fix: narrow IMAP MIME body repair

Author: ecashier-help

backend/src/routes/mail.js

@@ -5,7 +5,7 @@ const archiver = require('archiver');
 import { query } from '../services/db.js';
 import { requireAuth } from '../middleware/auth.js';
 import { imapManager } from '../index.js';
-import { sanitizeEmail, stripEmailHead, hasRemoteImages, blockRemoteImages, rewriteEbayImageserUrls, rewriteAnchorHrefs, repairResidualQuotedPrintableHtml } from '../services/emailSanitizer.js';
+import { sanitizeEmail, stripEmailHead, hasRemoteImages, blockRemoteImages, rewriteEbayImageserUrls, rewriteAnchorHrefs } from '../services/emailSanitizer.js';
 import { snippetFromBody, decodeMimeWords, parseRawHeaders, buildHeadersFromMessage } from '../services/messageParser.js';
 import { resolveTrashFolder, resolveAllTrashPaths, resolveAllDraftsPaths, resolveArchiveFolder, isAllMailFolder, resolveSpamFolder, resolveAllSpamPaths, getDeleteStrategy, adjustFolderCounts, fanOutReadToSiblings, fanOutStarToSiblings, fanOutBulkReadToSiblings } from '../utils/mailUtils.js';
 import { emitGtdIfRelevant } from '../services/gtdSections.js';
@@ -353,7 +353,7 @@ router.get('/messages/:id/body', async (req, res) => {
       : [];
     // Apply head-stripping to already-cached HTML so emails stored before this
     // fix was deployed are cleaned up immediately on first view.
-    let html = message.body_html ? repairResidualQuotedPrintableHtml(stripEmailHead(message.body_html)) : null;
+    let html = message.body_html ? stripEmailHead(message.body_html) : null;
     if (html !== message.body_html) {
       // Update cache so subsequent views don't need to re-strip
       query('UPDATE messages SET body_html = $1 WHERE id = $2', [sanitizeDbText(html), id]).catch(() => {});
@@ -411,7 +411,7 @@ router.get('/messages/:id/body', async (req, res) => {
       BODY_FETCH_TIMEOUT_MS
     );
 
-    const safeHtml = html ? sanitizeDbText(sanitizeEmail(repairResidualQuotedPrintableHtml(html))) : null;
+    const safeHtml = html ? sanitizeDbText(sanitizeEmail(html)) : null;
     const safeText = sanitizeDbText(text);
     const snip = sanitizeDbText(snippetFromBody(safeText, safeHtml || html));
 

backend/src/services/emailSanitizer.js

@@ -25,32 +25,6 @@ export function stripEmailHead(html) {
 }
 
 
-// Best-effort repair for bodies that were cached/fetched with leftover
-// quoted-printable fragments inside otherwise valid HTML. This happens with
-// malformed multipart messages where an IMAP BODY part contains an embedded
-// MIME subpart. Decode only explicit uppercase =HH runs so normal text like
-// "name=value" or email domains such as "example.=com" are not damaged.
-export function repairResidualQuotedPrintableHtml(html) {
-  if (!html || !/(?:=[0-9A-F]{2}|==[0-9A-F]{2}|Content-Transfer-Encoding|@[^\s<]+\.=[A-Za-z]{2,}|src=["']data:image\/[^"']*&lt;)/.test(html)) return html;
-  let out = String(html)
-    .replace(/^--[^\r\n]+\r?\nContent-Type:[\s\S]*?\r?\n\r?\n/i, '')
-    .replace(/=(?==[0-9A-F]{2})/g, '');
-
-  out = out.replace(/(?:=[0-9A-F]{2})+/g, (run) => {
-    const bytes = [];
-    for (let i = 0; i < run.length; i += 3) bytes.push(parseInt(run.slice(i + 1, i + 3), 16));
-    try { return new TextDecoder('utf-8', { fatal: false }).decode(Uint8Array.from(bytes)); }
-    catch { return run; }
-  });
-
-  return out
-    .replace(/<img\b[^>]*src=["']data:image\/[^"']*&lt;[^"']*["'][^>]*>/gi, '')
-    .replace(/&lt;=([A-Za-z/])/g, '&lt;$1')
-    .replace(/\bp=adding\b/g, 'padding')
-    .replace(/@([A-Za-z0-9.-]+)\.=([A-Za-z]{2,})\b/g, '@$1.$2')
-    .replace(/@([A-Za-z0-9.-]+)\.com\b/g, '@$1.com');
-}
-
 function upgradeUrl(url) {
   return typeof url === 'string' && url.startsWith('http://') ? 'https://' + url.slice(7) : url;
 }

backend/src/services/imapManager.js

@@ -318,7 +318,8 @@ function parseMimeHeaders(headerBlock) {
 // part is requested: the payload starts with a MIME boundary and embedded
 // Content-Type/Content-Transfer-Encoding headers. If passed to the sanitizer as
 // HTML, users see boundary lines and quoted-printable garbage (=D0=..., =3D).
-function unwrapEmbeddedMimeText(decoded) {
+function unwrapEmbeddedMimeText(decoded, depth = 0) {
+  if (depth >= 5) return decoded;
   const start = String(decoded || '').trimStart();
   if (!/^--[^\r\n]+\r?\nContent-/i.test(start)) return decoded;
 
