@rapidmx/web-client 0.30.0 → 0.32.0

package/lib/contacts/vcard.ts

@@ -104,6 +104,48 @@ function valueSeparatorIndex(line: string): number {
     return -1;
 }
 
+/** How much of a file's text `parseVCards()` reads, and how many records it takes from it (the rest is ignored). */
+export const VCARD_MAX_CHARS = 5_000_000;
+export const VCARD_MAX_CONTACTS = 2_000;
+
+/** Decodes a quoted-printable value: each `=XX` is one byte, and the bytes are text in `charset` (UTF-8 when none is named or the name is unknown). */
+function decodeQuotedPrintable(value: string, charset: string | undefined): string {
+    const encoder = new TextEncoder();
+    const bytes: number[] = [];
+    for (const [, hex, literal] of value.matchAll(/=([0-9a-f]{2})|([\s\S])/giu)) {
+        if (hex) {
+            bytes.push(parseInt(hex, 16));
+        } else {
+            bytes.push(...encoder.encode(literal));
+        }
+    }
+    try {
+        return new TextDecoder(charset || "utf-8").decode(new Uint8Array(bytes));
+    } catch {
+        return new TextDecoder().decode(new Uint8Array(bytes));
+    }
+}
+
+/** `lines` with each quoted-printable line that ends in `=` (a soft line break) joined to the line that carries on from it. */
+function joinQuotedPrintableLines(lines: string[]): string[] {
+    const joined: string[] = [];
+    for (let i = 0; i < lines.length; i++) {
+        let line = lines[i];
+        if (/^[^:]*QUOTED-PRINTABLE/i.test(line)) {
+            // Collected and joined once: appending to a growing string a line at a time is quadratic in a value of many soft breaks.
+            const parts: string[] = [];
+            while (line.endsWith("=") && i + 1 < lines.length) {
+                parts.push(line.slice(0, -1));
+                line = lines[++i];
+            }
+            parts.push(line);
+            line = parts.join("");
+        }
+        joined.push(line);
+    }
+    return joined;
+}
+
 /**
  * Maps a property's type parameters onto `ContactAddressKind`: every `TYPE=` value (vCard 3/4, including
  * comma lists and quoted lists like `TYPE="work,voice"`) plus vCard 2.1's bare parameters (`EMAIL;WORK:`)
@@ -134,13 +176,15 @@ function normalizeType(params: string[]): ContactAddressKind {
  * `normalizeType()`); structured values are split on unescaped `;` only.
  */
 export function parseVCards(text: string): ParsedVCardContact[] {
+    // A file is read only so far: nothing legitimate is this large, and a huge one would be minutes of parsing and thousands of records.
+    const source = text.length > VCARD_MAX_CHARS ? text.slice(0, VCARD_MAX_CHARS) : text;
     // Unfold first, then split only on a line that is exactly BEGIN:VCARD - a NOTE (or a folded line) that
     // merely contains the text "BEGIN:VCARD" must not start a bogus record.
-    const unfolded = text.replace(/(?:\r\n|\r|\n)[ \t]/g, "");
-    const cards = unfolded.split(/^[ \t]*BEGIN:VCARD[ \t]*$/im).slice(1);
+    const unfolded = source.replace(/(?:\r\n|\r|\n)[ \t]/g, "");
+    const cards = unfolded.split(/^[ \t]*BEGIN:VCARD[ \t]*$/im).slice(1, VCARD_MAX_CONTACTS + 1);
     return cards.map((card) => {
         const contact: ParsedVCardContact = { displayName: "", emails: [], phones: [], addresses: [] };
-        const lines = card.split(/\r\n|\r|\n/);
+        const lines = joinQuotedPrintableLines(card.split(/\r\n|\r|\n/));
         for (const rawLine of lines) {
             const line = rawLine.trim();
             const colonIndex = valueSeparatorIndex(line);
@@ -148,9 +192,13 @@ export function parseVCards(text: string): ParsedVCardContact[] {
                 continue;
             }
             const key = line.slice(0, colonIndex);
-            const rawValue = line.slice(colonIndex + 1);
-            const value = unescapeVCardValue(rawValue);
             const [groupedName, ...params] = key.split(";");
+            // vCard 2.1 may encode a value as quoted-printable (`ENCODING=QUOTED-PRINTABLE`, or the bare parameter), in a named charset;
+            // such a value has no backslash escapes.
+            const quotedPrintable = params.some((param) => /^(?:ENCODING=)?QUOTED-PRINTABLE$/i.test(param.trim()));
+            const charset = params.find((param) => /^CHARSET=/i.test(param.trim()))?.trim().slice("CHARSET=".length).replace(/"/g, "");
+            const rawValue = quotedPrintable ? decodeQuotedPrintable(line.slice(colonIndex + 1), charset) : line.slice(colonIndex + 1);
+            const value = quotedPrintable ? rawValue : unescapeVCardValue(rawValue);
             const name = groupedName.slice(groupedName.lastIndexOf(".") + 1).toUpperCase();
             const type = normalizeType(params);
 
