mailauth 7.3.0 → 7.3.1

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "7.3.0"
+    ".": "7.3.1"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [7.3.1](https://github.com/postalsys/mailauth/compare/v7.3.0...v7.3.1) (2026-10-18)
+
+
+### Bug Fixes
+
+* parse header blocks and trim field names in linear time ([78580bf](https://github.com/postalsys/mailauth/commit/78580bf379fc7d54c7997b0f4c2241e33f838aa5))
+
 ## [7.3.0](https://github.com/postalsys/mailauth/compare/v7.2.0...v7.3.0) (2026-10-10)
 
 

package/lib/dkim/dkim-verifier.js

@@ -18,6 +18,7 @@ const {
     isSupportedAlgorithm,
     createKeyCache
 } = require('../../lib/tools');
+const { trimChars } = require('../trim');
 const { DOMAIN_NAME, SELECTOR, LOCAL_PART, TIMESTAMP, BODY_LENGTH } = require('./syntax');
 const { MessageParser } = require('./message-parser');
 const { dkimBody } = require('./body');
@@ -827,7 +828,7 @@ const normalizeFieldList = value =>
     (value || '')
         .toString()
         .split(':')
-        .map(name => name.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, '').toLowerCase())
+        .map(name => trimChars(name, ' \t\r\n').toLowerCase())
         .filter(name => name);
 
 module.exports = { DkimVerifier };

package/lib/dkim2/fields.js

@@ -5,6 +5,7 @@
 
 const { Buffer } = require('node:buffer');
 const { formatRelaxedLine, toLineBytes, isValidDnsName, isSameOrSubdomain } = require('../tools');
+const { trimChars, trimEndChars } = require('../trim');
 const { parseRecipe } = require('./recipe');
 
 const MI_KEY = 'message-instance';
@@ -72,7 +73,7 @@ const parseTags = value => {
     let segments = value.split(';');
 
     for (let i = 0; i < segments.length; i++) {
-        let segment = segments[i].replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, '');
+        let segment = trimChars(segments[i], ' \t\r\n');
         if (!segment) {
             // the tag-list ends every tag with a semicolon, and a final one can be left out
             if (i < segments.length - 1) {
@@ -86,7 +87,7 @@ const parseTags = value => {
             return { tags, error: 'tag without a value' };
         }
 
-        let name = segment.substring(0, eqPos).replace(/[ \t\r\n]+$/, '');
+        let name = trimEndChars(segment.substring(0, eqPos), ' \t\r\n');
         if (!TAG_NAME.test(name)) {
             return { tags, error: 'invalid tag name' };
         }
@@ -291,7 +292,7 @@ const parseSignature = line => {
 
     if (tags.has('f')) {
         for (let flag of tags.get('f').split(',')) {
-            flag = flag.replace(/^[ \t\r\n]+|[ \t\r\n]+$/g, '');
+            flag = trimChars(flag, ' \t\r\n');
             if (!TEXTSTRING.test(flag)) {
                 return fail('syntax error');
             }

package/lib/dmarc/author-domain.js

@@ -162,8 +162,12 @@ const getAuthorDomain = (headerFrom, fromFields, opts) => {
             // a mailbox without a usable domain is not skipped, the domain a reader sees for it
             // is unknown, so the Author Domain can not be determined
             invalid = true;
-            if (typeof address === 'string' && address.indexOf('@') >= 0 && address.slice(address.lastIndexOf('@') + 1).replace(/^\s*\.?\s*$/, '')) {
-                malformed = true;
+            if (typeof address === 'string' && address.indexOf('@') >= 0) {
+                // a domain of whitespace, or of a lone dot, is missing rather than malformed
+                let domain = address.slice(address.lastIndexOf('@') + 1).trim();
+                if (domain && domain !== '.') {
+                    malformed = true;
+                }
             }
         }
         for (let entry of entries) {

package/lib/mta-sts.js

@@ -6,6 +6,7 @@ const https = require('node:https');
 const tls = require('node:tls');
 const { X509Certificate } = require('node:crypto');
 const { toALabel, createError } = require('./tools');
+const { trimChars, trimEndChars } = require('./trim');
 
