@bobfrankston/mailx 1.0.1

package/packages/mailx-api/node_modules/nodemailer/lib/addressparser/index.js

@@ -0,0 +1,383 @@
+'use strict';
+
+/**
+ * Converts tokens for a single address into an address object
+ *
+ * @param {Array} tokens Tokens object
+ * @param {Number} depth Current recursion depth for nested group protection
+ * @return {Object} Address object
+ */
+function _handleAddress(tokens, depth) {
+    let isGroup = false;
+    let state = 'text';
+    let address;
+    let addresses = [];
+    let data = {
+        address: [],
+        comment: [],
+        group: [],
+        text: [],
+        textWasQuoted: [] // Track which text tokens came from inside quotes
+    };
+    let i;
+    let len;
+    let insideQuotes = false; // Track if we're currently inside a quoted string
+
+    // Filter out <addresses>, (comments) and regular text
+    for (i = 0, len = tokens.length; i < len; i++) {
+        let token = tokens[i];
+        let prevToken = i ? tokens[i - 1] : null;
+        if (token.type === 'operator') {
+            switch (token.value) {
+                case '<':
+                    state = 'address';
+                    insideQuotes = false;
+                    break;
+                case '(':
+                    state = 'comment';
+                    insideQuotes = false;
+                    break;
+                case ':':
+                    state = 'group';
+                    isGroup = true;
+                    insideQuotes = false;
+                    break;
+                case '"':
+                    // Track quote state for text tokens
+                    insideQuotes = !insideQuotes;
+                    state = 'text';
+                    break;
+                default:
+                    state = 'text';
+                    insideQuotes = false;
+                    break;
+            }
+        } else if (token.value) {
+            if (state === 'address') {
+                // handle use case where unquoted name includes a "<"
+                // Apple Mail truncates everything between an unexpected < and an address
+                // and so will we
+                token.value = token.value.replace(/^[^<]*<\s*/, '');
+            }
+
+            if (prevToken && prevToken.noBreak && data[state].length) {
+                // join values
+                data[state][data[state].length - 1] += token.value;
+                if (state === 'text' && insideQuotes) {
+                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+                }
+            } else {
+                data[state].push(token.value);
+                if (state === 'text') {
+                    data.textWasQuoted.push(insideQuotes);
+                }
+            }
+        }
+    }
+
+    // If there is no text but a comment, replace the two
+    if (!data.text.length && data.comment.length) {
+        data.text = data.comment;
+        data.comment = [];
+    }
+
+    if (isGroup) {
+        // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
+        data.text = data.text.join(' ');
+
+        // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
+        let groupMembers = [];
+        if (data.group.length) {
+            let parsedGroup = addressparser(data.group.join(','), { _depth: depth + 1 });
+            // Flatten: if any member is itself a group, extract its members into the sequence
+            parsedGroup.forEach(member => {
+                if (member.group) {
+                    // Nested group detected - flatten it by adding its members directly
+                    groupMembers = groupMembers.concat(member.group);
+                } else {
+                    groupMembers.push(member);
+                }
+            });
+        }
+
+        addresses.push({
+            name: data.text || (address && address.name),
+            group: groupMembers
+        });
+    } else {
+        // If no address was found, try to detect one from regular text
+        if (!data.address.length && data.text.length) {
+            for (i = data.text.length - 1; i >= 0; i--) {
+                // Security fix: Do not extract email addresses from quoted strings
+                // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com
+                // Extracting emails from quoted text leads to misrouting vulnerabilities
+                if (!data.textWasQuoted[i] && data.text[i].match(/^[^@\s]+@[^@\s]+$/)) {
+                    data.address = data.text.splice(i, 1);
+                    data.textWasQuoted.splice(i, 1);
+                    break;
+                }
+            }
+
+            let _regexHandler = function (address) {
+                if (!data.address.length) {
+                    data.address = [address.trim()];
+                    return ' ';
+                } else {
+                    return address;
+                }
+            };
+
+            // still no address
+            if (!data.address.length) {
+                for (i = data.text.length - 1; i >= 0; i--) {
+                    // Security fix: Do not extract email addresses from quoted strings
+                    if (!data.textWasQuoted[i]) {
