@mavogel/awscdk-rootmail 0.1.2 → 0.1.3

package/node_modules/libmime/lib/libmime.js

@@ -10,6 +10,31 @@ const mimetypes = require('./mimetypes');
 const STAGE_KEY = 0x1001;
 const STAGE_VALUE = 0x1002;
 
+// Sets an own property on a plain object. A regular assignment with a
+// '__proto__' key would silently modify the object's prototype instead of
+// creating an own property, so it needs special handling.
+const setOwnProperty = (obj, key, value) => {
+    if (key === '__proto__') {
+        Object.defineProperty(obj, key, {
+            value,
+            writable: true,
+            enumerable: true,
+            configurable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+};
+
+// Checks own properties only, as attacker controlled keys like '__proto__'
+// or 'toString' would otherwise resolve to inherited Object.prototype members.
+// NB! Not named hasOwnProperty, that would shadow the global builtin
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
+// Whitespace that separates the tokens of a header value. Kept as a char comparison,
+// a regex test would be run for every single char of every parsed header
+const isWSP = chr => chr === ' ' || chr === '\t' || chr === '\r' || chr === '\n' || chr === '\f' || chr === '\v';
+
 class Libmime {
     constructor(config) {
         this.config = config || {};
@@ -386,7 +411,7 @@ class Libmime {
      * header might have its own rules (eg. formatted email addresses and such)
      *
      * @param {String} headers Headers string
-     * @return {Object} An object of headers, where header keys are object keys. NB! Several values with the same key make up an Array
+     * @return {Object} An object of headers, where header keys are object keys and every value is an Array of the values for that key
      */
     decodeHeaders(headers) {
         let lines = headers.split(/\r?\n|\r/),
@@ -395,8 +420,21 @@ class Libmime {
             i,
             len;
 
-        for (i = lines.length - 1; i >= 0; i--) {
-            if (i && lines[i].match(/^\s/)) {
+        // Empty lines in front of the block are not part of any header, a caller might
+        // include the line break that separates a mime part boundary from its headers
+        let headersPos = 0;
+        while (headersPos < lines.length && lines[headersPos] === '') {
+            headersPos++;
+        }
+
+        // An empty line terminates the header block, anything after it is the message body.
+        // Without this a body line that starts with whitespace would be folded into the last header
+        let bodyPos = lines.indexOf('', headersPos);
+        lines = lines.slice(headersPos, bodyPos >= 0 ? bodyPos : lines.length);
+
+        // unfold folded lines, a continuation line always starts with a space or a tab
+        for (i = lines.length - 1; i > 0; i--) {
+            if (/^[ \t]/.test(lines[i])) {
                 lines[i - 1] += '\r\n' + lines[i];
                 lines.splice(i, 1);
             }
@@ -404,8 +442,8 @@ class Libmime {
 
         for (i = 0, len = lines.length; i < len; i++) {
             header = this.decodeHeader(lines[i]);
-            if (!headersObj[header.key]) {
-                headersObj[header.key] = [header.value];
+            if (!hasOwn(headersObj, header.key)) {
+                setOwnProperty(headersObj, header.key, [header.value]);
             } else {
                 headersObj[header.key].push(header.value);
             }
@@ -449,7 +487,7 @@ class Libmime {
      * Parses a header value with key=value arguments into a structured
      * object.
      *
-     *   parseHeaderValue('content-type: text/plain; CHARSET='UTF-8'') ->
+     *   parseHeaderValue('text/plain; CHARSET=UTF-8') ->
      *   {
      *     'value': 'text/plain',
      *     'params': {
@@ -467,44 +505,78 @@ class Libmime {
         };
         let key = false;
         let value = '';
+        // Length of the significant part of `value`. Whitespace outside of quotes is
+        // not part of the value, while whitespace inside quotes is (rfc2045 section 5.1)
+        let valueEnd = 0;
         let stage = STAGE_VALUE;
 
         let quote = false;
         let escaped = false;
         let chr;
 
