1package message

2

3// todo: allow more invalid content-type values, we now stop parsing on: empty media type (eg "content-type: ; name=..."), empty value for property (eg "charset=", missing quotes for characters that should be quoted (eg boundary containing "=" but without quotes), duplicate properties (two charsets), empty pairs (eg "text/html;;").

4// todo: should we be forgiving when closing boundary in multipart message is missing? seems like spam messages do this...

5// todo: should we allow base64 messages where a line starts with a space? and possibly more whitespace. is happening in messages. coreutils base64 accepts it, encoding/base64 does not.

6// todo: handle comments in headers?

7// todo: should we just always store messages with \n instead of \r\n? \r\n seems easier for use with imap.

8// todo: can use a cleanup

9

10import (

11 "bufio"

12 "bytes"

13 "encoding/base64"

14 "errors"

15 "fmt"

16 "io"

17 "mime"

18 "mime/quotedprintable"

19 "net/mail"

20 "net/textproto"

21 "strings"

22 "time"

23

24 "golang.org/x/exp/slog"

25 "golang.org/x/text/encoding/ianaindex"

26

27 "github.com/mjl-/mox/mlog"

28 "github.com/mjl-/mox/smtp"

29)

30

31// Pedantic enables stricter parsing.

32var Pedantic bool

33

34var (

35 ErrBadContentType = errors.New("bad content-type")

36)

37

38var (

39 errNotMultipart = errors.New("not a multipart message")

40 errFirstBoundCloses = errors.New("first boundary cannot be finishing boundary")

41 errLineTooLong = errors.New("line too long")

42 errMissingBoundaryParam = errors.New("missing/empty boundary content-type parameter")

43 errMissingClosingBoundary = errors.New("eof without closing boundary")

44 errBareLF = errors.New("invalid bare line feed")

45 errBareCR = errors.New("invalid bare carriage return")

46 errUnexpectedEOF = errors.New("unexpected eof")

47)

48

49// If set, during tests, attempts to reparse a part will cause an error, because sequentially reading parts should not lead to reparsing.

50var enforceSequential bool

51

52// Part represents a whole mail message, or a part of a multipart message. It

53// is designed to handle IMAP requirements efficiently.

54type Part struct {

55 BoundaryOffset int64 // Offset in message where bound starts. -1 for top-level message.

56 HeaderOffset int64 // Offset in message file where header starts.

57 BodyOffset int64 // Offset in message file where body starts.

58 EndOffset int64 // Where body of part ends. Set when part is fully read.

59 RawLineCount int64 // Number of lines in raw, undecoded, body of part. Set when part is fully read.

60 DecodedSize int64 // Number of octets when decoded. If this is a text mediatype, lines ending only in LF are changed end in CRLF and DecodedSize reflects that.

61

62 MediaType string // From Content-Type, upper case. E.g. "TEXT". Can be empty because content-type may be absent. In this case, the part may be treated as TEXT/PLAIN.

63 MediaSubType string // From Content-Type, upper case. E.g. "PLAIN".

64 ContentTypeParams map[string]string // E.g. holds "boundary" for multipart messages. Has lower-case keys, and original case values.

65 ContentID string

66 ContentDescription string

67 ContentTransferEncoding string // In upper case.

68 Envelope *Envelope // Email message headers. Not for non-message parts.

69

70 Parts []Part // Parts if this is a multipart.

71

72 // Only for message/rfc822 and message/global. This part may have a buffer as

73 // backing io.ReaderAt, because a message/global can have a non-identity

74 // content-transfer-encoding. This part has a nil parent.

75 Message *Part

76

77 r io.ReaderAt

78 header textproto.MIMEHeader // Parsed header.

79 nextBoundOffset int64 // If >= 0, the offset where the next part header starts. We can set this when a user fully reads each part.

80 lastBoundOffset int64 // Start of header of last/previous part. Used to skip a part if ParseNextPart is called and nextBoundOffset is -1.

81 parent *Part // Parent part, for getting bound from, and setting nextBoundOffset when a part has finished reading. Only for subparts, not top-level parts.

82 bound []byte // Only set if valid multipart with boundary, includes leading --, excludes \r\n.

83 strict bool // If set, valid crlf line endings are verified when reading body.

84}

85

86// todo: have all Content* fields in Part?

87// todo: make Address contain a type Localpart and dns.Domain?

88// todo: if we ever make a major change and reparse all parts, switch to lower-case values if not too troublesome.

89

90// Envelope holds the basic/common message headers as used in IMAP4.

