@zone-eu/mailsplit 5.4.21 → 5.4.23

package/lib/headers.js

@@ -392,18 +392,29 @@ class Headers {
             lines.push({ key: this._normalizeHeader(first.substr(0, first.indexOf(':'))), line: first });
         }
 
+        // Set while the last entry has no colon yet, so that its key may still come from a
+        // continuation line. Only the new line is searched then: searching the whole
+        // accumulated line again for every continuation was quadratic on a keyless block
+        let keyPending = false;
+
         for (; i < rawLines.length; i++) {
             let currentLine = rawLines[i];
             if (this._isFoldingChar(currentLine.charAt(0))) {
                 // the loop starts on a non-folded line, so there is always a last entry here
                 let entry = lines[lines.length - 1];
-                entry.line += '\r\n' + currentLine;
-                if (!entry.key) {
+                if (keyPending) {
                     // the key comes from the first colon, which may only appear in a continuation
-                    entry.key = this._normalizeHeader(entry.line.substr(0, entry.line.indexOf(':')));
+                    let colon = currentLine.indexOf(':');
+                    if (colon >= 0) {
+                        entry.key = this._normalizeHeader(entry.line + '\r\n' + currentLine.substr(0, colon));
+                        keyPending = false;
+                    }
                 }
+                entry.line += '\r\n' + currentLine;
             } else {
-                lines.push({ key: this._normalizeHeader(currentLine.substr(0, currentLine.indexOf(':'))), line: currentLine });
+                let colon = currentLine.indexOf(':');
+                lines.push({ key: this._normalizeHeader(currentLine.substr(0, colon)), line: currentLine });
+                keyPending = colon < 0;
             }
         }
 

package/lib/message-splitter.js

@@ -94,6 +94,9 @@ class MessageSplitter extends Transform {
         // set once the closing delimiter of the current node's multipart has been seen, so
         // that any later boundary line of that node counts as epilogue. Reset per node.
         this.inEpilogue = false;
+        // the open ancestor multipart whose boundary the last delimiter line matched, set
+        // by checkBoundary() for a sibling (3) or closing (4) delimiter
+        this.delimiterOwner = /** @type {MimeNodeType | false} */ (false);
         this.newNode();
         // incomplete trailing line of the previous chunk, kept as a list of chunks so
         // that a long line without a line break is not copied over for every write
@@ -452,15 +455,38 @@ class MessageSplitter extends Transform {
             return boundary;
         }
 
-        if (this.node._parentBoundary && (boundary = this.compareBoundary(line, startpos, this.node._parentBoundary))) {
-            // 3: next sibling
-            // 4: parent end
-            return /** @type {3 | 4} */ (boundary + 2);
+        // A delimiter of any open ancestor multipart, not only the parent, ends everything
+        // below it. An inner multipart that is never closed would otherwise swallow the
+        // rest of the message as body text of its last part, while other parsers and mail
+        // clients show the parts that follow the outer delimiter
+        for (let owner = this.node._parentBoundaryOwner; owner; owner = owner._parentBoundaryOwner) {
+            if (owner._boundary && (boundary = this.compareBoundary(line, startpos, owner._boundary))) {
+                // 3: next sibling under the owner
+                // 4: the owner's multipart ends
+                this.delimiterOwner = owner;
+                return /** @type {3 | 4} */ (boundary + 2);
+            }
         }
 
         return false;
     }
 
+    /**
+     * Longest boundary a delimiter line on the current node could carry: the node's own
+     * boundary or that of any open ancestor multipart.
+     *
+     * @returns {number} Boundary length in bytes, 0 when no boundary applies.
+     */
+    maxBoundaryLength() {
+        let max = this.node._boundary ? this.node._boundary.length : 0;
+        for (let owner = this.node._parentBoundaryOwner; owner; owner = owner._parentBoundaryOwner) {
+            if (owner._boundary && owner._boundary.length > max) {
+                max = owner._boundary.length;
+            }
+        }
+        return max;
+    }
+
     /**
      * Checks the header bytes collected for the current node against maxHeadSize.
      *
@@ -488,12 +514,7 @@ class MessageSplitter extends Transform {
             return null;
         }
 