@@ -172,10 +220,15 @@ export function parseVCards(text: string): ParsedVCardContact[] {
                     contact.jobTitle = value;
                     break;
                 case "EMAIL":
-                    contact.emails!.push({ address: value, type });
+                    // An empty one would make the server refuse the whole contact.
+                    if (value.trim()) {
+                        contact.emails!.push({ address: value.trim(), type });
+                    }
                     break;
                 case "TEL":
-                    contact.phones!.push({ phoneNumber: value, type });
+                    if (value.trim()) {
+                        contact.phones!.push({ phoneNumber: value, type });
+                    }
                     break;
                 case "ADR": {
                     const [, , street, city, state, postalCode, country] = splitStructuredValue(rawValue);

package/lib/crypto/escrowKeys.ts

@@ -15,7 +15,7 @@
 import "reflect-metadata";
 import * as x509 from "@peculiar/x509";
 import type { EscrowScopePublicKey } from "../admin/escrowScopesApi.js";
-import { toBase64 } from "./encoding.js";
+import { fromBase64, toBase64 } from "./encoding.js";
 import { computeCertFingerprint } from "./smime.js";
 
 x509.cryptoProvider.set(crypto);
@@ -31,6 +31,26 @@ export interface GeneratedEscrowKeys {
     publicKey: EscrowScopePublicKey;
 }
 
+/**
+ * The SHA-256 fingerprint (lower-case hex, as `computeCertFingerprint()` gives it) of the certificate that `publicKey` - an escrow scope's pasted public key,
+ * the base64 of its DER - holds, or `null` when it is not a certificate. The holders compare a scope's fingerprint out of band, so one typed beside a
+ * different key makes that check worthless: this is what it has to be.
+ */
+export async function escrowPublicKeyFingerprint(publicKey: string): Promise<string | null> {
+    try {
+        const der = fromBase64(publicKey.trim());
+        void new x509.X509Certificate(new Uint8Array(der));
+        return await computeCertFingerprint(der);
+    } catch {
+        return null;
+    }
+}
+
+/** A fingerprint as `escrowPublicKeyFingerprint()` writes it: lower-case hex only, whatever separators (`AB:CD`, spaces) it was typed with. */
+export function normalizeFingerprint(fingerprint: string): string {
+    return fingerprint.replace(/[^0-9a-f]/gi, "").toLowerCase();
+}
+
 function toPem(label: string, der: Uint8Array): string {
     const lines = toBase64(der).match(/.{1,64}/g) ?? [];
     return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----\n`;

package/lib/crypto/messageSecurity.ts

@@ -123,8 +123,11 @@ export interface MessageSecurityResult {
      * recovered and it carried a protected Subject. */
     subject?: string;
     /** Every protected header recovered from inside the signed/decrypted entity - present only when that entity
-     * carries RFC 9788 protected headers (a protected `From`). Absent for a legacy S/MIME sender's signed-only
-     * message: its outer Subject/To/Cc were then never signed, and a UI should not present them as verified. */
+     * carries RFC 9788 protected headers (a protected `From`) AND a signature over them verified (so also for a
+     * `"verified_at_first_open"` result). Absent for a legacy S/MIME sender's signed-only message (its outer
+     * Subject/To/Cc were then never signed, and a UI should not present them as verified), and for an encrypted
+     * message without a verified signature: anyone holding the reader's public certificate can encrypt headers of their
+     * own choosing, so they are never exposed. */
     protectedHeaders?: MessageProtectedHeaders;
     /** The attachments inside the verified/decrypted entity - for a signed-only message the only attachments the
      * signature covers, so a UI showing a verified badge should list these rather than the server's attachment
@@ -189,7 +192,7 @@ function isEncryptedContentType(contentType: { value: string; params: Record<str
 