+                        // fixed the regex to parse email address correctly when email address has more than one @
+                        data.text[i] = data.text[i].replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, _regexHandler).trim();
+                        if (data.address.length) {
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+
+        // If there's still is no text but a comment exixts, replace the two
+        if (!data.text.length && data.comment.length) {
+            data.text = data.comment;
+            data.comment = [];
+        }
+
+        // Keep only the first address occurence, push others to regular text
+        if (data.address.length > 1) {
+            data.text = data.text.concat(data.address.splice(1));
+        }
+
+        // Join values with spaces
+        data.text = data.text.join(' ');
+        data.address = data.address.join(' ');
+
+        if (!data.address && isGroup) {
+            return [];
+        } else {
+            address = {
+                address: data.address || data.text || '',
+                name: data.text || data.address || ''
+            };
+
+            if (address.address === address.name) {
+                if ((address.address || '').match(/@/)) {
+                    address.name = '';
+                } else {
+                    address.address = '';
+                }
+            }
+
+            addresses.push(address);
+        }
+    }
+
+    return addresses;
+}
+
+/**
+ * Creates a Tokenizer object for tokenizing address field strings
+ *
+ * @constructor
+ * @param {String} str Address field string
+ */
+class Tokenizer {
+    constructor(str) {
+        this.str = (str || '').toString();
+        this.operatorCurrent = '';
+        this.operatorExpecting = '';
+        this.node = null;
+        this.escaped = false;
+
+        this.list = [];
+        /**
+         * Operator tokens and which tokens are expected to end the sequence
+         */
+        this.operators = {
+            '"': '"',
+            '(': ')',
+            '<': '>',
+            ',': '',
+            ':': ';',
+            // Semicolons are not a legal delimiter per the RFC2822 grammar other
+            // than for terminating a group, but they are also not valid for any
+            // other use in this context.  Given that some mail clients have
+            // historically allowed the semicolon as a delimiter equivalent to the
+            // comma in their UI, it makes sense to treat them the same as a comma
+            // when used outside of a group.
+            ';': ''
+        };
+    }
+
+    /**
+     * Tokenizes the original input string
+     *
+     * @return {Array} An array of operator|text tokens
+     */
+    tokenize() {
+        let list = [];
+
+        for (let i = 0, len = this.str.length; i < len; i++) {
+            let chr = this.str.charAt(i);
+            let nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
+            this.checkChar(chr, nextChr);
+        }
+
+        this.list.forEach(node => {
+            node.value = (node.value || '').toString().trim();
+            if (node.value) {
+                list.push(node);
+            }
+        });
+
+        return list;
+    }
+
+    /**
+     * Checks if a character is an operator or text and acts accordingly
+     *
+     * @param {String} chr Character from the address field
+     */
+    checkChar(chr, nextChr) {
+        if (this.escaped) {
+            // ignore next condition blocks
+        } else if (chr === this.operatorExpecting) {
+            this.node = {
+                type: 'operator',
+                value: chr
+            };
+
+            if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
+                this.node.noBreak = true;
+            }
+
+            this.list.push(this.node);
+            this.node = null;
+            this.operatorExpecting = '';
+            this.escaped = false;
+
+            return;
+        } else if (!this.operatorExpecting && chr in this.operators) {
+            this.node = {
+                type: 'operator',
+                value: chr
+            };
+            this.list.push(this.node);
+            this.node = null;
+            this.operatorExpecting = this.operators[chr];
+            this.escaped = false;
+            return;
+        } else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+            this.escaped = true;
+            return;
+        }
+
+        if (!this.node) {
+            this.node = {
+                type: 'text',
+                value: ''
+            };
+            this.list.push(this.node);
+        }
+
+        if (chr === '\n') {
+            // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
+            // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
+            chr = ' ';
+        }
+
+        if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
+            // skip command bytes
+            this.node.value += chr;
+        }
+
+        this.escaped = false;
+    }
+}
+
+/**
+ * Maximum recursion depth for parsing nested groups.
+ * RFC 5322 doesn't allow nested groups, so this is a safeguard against
+ * malicious input that could cause stack overflow.
