@mavogel/awscdk-rootmail 0.0.326 → 0.0.328

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [3.9.4](https://github.com/nodemailer/mailparser/compare/v3.9.3...v3.9.4) (2026-03-09)
+
+
+### Bug Fixes
+
+* bump nodemailer to 8.0.2 for unquoted comma-in-display-name parsing ([dd71f08](https://github.com/nodemailer/mailparser/commit/dd71f0817fb229aa1ffb421b9384704e550993ca))
+* filter false values from empty References headers ([9884e5d](https://github.com/nodemailer/mailparser/commit/9884e5dd34b9dff9a45f6c205281a50d702a23b1)), closes [#385](https://github.com/nodemailer/mailparser/issues/385)
+* prevent RFC 2047 encoded-word address fabrication in decodeAddresses ([08b800c](https://github.com/nodemailer/mailparser/commit/08b800cd1c5a2ec2341ad4c7f25dc65f584b3999))
+
+## [3.9.3](https://github.com/nodemailer/mailparser/compare/v3.9.2...v3.9.3) (2026-01-28)
+
+
+### Bug Fixes
+
+* escape URLs and link text in textToHtml to prevent XSS ([921a67d](https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08)), closes [#412](https://github.com/nodemailer/mailparser/issues/412)
+
+## [3.9.2](https://github.com/nodemailer/mailparser/compare/v3.9.1...v3.9.2) (2026-01-28)
+
+
+### Bug Fixes
+
+* Bumpe deps ([508bcf7](https://github.com/nodemailer/mailparser/commit/508bcf75eb36cfd45600d73eacd7ad1e50fc7466))
+
+## [3.9.1](https://github.com/nodemailer/mailparser/compare/v3.9.0...v3.9.1) (2025-12-11)
+
+
+### Bug Fixes
+
+* update dependencies ([6879d1b](https://github.com/nodemailer/mailparser/commit/6879d1bd7969cd4cc1e1480b4a5acd0215b3cd6c))
+
 ## [3.9.0](https://github.com/nodemailer/mailparser/compare/v3.8.1...v3.9.0) (2025-11-05)
 
 

package/node_modules/mailparser/README.md

@@ -2,11 +2,10 @@
 
 ![Nodemailer](https://raw.githubusercontent.com/nodemailer/nodemailer/master/assets/nm_logo_200x136.png)
 
-Advanced email parser for Node.js. Everything is handled as a stream which should make it able to parse even very large messages (100MB+) with relatively low overhead.
-
-## Looking for a front-end solution?
+> [!IMPORTANT]
+> This module is in maintenance mode. It will continue to receive security updates and critical bug fixes, but no new features or feature changes will be added. For new projects, please consider using [PostalMime](https://github.com/postalsys/postal-mime), which works in both Node.js and browser environments.
 
-_mailparser_ is Node.js only library, so you can't use it reliably in the front-end or bundle with WebPack. If you do need a solution to parse emails in the front-end then use [PostalMime](https://www.npmjs.com/package/postal-mime).
+Advanced email parser for Node.js. Everything is handled as a stream which should make it able to parse even very large messages (100MB+) with relatively low overhead.
 
 ## Installation
 

package/node_modules/mailparser/lib/mail-parser.js

@@ -348,7 +348,7 @@ class MailParser extends Transform {
                     } catch (E) {
                         // ignore
                     }
-                    value = value.split(/\s+/).map(this.ensureMessageIDFormat);
+                    value = value.split(/\s+/).map(this.ensureMessageIDFormat).filter(val => val);
                     break;
                 case 'message-id':
                 case 'in-reply-to':
@@ -526,18 +526,30 @@ class MailParser extends Transform {
             address.name = (address.name || '').toString().trim();
 