 // socket idle timeout for the policy request
 const HTTP_IDLE_TIMEOUT = 15 * 1000;
@@ -65,7 +66,7 @@ const parseTxtRecordStrict = record => {
         // WSP around a delimiter belongs to the delimiter
         let field = parts[i].replace(/^[ \t]+/, '');
         if (!isLast) {
-            field = field.replace(/[ \t]+$/, '');
+            field = trimEndChars(field, ' \t');
         } else if (!field) {
             // optional trailing delimiter
             continue;
@@ -217,7 +218,7 @@ const parsePolicyFile = (file, strict, warnings) => {
             if (!EXT_NAME.test(key)) {
                 continue;
             }
-            value = line.substr(colonPos + 1).replace(/^[ \t]+|[ \t]+$/g, '');
+            value = trimChars(line.substr(colonPos + 1), ' \t');
         } else {
             key = line.substr(0, colonPos).toLowerCase().trim();
             value = line.substr(colonPos + 1).trim();

package/lib/parse-dkim-headers.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { DANGEROUS_KEYS } = require('./safe-keys');
+const { trimChars } = require('./trim');
 
 // Keys the headerParser result pre-seeds: "header" holds the header name and "value" the
 // authserv-id picked from the first key-only part. A crafted part must not overwrite them,
@@ -24,7 +25,7 @@ const NUMERIC_TAGS = new Set(['l', 'v', 't', 'x']);
 // RFC 6376 section 3.2: tag-name = ALPHA *ALNUMPUNC
 const TAG_NAME = /^[A-Za-z][A-Za-z0-9_]*$/;
 // FWS around a tag-spec, only SP, HTAB and the CRLF of a fold
-const FWS_EDGES = /^[ \t\r\n]+|[ \t\r\n]+$/g;
+const FWS_CHARS = ' \t\r\n';
 
 const normalizeString = value => value.replace(/\s+/g, ' ').trim();
 
@@ -104,7 +105,7 @@ const tagListParser = (line, headerKey, strict) => {
 
     for (let i = 0; i < segments.length; i++) {
         let segment = segments[i];
-        let trimmed = segment.replace(FWS_EDGES, '');
+        let trimmed = trimChars(segment, FWS_CHARS);
 
         if (!trimmed) {
             // one trailing semicolon is allowed, an empty tag-spec anywhere else is not
@@ -127,7 +128,7 @@ const tagListParser = (line, headerKey, strict) => {
             continue;
         }
 
-        let name = segment.substring(0, eqPos).replace(FWS_EDGES, '');
+        let name = trimChars(segment.substring(0, eqPos), FWS_CHARS);
         let value = normalizeString(segment.substring(eqPos + 1));
 
         if (!TAG_NAME.test(name)) {

package/lib/tools.js

@@ -10,6 +10,7 @@ const crypto = require('node:crypto');
 const https = require('node:https');
 const packageData = require('../package');
 const parseDkimHeaders = require('./parse-dkim-headers');
+const { trimChars, trimEndChars } = require('./trim');
 const { parseTagList } = parseDkimHeaders;
 const tldts = require('tldts');
 const Joi = require('joi');
@@ -152,27 +153,27 @@ const FIELD_START = /^[\x21-\x39\x3b-\x7e]+[ \t\r\n]*:/;
 // only add bytes to a signed value, so it can only ever turn a pass into a fail; reading
 // the line the other way round is what cannot be undone. formatRelaxedLine is not lenient
 // in the same way, what a signature covers is RFC 6376 section 3.4.2 alone
-const startsField = row =>
-    // only the start of the row decides this, and a fold can push the colon no further
+const startsField = (line, next) =>
+    // only the start of a line decides this, and a fold can push the colon no further
     // than onto the line after the name
-    FIELD_START.test(row.length > 1 ? `${row[0]}\r\n${row[1]}` : row[0]);
+    FIELD_START.test(line) || (next !== undefined && FIELD_START.test(`${line}\r\n${next}`));
 
 const parseHeaders = buf => {
-    let rows = buf
-        .toString('binary')
-        .replace(/[\r\n]+$/, '')
-        .split(/\r?\n/)
-        .map(row => [row]);
+    let lines = trimEndChars(buf.toString('binary'), '\r\n').split(/\r?\n/);
 