+        // Stores the collected value, either as the default value, as the value for the
+        // current key, or as a key that has no value at all. Runs once per parameter
+        let commit = () => {
+            let collected = value.substring(0, valueEnd);
+            value = '';
+            valueEnd = 0;
+
+            if (stage === STAGE_KEY) {
+                // key without a value, see emptykey:
+                // Header-Key: somevalue; key=value; emptykey
+                if (collected) {
+                    setOwnProperty(response.params, collected.toLowerCase(), '');
+                }
+            } else if (key === false) {
+                // default value
+                response.value = collected;
+            } else {
+                // subkey value
+                setOwnProperty(response.params, key, collected);
+            }
+        };
+
         for (let i = 0, len = str.length; i < len; i++) {
             chr = str.charAt(i);
             switch (stage) {
                 case STAGE_KEY:
                     if (chr === '=') {
-                        key = value.trim().toLowerCase();
-                        stage = STAGE_VALUE;
+                        key = value.substring(0, valueEnd).toLowerCase();
                         value = '';
-                        break;
+                        valueEnd = 0;
+                        stage = STAGE_VALUE;
+                    } else if (chr === ';') {
+                        // key without a value, eg. the "inline" in "attachment; inline; filename=a.txt"
+                        commit();
+                    } else if (isWSP(chr)) {
+                        if (value.length) {
+                            value += chr;
+                        }
+                    } else {
+                        value += chr;
+                        valueEnd = value.length;
                     }
-                    value += chr;
                     break;
                 case STAGE_VALUE:
                     if (escaped) {
                         value += chr;
+                        valueEnd = value.length;
                     } else if (chr === '\\') {
                         escaped = true;
                         continue;
-                    } else if (quote && chr === quote) {
-                        quote = false;
-                    } else if (!quote && chr === '"') {
-                        quote = chr;
+                    } else if (chr === '"') {
+                        // every char between the quotes is significant, including whitespace
+                        quote = !quote;
                     } else if (!quote && chr === ';') {
-                        if (key === false) {
-                            response.value = value.trim();
-                        } else {
-                            response.params[key] = value.trim();
-                        }
+                        commit();
                         stage = STAGE_KEY;
-                        value = '';
+                    } else if (!quote && isWSP(chr)) {
+                        if (value.length) {
+                            value += chr;
+                        }
                     } else {
                         value += chr;
+                        valueEnd = value.length;
                     }
                     escaped = false;
                     break;
@@ -512,94 +584,80 @@ class Libmime {
         }
 
         // finalize remainder
-        value = value.trim();
-        if (stage === STAGE_VALUE) {
-            if (key === false) {
-                // default value
-                response.value = value;
-            } else {
-                // subkey value
-                response.params[key] = value;
-            }
-        } else if (value) {
-            // treat as key without value, see emptykey:
-            // Header-Key: somevalue; key=value; emptykey
-            response.params[value.toLowerCase()] = '';
-        }
+        commit();
 
         // handle parameter value continuations
         // https://tools.ietf.org/html/rfc2231#section-3
 
-        // preprocess values
-        Object.keys(response.params).forEach(key => {
-            let actualKey;
-            let nr;
-            let value;
+        // Collect the segments of every continuation parameter. These are kept out of
+        // response.params so that a half assembled value can not leak into the result
+        let continuations = new Map();
 
+        for (let key of Object.keys(response.params)) {
             let match = key.match(/\*((\d+)\*?)?$/);
 
             if (!match) {
                 // nothing to do here, does not seem like a continuation param
-                return;
+                continue;
             }
 
-            actualKey = key.substr(0, match.index).toLowerCase();
-            nr = Number(match[2]) || 0;
+            let actualKey = key.substr(0, match.index).toLowerCase();
+            let nr = Number(match[2]) || 0;
+            let value = response.params[key];
 
-            if (!response.params[actualKey] || typeof response.params[actualKey] !== 'object') {
-                response.params[actualKey] = {
+            // remove the old reference
+            delete response.params[key];
+
+            let continuation = continuations.get(actualKey);
+            if (!continuation) {
+                continuation = {
                     charset: false,
                     values: []
                 };
+                continuations.set(actualKey, continuation);
             }
 
-            value = response.params[key];
-
             if (nr === 0 && match[0].charAt(match[0].length - 1) === '*' && (match = value.match(/^([^']*)'[^']*'(.*)$/))) {
-                response.params[actualKey].charset = match[1] || 'utf-8';
+                continuation.charset = match[1] || 'utf-8';
                 value = match[2];
             }
 
-            response.params[actualKey].values.push({ nr, value });
-
-            // remove the old reference
-            delete response.params[key];
-        });
+            continuation.values.push({ nr, value });
+        }
 