91type Envelope struct {

92 Date time.Time

93 Subject string // Q/B-word-decoded.

94 From []Address

95 Sender []Address

96 ReplyTo []Address

97 To []Address

98 CC []Address

99 BCC []Address

100 InReplyTo string

101 MessageID string

102}

103

104// Address as used in From and To headers.

105type Address struct {

106 Name string // Free-form name for display in mail applications.

107 User string // Localpart.

108 Host string // Domain in ASCII.

109}

110

111// Parse reads the headers of the mail message and returns a part.

112// A part provides access to decoded and raw contents of a message and its multiple parts.

113//

114// If strict is set, fewer attempts are made to continue parsing when errors are

115// encountered, such as with invalid content-type headers or bare carriage returns.

116func Parse(elog *slog.Logger, strict bool, r io.ReaderAt) (Part, error) {

117 log := mlog.New("message", elog)

118 return newPart(log, strict, r, 0, nil)

119}

120

121// EnsurePart parses a part as with Parse, but ensures a usable part is always

122// returned, even if error is non-nil. If a parse error occurs, the message is

123// returned as application/octet-stream, and headers can still be read if they

124// were valid.

125//

126// If strict is set, fewer attempts are made to continue parsing when errors are

127// encountered, such as with invalid content-type headers or bare carriage returns.

128func EnsurePart(elog *slog.Logger, strict bool, r io.ReaderAt, size int64) (Part, error) {

129 log := mlog.New("message", elog)

130 p, err := Parse(log.Logger, strict, r)

131 if err == nil {

132 err = p.Walk(log.Logger, nil)

133 }

134 if err != nil {

135 np, err2 := fallbackPart(p, r, size)

136 if err2 != nil {

137 err = err2

138 }

139 p = np

140 }

141 return p, err

142}

143

144func fallbackPart(p Part, r io.ReaderAt, size int64) (Part, error) {

145 np := Part{

146 HeaderOffset: p.HeaderOffset,

147 BodyOffset: p.BodyOffset,

148 EndOffset: size,

149 MediaType: "APPLICATION",

150 MediaSubType: "OCTET-STREAM",

151 ContentTypeParams: p.ContentTypeParams,

152 ContentID: p.ContentID,

153 ContentDescription: p.ContentDescription,

154 ContentTransferEncoding: p.ContentTransferEncoding,

155 Envelope: p.Envelope,

156 // We don't keep:

157 // - BoundaryOffset: irrelevant for top-level message.

158 // - RawLineCount and DecodedSize: set below.

159 // - Parts: we are not treating this as a multipart message.

160 }

161 np.SetReaderAt(r)

162 // By reading body, the number of lines and decoded size will be set.

163 _, err := io.Copy(io.Discard, np.Reader())

164 return np, err

165}

166

167// SetReaderAt sets r as reader for this part and all its sub parts, recursively.

168// No reader is set for any Message subpart, see SetMessageReaderAt.

169func (p *Part) SetReaderAt(r io.ReaderAt) {

170 if r == nil {

171 panic("nil reader")

172 }

173 p.r = r

174 for i := range p.Parts {

175 pp := &p.Parts[i]

176 pp.SetReaderAt(r)

177 }

178}

179

180// SetMessageReaderAt sets a reader on p.Message, which must be non-nil.

181func (p *Part) SetMessageReaderAt() error {

182 // todo: if p.Message does not contain any non-identity content-transfer-encoding, we should set an offsetReader of p.Message, recursively.

183 buf, err := io.ReadAll(p.Reader())

184 if err != nil {

185 return err

186 }

187 p.Message.SetReaderAt(bytes.NewReader(buf))

188 return nil

189}

190

191// Walk through message, decoding along the way, and collecting mime part offsets and sizes, and line counts.

192func (p *Part) Walk(elog *slog.Logger, parent *Part) error {

193 log := mlog.New("message", elog)

194

195 if len(p.bound) == 0 {

196 if p.MediaType == "MESSAGE" && (p.MediaSubType == "RFC822" || p.MediaSubType == "GLOBAL") {

197 // todo: don't read whole submessage in memory...

198 buf, err := io.ReadAll(p.Reader())

199 if err != nil {

200 return err

201 }

202 br := bytes.NewReader(buf)

203 mp, err := Parse(log.Logger, p.strict, br)

204 if err != nil {

205 return fmt.Errorf("parsing embedded message: %w", err)

206 }

207 if err := mp.Walk(log.Logger, nil); err != nil {

208 // If this is a DSN and we are not in pedantic mode, accept unexpected end of

209 // message. This is quite common because MTA's sometimes just truncate the original

210 // message in a place that makes the message invalid.