-    if (rows.length === 1 && !rows[0][0]) {
+    if (lines.length === 1 && !lines[0]) {
         // nothing to parse, rather than one row that is not a header
         return { parsed: [], original: buf };
     }
 
-    for (let i = rows.length - 1; i > 0; i--) {
-        if (!startsField(rows[i])) {
-            rows[i - 1] = rows[i - 1].concat(rows[i]);
-            rows.splice(i, 1);
+    // the first line always opens a row, every later line either opens one or continues
+    // the row before it
+    let rows = [[lines[0]]];
+    for (let i = 1; i < lines.length; i++) {
+        if (startsField(lines[i], lines[i + 1])) {
+            rows.push([lines[i]]);
+        } else {
+            rows[rows.length - 1].push(lines[i]);
         }
     }
 
@@ -188,7 +189,7 @@ const parseHeaders = buf => {
             if (casedKey.indexOf('\n') >= 0) {
                 casedKey = casedKey.replace(/\r?\n/g, '');
             }
-            casedKey = casedKey.replace(/^[ \t]+|[ \t]+$/g, '');
+            casedKey = trimChars(casedKey, ' \t');
             key = lowerCaseASCII(casedKey);
         }
 
@@ -203,7 +204,7 @@ const parseHeaders = buf => {
 const normalizeFieldNames = fieldNames =>
     fieldNames
         .split(':')
-        .map(key => lowerCaseASCII(key.replace(/^[ \t]+|[ \t]+$/g, '')))
+        .map(key => lowerCaseASCII(trimChars(key, ' \t')))
         .filter(key => key);
 
 const defaultDKIMFieldNamesNormalized = normalizeFieldNames(defaultDKIMFieldNames);
@@ -219,7 +220,7 @@ const OVERSIGN_FIELD_NAME = /^[\x21-\x39\x3c-\x7e]+$/;
 const getOversignedNames = (fieldNames, signingList) => {
     let listed = new Map();
     for (let casedKey of fieldNames.split(':')) {
-        casedKey = casedKey.replace(/^[ \t]+|[ \t]+$/g, '');
+        casedKey = trimChars(casedKey, ' \t');
         let key = lowerCaseASCII(casedKey);
         if (!key) {
             continue;
@@ -987,7 +988,7 @@ const formatRelaxedLine = (line, suffix) => {
             // unfold
             .replace(/\r?\n/g, '')
             // key to lowercase, trim around :
-            .replace(/^([^:]*):[ \t]*/, (m, k) => lowerCaseASCII(k).replace(/^[ \t]+|[ \t]+$/g, '') + ':')
+            .replace(/^([^:]*):[ \t]*/, (m, k) => trimChars(lowerCaseASCII(k), ' \t') + ':')
             // single WSP
             .replace(/[ \t]+/g, ' ')
             // no WSP around the value
@@ -1034,7 +1035,7 @@ const formatDomain = domain => {
     // signer writes and the verifier reports for the same name
     domain = toALabel(domain.toLowerCase().trim()).toLowerCase().trim();
     // the root label is not part of the name, so "example.com." and "example.com" are the same domain
-    return domain.replace(/\.+$/, '');
+    return trimEndChars(domain, '.');
 };
 
 // A domain as getAlignment() compares it, after formatDomain(): labels of letters, digits, "-"

package/lib/trim.js

@@ -0,0 +1,27 @@
+'use strict';
+
+// Trims the characters of `chars` off the end of a string with an index scan. A regex such
+// as /[ \t]+$/ retries the trailing run from every position inside it whenever the run is
+// not at the end of the string, quadratic in the length of a run of those characters
+const trimEndChars = (str, chars) => {
+    let end = str.length;
+    while (end > 0 && chars.includes(str[end - 1])) {
+        end--;
+    }
+    return str.slice(0, end);
+};
+
+// Trims the characters of `chars` off both ends of a string, see trimEndChars
+const trimChars = (str, chars) => {
+    let start = 0;
+    let end = str.length;
+    while (start < end && chars.includes(str[start])) {
+        start++;
+    }
+    while (end > start && chars.includes(str[end - 1])) {
+        end--;
+    }
+    return str.slice(start, end);
+};
+
+module.exports = { trimChars, trimEndChars };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "7.3.0",
+    "version": "7.3.1",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",