 const NO_KEY_ERROR = "This device doesn't have the key needed to decrypt this message.";
 const UNSUPPORTED_ENCRYPTION_ERROR =
-    "This message uses an older, unauthenticated encryption algorithm that RapidMX doesn't accept, so it can't be opened safely.";
+    "This message uses an older, unauthenticated encryption algorithm, or an encryption format, that RapidMX doesn't accept, so it can't be opened safely.";
 
 function renderDisplayBody(display: DisplayBody | undefined): Pick<MessageSecurityResult, "html" | "text"> {
     if (display?.html !== undefined) {
@@ -219,7 +222,7 @@ export interface SignerBindingInput {
     /** The certificate matched to the verified SignerInfo; `undefined` fails closed. */
     signerCertificateDer: Uint8Array | undefined;
     /** Headers recovered from inside the signed content (RFC 9788), if any. */
-    protectedHeaders: (Pick<ProtectedHeaders, "from" | "to"> & Partial<Pick<ProtectedHeaders, "cc" | "subject">>) | undefined;
+    protectedHeaders: (Pick<ProtectedHeaders, "from" | "to"> & Partial<Pick<ProtectedHeaders, "cc" | "subject" | "date">>) | undefined;
     /** The received message's outer header map (lowercased names), as `parseMimeEntity()` returns it. */
     outerHeaders: Record<string, string>;
     /** Every outer header field in order (`parseMimeEntity()`'s `fields`) - checked for repeated
@@ -229,7 +232,7 @@ export interface SignerBindingInput {
     protectedFields?: MimeHeaderField[];
     /** One trusted fingerprint or several (any match is accepted). An empty array counts as none supplied. */
     pinnedSignerFingerprint?: string | string[];
-    /** Also require the protected `Subject` (when protected headers are present) to equal the outer one - right for
+    /** Also require the protected `Subject` and `Date` (when protected headers are present) to equal the outer ones - right for
      * a signed-only (`hp="clear"`) message, wrong for an encrypted one whose outer Subject is obscured. */
     compareSubject?: boolean;
 }
@@ -246,6 +249,15 @@ function hasRepeatedAddressField(fields: MimeHeaderField[] | undefined): boolean
     return SINGLETON_ADDRESS_FIELDS.some((name) => (counts.get(name) ?? 0) > 1);
 }
 
+/** Whether the unsigned (outer) `Date:` header value `outer` names the same instant as the signed one, `signed`. A signed date
+ * that is missing or unreadable leaves nothing to compare, but when there is one the outer must match it: a replayed message
+ * that dropped or garbled its outer Date is as changed as one that carries a new one. */
+function sameInstant(signed: string | undefined, outer: string | undefined): boolean {
+    // `String(undefined)` is not a date either.
+    const left = Date.parse(String(signed));
+    return Number.isNaN(left) || left === Date.parse(String(outer));
+}
+
 function normalizePins(pins: string | string[] | undefined): string[] {
     return (Array.isArray(pins) ? pins : pins === undefined ? [] : [pins]).map((pin) => pin.toLowerCase());
 }
@@ -292,7 +304,13 @@ function checkIdentityAndHeaders(input: SignerBindingInput, certDer: Uint8Array)
         if (!sameAddressSet(extractAddresses(protectedHeaders?.cc), extractAddresses(outerHeaders["cc"]))) {
             return "header_mismatch";
         }
-        if (input.compareSubject && normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"])) {
+        // A signed-only message's outer Date is unsigned too: a signed message replayed later carries a new one. (An encrypted
+        // message's outer Date is checked against its HP-Outer copy instead - see `headerTamperDetected`.)
+        if (
+            input.compareSubject &&
+            (normalizeSubject(protectedHeaders?.subject) !== normalizeSubject(outerHeaders["subject"]) ||
+                !sameInstant(protectedHeaders?.date, outerHeaders["date"]))
+        ) {
             return "header_mismatch";
         }
     }
@@ -448,14 +466,16 @@ async function evaluateLive(
         if (!parsed.decrypted) {
             return { result: { state: "encrypted", decryptError: parsed.unsupportedContentEncryption ? UNSUPPORTED_ENCRYPTION_ERROR : NO_KEY_ERROR }, kind: "encrypted" };
         }
+        // Anyone holding the reader's public certificate can encrypt a message with any protected headers they like, so they
+        // are only exposed once a signature over them verified - and a key-changed message keeps them aside for a seal.
         const content = {
             ...renderDisplayBody(parsed.displayBody),
             headerTamperDetected: parsed.headerTamperDetected,
             subject: parsed.protectedHeaders?.subject || undefined,
-            ...exposedHeaders(parsed.protectedHeaders),
             attachments: parsed.attachments,
             ...addressing(parsed.protectedHeaders),
         };
+        const signedHeaders = exposedHeaders(parsed.protectedHeaders);
         if (parsed.signatureVerified === undefined) {
             return { result: { state: "encrypted", ...content }, kind: "encrypted" };
         }
@@ -464,9 +484,13 @@ async function evaluateLive(
         }
         const { failure, trusted, signer, acceptedSigner } = await checkSigner(parsed.signerCertificateDer, parsed.protectedHeaders, parsed.protectedHeaderFields, false);
         if (failure) {
-            return { result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) }, kind: "encrypted" };
+            return {
+                result: { state: "signature_failed", signatureFailureReason: failure, ...content, ...(failure === "signer_key_changed" ? acceptedSigner : signer) },
+                kind: "encrypted",
+                ...(failure === "signer_key_changed" ? { signedContent: signedHeaders } : {}),
+            };
         }
-        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...acceptedSigner }, kind: "encrypted" };
+        return { result: { state: trusted ? "encrypted_verified" : "encrypted_unverified_signer", ...content, ...signedHeaders, ...acceptedSigner }, kind: "encrypted" };
     }
 
