @@ export interface SignerBindingInput {
     /** The certificate matched to the verified SignerInfo; `undefined` fails closed. */
     signerCertificateDer: Uint8Array | undefined;
     /** Headers recovered from inside the signed content (RFC 9788), if any. */
-    protectedHeaders: (Pick<ProtectedHeaders, "from" | "to"> & Partial<Pick<ProtectedHeaders, "cc" | "subject">>) | undefined;
+    protectedHeaders: (Pick<ProtectedHeaders, "from" | "to"> & Partial<Pick<ProtectedHeaders, "cc" | "subject" | "date">>) | undefined;
     /** The received message's outer header map (lowercased names), as `parseMimeEntity()` returns it. */
     outerHeaders: Record<string, string>;
     /** Every outer header field in order (`parseMimeEntity()`'s `fields`) - checked for repeated
@@ -229,7 +232,7 @@ export interface SignerBindingInput {
     protectedFields?: MimeHeaderField[];
     /** One trusted fingerprint or several (any match is accepted). An empty array counts as none supplied. */
     pinnedSignerFingerprint?: string | string[];
-    /** Also require the protected `Subject` (when protected headers are present) to equal the outer one - right for
+    /** Also require the protected `Subject` and `Date` (when protected headers are present) to equal the outer ones - right for
      * a signed-only (`hp="clear"`) message, wrong for an encrypted one whose outer Subject is obscured. */
     compareSubject?: boolean;
 }
@@ -246,6 +249,15 @@ function hasRepeatedAddressField(fields: MimeHeaderField[] | undefined): boolean
     return SINGLETON_ADDRESS_FIELDS.some((name) => (counts.get(name) ?? 0) > 1);
 }
 
+/** Whether the unsigned (outer) `Date:` header value `outer` names the same instant as the signed one, `signed`. A signed date
+ * that is missing or unreadable leaves nothing to compare, but when there is one the outer must match it: a replayed message
+ * that dropped or garbled its outer Date is as changed as one that carries a new one. */
+function sameInstant(signed: string | undefined, outer: string | undefined): boolean {
+    // `String(undefined)` is not a date either.
+    const left = Date.parse(String(signed));
+    return Number.isNaN(left) || left === Date.parse(String(outer));
+}
+
 function normalizePins(pins: string | string[] | undefined): string[] {
     return (Array.isArray(pins) ? pins : pins === undefined ? [] : [pins]).map((pin) => pin.toLowerCase());
 }
@@ -292,7 +304,13 @@ function checkIdentityAndHeaders(input: SignerBindingInput, certDer: Uint8Array)
         if (!sameAddressSet(extractAddresses(protectedHeaders?.cc), extractAddresses(outerHeaders["cc"]))) {
             return "header_mismatch";
         }
-        if (input.compareSubject && normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"])) {
+        // A signed-only message's outer Date is unsigned too: a signed message replayed later carries a new one. (An encrypted
+        // message's outer Date is checked against its HP-Outer copy instead - see `headerTamperDetected`.)
+        if (
+            input.compareSubject &&
+            (normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"]) ||
+                !sameInstant(protectedHeaders?.date, outerHeaders["date"]))
+        ) {
             return "header_mismatch";
         }
     }
@@ -448,14 +466,16 @@ async function evaluateLive(
         if (!parsed.decrypted) {
             return { result: { state: "encrypted", decryptError: parsed.unsupportedContentEncryption ? UNSUPPORTED_ENCRYPTION_ERROR : NO_KEY_ERROR }, kind: "encrypted" };
         }
+        // Anyone holding the reader's public certificate can encrypt a message with any protected headers they like, so they
+        // are only exposed once a signature over them verified - and a key-changed message keeps them aside for a seal.
         const content = {
             ...renderDisplayBody(parsed.displayBody),
             headerTamperDetected: parsed.headerTamperDetected,
             subject: parsed.protectedHeaders?.subject || undefined,
-            ...exposedHeaders(parsed.protectedHeaders),
             attachments: parsed.attachments,
             ...addressing(parsed.protectedHeaders),
         };
+        const signedHeaders = exposedHeaders(parsed.protectedHeaders);
         if (parsed.signatureVerified === undefined) {
             return { result: { state: "encrypted", ...content }, kind: "encrypted" };
         }
@@ -464,9 +484,13 @@ async function evaluateLive(
         }
         const { failure, trusted, signer, acceptedSigner } = await checkSigner(parsed.signerCertificateDer, parsed.protectedHeaders, parsed.protectedHeaderFields, false);
         if (failure) {
-            return { result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) }, kind: "encrypted" };
+            return {
+                result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) },
+                kind: "encrypted",
+                ...(failure === "signer_key_changed" ? { signedContent: signedHeaders } : {}),
+            };
         }
-        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...acceptedSigner }, kind: "encrypted" };
+        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...signedHeaders, ...acceptedSigner }, kind: "encrypted" };
     }
 