+ */
+const MAX_NESTED_GROUP_DEPTH = 50;
+
+/**
+ * Parses structured e-mail addresses from an address field
+ *
+ * Example:
+ *
+ *    'Name <address@domain>'
+ *
+ * will be converted to
+ *
+ *     [{name: 'Name', address: 'address@domain'}]
+ *
+ * @param {String} str Address field
+ * @param {Object} options Optional options object
+ * @param {Number} options._depth Internal recursion depth counter (do not set manually)
+ * @return {Array} An array of address objects
+ */
+function addressparser(str, options) {
+    options = options || {};
+    let depth = options._depth || 0;
+
+    // Prevent stack overflow from deeply nested groups (DoS protection)
+    if (depth > MAX_NESTED_GROUP_DEPTH) {
+        return [];
+    }
+
+    let tokenizer = new Tokenizer(str);
+    let tokens = tokenizer.tokenize();
+
+    let addresses = [];
+    let address = [];
+    let parsedAddresses = [];
+
+    tokens.forEach(token => {
+        if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
+            if (address.length) {
+                addresses.push(address);
+            }
+            address = [];
+        } else {
+            address.push(token);
+        }
+    });
+
+    if (address.length) {
+        addresses.push(address);
+    }
+
+    addresses.forEach(address => {
+        address = _handleAddress(address, depth);
+        if (address.length) {
+            parsedAddresses = parsedAddresses.concat(address);
+        }
+    });
+
+    if (options.flatten) {
+        let addresses = [];
+        let walkAddressList = list => {
+            list.forEach(address => {
+                if (address.group) {
+                    return walkAddressList(address.group);
+                } else {
+                    addresses.push(address);
+                }
+            });
+        };
+        walkAddressList(parsedAddresses);
+        return addresses;
+    }
+
+    return parsedAddresses;
+}
+
+// expose to the world
+module.exports = addressparser;

package/packages/mailx-api/node_modules/nodemailer/lib/base64/index.js

@@ -0,0 +1,139 @@
+'use strict';
+
+const Transform = require('stream').Transform;
+
+/**
+ * Encodes a Buffer into a base64 encoded string
+ *
+ * @param {Buffer} buffer Buffer to convert
+ * @returns {String} base64 encoded string
+ */
+function encode(buffer) {
+    if (typeof buffer === 'string') {
+        buffer = Buffer.from(buffer, 'utf-8');
+    }
+
+    return buffer.toString('base64');
+}
+
+/**
+ * Adds soft line breaks to a base64 string
+ *
+ * @param {String} str base64 encoded string that might need line wrapping
+ * @param {Number} [lineLength=76] Maximum allowed length for a line
+ * @returns {String} Soft-wrapped base64 encoded string
+ */
+function wrap(str, lineLength) {
+    str = (str || '').toString();
+    lineLength = lineLength || 76;
+
+    if (str.length <= lineLength) {
+        return str;
+    }
+
+    let result = [];
+    let pos = 0;
+    let chunkLength = lineLength * 1024;
+    while (pos < str.length) {
+        let wrappedLines = str.substr(pos, chunkLength).replace(new RegExp('.{' + lineLength + '}', 'g'), '$&\r\n');
+        result.push(wrappedLines);
+        pos += chunkLength;
+    }
+
+    return result.join('');
+}
+
+/**
+ * Creates a transform stream for encoding data to base64 encoding
+ *
+ * @constructor
+ * @param {Object} options Stream options
+ * @param {Number} [options.lineLength=76] Maximum length for lines, set to false to disable wrapping
+ */
+class Encoder extends Transform {
+    constructor(options) {
+        super();
+        this.options = options || {};
+
+        if (this.options.lineLength !== false) {
+            this.options.lineLength = this.options.lineLength || 76;
+        }
+
+        this._curLine = '';
+        this._remainingBytes = false;
+
+        this.inputBytes = 0;
+        this.outputBytes = 0;
+    }
+
+    _transform(chunk, encoding, done) {
+        if (encoding !== 'buffer') {
+            chunk = Buffer.from(chunk, encoding);
+        }
+
+        if (!chunk || !chunk.length) {
+            return setImmediate(done);
+        }
+
+        this.inputBytes += chunk.length;
+
+        if (this._remainingBytes && this._remainingBytes.length) {
+            chunk = Buffer.concat([this._remainingBytes, chunk], this._remainingBytes.length + chunk.length);
+            this._remainingBytes = false;
+        }
+
+        if (chunk.length % 3) {
+            this._remainingBytes = chunk.slice(chunk.length - (chunk.length % 3));
+            chunk = chunk.slice(0, chunk.length - (chunk.length % 3));
+        } else {
+            this._remainingBytes = false;
+        }
+
+        let b64 = this._curLine + encode(chunk);
+
+        if (this.options.lineLength) {
+            b64 = wrap(b64, this.options.lineLength);
+
+            let lastLF = b64.lastIndexOf('\n');
+            if (lastLF < 0) {
+                this._curLine = b64;
+                b64 = '';
+            } else {
+                this._curLine = b64.substring(lastLF + 1);
+                b64 = b64.substring(0, lastLF + 1);
+
+                if (b64 && !b64.endsWith('\r\n')) {
+                    b64 += '\r\n';
+                }
+            }
+        } else {
+            this._curLine = '';
+        }
+
+        if (b64) {
+            this.outputBytes += b64.length;
+            this.push(Buffer.from(b64, 'ascii'));
+        }
+
+        setImmediate(done);
+    }
+
+    _flush(done) {
+        if (this._remainingBytes && this._remainingBytes.length) {
+            this._curLine += encode(this._remainingBytes);
+        }
+
+        if (this._curLine) {
+            this.outputBytes += this._curLine.length;
+            this.push(Buffer.from(this._curLine, 'ascii'));
+            this._curLine = '';
+        }
+        done();
+    }
+}
+
+module.exports = {
+    encode,
+    wrap,
+    Encoder
+};