             if (!address.address && /^(=\?([^?]+)\?[Bb]\?[^?]*\?=)(\s*=\?([^?]+)\?[Bb]\?[^?]*\?=)*$/.test(address.name) && !processedAddress.has(address)) {
-                let parsed = addressparser(this.libmime.decodeWords(address.name));
-                if (parsed.length) {
-                    parsed.forEach(entry => {
-                        processedAddress.add(entry);
-                        addresses.push(entry);
-                    });
-                }
+                let decoded = this.libmime.decodeWords(address.name);
+                // Security fix: only re-parse if decoded text contains angle-bracket-delimited
+                // addresses (e.g. "Name <user@domain>"). Bare decoded text like "attacker@evil.com"
+                // must not be re-interpreted as an address -- RFC 2047 Section 5 prohibits
+                // encoded-words in addr-spec, and re-parsing fabricates addresses not present
+                // in the original header.
+                if (/<[^<>]+@[^<>]+>/.test(decoded)) {
+                    let parsed = addressparser(decoded);
+                    if (parsed.length) {
+                        parsed.forEach(entry => {
+                            processedAddress.add(entry);
+                            addresses.push(entry);
+                        });
+                    }
 
-                // remove current element
-                addresses.splice(i, 1);
-                i--;
-                continue;
+                    // remove current element
+                    addresses.splice(i, 1);
+                    i--;
+                    continue;
+                } else {
+                    // Treat decoded content as display name only
+                    address.name = decoded;
+                    continue;
+                }
             }
 
             if (address.name) {
@@ -547,6 +559,21 @@ class MailParser extends Transform {
                     //ignore, keep as is
                 }
             }
+            // Security fix: detect RFC 2047 encoded-words in the address field.
+            // Per RFC 2047 Section 5, encoded-words MUST NOT appear in addr-spec.
+            // If found, decode and validate; reject if result is not a simple local@domain.
+            if (address.address && /[=]\?[^?]+\?[BbQq]\?[^?]*\?[=]/.test(address.address)) {
+                try {
+                    let decodedAddr = this.libmime.decodeWords(address.address);
+                    if (/^[^\s@]+@[^\s@]+$/.test(decodedAddr) && !/[=]\?/.test(decodedAddr)) {
+                        address.address = decodedAddr;
+                    } else {
+                        address.address = '';
+                    }
+                } catch (E) {
+                    address.address = '';
+                }
+            }
             if (/@xn--/.test(address.address)) {
                 try {
                     address.address =
@@ -1129,7 +1156,11 @@ class MailParser extends Transform {
                             result.push(textPart);
                         }
 
-                        result.push(`<a href="${link.url}">${link.text}</a>`);
+                        // Escape quotes in URL to prevent XSS
+                        let safeUrl = link.url.replace(/"/g, '&quot;');
+                        // Escape HTML entities in link text
+                        let safeText = he.encode(link.text, { useNamedReferences: true });
+                        result.push(`<a href="${safeUrl}">${safeText}</a>`);
 
                         last = link.lastIndex;
                     });

package/node_modules/mailparser/node_modules/iconv-lite/lib/index.d.ts

@@ -1,41 +1,129 @@
-/*---------------------------------------------------------------------------------------------
+/* ---------------------------------------------------------------------------------------------
  *  Copyright (c) Microsoft Corporation. All rights reserved.
  *  Licensed under the MIT License.
  *  REQUIREMENT: This definition is dependent on the @types/node definition.
  *  Install with `npm install @types/node --save-dev`
- *--------------------------------------------------------------------------------------------*/
+ *-------------------------------------------------------------------------------------------- */
 
-declare module 'iconv-lite' {
-	// Basic API
-	export function decode(buffer: Buffer | Uint8Array, encoding: string, options?: Options): string;
+/* ---------------------------------------------------------------------------------------------
+ * This file provides detailed typings for the public API of iconv-lite
+ *-------------------------------------------------------------------------------------------- */
 
-	export function encode(content: string, encoding: string, options?: Options): Buffer;
+import type Stream = require("stream")
+import type { Encoding } from "../types/encodings"
 
-	export function encodingExists(encoding: string): boolean;
+declare namespace iconv {
+  export interface DecodeOptions {
+    /**
+     * Strip the Byte Order Mark (BOM) from the input,
+     * when decoding, if the codec is BOM-aware. @default true
+     */
+    stripBOM?: boolean;
+    /** Override the default endianness for `UTF-16` and `UTF-32` decodings. */
+    defaultEncoding?: "utf16be" | "utf32be";
+  }
 