     return { result: { state: "unprotected" }, kind: "other" };

package/lib/crypto/passwordUnlock.ts

@@ -33,6 +33,11 @@ export const DEFAULT_ARGON2ID_PARAMS: Argon2idParams = { memorySize: 65536, iter
 
 const ARGON2ID_HASH_LENGTH_BYTES = 32;
 
+/** The most a `MasterKeyWrap.kdf` label read back from the server may ask this device to spend: 1 GiB (in KiB),
+ * 10 passes and 16 lanes - well above every default this system has used, but far from what a hostile or buggy
+ * server could name (`m=4294967295`) to freeze the tab or exhaust WebAssembly memory. */
+export const MAX_ARGON2ID_PARAMS: Argon2idParams = { memorySize: 1048576, iterations: 10, parallelism: 16 };
+
 /** Builds the `kdf` string stored alongside a password-method `MasterKeyWrap`, so parameters can be
  * upgraded over time without breaking existing accounts (each wrap records the parameters it was
  * actually created with). */
@@ -44,7 +49,8 @@ export function argon2idKdfLabel(params: Argon2idParams): string {
  * created with, so unlocking always re-derives with the *original* parameters even if
  * `DEFAULT_ARGON2ID_PARAMS` has since changed (the spec's own "KDF parameters ... MUST be stored
  * alongside each wrap, so costs can be raised over time without breaking existing accounts"). Returns
- * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label — including a
+ * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label, or whose parameters are
+ * zero or beyond `MAX_ARGON2ID_PARAMS` — including a
  * different KDF entirely (e.g. recovery codes' own `"hkdf-sha256"` label), which callers must not
  * attempt to unlock as if it were password-derived.
  */
@@ -53,7 +59,13 @@ export function parseArgon2idKdfLabel(label: string): Argon2idParams | undefined
     if (!match) {
         return undefined;
     }
-    return { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const params = { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const inRange = (value: number, max: number) => value >= 1 && value <= max;
+    return inRange(params.memorySize, MAX_ARGON2ID_PARAMS.memorySize) &&
+        inRange(params.iterations, MAX_ARGON2ID_PARAMS.iterations) &&
+        inRange(params.parallelism, MAX_ARGON2ID_PARAMS.parallelism)
+        ? params
+        : undefined;
 }
 
 /** A fresh random salt for a new password enrollment. 16 bytes is Argon2id's own recommended minimum. */

package/lib/crypto/smime.ts

@@ -41,6 +41,10 @@ const ID_DATA = pkijs.ContentInfo.DATA;
 
 /** AES-GCM content-encryption OIDs (id-aes128-GCM, id-aes192-GCM, id-aes256-GCM - RFC 5084). The only
  * content encryption `decryptEnvelopedData()` accepts: see `UnsupportedContentEncryptionError`. */
+/** The CMS content type of RFC 5083 `AuthEnvelopedData` (`smime-type="authenveloped-data"`): authenticated, but not the
+ * structure `decryptEnvelopedDataWithKeys()` reads - it is reported as unsupported rather than as a missing key. */
+const AUTH_ENVELOPED_DATA_OID = "1.2.840.113549.1.9.16.1.23";
+
 const AEAD_CONTENT_ENCRYPTION_OIDS = new Set(["2.16.840.1.101.3.4.1.6", "2.16.840.1.101.3.4.1.26", "2.16.840.1.101.3.4.1.46"]);
 