211 if errors.Is(err, errUnexpectedEOF) && !Pedantic && parent != nil && len(parent.Parts) >= 3 && p == &parent.Parts[2] && parent.MediaType == "MULTIPART" && parent.MediaSubType == "REPORT" {

212 mp, err = fallbackPart(mp, br, int64(len(buf)))

213 if err != nil {

214 return fmt.Errorf("parsing invalid embedded message: %w", err)

215 }

216 } else {

217 return fmt.Errorf("parsing parts of embedded message: %w", err)

218 }

219 }

220 // todo: if mp does not contain any non-identity content-transfer-encoding, we should set an offsetReader of p.r on mp, recursively.

221 p.Message = &mp

222 return nil

223 }

224 _, err := io.Copy(io.Discard, p.Reader())

225 return err

226 }

227

228 for {

229 pp, err := p.ParseNextPart(log.Logger)

230 if err == io.EOF {

231 return nil

232 }

233 if err != nil {

234 return err

235 }

236 if err := pp.Walk(log.Logger, p); err != nil {

237 return err

238 }

239 }

240}

241

242// String returns a debugging representation of the part.

243func (p *Part) String() string {

244 return fmt.Sprintf("&Part{%s/%s offsets %d/%d/%d/%d lines %d decodedsize %d next %d last %d bound %q parts %v}", p.MediaType, p.MediaSubType, p.BoundaryOffset, p.HeaderOffset, p.BodyOffset, p.EndOffset, p.RawLineCount, p.DecodedSize, p.nextBoundOffset, p.lastBoundOffset, p.bound, p.Parts)

245}

246

247// newPart parses a new part, which can be the top-level message.

248// offset is the bound offset for parts, and the start of message for top-level messages. parent indicates if this is a top-level message or sub-part.

249// If an error occurs, p's exported values can still be relevant. EnsurePart uses these values.

250func newPart(log mlog.Log, strict bool, r io.ReaderAt, offset int64, parent *Part) (p Part, rerr error) {

251 if r == nil {

252 panic("nil reader")

253 }

254 p = Part{

255 BoundaryOffset: -1,

256 EndOffset: -1,

257 r: r,

258 parent: parent,

259 strict: strict,

260 }

261

262 b := &bufAt{strict: strict, r: r, offset: offset}

263

264 if parent != nil {

265 p.BoundaryOffset = offset

266 if line, _, err := b.ReadLine(true); err != nil {

267 return p, err

268 } else if match, finish := checkBound(line, parent.bound); !match {

269 return p, fmt.Errorf("missing bound")

270 } else if finish {

271 return p, fmt.Errorf("new part for closing boundary")

272 }

273 }

274

275 // Collect header.

276 p.HeaderOffset = b.offset

277 p.BodyOffset = b.offset

278 hb := &bytes.Buffer{}

279 for {

280 line, _, err := b.ReadLine(true)

281 if err == io.EOF {

282 // No body is valid.

283 break

284 }

285 if err != nil {

286 return p, fmt.Errorf("reading header line: %w", err)

287 }

288 hb.Write(line)

289 if len(line) == 2 {

290 break // crlf

291 }

292 }

293 p.BodyOffset = b.offset

294

295 // Don't attempt to parse empty header, mail.ReadMessage doesn't like it.

296 if p.HeaderOffset == p.BodyOffset {

297 p.header = textproto.MIMEHeader{}

298 } else {

299 h, err := parseHeader(hb)

300 if err != nil {

301 return p, fmt.Errorf("parsing header: %w", err)

302 }

303 p.header = h

304 }

305

306 ct := p.header.Get("Content-Type")

307 mt, params, err := mime.ParseMediaType(ct)

308 if err != nil && ct != "" {

309 if Pedantic || strict {

310 return p, fmt.Errorf("%w: %s: %q", ErrBadContentType, err, ct)

311 }

312

313 // Try parsing just a content-type, ignoring parameters.

314 // ../rfc/2045:628

315 ct = strings.TrimSpace(strings.SplitN(ct, ";", 2)[0])

316 t := strings.SplitN(ct, "/", 2)

317 isToken := func(s string) bool {

318 const separators = `()<>@,;:\\"/[]?= ` // ../rfc/2045:663

319 for _, c := range s {

320 if c < 0x20 || c >= 0x80 || strings.ContainsRune(separators, c) {

321 return false

322 }

323 }

324 return len(s) > 0

325 }

326 // We cannot recover content-type of multipart, we won't have a boundary.

