@mavogel/awscdk-rootmail 0.1.2 → 0.1.4

package/node_modules/nodemailer/{lib → dist/esm}/addressparser/index.js

@@ -1,11 +1,123 @@
-'use strict';
-
+/**
+ * Restores the quoting of a local part that was read out of a quoted string.
+ *
+ * RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
+ * on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
+ * domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
+ * same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
+ * recipient separator once the consumer puts the address back into a header.
+ *
+ * This module has no dependencies so that it can ship on its own, which is why the two
+ * grammar tests below are spelled out here instead of shared with src/mime-node. Keeping
+ * only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
+ * dot-atom rule on top of this when it emits an address.
+ *
+ * @param address Address with an unquoted local part
+ * @return Address with the local part as a quoted-string
+ */
+function _quoteLocalPart(address) {
+    const lastAt = address.lastIndexOf('@');
+    if (lastAt < 0) {
+        // no domain to split off, nothing can be misrouted
+        return address;
+    }
+    const user = address.substr(0, lastAt);
+    if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
+        // a local part that carries no special reads the same with or without the quotes,
+        // and one that is already a complete quoted-string needs nothing either
+        return address;
+    }
+    return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
+}
+/**
+ * Reached for every parsed address, so it is built once rather than per call.
+ */
+const HAS_WHITESPACE = /\s/;
+/**
+ * An addr-spec that carries its whitespace legally, inside a quoted local part. The
+ * optional tail is the malformed shape: a real mailbox with wreckage trailing it.
+ */
+const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
+/**
+ * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
+ */
+const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+ * The looser reading applied once the strict one finds nothing, which tolerates the
+ * further '@' that a domain should not have but malformed headers carry anyway.
+ */
+const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
+ *
+ * A malformed header can put more than a mailbox between the angle brackets, most often
+ * because the generator wrote the recipient twice: '<user@example.com user@example.com>'
+ * or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
+ * never be a mailbox anyone could deliver to, and passing it on as the address loses the
+ * recipient that is sitting right there in the header.
+ *
+ * The run that still reads as an addr-spec is kept and whatever is left over becomes
+ * display text rather than being dropped. Candidates are read strictly first and then
+ * under the looser grammar, the same two tiers the unquoted-text branch below applies to
+ * the same problem, so that '<a@b@c.com junk>' and a bare 'a@b@c.com junk' agree on the
+ * recipient. When several runs qualify the first wins, which is what that branch's looser
+ * tier does within a token.
+ *
+ * A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
+ * '<"user name"@example.com>' is well formed and means exactly what it says.
+ *
+ * @param data Collected address parts, mutated in place
+ */
+function _recoverAddrSpec(data) {
+    if (!HAS_WHITESPACE.test(data.address)) {
+        return;
+    }
+    let address;
+    let rest;
+    const quoted = data.address.match(QUOTED_LOCAL_ADDR);
+    if (quoted) {
+        if (!quoted[2]) {
+            // the whitespace sits inside the quoted local part, this is a well formed mailbox
+            return;
+        }
+        // a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
+        // than splitting into the quotes
+        address = quoted[1];
+        rest = [quoted[2]];
+    }
+    else {
+        if (data.address.indexOf('"') >= 0) {
+            // Splitting on whitespace loses track of where the quoted string starts and ends,
+            // and this module does not take addresses out of quoted strings: the run picked out
+            // of '<junk "user@evil.com b"@good.com>' would be an address from the domain the
+            // quotes were hiding. Every well formed shape was already handled above, so what is
+            // left is wreckage either way and the original is the honest answer
+            return;
+        }
+        const parts = data.address.split(/\s+/);
+        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        if (addrIndex < 0) {
+            addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
+        }
+        if (addrIndex < 0) {
+            // nothing in there reads as an address, there is no better answer than the original
+            return;
+        }
+        address = parts.splice(addrIndex, 1)[0];
+        rest = parts;
+    }
+    data.address = address;
+    data.text = [data.text]
+        .concat(rest)
+        .filter(part => part)
+        .join(' ');
+}
 /**
  * Converts tokens for a single address into an address object
  *
- * @param {Array} tokens Tokens object
- * @param {Number} depth Current recursion depth for nested group protection
- * @return {Object} Address object
+ * @param tokens Tokens object
+ * @param depth Current recursion depth for nested group protection
+ * @return Address object
  */
 function _handleAddress(tokens, depth) {
     let isGroup = false;
@@ -19,7 +131,6 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
-
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -48,19 +159,29 @@ function _handleAddress(tokens, depth) {
                     insideQuotes = false;
                     break;
             }
-        } else if (token.value) {
+        }
+        else if (token.value) {
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
                 token.value = token.value.replace(/^[^<]*<\s*/, '');
             }
-
-            if (prevToken && prevToken.noBreak && data[state].length) {
+            // A comment is folding whitespace. It may sit inside an addr-spec, on either side
+            // of the '@', but it cannot join two atoms into one: gluing across it would read
+            // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
+            // deliver to a domain the sender never named.