 /**
@@ -56,7 +60,7 @@ export class UnsupportedContentEncryptionError extends Error {
     public readonly algorithmOid: string;
 
     constructor(algorithmOid: string) {
-        super(`This message uses unauthenticated content encryption (${algorithmOid}), which is not accepted.`);
+        super(`This message uses content encryption (${algorithmOid}) that is not accepted: only AES-GCM EnvelopedData is.`);
         this.name = "UnsupportedContentEncryptionError";
         this.algorithmOid = algorithmOid;
     }
@@ -178,10 +182,12 @@ export function extractCertificateEmails(certDer: Uint8Array): string[] {
         return [];
     }
     const sanEmails: string[] = [];
+    let hasSan = false;
     for (const extension of cert.extensions ?? []) {
         if (extension.extnID !== "2.5.29.17") {
             continue;
         }
+        hasSan = true;
         // pkijs parses a well-formed SubjectAlternativeName into an AltName automatically, and leaves
         // `parsedValue` unset for a malformed one - a certificate asserting an unreadable SAN names nobody.
         const altNames = (extension.parsedValue as pkijs.AltName | undefined)?.altNames;
@@ -195,7 +201,9 @@ export function extractCertificateEmails(certDer: Uint8Array): string[] {
             }
         }
     }
-    if (sanEmails.length > 0) {
+    // The SAN is authoritative whenever the certificate has one: DNS names alone name no mailbox, so a subject email
+    // address next to them must not stand in for it.
+    if (hasSan) {
         return sanEmails;
     }
     const subjectEmails: string[] = [];
@@ -376,6 +384,9 @@ function recipientMatchesCertificate(recipientInfo: pkijs.RecipientInfo, certifi
  */
 export async function decryptEnvelopedDataWithKeys(envelopedDer: Uint8Array, keys: DecryptionKey[]): Promise<Uint8Array> {
     const contentInfo = pkijs.ContentInfo.fromBER(toArrayBuffer(envelopedDer));
+    if (contentInfo.contentType === AUTH_ENVELOPED_DATA_OID) {
+        throw new UnsupportedContentEncryptionError(AUTH_ENVELOPED_DATA_OID);
+    }
     if (contentInfo.contentType !== pkijs.ContentInfo.ENVELOPED_DATA) {
         throw new Error("This CMS content is not EnvelopedData.");
     }

package/lib/mail/compose/composeQuoting.ts

@@ -15,7 +15,7 @@
  */
 
 import { Message, Recipient } from "../mailApi.js";
-import { sanitizeQuotedHtml } from "../messageBodySanitizer.js";
+import { sanitizeQuotedHtml, sanitizeSignatureHtml } from "../messageBodySanitizer.js";
 
 function escapeHtml(text: string): string {
     return text
@@ -154,7 +154,8 @@ export function buildComposeBodyHtml(signatureHtml?: string, quotedHtml?: string
     }
     const separator = signatureHtml && quotedHtml ? "<p></p>" : "";
     const aboveQuote = quotedHtml ? "<p></p>" : "";
-    return `<p></p>${signatureHtml ?? ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
+    // A signature can be written by someone else (a shared mailbox's delegate): it is sanitized like anything else the editor is given.
+    return `<p></p>${signatureHtml ? sanitizeSignatureHtml(signatureHtml) : ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
 }
 
 /**

package/lib/mail/compose/quotedImages.ts

@@ -13,6 +13,8 @@
 export const MAX_QUOTED_IMAGE_BYTES = 2_000_000;
 /** The most picture data a quote carries, in all (as `data:` URI characters). */
 export const MAX_QUOTED_IMAGES_CHARS = 6_000_000;
+/** How many pictures are fetched at once. */
+const QUOTED_IMAGE_CONCURRENCY = 4;
 
 export interface QuotedImageReference {
     /** The token of a `cid:` reference, absent for an image with no source. */
@@ -22,24 +24,52 @@ export interface QuotedImageReference {
 