327 if len(t) == 2 && isToken(t[0]) && !strings.EqualFold(t[0], "multipart") && isToken(t[1]) {

328 p.MediaType = strings.ToUpper(t[0])

329 p.MediaSubType = strings.ToUpper(t[1])

330 } else {

331 p.MediaType = "APPLICATION"

332 p.MediaSubType = "OCTET-STREAM"

333 }

334 log.Debugx("malformed content-type, attempting to recover and continuing", err,

335 slog.String("contenttype", p.header.Get("Content-Type")),

336 slog.String("mediatype", p.MediaType),

337 slog.String("mediasubtype", p.MediaSubType))

338 } else if mt != "" {

339 t := strings.SplitN(strings.ToUpper(mt), "/", 2)

340 if len(t) != 2 {

341 if Pedantic || strict {

342 return p, fmt.Errorf("bad content-type: %q (content-type %q)", mt, ct)

343 }

344 log.Debug("malformed media-type, ignoring and continuing", slog.String("type", mt))

345 p.MediaType = "APPLICATION"

346 p.MediaSubType = "OCTET-STREAM"

347 } else {

348 p.MediaType = t[0]

349 p.MediaSubType = t[1]

350 p.ContentTypeParams = params

351 }

352 }

353

354 p.ContentID = p.header.Get("Content-Id")

355 p.ContentDescription = p.header.Get("Content-Description")

356 p.ContentTransferEncoding = strings.ToUpper(p.header.Get("Content-Transfer-Encoding"))

357

358 if parent == nil {

359 p.Envelope, err = parseEnvelope(log, mail.Header(p.header))

360 if err != nil {

361 return p, err

362 }

363 }

364

365 if p.MediaType == "MULTIPART" {

366 s := params["boundary"]

367 if s == "" {

368 return p, errMissingBoundaryParam

369 }

370 p.bound = append([]byte("--"), s...)

371

372 // Discard preamble, before first boundary.

373 for {

374 line, _, err := b.PeekLine(true)

375 if err != nil {

376 return p, fmt.Errorf("parsing line for part preamble: %w", err)

377 }

378 // Line only needs boundary prefix, not exact match. ../rfc/2046:1103

379 // Well, for compatibility, we require whitespace after the boundary. Because some

380 // software use the same boundary but with text appended for sub parts.

381 if match, finish := checkBound(line, p.bound); match {

382 if finish {

383 return p, errFirstBoundCloses

384 }

385 break

386 }

387 b.ReadLine(true)

388 }

389 p.nextBoundOffset = b.offset

390 p.lastBoundOffset = b.offset

391 }

392

393 return p, nil

394}

395

396// Header returns the parsed header of this part.

397func (p *Part) Header() (textproto.MIMEHeader, error) {

398 if p.header != nil {

399 return p.header, nil

400 }

401 if p.HeaderOffset == p.BodyOffset {

402 p.header = textproto.MIMEHeader{}

403 return p.header, nil

404 }

405 h, err := parseHeader(p.HeaderReader())

406 p.header = h

407 return h, err

408}

409

410// HeaderReader returns a reader for the header section of this part, including ending bare CRLF.

411func (p *Part) HeaderReader() io.Reader {

412 return io.NewSectionReader(p.r, p.HeaderOffset, p.BodyOffset-p.HeaderOffset)

413}

414

415// parse a header, only call this on non-empty input (even though that is a valid header).

416func parseHeader(r io.Reader) (textproto.MIMEHeader, error) {

417 // We read using mail.ReadMessage instead of textproto.ReadMIMEHeaders because the

418 // first handles email messages properly, while the second only works for HTTP

419 // headers.

420 var zero textproto.MIMEHeader

421

422 // We read the header and add the optional \r\n header/body separator. If the \r\n

423 // is missing, parsing with Go <1.21 results in an EOF error.

424 // todo: directly parse from reader r when Go 1.20 is no longer supported.

425 buf, err := io.ReadAll(r)

426 if err != nil {

427 return zero, err

428 }

429 if bytes.HasSuffix(buf, []byte("\r\n")) && !bytes.HasSuffix(buf, []byte("\r\n\r\n")) {

430 buf = append(buf, "\r\n"...)