-	// Stream API
-	export function decodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;
+  export interface EncodeOptions {
+    /**
+     * Add a Byte Order Mark (BOM) to the output, when encoding,
+     * if the codec is BOM-aware. @default false
+     */
+    addBOM?: boolean;
+    /** Override the default endianness for `UTF-32` encoding. */
+    defaultEncoding?: "utf32be";
+  }
 
-	export function encodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;
+  export interface EncoderStream {
+    write(str: string): Buffer;
+    end(): Buffer | undefined;
+  }
 
-	// Low-level stream APIs
-	export function getEncoder(encoding: string, options?: Options): EncoderStream;
+  export interface DecoderStream {
+    write(buf: Buffer): string;
+    end(): string | undefined;
+  }
 
-	export function getDecoder(encoding: string, options?: Options): DecoderStream;
-}
+  export interface Codec {
+    encoder: new (options?: EncodeOptions, codec?: Codec) => EncoderStream;
+    decoder: new (options?: DecodeOptions, codec?: Codec) => DecoderStream;
+    bomAware?: boolean;
+    [key: string]: any;
+  }
 
-export interface Options {
-    stripBOM?: boolean;
-    addBOM?: boolean;
-    defaultEncoding?: string;
-}
+  /** Encodes a `string` into a `Buffer`, using the provided `encoding`. */
+  export function encode (content: string, encoding: Encoding, options?: EncodeOptions): Buffer
 
-export interface EncoderStream {
-	write(str: string): Buffer;
-	end(): Buffer | undefined;
-}
+  /** Decodes a `Buffer` into a `string`, using the provided `encoding`. */
+  export function decode (buffer: Buffer | Uint8Array, encoding: Encoding, options?: DecodeOptions): string
+
+  /** Checks if a given encoding is supported by `iconv-lite`. */
+  export function encodingExists (encoding: string): encoding is Encoding
+
+  /** Legacy alias for {@link iconv.encode}. */
+  export const toEncoding: typeof iconv.encode
+
+  /** Legacy alias for {@link iconv.decode}. */
+  export const fromEncoding: typeof iconv.decode
+
+  /** Creates a stream that decodes binary data from a given `encoding` into strings. */
+  export function decodeStream (encoding: Encoding, options?: DecodeOptions): NodeJS.ReadWriteStream
+
+  /** Creates a stream that encodes strings into binary data in a given `encoding`. */
+  export function encodeStream (encoding: Encoding, options?: EncodeOptions): NodeJS.ReadWriteStream
 
-export interface DecoderStream {
-	write(buf: Buffer): string;
-	end(): string | undefined;
+  /**
+   * Explicitly enable Streaming API in browser environments by passing in:
+   * ```js
+   * require('stream')
+   * ```
+   * @example iconv.enableStreamingAPI(require('stream'));
+   */
+  export function enableStreamingAPI (stream_module: { Transform: typeof Stream.Transform }): void
+
+  /** Creates and returns a low-level encoder stream. */
+  export function getEncoder (encoding: Encoding, options?: EncodeOptions): EncoderStream
+
+  /** Creates and returns a low-level decoder stream. */
+  export function getDecoder (encoding: Encoding, options?: DecodeOptions): DecoderStream
+
+  /**
+   * Returns a codec object for the given `encoding`.
+   * @throws If the `encoding` is not recognized.
+   */
+  export function getCodec (encoding: Encoding): Codec
+
+  /** Strips all non-alphanumeric characters and appended year from `encoding`. */
+  export function _canonicalizeEncoding (encoding: Encoding): string
+
+  /** A cache of all loaded encoding definitions. */
+  export let encodings: Record<
+    Encoding,
+    | string
+    | {
+      type: string;
+      [key: string]: any;
+    }
+  > | null
+
+  /** A cache of initialized codec objects. */
+  export let _codecDataCache: Record<string, Codec>
+
+  /** The character used for untranslatable `Unicode` characters. @default "�" */
+  export let defaultCharUnicode: string
+
+  /** The character used for untranslatable `single-byte` characters. @default "?" */
+  export let defaultCharSingleByte: string
+
+  /**
+   * Skip deprecation warning when strings are used instead of Buffers during decoding.
+   * Note: {@link iconv.decode} converts the string to Buffer regardless.
+   */
+  export let skipDecodeWarning: boolean
+
+  /** @readonly Whether or not, Streaming API is enabled. */
+  export const supportsStreams: boolean
+
+  export type { iconv as Iconv, Encoding }
 }
+
+export = iconv