 /**
  * `html` with each of its embedded images (`cid:`, or no source at all) replaced by the `data:` URI `resolve` gives for it. An image
- * `resolve` has no picture for is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and remote
- * ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ * `resolve` has no picture for (or fails on) is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and
+ * remote ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ *
+ * The images are resolved a few at a time. When `signal` aborts (the caller's deadline) the wait ends there: the pictures that have arrived
+ * are embedded, the rest left as they were, and `resolve` - which is given `signal` to cancel its own request with - is asked for no more.
  */
-export async function embedQuotedImages(html: string, resolve: (reference: QuotedImageReference) => Promise<string | undefined>): Promise<string> {
+export async function embedQuotedImages(
+    html: string,
+    resolve: (reference: QuotedImageReference, signal?: AbortSignal) => Promise<string | undefined>,
+    signal?: AbortSignal,
+): Promise<string> {
     if (typeof DOMParser === "undefined" || !/<img\b/i.test(html)) {
         return html;
     }
     const doc = new DOMParser().parseFromString(html, "text/html");
-    let budget = MAX_QUOTED_IMAGES_CHARS;
-    let changed = false;
+    const targets: { image: Element; reference: QuotedImageReference; uri?: string }[] = [];
     for (const image of Array.from(doc.querySelectorAll("img"))) {
         const src = (image.getAttribute("src") ?? "").trim();
         const cid = /^cid:/i.test(src);
-        if (!cid && src !== "") {
-            continue;
+        if (cid || src === "") {
+            targets.push({ image, reference: { ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined } });
+        }
+    }
+    let next = 0;
+    const worker = async () => {
+        while (next < targets.length && !signal?.aborted) {
+            const target = targets[next++];
+            target.uri = await resolve(target.reference, signal).catch(() => undefined);
         }
-        const uri = await resolve({ ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined });
-        if (uri !== undefined && uri.length <= budget) {
+    };
+    let onAbort!: () => void;
+    const deadline = new Promise<void>((done) => {
+        onAbort = done;
+        if (signal?.aborted) {
+            done();
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    await Promise.race([Promise.all(Array.from({ length: Math.min(QUOTED_IMAGE_CONCURRENCY, targets.length) }, worker)), deadline]);
+    signal?.removeEventListener("abort", onAbort);
+    // Whatever has arrived by now is embedded, in document order, for as long as the budget lasts.
+    let budget = MAX_QUOTED_IMAGES_CHARS;
+    let changed = false;
+    for (const { image, uri } of targets) {
+        // Only a picture of the original's own is ever put in: whatever a resolver answers, a `src` that is not a `data:` image never gets in.
+        if (uri !== undefined && /^data:image\//i.test(uri) && uri.length <= budget) {
             budget -= uri.length;
             image.setAttribute("src", uri);
             changed = true;

package/lib/mail/labelsApi.ts

@@ -11,7 +11,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 
 export type { ListParams };
 
@@ -31,7 +31,7 @@ export interface Label {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listLabels(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<Label[]> {
-    return withClient(client, `/mail/labels?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/labels?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getLabel(uid: string, client?: ApiClient): Promise<Label> {

package/lib/mail/mailApi.ts

@@ -13,12 +13,23 @@
  * `@rapidmx/restapi` and this repo's `.claude/NOTES.md`.
  */
 
-import { ApiClient, ApiRequestError, apiFetch, apiUrl, authApiFetch, withClient, withCsrfHeader } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import {
+    ApiClient,
+    ApiRequestError,
+    apiFetch,
+    apiUrl,
+    authApiFetch,
+    withClient,
+    withClientBlob,
+    withClientRaw,
+    withCsrfHeader,
+} from "../util/api.js";
+import { ListParams, buildQuery, sortQuery } from "../util/apiQuery.js";
 import { deviceTimeZone } from "../util/timeZone.js";
 import type { EncryptionPreference, PublicKey } from "../crypto/keyvaultApi.js";
 import { bytesToBinaryString } from "../crypto/mime.js";
-import { newContentId, parseDataImage } from "./inlineImages.js";
+import { EMBEDDED_IMAGE_TYPES, newContentId, parseDataImage } from "./inlineImages.js";
+import { MAX_QUOTED_IMAGE_BYTES } from "./compose/quotedImages.js";
 import type { ResolvedPrincipal } from "./mailboxAccessApi.js";
 
 export type { ListParams };
@@ -156,7 +167,7 @@ export function safeSendersOf(mailbox: Pick<Mailbox, "safeSenders">): string[] {
 /** Lists the mailboxes the caller owns or has been granted - the same for everyone, an administrator included. With
  * `scope: "admin"` (admin console only) it lists every mailbox as administrative metadata instead. */
 export function listMailboxes(params: ListParams & AdminScopeParams = {}, client?: ApiClient): Promise<Mailbox[]> {
-    return withClient(client, `/mail/mailboxes?${buildQuery(params, scopeQuery(params))}`);
+    return withClient(client, `/mail/mailboxes?${buildQuery(params, { ...scopeQuery(params), ...(params.scope === "admin" ? sortQuery({ uid: "ASC" }) : {}) })}`);
 }
 