431 }

432 msg, err := mail.ReadMessage(bytes.NewReader(buf))

433 if err != nil {

434 return zero, err

435 }

436 return textproto.MIMEHeader(msg.Header), nil

437}

438

439var wordDecoder = mime.WordDecoder{

440 CharsetReader: func(charset string, r io.Reader) (io.Reader, error) {

441 switch strings.ToLower(charset) {

442 case "", "us-ascii", "utf-8":

443 return r, nil

444 }

445 enc, _ := ianaindex.MIME.Encoding(charset)

446 if enc == nil {

447 enc, _ = ianaindex.IANA.Encoding(charset)

448 }

449 if enc == nil {

450 return r, fmt.Errorf("unknown charset %q", charset)

451 }

452 return enc.NewDecoder().Reader(r), nil

453 },

454}

455

456func parseEnvelope(log mlog.Log, h mail.Header) (*Envelope, error) {

457 date, _ := h.Date()

458

459 // We currently marshal this field to JSON. But JSON cannot represent all

460 // time.Time. Time zone of 24:00 was seen in the wild. We won't try for extreme

461 // years, but we can readjust timezones.

462 // todo: remove this once we no longer store using json.

463 _, offset := date.Zone()

464 if date.Year() > 9999 {

465 date = time.Time{}

466 } else if offset <= -24*3600 || offset >= 24*3600 {

467 date = time.Unix(date.Unix(), 0).UTC()

468 }

469

470 subject := h.Get("Subject")

471 if s, err := wordDecoder.DecodeHeader(subject); err == nil {

472 subject = s

473 }

474

475 env := &Envelope{

476 date,

477 subject,

478 parseAddressList(log, h, "from"),

479 parseAddressList(log, h, "sender"),

480 parseAddressList(log, h, "reply-to"),

481 parseAddressList(log, h, "to"),

482 parseAddressList(log, h, "cc"),

483 parseAddressList(log, h, "bcc"),

484 h.Get("In-Reply-To"),

485 h.Get("Message-Id"),

486 }

487 return env, nil

488}

489

490func parseAddressList(log mlog.Log, h mail.Header, k string) []Address {

491 // todo: possibly work around ios mail generating incorrect q-encoded "phrases" with unencoded double quotes? ../rfc/2047:382

492 l, err := h.AddressList(k)

493 if err != nil {

494 return nil

495 }

496 var r []Address

497 for _, a := range l {

498 // todo: parse more fully according to ../rfc/5322:959

499 var user, host string

500 addr, err := smtp.ParseAddress(a.Address)

501 if err != nil {

502 log.Infox("parsing address (continuing)", err, slog.Any("address", a.Address))

503 } else {

504 user = addr.Localpart.String()

505 host = addr.Domain.ASCII

506 }

507 r = append(r, Address{a.Name, user, host})

508 }

509 return r

510}

511

512// ParseNextPart parses the next (sub)part of this multipart message.

513// ParseNextPart returns io.EOF and a nil part when there are no more parts.

514// Only used for initial parsing of message. Once parsed, use p.Parts.

515func (p *Part) ParseNextPart(elog *slog.Logger) (*Part, error) {

516 log := mlog.New("message", elog)

517

518 if len(p.bound) == 0 {

519 return nil, errNotMultipart

520 }

521 if p.nextBoundOffset == -1 {

522 if enforceSequential {

523 panic("access not sequential")

524 }

525 // Set nextBoundOffset by fully reading the last part.

526 last, err := newPart(log, p.strict, p.r, p.lastBoundOffset, p)

527 if err != nil {

528 return nil, err

529 }

530 if _, err := io.Copy(io.Discard, last.RawReader()); err != nil {

531 return nil, err

532 }

533 if p.nextBoundOffset == -1 {

534 return nil, fmt.Errorf("internal error: reading part did not set nextBoundOffset")

535 }

536 }

537 b := &bufAt{strict: p.strict, r: p.r, offset: p.nextBoundOffset}

538 // todo: should we require a crlf on final closing bound? we don't require it because some message/rfc822 don't have a crlf after their closing boundary, so those messages don't end in crlf.

539 line, crlf, err := b.ReadLine(false)

540 if err != nil {

541 return nil, err

542 }

543 if match, finish := checkBound(line, p.bound); !match {

544 return nil, fmt.Errorf("expected bound, got %q", line)

545 } else if finish {

546 // Read any trailing data.