     return { result: { state: "unprotected" }, kind: "other" };

package/lib/crypto/passwordUnlock.ts

@@ -33,6 +33,11 @@ export const DEFAULT_ARGON2ID_PARAMS: Argon2idParams = { memorySize: 65536, iter
 
 const ARGON2ID_HASH_LENGTH_BYTES = 32;
 
+/** The most a `MasterKeyWrap.kdf` label read back from the server may ask this device to spend: 1 GiB (in KiB),
+ * 10 passes and 16 lanes - well above every default this system has used, but far from what a hostile or buggy
+ * server could name (`m=4294967295`) to freeze the tab or exhaust WebAssembly memory. */
+export const MAX_ARGON2ID_PARAMS: Argon2idParams = { memorySize: 1048576, iterations: 10, parallelism: 16 };
+
 /** Builds the `kdf` string stored alongside a password-method `MasterKeyWrap`, so parameters can be
  * upgraded over time without breaking existing accounts (each wrap records the parameters it was
  * actually created with). */
@@ -44,7 +49,8 @@ export function argon2idKdfLabel(params: Argon2idParams): string {
  * created with, so unlocking always re-derives with the *original* parameters even if
  * `DEFAULT_ARGON2ID_PARAMS` has since changed (the spec's own "KDF parameters ... MUST be stored
  * alongside each wrap, so costs can be raised over time without breaking existing accounts"). Returns
- * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label — including a
+ * `undefined` for anything that isn't a well-formed `argon2id:m=...,t=...,p=...` label, or whose parameters are
+ * zero or beyond `MAX_ARGON2ID_PARAMS` — including a
  * different KDF entirely (e.g. recovery codes' own `"hkdf-sha256"` label), which callers must not
  * attempt to unlock as if it were password-derived.
  */
@@ -53,7 +59,13 @@ export function parseArgon2idKdfLabel(label: string): Argon2idParams | undefined
     if (!match) {
         return undefined;
     }
-    return { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const params = { memorySize: Number(match[1]), iterations: Number(match[2]), parallelism: Number(match[3]) };
+    const inRange = (value: number, max: number) => value >= 1 && value <= max;
+    return inRange(params.memorySize, MAX_ARGON2ID_PARAMS.memorySize) &&
+        inRange(params.iterations, MAX_ARGON2ID_PARAMS.iterations) &&
+        inRange(params.parallelism, MAX_ARGON2ID_PARAMS.parallelism)
+        ? params
+        : undefined;
 }
 
 /** A fresh random salt for a new password enrollment. 16 bytes is Argon2id's own recommended minimum. */

package/lib/crypto/smime.ts

@@ -41,6 +41,10 @@ const ID_DATA = pkijs.ContentInfo.DATA;
 