 /** One mailbox the caller owns or has been granted; with `scope: "admin"` (admin console only), its administrative metadata. */
@@ -320,7 +331,7 @@ export function listQuarantine(
     params: ListParams & AdminScopeParams = {},
     client?: ApiClient,
 ): Promise<QuarantineEntry[]> {
-    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/quarantine?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 
 /**
@@ -368,7 +379,7 @@ export function listIngestQueue(
     params: ListParams & AdminScopeParams = {},
     client?: ApiClient,
 ): Promise<IngestQueueEntry[]> {
-    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params) })}`);
+    return withClient(client, `/mail/ingest-queue?${buildQuery(params, { mailboxUid, ...scopeQuery(params), ...sortQuery({ dateCreated: "DESC", uid: "ASC" }) })}`);
 }
 
 export interface AclRecord {
@@ -1029,9 +1040,14 @@ export function attachmentContentUrl(uid: string): string {
 /**
  * Uploads a file's raw bytes as a new attachment on a not-yet-sent draft. Bypasses `apiFetch` — that helper
  * always forces `Content-Type: application/json`, which would corrupt binary content; this sends the file's
- * own bytes/type directly instead, matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
+ * own bytes/type directly instead (through `client` when one is given), matching `BaseAttachmentRoute.upload`'s expectation of a raw request body.
  */
-export async function uploadAttachment(messageUid: string, file: File, options: { inline?: boolean; contentId?: string } = {}): Promise<Attachment> {
+export function uploadAttachment(
+    messageUid: string,
+    file: File,
+    options: { inline?: boolean; contentId?: string } = {},
+    client?: ApiClient,
+): Promise<Attachment> {
     // Percent-encoded, not form-encoded (`URLSearchParams` writes a space as `+`, which the server reads as a plus sign: "My+photo.png").
     const query: Record<string, string> = { messageUid, filename: file.name, mimeType: file.type || "application/octet-stream" };
     if (options.inline) {
@@ -1043,19 +1059,7 @@ export async function uploadAttachment(messageUid: string, file: File, options:
     const params = Object.entries(query)
         .map(([key, value]) => `${key}=${encodeURIComponent(value)}`)
         .join("&");
-    const res = await fetch(apiUrl(`/mail/attachments/upload?${params}`), {
-        method: "POST",
-        credentials: "include",
-        headers: withCsrfHeader({ "Content-Type": file.type || "application/octet-stream" }),
-        body: file,
-    });
-    const contentType = res.headers.get("content-type") ?? "";
-    const responseBody = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-    if (!res.ok) {
-        const message = (responseBody && (responseBody.message || responseBody.error)) || res.statusText || "Upload failed.";
-        throw new ApiRequestError(message, res.status, responseBody?.code);
-    }
-    return responseBody as Attachment;
+    return withClientRaw(client, `/mail/attachments/upload?${params}`, "POST", file, file.type || "application/octet-stream");
 }
 
 export interface ComposeRecipientInput {
@@ -1149,15 +1153,58 @@ export function emptyFolder(folderUid: string, client?: ApiClient): Promise<void
  * itself does no MIME composition). Does not send the message.
  */
 export async function assembleDraft(messageUid: string, input: AssembleDraftInput, client?: ApiClient): Promise<Message> {
-    const html = await attachDataImages(messageUid, input.html);
+    const html = await attachDataImages(messageUid, input.html, client);
     return withClient(client, `/mail/compose/${encodeURIComponent(messageUid)}/assemble`, {
         method: "POST",
         body: JSON.stringify({ ...input, html }),
     });
 }
 