547 if p.parent != nil {

548 for {

549 line, _, err := b.PeekLine(false)

550 if err != nil {

551 break

552 }

553 if match, _ := checkBound(line, p.parent.bound); match {

554 break

555 }

556 b.ReadLine(false)

557 }

558 if p.parent.lastBoundOffset == p.BoundaryOffset {

559 p.parent.nextBoundOffset = b.offset

560 }

561 }

562 p.EndOffset = b.offset

563 return nil, io.EOF

564 } else if !crlf {

565 return nil, fmt.Errorf("non-finishing bound without crlf: %w", errUnexpectedEOF)

566 }

567 boundOffset := p.nextBoundOffset

568 p.lastBoundOffset = boundOffset

569 p.nextBoundOffset = -1

570 np, err := newPart(log, p.strict, p.r, boundOffset, p)

571 if err != nil {

572 return nil, err

573 }

574 p.Parts = append(p.Parts, np)

575 return &p.Parts[len(p.Parts)-1], nil

576}

577

578// Reader returns a reader for the decoded body content.

579func (p *Part) Reader() io.Reader {

580 return p.bodyReader(p.RawReader())

581}

582

583// ReaderUTF8OrBinary returns a reader for the decoded body content, transformed to

584// utf-8 for known mime/iana encodings (only if they aren't us-ascii or utf-8

585// already). For unknown or missing character sets/encodings, the original reader

586// is returned.

587func (p *Part) ReaderUTF8OrBinary() io.Reader {

588 return DecodeReader(p.ContentTypeParams["charset"], p.Reader())

589}

590

591func (p *Part) bodyReader(r io.Reader) io.Reader {

592 r = newDecoder(p.ContentTransferEncoding, r)

593 if p.MediaType == "TEXT" {

594 return &textReader{p, bufio.NewReader(r), 0, false}

595 }

596 return &countReader{p, r, 0}

597}

598

599// countReader is an io.Reader that passes Reads to the underlying reader.

600// when eof is read, it sets p.DecodedSize to the number of bytes returned.

601type countReader struct {

602 p *Part

603 r io.Reader

604 count int64

605}

606

607func (cr *countReader) Read(buf []byte) (int, error) {

608 n, err := cr.r.Read(buf)

609 if n >= 0 {

610 cr.count += int64(n)

611 }

612 if err == io.EOF {

613 cr.p.DecodedSize = cr.count

614 }

615 return n, err

616}

617

618// textReader is an io.Reader that ensures all lines return end in CRLF.

619// when eof is read from the underlying reader, it sets p.DecodedSize.

620type textReader struct {

621 p *Part

622 r *bufio.Reader

623 count int64

624 prevcr bool // If previous byte returned was a CR.

625}

626

627func (tr *textReader) Read(buf []byte) (int, error) {

628 o := 0

629 for o < len(buf) {

630 c, err := tr.r.ReadByte()

631 if err != nil {

632 tr.count += int64(o)

633 tr.p.DecodedSize = tr.count

634 return o, err

635 }

636 if c == '\n' && !tr.prevcr {

637 buf[o] = '\r'

638 o++

639 tr.prevcr = true

640 tr.r.UnreadByte()

641 continue

642 }

643 buf[o] = c

644 tr.prevcr = c == '\r'

645 o++

646 }

647 tr.count += int64(o)

648 return o, nil

649}

650

651func newDecoder(cte string, r io.Reader) io.Reader {

652 // ../rfc/2045:775

653 switch cte {

654 case "BASE64":

655 return base64.NewDecoder(base64.StdEncoding, r)

656 case "QUOTED-PRINTABLE":

657 return quotedprintable.NewReader(r)

658 }

659 return r

660}

661

662// RawReader returns a reader for the raw, undecoded body content. E.g. with

663// quoted-printable or base64 content intact.

664// Fully reading a part helps its parent part find its next part efficiently.

665func (p *Part) RawReader() io.Reader {

666 if p.r == nil {

667 panic("missing reader")

668 }

669 if p.EndOffset >= 0 {

670 return &crlfReader{strict: p.strict, r: io.NewSectionReader(p.r, p.BodyOffset, p.EndOffset-p.BodyOffset)}

671 }

672 p.RawLineCount = 0

673 if p.parent == nil {

674 return &offsetReader{p, p.BodyOffset, p.strict, true, false, 0}

675 }

676 return &boundReader{p: p, b: &bufAt{strict: p.strict, r: p.r, offset: p.BodyOffset}, prevlf: true}

677}

678

679// crlfReader verifies there are no bare newlines and optionally no bare carriage returns.