package/node_modules/mailparser/node_modules/iconv-lite/lib/index.js

@@ -4,22 +4,21 @@ var Buffer = require("safer-buffer").Buffer
 
 var bomHandling = require("./bom-handling")
 var mergeModules = require("./helpers/merge-exports")
-var iconv = module.exports
 
 // All codecs and aliases are kept here, keyed by encoding name/alias.
 // They are lazy loaded in `iconv.getCodec` from `encodings/index.js`.
 // Cannot initialize with { __proto__: null } because Boolean({ __proto__: null }) === true
-iconv.encodings = null
+module.exports.encodings = null
 
 // Characters emitted in case of error.
-iconv.defaultCharUnicode = "�"
-iconv.defaultCharSingleByte = "?"
+module.exports.defaultCharUnicode = "�"
+module.exports.defaultCharSingleByte = "?"
 
 // Public API.
-iconv.encode = function encode (str, encoding, options) {
+module.exports.encode = function encode (str, encoding, options) {
   str = "" + (str || "") // Ensure string.
 
-  var encoder = iconv.getEncoder(encoding, options)
+  var encoder = module.exports.getEncoder(encoding, options)
 
   var res = encoder.write(str)
   var trail = encoder.end()
@@ -27,17 +26,17 @@ iconv.encode = function encode (str, encoding, options) {
   return (trail && trail.length > 0) ? Buffer.concat([res, trail]) : res
 }
 
-iconv.decode = function decode (buf, encoding, options) {
+module.exports.decode = function decode (buf, encoding, options) {
   if (typeof buf === "string") {
-    if (!iconv.skipDecodeWarning) {
+    if (!module.exports.skipDecodeWarning) {
       console.error("Iconv-lite warning: decode()-ing strings is deprecated. Refer to https://github.com/ashtuchkin/iconv-lite/wiki/Use-Buffers-when-decoding")
-      iconv.skipDecodeWarning = true
+      module.exports.skipDecodeWarning = true
     }
 
     buf = Buffer.from("" + (buf || ""), "binary") // Ensure buffer.
   }
 
-  var decoder = iconv.getDecoder(encoding, options)
+  var decoder = module.exports.getDecoder(encoding, options)
 
   var res = decoder.write(buf)
   var trail = decoder.end()
@@ -45,9 +44,9 @@ iconv.decode = function decode (buf, encoding, options) {
   return trail ? (res + trail) : res
 }
 
-iconv.encodingExists = function encodingExists (enc) {
+module.exports.encodingExists = function encodingExists (enc) {
   try {
-    iconv.getCodec(enc)
+    module.exports.getCodec(enc)
     return true
   } catch (e) {
     return false
@@ -55,31 +54,31 @@ iconv.encodingExists = function encodingExists (enc) {
 }
 
 // Legacy aliases to convert functions
-iconv.toEncoding = iconv.encode
-iconv.fromEncoding = iconv.decode
+module.exports.toEncoding = module.exports.encode
+module.exports.fromEncoding = module.exports.decode
 
 // Search for a codec in iconv.encodings. Cache codec data in iconv._codecDataCache.
-iconv._codecDataCache = { __proto__: null }
+module.exports._codecDataCache = { __proto__: null }
 