-        let maxBoundaryLength = Math.max(
-            this.node._boundary ? this.node._boundary.length : 0,
-            this.node._parentBoundary ? this.node._parentBoundary.length : 0
-        );
-
-        if (this.lineLength <= maxBoundaryLength + BOUNDARY_LINE_OVERHEAD) {
+        if (this.lineLength <= this.maxBoundaryLength() + BOUNDARY_LINE_OVERHEAD) {
             // might still turn out to be a boundary delimiter line
             return null;
         }
@@ -571,8 +592,8 @@ class MessageSplitter extends Transform {
                     // reached end of children, keep current node
                     break;
                 case 3: {
-                    // next sibling
-                    this.newNode(this.parentMultipartNode());
+                    // next sibling under the multipart that owns the matched boundary
+                    this.newNode(this.delimiterOwner);
                     flush = true;
                     break;
                 }
@@ -583,7 +604,7 @@ class MessageSplitter extends Transform {
                         this.push(this.node);
                     }
                     // move up to the multipart node this closing delimiter belongs to
-                    let parentNode = this.parentMultipartNode();
+                    let parentNode = this.delimiterOwner;
                     if (parentNode) {
                         this.node = parentNode;
                         // the closing delimiter of this multipart was just processed, so any
@@ -662,16 +683,6 @@ class MessageSplitter extends Transform {
         next(null, false);
     }
 
-    /**
-     * Resolves the multipart node that owns the boundary of the current node, ie. the
-     * node a sibling delimiter or a closing delimiter of _parentBoundary refers to.
-     *
-     * @returns {MimeNodeType | false} Owner of _parentBoundary or false for the root node.
-     */
-    parentMultipartNode() {
-        return this.node._parentBoundaryOwner || false;
-    }
-
     /**
      * @param {MimeNodeType | false} [parent]
      * @returns {void}

package/lib/mime-node.js

@@ -44,6 +44,55 @@ function stripComments(value) {
         .join('');
 }
 
+/**
+ * Lists the parameters a header value gives in RFC 2231 form (`name*=`, `name*0=` or
+ * `name*0*=`). libmime decodes those while parsing the header, so the result must not
+ * go through `decodeWords` as well: a value like `filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D`
+ * would otherwise come out as `a.exe` while a parser that decodes once sees the encoded word.
+ *
+ * @param {string} value Raw header value.
+ * @returns {Set<string>} Lowercased parameter names.
+ */
+function rfc2231ParamNames(value) {
+    let names = new Set();
+    let quote = false;
+    let escaped = false;
+    let start = 0;
+
+    /**
+     * @param {number} end End offset of the segment starting at `start`.
+     * @returns {void}
+     */
+    let addSegment = end => {
+        let segment = value.substring(start, end);
+        let eq = segment.indexOf('=');
+        if (eq < 0) {
+            return;
+        }
+        let match = segment.substring(0, eq).trim().toLowerCase().match(/^(.+?)\*(\d+\*?)?$/);
+        if (match) {
+            names.add(match[1]);
+        }
+    };
+
+    for (let i = 0; i < value.length; i++) {
+        let chr = value.charAt(i);
+        if (escaped) {
+            escaped = false;
+        } else if (chr === '\\') {
+            escaped = true;
+        } else if (chr === '"') {
+            quote = !quote;
+        } else if (chr === ';' && !quote) {
+            addSegment(i);
+            start = i + 1;
+        }
+    }
+    addSegment(value.length);
+
+    return names;
+}
+
 /**
  * Parsed MIME node with mutable headers and transfer-encoding helpers.
  */
@@ -142,7 +191,8 @@ class MimeNode {
         this.headers = new Headers(Buffer.concat(this._headersLines, this._headerlen), this.config);
         let headers = this.headers;
 
-        this._parsedContentDisposition = this.libmime.parseHeaderValue(headers.getFirst('Content-Disposition'));
+        let dispositionHeader = headers.getFirst('Content-Disposition');
+        this._parsedContentDisposition = this.libmime.parseHeaderValue(dispositionHeader);
         let parsedContentDisposition = /** @type {StructuredHeader} */ (this._parsedContentDisposition);
 
         // if content-type is missing default to plaintext
@@ -192,10 +242,16 @@ class MimeNode {
         }
 
         if (this.filename) {
-            try {
-                this.filename = this.libmime.decodeWords(this.filename);
-            } catch (E) {
-                // failed to parse filename, keep as is (most probably an unknown charset is used)
+            // a parameter given in RFC 2231 form was decoded by libmime already
+            let decoded = parsedContentDisposition.params.filename
+                ? rfc2231ParamNames(dispositionHeader).has('filename')
+                : rfc2231ParamNames(contentHeader).has('name');
+            if (!decoded) {
+                try {
+                    this.filename = this.libmime.decodeWords(this.filename);
+                } catch (E) {
+                    // failed to parse filename, keep as is (most probably an unknown charset is used)
+                }
             }
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zone-eu/mailsplit",
-    "version": "5.4.21",
+    "version": "5.4.23",
     "description": "Split email messages into an object stream",
     "main": "index.js",
     "types": "index.d.ts",
@@ -16,8 +16,8 @@
     "license": "(MIT OR EUPL-1.1+)",
     "dependencies": {
         "libbase64": "1.3.3",
-        "libmime": "5.4.8",
-        "libqp": "2.1.2"
+        "libmime": "5.4.9",
+        "libqp": "2.1.3"
     },
     "devDependencies": {
         "@types/eslint": "9.6.1",