680type crlfReader struct {

681 r io.Reader

682 strict bool

683 prevcr bool

684}

685

686func (r *crlfReader) Read(buf []byte) (int, error) {

687 n, err := r.r.Read(buf)

688 if err == nil || err == io.EOF {

689 for _, b := range buf[:n] {

690 if b == '\n' && !r.prevcr {

691 err = errBareLF

692 break

693 } else if b != '\n' && r.prevcr && (r.strict || Pedantic) {

694 err = errBareCR

695 break

696 }

697 r.prevcr = b == '\r'

698 }

699 }

700 return n, err

701}

702

703// bufAt is a buffered reader on an underlying ReaderAt.

704// bufAt verifies that lines end with crlf.

705type bufAt struct {

706 offset int64 // Offset in r currently consumed, i.e. not including any buffered data.

707

708 strict bool

709 r io.ReaderAt

710 buf []byte // Buffered data.

711 nbuf int // Valid bytes in buf.

712 scratch []byte

713}

714

715// Messages should not have lines longer than 78+2 bytes, and must not have

716// lines longer than 998+2 bytes. But in practice they have longer lines. We

717// have a higher limit, but for when parsing with strict we check for the 1000

718// bytes limit.

719// ../rfc/5321:3512

720const maxLineLength = 8 * 1024

721

722func (b *bufAt) maxLineLength() int {

723 if b.strict || Pedantic {

724 return 1000

725 }

726 return maxLineLength

727}

728

729// ensure makes sure b.nbuf is up to maxLineLength, unless eof is encountered.

730func (b *bufAt) ensure() error {

731 for _, c := range b.buf[:b.nbuf] {

732 if c == '\n' {

733 return nil

734 }

735 }

736 if b.scratch == nil {

737 b.scratch = make([]byte, b.maxLineLength())

738 }

739 if b.buf == nil {

740 b.buf = make([]byte, b.maxLineLength())

741 }

742 for b.nbuf < b.maxLineLength() {

743 n, err := b.r.ReadAt(b.buf[b.nbuf:], b.offset+int64(b.nbuf))

744 if n > 0 {

745 b.nbuf += n

746 }

747 if err != nil && err != io.EOF || err == io.EOF && b.nbuf+n == 0 {

748 return err

749 }

750 if n == 0 || err == io.EOF {

751 break

752 }

753 }

754 return nil

755}

756

757// ReadLine reads a line until \r\n is found, returning the line including \r\n.

758// If not found, or a bare \n is encountered, or a bare \r is enountered in pedantic mode, ReadLine returns an error.

759func (b *bufAt) ReadLine(requirecrlf bool) (buf []byte, crlf bool, err error) {

760 return b.line(true, requirecrlf)

761}

762

763func (b *bufAt) PeekLine(requirecrlf bool) (buf []byte, crlf bool, err error) {

764 return b.line(false, requirecrlf)

765}

766

767func (b *bufAt) line(consume, requirecrlf bool) (buf []byte, crlf bool, err error) {

768 if err := b.ensure(); err != nil {

769 return nil, false, err

770 }

771 for i, c := range b.buf[:b.nbuf] {

772 if c == '\n' {

773 // Should have seen a \r, which should have been handled below.

774 return nil, false, errBareLF

775 }

776 if c != '\r' {

777 continue

778 }

779 i++

780 if i >= b.nbuf || b.buf[i] != '\n' {

781 if b.strict || Pedantic {

782 return nil, false, errBareCR

783 }

784 continue

785 }

786 b.scratch = b.scratch[:i+1]

787 copy(b.scratch, b.buf[:i+1])

788 if consume {

789 copy(b.buf, b.buf[i+1:])

790 b.offset += int64(i + 1)

791 b.nbuf -= i + 1

792 }

793 return b.scratch, true, nil

794 }

795 if b.nbuf >= b.maxLineLength() {

796 return nil, false, errLineTooLong

797 }

798 if requirecrlf {

799 return nil, false, errUnexpectedEOF

800 }

801 b.scratch = b.scratch[:b.nbuf]

802 copy(b.scratch, b.buf[:b.nbuf])

803 if consume {

804 b.offset += int64(b.nbuf)

805 b.nbuf = 0

806 }

807 return b.scratch, false, nil

808}

809

810// PeekByte returns the next unread byte, or an error.

811func (b *bufAt) PeekByte() (byte, error) {

812 if err := b.ensure(); err != nil {

813 return 0, err

814 }

815 if b.nbuf == 0 {

816 return 0, io.EOF

817 }

818 return b.buf[0], nil

819}

820

821// offsetReader reads from p.r starting from offset, and RawLineCount on p.

822// offsetReader validates lines end with \r\n.

