Parser crashes on malformed header folding with misleading datetime error #1649

Environment

• Mail 2.9.0 (latest release)
• Ruby 3.2.2 (2023-03-30 revision e51014f9c0)
• Rails 7.1.5.2 w/ ActionMailbox

Problem

I've been seeing ArgumentError: string length (X) exceeds the limit 128 errors in Sidekiq when ActionMailbox processes certain incoming emails. Took a while to track down, but it's triggered by malformed emails that have leading whitespace before header field names.

Yeah, these emails are technically invalid per RFC 5322, but they're all over the place in spam/phishing emails, and the error is pretty misleading.

What happens

ArgumentError: string length (238) exceeds the limit 128
datetime = ::DateTime.parse(stripped)
                            ^^^^^^^^

The error mentions datetime parsing, but that's not really what's wrong. Turns out when there's a leading space before a header like From:, the parser treats it as header folding and concatenates it with the previous header. If that previous header is Date:, it then tries to parse the whole mess as a datetime and hits the 128-char limit.

The actual issue is the malformed header, but you wouldn't know that from the error message.

Reproduction

require 'mail'

raw_email = <<~EMAIL
To: "IN NUR 7 TAGEN AUF 500.000 EUR MIT KRYPTO https://chatahamor.123u.sk/jmp/239,https://telegra.ph/nmz-09-29?5427" <recipient@example.com>
Subject: =?us-ascii?Q?Congratulations!_Your_registration_was_successf?=  =?us-ascii?Q?ul?=
Date: Thu, 2 Oct 2025 13:05:38 +0100
 From: Securedmarketsoption <support@example.com>
 Message-ID: <6TnWk1vHKXmQlRvlWMJXa3ohVSsmyG4OQ4Yp2zTQ@www.example.com>
 MIME-Version: 1.0
 Content-Type: text/html; charset=iso-8859-1

Test body
EMAIL

Mail.new(raw_email)
# => ArgumentError: string length (212) exceeds the limit 128
#    datetime = ::DateTime.parse(stripped)

The combination of the encoded Subject, long To display name, and malformed header folding (leading spaces before From:, Message-ID:, etc.) triggers it. The parser treats those indented lines as continuations of the Date header and tries to parse the whole concatenated mess as a datetime.

Example from the wild

Here's the actual phishing email that first surfaced this:

To: "IN NUR 7 TAGEN AUF 500.000 EUR MIT KRYPTO https://example.com/..." <user@example.com>
Subject: =?us-ascii?Q?Congratulations!_Your_registration_was_successf?=  =?us-ascii?Q?ul?=
Date: Thu, 2 Oct 2025 13:05:38 +0100
 From: Spammer <support@example.com>
 Message-ID: <test123@example.com>
 MIME-Version: 1.0
 Content-Type: text/html; charset=iso-8859-1

Multiple headers with leading spaces, all get folded into the Date header, parser explodes.

Possible fixes

Not sure what the right approach is here. Options:

1. Better error message that actually says "malformed headers" instead of the datetime thing
2. More lenient parsing that can recover from this kind of junk
3. At least catch this specific case and fail with something comprehensible

For context, this matters because if you're running ActionMailbox or similar, you don't control what comes in. Spam is full of malformed emails and taking down Sidekiq jobs over it is annoying.