-/** `data:` images already attached to a draft: its uid and the image, to the URL of the attachment it became. */
+/** `data:` images already attached to a draft: its uid and a fingerprint of the image, to the URL of the attachment it became. */
 const attachedDataImages = new Map<string, string>();
+/** The most pictures remembered; the oldest go first (a draft that was never sent or discarded here would otherwise keep its pictures forever). */
+const MAX_ATTACHED_DATA_IMAGES = 256;
+
+/** The SHA-256 of the whole of `text`, in hex - what stands for a `data:` URI of up to megabytes without holding it, and which no two quoted pictures can be made to share. Where Web Crypto is not available the text itself stands for it. */
+async function fingerprint(text: string): Promise<string> {
+    if (!globalThis.crypto?.subtle) {
+        return text;
+    }
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+/** The most pictures attached to one draft from its text; a quote cannot make a person's reply upload (and be charged for) any number of them. */
+const MAX_DATA_IMAGES_PER_DRAFT = 20;
+
+/** Whether `bytes` start the way a picture of `contentType` does - the type a quote declares is its own word, and the bytes are what the server stores and shows. */
+function hasImageSignature(contentType: string, bytes: Uint8Array): boolean {
+    const at = (offset: number, text: string) => Array.from(text).every((char, i) => bytes[offset + i] === char.charCodeAt(0));
+    switch (contentType.split("/")[1]) {
+        case "png":
+            return at(0, "\x89PNG");
+        case "jpg":
+        case "jpeg":
+            return at(0, "\xff\xd8\xff");
+        case "gif":
+            return at(0, "GIF8");
+        case "webp":
+            return at(0, "RIFF") && at(8, "WEBP");
+        case "avif":
+            return at(4, "ftypavi");
+        default:
+            return at(0, "BM");
+    }
+}
+
+/** Forgets the pictures attached to draft `messageUid`, for when it has been sent or deleted (they are only remembered to avoid attaching one twice). */
+export function forgetDraftImages(messageUid: string): void {
+    for (const key of Array.from(attachedDataImages.keys())) {
+        if (key.startsWith(`${messageUid}\n`)) {
+            attachedDataImages.delete(key);
+        }
+    }
+}
 
 const DATA_IMAGE_TAG = /(<img\b[^>]*?\bsrc\s*=\s*)(["'])(data:image\/[^"']*)\2/gi;
 
@@ -1169,28 +1216,39 @@ function pictureName(contentType: string): string {
 /**
  * `html` with each `<img>` that embeds its picture as a `data:` URI (a quoted original's image, one pasted into the editor) pointed at an
  * attachment of the draft instead: the server drops `data:` images from the message it composes, and an attachment is what it makes an
- * inline part of. A picture is attached once per draft however often the draft is saved.
+ * inline part of. A picture is attached once per draft however often the draft is saved. Only what a quote itself embeds is attached - a raster
+ * image (`EMBEDDED_IMAGE_TYPES`, never SVG) of at most `MAX_QUOTED_IMAGE_BYTES` whose bytes are of the type it declares, and no more than
+ * `MAX_DATA_IMAGES_PER_DRAFT` of them; any other is left as it is, and the server drops it.
  */
-async function attachDataImages(messageUid: string, html: string): Promise<string> {
+async function attachDataImages(messageUid: string, html: string, client?: ApiClient): Promise<string> {
     const found = Array.from(html.matchAll(DATA_IMAGE_TAG));
     if (found.length === 0) {
         return html;
     }
     const urls = new Map<string, string>();
     for (const [, , , uri] of found) {
-        const key = `${messageUid}\n${uri}`;
+        if (urls.has(uri)) {
+            continue;
+        }
+        if (urls.size >= MAX_DATA_IMAGES_PER_DRAFT) {
+            break;
+        }
+        const key = `${messageUid}\n${await fingerprint(uri)}`;
         const known = attachedDataImages.get(key);
         if (known) {
             urls.set(uri, known);
             continue;
         }
         const image = parseDataImage(uri);
-        if (!image) {
+        if (!image || !EMBEDDED_IMAGE_TYPES.test(image.contentType) || image.bytes.length > MAX_QUOTED_IMAGE_BYTES || !hasImageSignature(image.contentType, image.bytes)) {
             continue;
         }
-        const attachment = await uploadAttachment(messageUid, new File([image.bytes as BlobPart], pictureName(image.contentType), { type: image.contentType }), { inline: true });
+        const attachment = await uploadAttachment(messageUid, new File([image.bytes as BlobPart], pictureName(image.contentType), { type: image.contentType }), { inline: true }, client);
         const url = attachmentContentUrl(attachment.uid);
         attachedDataImages.set(key, url);
+        if (attachedDataImages.size > MAX_ATTACHED_DATA_IMAGES) {
+            attachedDataImages.delete(attachedDataImages.keys().next().value!);
+        }
         urls.set(uri, url);
     }
     return html.replace(DATA_IMAGE_TAG, (match, start: string, quote: string, uri: string) => (urls.has(uri) ? `${start}${quote}${urls.get(uri)}${quote}` : match));
@@ -1283,8 +1341,9 @@ export async function queueMessageSend(messageUid: string, client?: ApiClient):
 