+            const parts = data[state];
+            const joins = prevToken &&
+                prevToken.noBreak &&
+                parts.length &&
+                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+            if (joins) {
                 data[state][data[state].length - 1] += token.value;
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
-            } else {
+            }
+            else {
                 data[state].push(token.value);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes);
@@ -68,17 +189,14 @@ function _handleAddress(tokens, depth) {
             }
         }
     }
-
     // If there is no text but a comment, replace the two
     if (!data.text.length && data.comment.length) {
         data.text = data.comment;
         data.comment = [];
     }
-
     if (isGroup) {
         // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
         data.text = data.text.join(' ');
-
         // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
         let groupMembers = [];
         if (data.group.length) {
@@ -86,30 +204,30 @@ function _handleAddress(tokens, depth) {
             parsedGroup.forEach(member => {
                 if (member.group) {
                     groupMembers = groupMembers.concat(member.group);
-                } else {
+                }
+                else {
                     groupMembers.push(member);
                 }
             });
         }
-
         addresses.push({
             name: data.text || '',
             group: groupMembers
         });
-    } else {
+    }
+    else {
         // If no address was found, try to detect one from regular text
         if (!data.address.length && data.text.length) {
             for (let i = data.text.length - 1; i >= 0; i--) {
                 // Security: Do not extract email addresses from quoted strings.
                 // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
                 // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                if (!data.textWasQuoted[i] && /^[^@\s]+@[^@\s]+$/.test(data.text[i])) {
+                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
                     data.address = data.text.splice(i, 1);
                     data.textWasQuoted.splice(i, 1);
                     break;
                 }
             }
-
             // Try a looser regex match if strict match found nothing
             if (!data.address.length) {
                 let extracted = false;
@@ -117,14 +235,14 @@ function _handleAddress(tokens, depth) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
                         data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, match => {
-                                if (!extracted) {
-                                    data.address = [match.trim()];
-                                    extracted = true;
-                                    return ' ';
-                                }
-                                return match;
-                            })
+                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
+                            if (!extracted) {
+                                data.address = [match.trim()];
+                                extracted = true;
+                                return ' ';
+                            }
+                            return match;
+                        })
                             .trim();
                         if (extracted) {
                             break;
@@ -133,46 +251,46 @@ function _handleAddress(tokens, depth) {
                 }
             }
         }
-
         // If there's still no text but a comment exists, replace the two
         if (!data.text.length && data.comment.length) {
             data.text = data.comment;
             data.comment = [];
         }
-
         // Keep only the first address occurrence, push others to regular text
         if (data.address.length > 1) {
             data.text = data.text.concat(data.address.splice(1));
         }
-
+        // An address is only taken from unquoted text, so anything left in the text at this
+        // point that still has to serve as the address carries its quoting in this flag
+        const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
-
+        _recoverAddrSpec(data);
         const address = {
             address: data.address || data.text || '',
             name: data.text || data.address || ''
         };
-
         if (address.address === address.name) {
             if (/@/.test(address.address || '')) {
                 address.name = '';
-            } else {
+            }
+            else {
                 address.address = '';
             }
         }
-
+        if (addressFromQuotedText && address.address) {
+            address.address = _quoteLocalPart(address.address);
+        }
         addresses.push(address);
     }
-
     return addresses;
 }
-
 /**
  * Creates a Tokenizer object for tokenizing address field strings
  *
  * @constructor
- * @param {String} str Address field string
+ * @param str Address field string
  */
 class Tokenizer {
     constructor(str) {
@@ -182,7 +300,6 @@ class Tokenizer {
         this.node = null;
         this.escaped = false;
         this.inDomainLiteral = false;
-
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -202,35 +319,30 @@ class Tokenizer {
             ';': ''
         };
     }
-
     /**
      * Tokenizes the original input string
      *
-     * @return {Array} An array of operator|text tokens
+     * @return An array of operator|text tokens
      */
     tokenize() {
         const list = [];
-
         for (let i = 0, len = this.str.length; i < len; i++) {
             const chr = this.str.charAt(i);
             const nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
             this.checkChar(chr, nextChr);
         }
-
         this.list.forEach(node => {
             node.value = (node.value || '').toString().trim();
             if (node.value) {
                 list.push(node);
             }
         });
-
         return list;
     }
-
     /**
      * Checks if a character is an operator or text and acts accordingly
      *
-     * @param {String} chr Character from the address field
+     * @param chr Character from the address field
      */
     checkChar(chr, nextChr) {
         // Track RFC 5322 domain-literals ("[" *dtext "]"). Operator characters such
@@ -243,30 +355,29 @@ class Tokenizer {
         if (!this.escaped && !this.operatorExpecting) {
             if (!this.inDomainLiteral && chr === '[') {
                 this.inDomainLiteral = true;
-            } else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
+            }
+            else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
                 this.inDomainLiteral = false;
             }
         }
-
         if (this.escaped) {
             // ignore next condition blocks
-        } else if (chr === this.operatorExpecting) {
+        }
+        else if (chr === this.operatorExpecting) {
             this.node = {
                 type: 'operator',
                 value: chr
             };
-
             if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
                 this.node.noBreak = true;
             }
-
             this.list.push(this.node);
             this.node = null;
             this.operatorExpecting = '';
             this.escaped = false;
-
             return;
-        } else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
+        }
+        else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
             this.node = {
                 type: 'operator',
                 value: chr
@@ -276,11 +387,11 @@ class Tokenizer {
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
             return;
-        } else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+        }
+        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
             this.escaped = true;
             return;
         }
-
         if (!this.node) {
             this.node = {
                 type: 'text',
@@ -288,29 +399,24 @@ class Tokenizer {
             };
             this.list.push(this.node);
         }
-
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
             // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
             chr = ' ';
         }
-
         if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
             // skip command bytes
             this.node.value += chr;
         }
-
         this.escaped = false;
     }
 }
-
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
  * malicious input that could cause stack overflow.