-iconv.getCodec = function getCodec (encoding) {
-  if (!iconv.encodings) {
+module.exports.getCodec = function getCodec (encoding) {
+  if (!module.exports.encodings) {
     var raw = require("../encodings")
     // TODO: In future versions when old nodejs support is removed can use object.assign
-    iconv.encodings = { __proto__: null } // Initialize as empty object.
-    mergeModules(iconv.encodings, raw)
+    module.exports.encodings = { __proto__: null } // Initialize as empty object.
+    mergeModules(module.exports.encodings, raw)
   }
 
   // Canonicalize encoding name: strip all non-alphanumeric chars and appended year.
-  var enc = iconv._canonicalizeEncoding(encoding)
+  var enc = module.exports._canonicalizeEncoding(encoding)
 
   // Traverse iconv.encodings to find actual codec.
   var codecOptions = {}
   while (true) {
-    var codec = iconv._codecDataCache[enc]
+    var codec = module.exports._codecDataCache[enc]
 
     if (codec) { return codec }
 
-    var codecDef = iconv.encodings[enc]
+    var codecDef = module.exports.encodings[enc]
 
     switch (typeof codecDef) {
       case "string": // Direct alias to other encoding.
@@ -100,9 +99,9 @@ iconv.getCodec = function getCodec (encoding) {
         // The codec function must load all tables and return object with .encoder and .decoder methods.
         // It'll be called only once (for each different options object).
         //
-        codec = new codecDef(codecOptions, iconv)
+        codec = new codecDef(codecOptions, module.exports)
 
-        iconv._codecDataCache[codecOptions.encodingName] = codec // Save it to be reused later.
+        module.exports._codecDataCache[codecOptions.encodingName] = codec // Save it to be reused later.
         return codec
 
       default:
@@ -111,13 +110,13 @@ iconv.getCodec = function getCodec (encoding) {
   }
 }
 
-iconv._canonicalizeEncoding = function (encoding) {
+module.exports._canonicalizeEncoding = function (encoding) {
   // Canonicalize encoding name: strip all non-alphanumeric chars and appended year.
   return ("" + encoding).toLowerCase().replace(/:\d{4}$|[^0-9a-z]/g, "")
 }
 
-iconv.getEncoder = function getEncoder (encoding, options) {
-  var codec = iconv.getCodec(encoding)
+module.exports.getEncoder = function getEncoder (encoding, options) {
+  var codec = module.exports.getCodec(encoding)
   var encoder = new codec.encoder(options, codec)
 
   if (codec.bomAware && options && options.addBOM) { encoder = new bomHandling.PrependBOM(encoder, options) }
@@ -125,8 +124,8 @@ iconv.getEncoder = function getEncoder (encoding, options) {
   return encoder
 }
 
-iconv.getDecoder = function getDecoder (encoding, options) {
-  var codec = iconv.getCodec(encoding)
+module.exports.getDecoder = function getDecoder (encoding, options) {
+  var codec = module.exports.getCodec(encoding)
   var decoder = new codec.decoder(options, codec)
 
   if (codec.bomAware && !(options && options.stripBOM === false)) { decoder = new bomHandling.StripBOM(decoder, options) }
@@ -139,26 +138,26 @@ iconv.getDecoder = function getDecoder (encoding, options) {
 // up to 100Kb to the output bundle. To avoid unnecessary code bloat, we don't enable Streaming API in browser by default.
 // If you would like to enable it explicitly, please add the following code to your app:
 // > iconv.enableStreamingAPI(require('stream'));
-iconv.enableStreamingAPI = function enableStreamingAPI (streamModule) {
-  if (iconv.supportsStreams) { return }
+module.exports.enableStreamingAPI = function enableStreamingAPI (streamModule) {
+  if (module.exports.supportsStreams) { return }
 
   // Dependency-inject stream module to create IconvLite stream classes.
   var streams = require("./streams")(streamModule)
 
   // Not public API yet, but expose the stream classes.
-  iconv.IconvLiteEncoderStream = streams.IconvLiteEncoderStream
-  iconv.IconvLiteDecoderStream = streams.IconvLiteDecoderStream
+  module.exports.IconvLiteEncoderStream = streams.IconvLiteEncoderStream
+  module.exports.IconvLiteDecoderStream = streams.IconvLiteDecoderStream
 