-        // concatenate split rfc2231 strings and convert encoded strings to mime encoded words
-        Object.keys(response.params).forEach(key => {
-            let value;
-            if (response.params[key] && Array.isArray(response.params[key].values)) {
-                value = response.params[key].values
-                    .sort((a, b) => a.nr - b.nr)
-                    .map(val => (val && val.value) || '')
-                    .join('');
-
-                if (response.params[key].charset) {
-                    // convert "%AB" to "=?charset?Q?=AB?=" and then to unicode
-                    response.params[key] = this.decodeWords(
-                        '=?' +
-                            response.params[key].charset +
-                            '?Q?' +
-                            value
-                                // fix invalidly encoded chars
-                                .replace(/[=?_\s]/g, s => {
-                                    let c = s.charCodeAt(0).toString(16);
-                                    if (s === ' ') {
-                                        return '_';
-                                    } else {
-                                        return '%' + (c.length < 2 ? '0' : '') + c;
-                                    }
-                                })
-                                // change from urlencoding to percent encoding
-                                .replace(/%/g, '=') +
-                            '?='
-                    );
-                } else {
-                    response.params[key] = this.decodeWords(value);
-                }
+        // concatenate the split rfc2231 strings and decode the encoded ones
+        for (let [key, continuation] of continuations) {
+            // NB! An assembled continuation always overrides a plain parameter with the same
+            // name, in either source order. The plain form is the legacy ascii fallback of the
+            // extended one, so rfc6266 section 4.3 requires picking the extended value. Letting
+            // the fallback win would make libmime disagree with the mail clients that follow it
+            let value = continuation.values
+                .sort((a, b) => a.nr - b.nr)
+                .map(val => val.value)
+                .join('');
+
+            if (!continuation.charset) {
+                setOwnProperty(response.params, key, this.decodeWords(value));
+                continue;
             }
-        });
+
+            // convert "%AB" to the quoted printable "=AB" and decode it as the charset of the parameter.
+            // NB! The charset is passed in as an argument instead of building a "=?charset?Q?=AB?=" string,
+            // a charset that contains "?" would otherwise inject an encoded word of its own
+            let qpValue = value
+                // fix invalidly encoded chars
+                .replace(/[=_\s]/g, s => {
+                    if (s === ' ') {
+                        return '_';
+                    }
+                    let c = s.charCodeAt(0).toString(16);
+                    return '%' + (c.length < 2 ? '0' : '') + c;
+                })
+                // change from urlencoding to percent encoding
+                .replace(/%/g, '=');
+
+            setOwnProperty(response.params, key, this.decodeWord(continuation.charset, 'Q', qpValue));
+        }
 
         return response;
     }
@@ -622,7 +680,13 @@ class Libmime {
      */
     buildHeaderParam(key, data, maxLength, fromCharset) {
         let list = [];
-        let encodedStr = typeof data === 'string' ? data : this.decode(data, fromCharset);
+
+        if (typeof data !== 'string' && !Buffer.isBuffer(data)) {
+            // documented input is a string or a Buffer, normalize anything else
+            data = data === null || data === undefined ? '' : data.toString();
+        }
+
+        let encodedStr = typeof data === 'string' ? data : libcharset.decode(data, fromCharset);
         let encodedStrArr;
         let chr, ord;
         let line;
@@ -756,7 +820,7 @@ class Libmime {
      */
     detectExtension(mimeType) {
         mimeType = (mimeType || '').toString().toLowerCase().replace(/\s/g, '');
-        if (!(mimeType in mimetypes.list)) {
+        if (!hasOwn(mimetypes.list, mimeType)) {
             return 'bin';
         }
 
@@ -787,7 +851,7 @@ class Libmime {
     detectMimeType(extension) {
         extension = (extension || '').toString().toLowerCase().replace(/\s/g, '').replace(/^\./g, '').split('.').pop();
 
-        if (!(extension in mimetypes.extensions)) {
+        if (!hasOwn(mimetypes.extensions, extension)) {
             return 'application/octet-stream';
         }
 
@@ -905,18 +969,12 @@ class Libmime {
 
     encodeURICharComponent(chr) {
         let res = '';
-        let ord = chr.charCodeAt(0).toString(16).toUpperCase();
-
-        if (ord.length % 2) {
-            ord = '0' + ord;
-        }
+        // percent encoding is defined over bytes, so encode the char as UTF-8 first
+        let buf = Buffer.from(chr, 'utf-8');
 