823type offsetReader struct {

824 p *Part

825 offset int64

826 strict bool

827 prevlf bool

828 prevcr bool

829 linelength int

830}

831

832func (r *offsetReader) Read(buf []byte) (int, error) {

833 n, err := r.p.r.ReadAt(buf, r.offset)

834 if n > 0 {

835 r.offset += int64(n)

836 max := maxLineLength

837 if r.strict || Pedantic {

838 max = 1000

839 }

840

841 for _, c := range buf[:n] {

842 if r.prevlf {

843 r.p.RawLineCount++

844 }

845 if err == nil || err == io.EOF {

846 if c == '\n' && !r.prevcr {

847 err = errBareLF

848 } else if c != '\n' && r.prevcr && (r.strict || Pedantic) {

849 err = errBareCR

850 }

851 }

852 r.prevlf = c == '\n'

853 r.prevcr = c == '\r'

854 r.linelength++

855 if c == '\n' {

856 r.linelength = 0

857 } else if r.linelength > max && err == nil {

858 err = errLineTooLong

859 }

860 }

861 }

862 if err == io.EOF {

863 r.p.EndOffset = r.offset

864 }

865 return n, err

866}

867

868var crlf = []byte("\r\n")

869

870// boundReader is a reader that stops at a closing multipart boundary.

871// boundReader ensures lines end with crlf through its use of bufAt.

872type boundReader struct {

873 p *Part

874 b *bufAt

875 buf []byte // Data from previous line, to be served first.

876 nbuf int // Number of valid bytes in buf.

877 crlf []byte // Possible crlf, to be returned if we do not yet encounter a boundary.

878 prevlf bool // If last char returned was a newline. For counting lines.

879}

880

881func (b *boundReader) Read(buf []byte) (count int, rerr error) {

882 origBuf := buf

883 defer func() {

884 if count > 0 {

885 for _, c := range origBuf[:count] {

886 if b.prevlf {

887 b.p.RawLineCount++

888 }

889 b.prevlf = c == '\n'

890 }

891 }

892 }()

893

894 for {

895 // Read data from earlier line.

896 if b.nbuf > 0 {

897 n := b.nbuf

898 if n > len(buf) {

899 n = len(buf)

900 }

901 copy(buf, b.buf[:n])

902 copy(b.buf, b.buf[n:])

903 buf = buf[n:]

904 b.nbuf -= n

905 count += n

906 if b.nbuf > 0 {

907 break

908 }

909 }

910

911 // Look at next line. If it is a boundary, we are done and won't serve the crlf from the last line.

912 line, _, err := b.b.PeekLine(false)

913 if match, _ := checkBound(line, b.p.parent.bound); match {

914 b.p.EndOffset = b.b.offset - int64(len(b.crlf))

915 if b.p.parent.lastBoundOffset == b.p.BoundaryOffset {

916 b.p.parent.nextBoundOffset = b.b.offset

917 } else if enforceSequential {

918 panic("access not sequential")

919 }

920 return count, io.EOF

921 }

922 if err == io.EOF {

923 err = errMissingClosingBoundary

924 }

925 if err != nil && err != io.EOF {

926 return count, err

927 }

928 if len(b.crlf) > 0 {

929 n := len(b.crlf)

930 if n > len(buf) {

931 n = len(buf)

932 }

933 copy(buf, b.crlf[:n])

934 count += n

935 buf = buf[n:]

936 b.crlf = b.crlf[n:]

937 }

938 if len(buf) == 0 {

939 break

940 }

941 line, _, err = b.b.ReadLine(true)

942 if err != nil {

943 // Could be an unexpected end of the part.

944 return 0, err

945 }

946 b.crlf = crlf // crlf will be read next time, but not if a boundary follows.

947 n := len(line) - 2

948 line = line[:n]

949 if n > len(buf) {

950 n = len(buf)

951 }

952 copy(buf, line[:n])

953 count += n

954 buf = buf[n:]

955 line = line[n:]

956 if len(line) > 0 {

957 if b.buf == nil {

958 b.buf = make([]byte, b.b.maxLineLength())

959 }

960 copy(b.buf, line)

961 b.nbuf = len(line)

962 }

963 }

964 return count, nil

965}

966

967func checkBound(line, bound []byte) (bool, bool) {

968 if !bytes.HasPrefix(line, bound) {

969 return false, false

970 }

971 line = line[len(bound):]

972 if bytes.HasPrefix(line, []byte("--")) {

973 return true, true

974 }

975 if len(line) == 0 {

976 return true, false

977 }

978 c := line[0]

979 switch c {

980 case ' ', '\t', '\r', '\n':

981 return true, false

982 }

983 return false, false

984}

985