 /** AES-GCM content-encryption OIDs (id-aes128-GCM, id-aes192-GCM, id-aes256-GCM - RFC 5084). The only
  * content encryption `decryptEnvelopedData()` accepts: see `UnsupportedContentEncryptionError`. */
+/** The CMS content type of RFC 5083 `AuthEnvelopedData` (`smime-type="authenveloped-data"`): authenticated, but not the
+ * structure `decryptEnvelopedDataWithKeys()` reads - it is reported as unsupported rather than as a missing key. */
+const AUTH_ENVELOPED_DATA_OID = "1.2.840.113549.1.9.16.1.23";
+
 const AEAD_CONTENT_ENCRYPTION_OIDS = new Set(["2.16.840.1.101.3.4.1.6", "2.16.840.1.101.3.4.1.26", "2.16.840.1.101.3.4.1.46"]);
 
 /**
@@ -56,7 +60,7 @@ export class UnsupportedContentEncryptionError extends Error {
     public readonly algorithmOid: string;
 
     constructor(algorithmOid: string) {
-        super(`This message uses unauthenticated content encryption (${algorithmOid}), which is not accepted.`);
+        super(`This message uses content encryption (${algorithmOid}) that is not accepted: only AES-GCM EnvelopedData is.`);
         this.name = "UnsupportedContentEncryptionError";
         this.algorithmOid = algorithmOid;
     }
@@ -178,10 +182,12 @@ export function extractCertificateEmails(certDer: Uint8Array): string[] {
         return [];
     }
     const sanEmails: string[] = [];
+    let hasSan = false;
     for (const extension of cert.extensions ?? []) {
         if (extension.extnID !== "2.5.29.17") {
             continue;
         }
+        hasSan = true;
         // pkijs parses a well-formed SubjectAlternativeName into an AltName automatically, and leaves
         // `parsedValue` unset for a malformed one - a certificate asserting an unreadable SAN names nobody.
         const altNames = (extension.parsedValue as pkijs.AltName | undefined)?.altNames;
@@ -195,7 +201,9 @@ export function extractCertificateEmails(certDer: Uint8Array): string[] {
             }
         }
     }
-    if (sanEmails.length > 0) {
+    // The SAN is authoritative whenever the certificate has one: DNS names alone name no mailbox, so a subject email
+    // address next to them must not stand in for it.
+    if (hasSan) {
         return sanEmails;
     }
     const subjectEmails: string[] = [];
@@ -376,6 +384,9 @@ function recipientMatchesCertificate(recipientInfo: pkijs.RecipientInfo, certifi
  */
 export async function decryptEnvelopedDataWithKeys(envelopedDer: Uint8Array, keys: DecryptionKey[]): Promise<Uint8Array> {
     const contentInfo = pkijs.ContentInfo.fromBER(toArrayBuffer(envelopedDer));
+    if (contentInfo.contentType === AUTH_ENVELOPED_DATA_OID) {
+        throw new UnsupportedContentEncryptionError(AUTH_ENVELOPED_DATA_OID);
+    }
     if (contentInfo.contentType !== pkijs.ContentInfo.ENVELOPED_DATA) {
         throw new Error("This CMS content is not EnvelopedData.");
     }

package/lib/mail/compose/composeQuoting.ts

@@ -15,7 +15,7 @@
  */
 
 import { Message, Recipient } from "../mailApi.js";
-import { sanitizeQuotedHtml } from "../messageBodySanitizer.js";
+import { sanitizeQuotedHtml, sanitizeSignatureHtml } from "../messageBodySanitizer.js";
 
 function escapeHtml(text: string): string {
     return text
@@ -154,7 +154,8 @@ export function buildComposeBodyHtml(signatureHtml?: string, quotedHtml?: string
     }
     const separator = signatureHtml && quotedHtml ? "<p></p>" : "";
     const aboveQuote = quotedHtml ? "<p></p>" : "";
-    return `<p></p>${signatureHtml ?? ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
+    // A signature can be written by someone else (a shared mailbox's delegate): it is sanitized like anything else the editor is given.
+    return `<p></p>${signatureHtml ? sanitizeSignatureHtml(signatureHtml) : ""}${separator}${aboveQuote}${quotedHtml ?? ""}`;
 }
 
 /**

package/lib/mail/compose/quotedImages.ts

@@ -13,6 +13,8 @@
 export const MAX_QUOTED_IMAGE_BYTES = 2_000_000;
 /** The most picture data a quote carries, in all (as `data:` URI characters). */
 export const MAX_QUOTED_IMAGES_CHARS = 6_000_000;
+/** How many pictures are fetched at once. */
+const QUOTED_IMAGE_CONCURRENCY = 4;
 
 export interface QuotedImageReference {
     /** The token of a `cid:` reference, absent for an image with no source. */
@@ -22,24 +24,52 @@ export interface QuotedImageReference {
 