@@ -352,7 +353,7 @@ function unwrapEmbeddedMimeText(decoded) {
     });
   }
   const best = candidates.find(p => p.type === 'text/html') || candidates.find(p => p.type === 'text/plain');
-  return best ? unwrapEmbeddedMimeText(best.text) : decoded;
+  return best ? unwrapEmbeddedMimeText(best.text, depth + 1) : decoded;
 }
 
 // Decode a MIME body part from its raw Buffer.
@@ -378,6 +379,12 @@ function decodeBody(buf, encoding, charset) {
   return unwrapEmbeddedMimeText(decodeBytes(rawBytes, charset));
 }
 
+function looksLikeTextPayload(buf) {
+  if (!buf || buf.length === 0) return false;
+  const sample = Buffer.isBuffer(buf) ? buf.subarray(0, 512).toString('ascii') : String(buf).slice(0, 512);
+  return /(?:<html|<!doctype|<style|Content-Type:|Content-Transfer-Encoding:|=D0|=D1|=3D|&lt;html|&lt;style)/i.test(sample);
+}
+
 function decodeAttachmentBuffer(buf, encoding) {
   const enc = (encoding || '').toLowerCase();
   if (enc === 'base64') {
@@ -3974,12 +3981,13 @@ export class ImapManager {
         }
 
         // Per-part individual fetch for text parts. Some IMAP servers return a
-        // whole multipart wrapper for speculative/batched sibling requests while
-        // BODY[2.1] alone is correct; accepting the batched value leaks MIME
-        // boundaries and quoted-printable fragments into the UI. Do this even
-        // when speculative fetch already returned the part, so the direct result
-        // overwrites any malformed batched value. Inline images keep the batched
-        // value because they are binary and are not parsed as HTML.
+        // non-empty but malformed text payload for speculative/batched sibling
+        // requests while BODY[2.1] alone is correct; accepting the batched value
+        // leaks MIME boundaries and quoted-printable fragments into the UI. Do
+        // this even when speculative fetch already returned the part, so the
+        // direct text result overwrites any malformed batched value. Inline
+        // images keep the batched value because they are binary and are not
+        // parsed as HTML.
         for (const part of results.textParts) {
           try {
             for await (const msg of client.fetch(uidStr, { uid: true, bodyParts: [part.part] }, { uid: true })) {
@@ -3989,17 +3997,19 @@ export class ImapManager {
           } catch { /* don't let a single part failure block others */ }
         }
 
-        // Per-part individual fetch for inline images too. Some servers can also
-        // return the wrong sibling payload for BODY[2.2] in a multi-part batch;
-        // if that HTML fragment is used as the CID image, it becomes a broken
-        // data:image URL and leaks escaped HTML into the rendered message.
+        // Inline images normally keep the batched value for performance. Retry
+        // only the suspicious ones: some servers return a text/html sibling for
+        // an image part in a multi-part batch, producing data:image URLs that
+        // contain escaped HTML/QP text and leak quoted-message garbage.
         for (const part of inlineImages) {
+          const existing = prefetched.get(part.part);
+          if (!looksLikeTextPayload(existing)) continue;
           try {
             for await (const msg of client.fetch(uidStr, { uid: true, bodyParts: [part.part] }, { uid: true })) {
               const v = msg.bodyParts?.get(part.part);
               if (v && v.length > 0) prefetched.set(part.part, v);
             }
-          } catch { /* don't let a single part failure block others */ }
+          } catch { /* keep the batched value if the direct retry fails */ }
         }
 
         for (const part of results.textParts) {
@@ -4016,7 +4026,7 @@ export class ImapManager {
           for (const img of inlineImages) {
             if (!img.cid) continue;
             const buf = prefetched.get(img.part);
-            if (!buf) continue;
+            if (!buf || looksLikeTextPayload(buf)) continue;
             const enc = (img.encoding || '').toLowerCase();
             const b64 = enc === 'base64'
               ? buf.toString('ascii').replace(/\s/g, '')