-        if (ord.length > 2) {
-            for (let i = 0, len = ord.length / 2; i < len; i++) {
-                res += '%' + ord.substr(i, 2);
-            }
-        } else {
-            res += '%' + ord;
+        for (let i = 0, len = buf.length; i < len; i++) {
+            let ord = buf[i].toString(16).toUpperCase();
+            res += '%' + (ord.length < 2 ? '0' : '') + ord;
         }
 
         return res;

package/node_modules/libmime/package.json

@@ -1,7 +1,7 @@
 {
     "name": "libmime",
     "description": "Encode and decode quoted printable and base64 strings",
-    "version": "5.4.1",
+    "version": "5.4.3",
     "main": "lib/libmime.js",
     "files": [
         "lib",
@@ -24,7 +24,7 @@
         "update": "rm -rf node_modules package-lock.json && ncu -u && npm install"
     },
     "dependencies": {
-        "encoding-japanese": "2.2.0",
+        "encoding-japanese": "2.3.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.3.0",
         "libqp": "2.1.1"
@@ -33,10 +33,10 @@
         "chai": "4.4.1",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "grunt": "1.6.2",
+        "grunt": "1.6.3",
         "grunt-cli": "1.5.0",
         "grunt-eslint": "24.3.0",
         "grunt-mocha-test": "0.13.3",
-        "mocha": "11.7.6"
+        "mocha": "11.8.0"
     }
 }

package/node_modules/mailparser/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.14"
+    ".": "3.9.22"
 }

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## [3.9.22](https://github.com/nodemailer/mailparser/compare/v3.9.21...v3.9.22) (2026-09-06)
+
+
+### Bug Fixes
+
+* declare the Node 20 floor this package already has ([e9de771](https://github.com/nodemailer/mailparser/commit/e9de7718eea4486ce8992c34660c37c7ca07c36d))
+
+## [3.9.21](https://github.com/nodemailer/mailparser/compare/v3.9.20...v3.9.21) (2026-09-06)
+
+
+### Bug Fixes
+
+* **deps:** move to nodemailer 10 ([a83474e](https://github.com/nodemailer/mailparser/commit/a83474ee34f9f0ac047c49925c9ac3b7b0734855))
+
+## [3.9.20](https://github.com/nodemailer/mailparser/compare/v3.9.19...v3.9.20) (2026-09-01)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 9.1.1 ([36233e6](https://github.com/nodemailer/mailparser/commit/36233e60c50b06a9b17beee1f608d73ab976a07c))
+
+## [3.9.19](https://github.com/nodemailer/mailparser/compare/v3.9.18...v3.9.19) (2026-08-31)
+
+
+### Bug Fixes
+
+* **deps:** update libmime and mailsplit for the CP932 extended areas ([0bbe7a3](https://github.com/nodemailer/mailparser/commit/0bbe7a358672f8fd3c47b002c95867d672a58d07))
+
+## [3.9.18](https://github.com/nodemailer/mailparser/compare/v3.9.17...v3.9.18) (2026-08-31)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 9.1.0 ([b812c54](https://github.com/nodemailer/mailparser/commit/b812c54a733d96cdc8d9b2567d111322f2404724))
+
+## [3.9.17](https://github.com/nodemailer/mailparser/compare/v3.9.16...v3.9.17) (2026-08-27)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 9.0.6 ([26c7ccb](https://github.com/nodemailer/mailparser/commit/26c7ccb129fe6554613d7af12fb2b362e64e6d82))
+
+## [3.9.16](https://github.com/nodemailer/mailparser/compare/v3.9.15...v3.9.16) (2026-08-24)
+
+
+### Bug Fixes
+
+* bound linkify-it scanning of untrusted text bodies ([1910471](https://github.com/nodemailer/mailparser/commit/1910471a4edd72249237ce7ad243228d61c4908f))
+* **deps:** update html-to-text to 10.0.1 ([308e1b2](https://github.com/nodemailer/mailparser/commit/308e1b2993e554470ecbd3570cdd18a394b866b3))
+
+## [3.9.15](https://github.com/nodemailer/mailparser/compare/v3.9.14...v3.9.15) (2026-08-07)
+
+
+### Bug Fixes
+
+* update dependencies (@zone-eu/mailsplit 5.4.15, libmime 5.4.2, nodemailer 9.0.5) ([047379d](https://github.com/nodemailer/mailparser/commit/047379df5537d799e21b410a7c9019872579ff5a))
+
 ## [3.9.14](https://github.com/nodemailer/mailparser/compare/v3.9.13...v3.9.14) (2026-07-05)