 /**
  * `html` with each of its embedded images (`cid:`, or no source at all) replaced by the `data:` URI `resolve` gives for it. An image
- * `resolve` has no picture for is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and remote
- * ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ * `resolve` has no picture for (or fails on) is left as it is (the quote's sanitizer then drops it); images that already are `data:` URIs and
+ * remote ones are not asked about. `html` is returned as given when it has no such image, or where there is no DOM to parse it with.
+ *
+ * The images are resolved a few at a time. When `signal` aborts (the caller's deadline) the wait ends there: the pictures that have arrived
+ * are embedded, the rest left as they were, and `resolve` - which is given `signal` to cancel its own request with - is asked for no more.
  */
-export async function embedQuotedImages(html: string, resolve: (reference: QuotedImageReference) => Promise<string | undefined>): Promise<string> {
+export async function embedQuotedImages(
+    html: string,
+    resolve: (reference: QuotedImageReference, signal?: AbortSignal) => Promise<string | undefined>,
+    signal?: AbortSignal,
+): Promise<string> {
     if (typeof DOMParser === "undefined" || !/<img\b/i.test(html)) {
         return html;
     }
     const doc = new DOMParser().parseFromString(html, "text/html");
-    let budget = MAX_QUOTED_IMAGES_CHARS;
-    let changed = false;
+    const targets: { image: Element; reference: QuotedImageReference; uri?: string }[] = [];
     for (const image of Array.from(doc.querySelectorAll("img"))) {
         const src = (image.getAttribute("src") ?? "").trim();
         const cid = /^cid:/i.test(src);
-        if (!cid && src !== "") {
-            continue;
+        if (cid || src === "") {
+            targets.push({ image, reference: { ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined } });
+        }
+    }
+    let next = 0;
+    const worker = async () => {
+        while (next < targets.length && !signal?.aborted) {
+            const target = targets[next++];
+            target.uri = await resolve(target.reference, signal).catch(() => undefined);
         }
-        const uri = await resolve({ ...(cid ? { cid: src.slice(4) } : {}), alt: image.getAttribute("alt") ?? undefined });
-        if (uri !== undefined && uri.length <= budget) {
+    };
+    let onAbort!: () => void;
+    const deadline = new Promise<void>((done) => {
+        onAbort = done;
+        if (signal?.aborted) {
+            done();
+        }
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+    await Promise.race([Promise.all(Array.from({ length: Math.min(QUOTED_IMAGE_CONCURRENCY, targets.length) }, worker)), deadline]);
+    signal?.removeEventListener("abort", onAbort);
+    // Whatever has arrived by now is embedded, in document order, for as long as the budget lasts.
+    let budget = MAX_QUOTED_IMAGES_CHARS;
+    let changed = false;
+    for (const { image, uri } of targets) {
+        // Only a picture of the original's own is ever put in: whatever a resolver answers, a `src` that is not a `data:` image never gets in.
+        if (uri !== undefined && /^data:image\//i.test(uri) && uri.length <= budget) {
             budget -= uri.length;
             image.setAttribute("src", uri);
             changed = true;

package/lib/mail/labelsApi.ts

@@ -11,7 +11,7 @@
  */
 
 import { ApiClient, withClient } from "../util/api.js";
-import { ListParams, buildQuery } from "../util/apiQuery.js";
+import { ListParams, SETTINGS_LIST_LIMIT, buildQuery } from "../util/apiQuery.js";
 
 export type { ListParams };
 
@@ -31,7 +31,7 @@ export interface Label {
  * account of a multi-account app) to call instead of the default global `apiFetch()` - see `withClient()`'s
  * own doc comment in `util/api.ts`. Omitted (the default), every function here behaves exactly as before. */
 export function listLabels(mailboxUid: string, params: ListParams = {}, client?: ApiClient): Promise<Label[]> {
-    return withClient(client, `/mail/labels?${buildQuery(params, { mailboxUid })}`);
+    return withClient(client, `/mail/labels?${buildQuery({ limit: SETTINGS_LIST_LIMIT, ...params }, { mailboxUid })}`);
 }
 
 export function getLabel(uid: string, client?: ApiClient): Promise<Label> {