@zone-eu/mailsplit 5.4.24 → 5.4.25

package/README.md

@@ -31,7 +31,7 @@ Where
 
 -   **options** is an optional options object
     -   **options.ignoreEmbedded** (boolean, defaults to false) if true then treat message/rfc822 node as normal leaf node and do not try to parse it
-    -   **options.maxHeadSize** (number, defaults to Infinity) limits message header size in bytes
+    -   **options.maxHeadSize** (number, defaults to 1 MiB) limits the header size of a MIME node in bytes, every header line counting for at least 64 bytes
 
 #### Events
 

package/lib/message-splitter.js

@@ -488,13 +488,14 @@ class MessageSplitter extends Transform {
     }
 
     /**
-     * Checks the header bytes collected for the current node against maxHeadSize.
+     * Checks the header bytes collected for the current node against maxHeadSize. See
+     * MimeNode#headerCost.
      *
      * @param {number} [extra] Bytes that belong to the header block but are not stored yet.
      * @returns {(Error & {code?: string}) | null} Error object if the limit was exceeded.
      */
     checkHeadSize(extra) {
-        if (this.node._headerlen + (extra || 0) > this.maxHeadSize) {
+        if (this.node.headerCost(extra) > this.maxHeadSize) {
             return maxLenError('Max header size for a MIME node exceeded');
         }
         return null;
@@ -630,12 +631,12 @@ class MessageSplitter extends Transform {
 
         switch (this.state) {
             case HEAD: {
-                this.node.addHeaderChunk(line);
+                let endsBlock = this.node.addHeaderChunk(line);
                 let headSizeError = this.checkHeadSize();
                 if (headSizeError) {
                     return next(headSizeError);
                 }
-                if (final || (line.length === 1 && line[0] === 0x0a) || (line.length === 2 && line[0] === 0x0d && line[1] === 0x0a)) {
+                if (final || endsBlock) {
                     let currentNode = this.node;
 
                     currentNode.parseHeaders();

package/lib/mime-node.d.ts

@@ -23,6 +23,7 @@ declare class MimeNode implements MimeNodeShape {
 
     /** Length, in bytes, of the raw header block collected for this node. */
     _headerlen: number;
+    _headerCost: number;
 
     /** Multipart subtype such as `mixed` or `alternative`, or `false` for leaf nodes. */
     multipart: string | false;
@@ -88,7 +89,9 @@ declare class MimeNode implements MimeNodeShape {
      * @param line Raw header line bytes; falsy values are ignored.
      * @returns Nothing.
      */
-    addHeaderChunk(line?: Buffer | false): void;
+    addHeaderChunk(line?: Buffer | false): boolean;
+    /** What the header lines count for against maxHeadSize, every line at least 64 bytes */
+    headerCost(extra?: number): number;
 
     /**
      * Parses collected header bytes and populates MIME metadata fields.

package/lib/mime-node.js

@@ -18,6 +18,10 @@ const pathlib = require('path');
 
 const Libmime = /** @type {any} */ (libmime.Libmime);
 
+// The least a header line counts for against maxHeadSize. A parsed line costs a fixed
+// overhead on top of its bytes, so 1 MiB of header is at most 16k lines
+const HEADER_LINE_MIN_COST = 64;
+
 /**
  * Removes everything from the first `(` to the last `)` of each line, the same result as
  * `value.replace(/\(.*\)/g, '')`, but in linear time. The regex backtracks quadratically
@@ -117,6 +121,7 @@ class MimeNode {
         /** @type {Buffer[]} */
         this._headersLines = [];
         this._headerlen = 0;
+        this._headerCost = 0;
 
         /** @type {StructuredHeader | false} */
         this._parsedContentType = false;
@@ -171,14 +176,28 @@ class MimeNode {
 
     /**
      * @param {Buffer | false} [line]
-     * @returns {void}
+     * @returns {boolean} Whether the line is the empty line that ends the header block.
      */
     addHeaderChunk(line) {
         if (!line) {
-            return;
+            return false;
         }
         this._headersLines.push(line);
         this._headerlen += line.length;
+        let endsBlock = (line.length === 1 && line[0] === 0x0a) || (line.length === 2 && line[0] === 0x0d && line[1] === 0x0a);
+        // the empty line that ends the block costs its bytes, every other line at least the floor
+        this._headerCost += endsBlock ? line.length : Math.max(line.length, HEADER_LINE_MIN_COST);
+        return endsBlock;
+    }
+
+    /**
+     * What the header lines of this node count for against maxHeadSize, see HEADER_LINE_MIN_COST.
+     *
+     * @param {number} [extra] Bytes of a header line that is not stored yet.
+     * @returns {number} The cost in bytes.
+     */
+    headerCost(extra) {
+        return this._headerCost + (extra ? Math.max(extra, HEADER_LINE_MIN_COST) : 0);
     }
 
     /**
@@ -189,6 +208,8 @@ class MimeNode {
             return;
         }
         this.headers = new Headers(Buffer.concat(this._headersLines, this._headerlen), this.config);
+        // the views held the input chunks alive, the block lives on in the copy
+        this._headersLines = [];
         let headers = this.headers;
 
         let dispositionHeader = headers.getFirst('Content-Disposition');

package/lib/types.d.ts

@@ -83,6 +83,8 @@ export interface MimeNode {
 
     /** Length, in bytes, of the raw header block collected for this node. */
     _headerlen: number;
+    _headerCost: number;
+    headerCost(extra?: number): number;
 
     /** Multipart subtype such as `mixed` or `alternative`, or `false` for leaf nodes. */
     multipart: string | false;
@@ -140,7 +142,7 @@ export interface MimeNode {
      * @param line Raw header line bytes; falsy values are ignored.
      * @returns Nothing.
      */
-    addHeaderChunk(line?: Buffer | false): void;
+    addHeaderChunk(line?: Buffer | false): boolean;
 
     /**
      * Parses collected header bytes and populates MIME metadata fields.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zone-eu/mailsplit",
-    "version": "5.4.24",
+    "version": "5.4.25",
     "description": "Split email messages into an object stream",
     "main": "index.js",
     "types": "index.d.ts",