   // Streaming API.
-  iconv.encodeStream = function encodeStream (encoding, options) {
-    return new iconv.IconvLiteEncoderStream(iconv.getEncoder(encoding, options), options)
+  module.exports.encodeStream = function encodeStream (encoding, options) {
+    return new module.exports.IconvLiteEncoderStream(module.exports.getEncoder(encoding, options), options)
   }
 
-  iconv.decodeStream = function decodeStream (encoding, options) {
-    return new iconv.IconvLiteDecoderStream(iconv.getDecoder(encoding, options), options)
+  module.exports.decodeStream = function decodeStream (encoding, options) {
+    return new module.exports.IconvLiteDecoderStream(module.exports.getDecoder(encoding, options), options)
   }
 
-  iconv.supportsStreams = true
+  module.exports.supportsStreams = true
 }
 
 // Enable Streaming API automatically if 'stream' module is available and non-empty (the majority of environments).
@@ -168,10 +167,10 @@ try {
 } catch (e) {}
 
 if (streamModule && streamModule.Transform) {
-  iconv.enableStreamingAPI(streamModule)
+  module.exports.enableStreamingAPI(streamModule)
 } else {
   // In rare cases where 'stream' module is not available by default, throw a helpful exception.
-  iconv.encodeStream = iconv.decodeStream = function () {
+  module.exports.encodeStream = module.exports.decodeStream = function () {
     throw new Error("iconv-lite Streaming API is not enabled. Use iconv.enableStreamingAPI(require('stream')); to enable it.")
   }
 }

package/node_modules/mailparser/node_modules/iconv-lite/package.json

@@ -1,7 +1,7 @@
 {
     "name": "iconv-lite",
     "description": "Convert character encodings in pure javascript.",
-    "version": "0.7.0",
+    "version": "0.7.2",
     "license": "MIT",
     "keywords": [
         "iconv",
@@ -14,6 +14,11 @@
     "typings": "./lib/index.d.ts",
     "homepage": "https://github.com/pillarjs/iconv-lite",
     "bugs": "https://github.com/pillarjs/iconv-lite/issues",
+    "files": [
+        "lib/",
+        "encodings/",
+        "types/"
+    ],
     "funding": {
       "type": "opencollective",
       "url": "https://opencollective.com/express"
@@ -33,24 +38,30 @@
         "test:cov": "nyc --exclude test --reporter=html --reporter=text npm test",
         "test:performance": "node --allow-natives-syntax performance/index.js",
         "test:tap": "mocha --reporter tap --check-leaks --grep .",
-        "test:webpack": "npm pack && mv iconv-lite-*.tgz test/webpack/iconv-lite.tgz && cd test/webpack && npm install && npm run test && rm iconv-lite.tgz"
+        "test:typescript": "tsc && attw --pack",
+        "test:webpack": "npm pack && mv iconv-lite-*.tgz test/webpack/iconv-lite.tgz && cd test/webpack && npm install && npm run test && rm iconv-lite.tgz",
+        "typegen": "node generation/gen-typings.js"
     },
     "browser": {
         "stream": false
     },
     "devDependencies": {
+        "@arethetypeswrong/cli": "^0.17.4",
         "@stylistic/eslint-plugin": "^5.1.0",
         "@stylistic/eslint-plugin-js": "^4.1.0",
+        "@types/node": "^24.0.12",
         "async": "^3.2.0",
         "bench-node": "^0.10.0",
         "eslint": "^9.0.0",
         "errto": "^0.2.1",
+        "expect-type": "^1.2.0",
         "iconv": "^2.3.5",
         "mocha": "^6.2.2",
         "neostandard": "^0.12.0",    
         "nyc": "^14.1.1",
         "request": "^2.88.2",
         "semver": "^6.3.0",
+        "typescript": "~5.9.2",
         "unorm": "^1.6.0"
     },
     "dependencies": {