 /**
  * Fetches a message's raw RFC 5322 MIME source — for client-side E2E decrypt/signature-verification
- * only (`crypto/smimeMessage.ts`), never for display. Bypasses `apiFetch()` (which only ever decodes a
- * JSON response body): this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
+ * only (`crypto/smimeMessage.ts`), never for display. Goes through `withClientBlob()` rather than `apiFetch()` (which
+ * only ever decodes a JSON response body, and renews an expired session) - the same session renewal and, given a
+ * `client`, the same account and token as every other call: this server-local route (`BaseMessageRawContentRoute.ts` in `server`, mounted
  * alongside `@rapidmx/restapi`'s own `MessageRoute`) returns `message/rfc822`, not JSON — the one thing
  * that library's own `GET /:id/content` deliberately never serves (see that route's own doc comment).
  *
@@ -1294,17 +1353,15 @@ export async function queueMessageSend(messageUid: string, client?: ApiClient):
  * straight to `evaluateMessageSecurity()` (see `crypto/mime.ts`'s doc comment on binary strings); it is
  * not display text.
  */
-export async function getMessageRawContent(messageUid: string): Promise<string> {
-    const res = await fetch(apiUrl(`/mail/messages/${encodeURIComponent(messageUid)}/raw`), { credentials: "include" });
-    if (!res.ok) {
-        const contentType = res.headers.get("content-type") ?? "";
-        const body = contentType.includes("application/json") ? await res.json().catch(() => undefined) : undefined;
-        const message = (body && (body.message || body.error)) || res.statusText || "Could not load this message's raw content.";
-        throw new ApiRequestError(message, res.status, body?.code);
-    }
+export async function getMessageRawContent(messageUid: string, client?: ApiClient): Promise<string> {
+    const raw = await withClientBlob(
+        client,
+        `/mail/messages/${encodeURIComponent(messageUid)}/raw`,
+        "Could not load this message's raw content.",
+    );
     // Not `new TextDecoder("latin1")`: WHATWG maps that label to windows-1252, which remaps 0x80-0x9F and so
     // isn't byte-preserving. `bytesToBinaryString()` is an exact byte -> code unit conversion.
-    return bytesToBinaryString(new Uint8Array(await res.arrayBuffer()));
+    return bytesToBinaryString(new Uint8Array(await raw.arrayBuffer()));
 }
 
 export interface ImpersonationResult {

package/lib/mail/mailDetailHooks.ts

@@ -14,9 +14,14 @@ export function useMessageAttachments(message: Message | null): Attachment[] {
             setAttachments([]);
             return;
         }
+        // A response for a message since replaced must not overwrite the one now shown.
+        let cancelled = false;
         listAttachments(message.folderUid, message.uid)
-            .then(setAttachments)
-            .catch(() => setAttachments([]));
+            .then((listed) => !cancelled && setAttachments(listed))
+            .catch(() => !cancelled && setAttachments([]));
+        return () => {
+            cancelled = true;
+        };
         // Only the fields the fetch actually depends on — not the whole `message` object, which gets a new
         // reference on every metadata-only patch (e.g. `useMarkMessageRead`'s `onUpdated(updated)`, or a
         // star/flag/label change wired to the same state) and would otherwise trigger a needless re-fetch.
@@ -53,5 +58,8 @@ export function useMarkMessageRead(message: Message | null, onUpdated: (updated:
         return () => {
             cancelled = true;
         };
-    }, [message]);
+        // Only the message's identity and read flag: a metadata-only patch swaps the object while the request is in flight, and
+        // restarting then would drop the first answer and send a second request with the old version (a 409 that leaves the
+        // message unread).
+    }, [message?.uid, message?.flags.read]);
 }

package/lib/mail/mailFilterRulesApi.ts

@@ -12,7 +12,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 import { MessageImportance } from "./mailApi.js";
 
 export type { ListParams };
@@ -62,7 +62,7 @@ export interface MailFilterRule {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailFilterRules(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<MailFilterRule[]> {
-    return withClient(client, `/mail/mail-filter-rules?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-filter-rules?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getMailFilterRule(uid: string, client?: ApiClient): Promise<MailFilterRule> {

package/lib/mail/mailSignaturesApi.ts

@@ -11,7 +11,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 
 export type { ListParams };
 
@@ -36,7 +36,7 @@ export interface MailSignature {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listMailSignatures(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<MailSignature[]> {
-    return withClient(client, `/mail/mail-signatures?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/mail-signatures?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getMailSignature(uid: string, client?: ApiClient): Promise<MailSignature> {