GHSA-V53P-9FQP-M79J

+/**+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let+ * loose to search, see there.+ */+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;++/**+ * The characters JS `\s` matches, which the scan below has to agree with to land on the+ * same match the pattern would.+ */+function _isSpaceCode(code: number): boolean {+    return (+        code === 0x20 ||+        (code >= 0x09 && code <= 0x0d) ||+        code === 0xa0 ||+        code === 0x1680 ||+        (code >= 0x2000 && code <= 0x200a) ||+        code === 0x2028 ||+        code === 0x2029 ||+        code === 0x202f ||+        code === 0x205f ||+        code === 0x3000 ||+        code === 0xfeff+    );+}++/**+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,+ * which compares false throughout, so out of range reads as the non-word the pattern+ * treats them as.+ */+function _isWordCode(code: number): boolean {+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;+}++/**+ * Whether `\b` holds at an offset+ */+function _isBoundary(text: string, at: number): boolean {+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));+}++/**+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.+ *+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters+ * back until it lands on a boundary, so the only end it can take in that run is the last+ * boundary in it. Both are found in one pass, and the pattern is then run at that single+ * offset.+ *+ * @param text Free text to look in+ * @return Offset to match at, or -1+ */+function _looseAddressStart(text: string): number {+    const len = text.length;+    let pos = 0;++    while (pos < len) {+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {+            pos++;+        }+        if (pos >= len) {+            break;+        }++        const runStart = pos;+        let runEnd = pos;+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {

+                if (_isBoundary(text, k)) {+                    lastBoundary = k;+                    break;+                }+            }

+        // does: 273KB took+        // ~43s of blocked event loop. The shapes below are the three ways the '@' can be+        // unusable, plus a run that has none at all.+        for (const [label, build] of [+            ['no at sign at all', (count: number) => '[x]'.repeat(count)],+            ['an at sign with nothing after it', (count: number) => '[x]'.repeat(count) + '@'],+            ['an at sign with nothing before it', (count: number) => '@' + '[x]'.repeat(count)],+            ['an address only past a long run', (count: number) => '[x]'.repeat(count) + ' a@b.com']+        ] as [string, (count: number) => string][]) {+            it(`should scan free text holding ${label} in linear time`, () => {+                const count = 40000;+                const input = build(count);++                const started = Date.now();+                addressparser(input);+                const elapsed = Date.now() - started;++                assert.ok(elapsed < 5000, `scanning a ${input.length} byte value took ${elapsed}ms`);+            });+        }++        it('should still read an address out of free text', () => {+            assert.deepStrictEqual(addressparser('junk [x] a@b.com more'), [{ address: 'a@b.com', name: 'junk [x] more' }]);+            assert.deepStrictEqual(addressparser('   a@b.com   '), [{ address: 'a@b.com', name: '' }]);+            assert.deepStrictEqual(addressparser('!a@b!'), [{ address: '!a@b!', name: '' }]);+        });+         it('should keep fragment merging identical to the previous implementation', () => {             assert.deepStrictEqual(addressparser('Joe Foo, PhD <joe@example.com>'), [{ address: 'joe@example.com', name: 'Joe Foo, PhD' }]);             assert.deepStrictEqual(addressparser('a, b, c <x@y.com>'), [{ address: 'x@y.com', name: 'a, b, c' }]);

+/**+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.+ *+ * indexOf would scan on to the end of the value, and the value here is a whole header. The+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left+ * the probe unbounded behind it.+ *+ * @param text Text to look in+ * @param from Offset to start at

+        }+    }++    return -1;+}+ /**  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.  *@@ -193,8 +218,8 @@ function _looseAddressStart(text: string): number {             runEnd++;         } -        let at = text.indexOf('@', runStart);-        if (at >= 0 && at < runEnd) {+        let at = _indexOfAt(text, runStart, runEnd);+        if (at >= 0) {             let lastBoundary = -1;             for (let k = runEnd; k > runStart; k--) {                 if (_isBoundary(text, k)) {@@ -204,7 +229,7 @@ function _looseAddressStart(text: string): number {             }              let atomStart = runStart;-            while (lastBoundary >= 0 && at >= 0 && at < runEnd) {+            while (lastBoundary >= 0 && at >= 0) {                 // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,                 // and the boundary that ends the match has to sit past both                 if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {@@ -224,7 +249,7 @@ function _looseAddressStart(text: string): number {                     }                 }                 atomStart = at + 1;-                at = text.indexOf('@', atomStart);+                at = _indexOfAt(text, atomStart, runEnd);             }         } 

+        // blocked event loop where the bounded probe takes ~90ms. The shapes above are single+        // runs and never reached it.+        for (const [label, build] of [+            ['many runs and no at sign', (count: number) => ' [x]'.repeat(count)],+            ['many runs before an address', (count: number) => ' [x]'.repeat(count) + ' a@b.com'],+            ['many runs after an address', (count: number) => 'a@b.com' + ' [x]'.repeat(count)]+        ] as [string, (count: number) => string][]) {+            it(`should scan free text holding ${label} in linear time`, () => {+                // ~2.5MB, where the unbounded probe took ~12s and the bounded one takes ~90ms+                const count = 640000;+                const input = build(count);++                const started = Date.now();+                addressparser(input);+                const elapsed = Date.now() - started;++                assert.ok(elapsed < 5000, `scanning a ${input.length} byte value took ${elapsed}ms`);+            });+        }+         it('should still read an address out of free text', () => {             assert.deepStrictEqual(addressparser('junk [x] a@b.com more'), [{ address: 'a@b.com', name: 'junk [x] more' }]);             assert.deepStrictEqual(addressparser('   a@b.com   '), [{ address: 'a@b.com', name: '' }]);