  */
 const MAX_NESTED_GROUP_DEPTH = 50;
-
 /**
  * Parses structured e-mail addresses from an address field
  *
@@ -322,65 +428,67 @@ const MAX_NESTED_GROUP_DEPTH = 50;
  *
  *     [{name: 'Name', address: 'address@domain'}]
  *
- * @param {String} str Address field
- * @param {Object} options Optional options object
- * @param {Number} options._depth Internal recursion depth counter (do not set manually)
- * @return {Array} An array of address objects
+ * @param str Address field
+ * @param options Optional options object
+ * @param options._depth Internal recursion depth counter (do not set manually)
+ * @return An array of address objects
  */
-function addressparser(str, options) {
+export default function addressparser(str, options) {
     options = options || {};
     const depth = options._depth || 0;
-
     // Prevent stack overflow from deeply nested groups (DoS protection)
     if (depth > MAX_NESTED_GROUP_DEPTH) {
         return [];
     }
-
     const tokenizer = new Tokenizer(str);
     const tokens = tokenizer.tokenize();
-
     const addresses = [];
     let address = [];
     let parsedAddresses = [];
-
     tokens.forEach(token => {
         if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
             if (address.length) {
                 addresses.push(address);
             }
             address = [];
-        } else {
+        }
+        else {
             address.push(token);
         }
     });
-
     if (address.length) {
         addresses.push(address);
     }
-
     addresses.forEach(addr => {
         const handled = _handleAddress(addr, depth);
-        if (handled.length) {
-            parsedAddresses = parsedAddresses.concat(handled);
+        // Appended in place. Rebuilding the accumulator with concat() would copy every
+        // entry collected so far on each address, making a flat list cost O(n^2).
+        for (let i = 0; i < handled.length; i++) {
+            parsedAddresses.push(handled[i]);
         }
     });
-
     // Merge fragments produced when unquoted display names contain commas.
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
     // Recombine: a name-only entry followed by an entry with both name and address.
-    for (let i = parsedAddresses.length - 2; i >= 0; i--) {
+    // Walked back to front so that a run of fragments folds into one entry in a single
+    // pass. Splicing each fragment out of the list instead would cost O(n^2).
+    const mergedAddresses = [];
+    for (let i = parsedAddresses.length - 1; i >= 0; i--) {
         const current = parsedAddresses[i];
-        const next = parsedAddresses[i + 1];
-        if (current.address === '' && current.name && !current.group && next.address && next.name) {
+        const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
+        if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
             next.name = current.name + ', ' + next.name;
-            parsedAddresses.splice(i, 1);
+        }
+        else {
+            mergedAddresses.push(current);
         }
     }
-
+    mergedAddresses.reverse();
+    parsedAddresses = mergedAddresses;
     if (options.flatten) {
         const flatAddresses = [];
-        const walkAddressList = list => {
+        const walkAddressList = (list) => {
             list.forEach(entry => {
                 if (entry.group) {
                     return walkAddressList(entry.group);
@@ -391,8 +499,5 @@ function addressparser(str, options) {
         walkAddressList(parsedAddresses);
         return flatAddresses;
     }
-
     return parsedAddresses;
 }
-
-module.exports = addressparser;

package/node_modules/nodemailer/dist/esm/base64/index.d.ts

@@ -0,0 +1,40 @@
+import { Transform, type TransformCallback } from 'node:stream';
+/**
+ * Encodes a Buffer into a base64 encoded string
+ *
+ * @param buffer Buffer to convert
+ * @returns base64 encoded string
+ */
+export declare function encode(buffer: Buffer | string): string;
+/**
+ * Adds soft line breaks to a base64 string
+ *
+ * @param str base64 encoded string that might need line wrapping
+ * @param [lineLength=76] Maximum allowed length for a line
+ * @returns Soft-wrapped base64 encoded string
+ */
+export declare function wrap(str: string, lineLength?: number | false): string;
+/**
+ * Options for the base64 encoder stream
+ */
+export interface EncoderOptions {
+    /** Maximum length for lines, set to false to disable wrapping */
+    lineLength?: number | false;
+}
+/**
+ * Creates a transform stream for encoding data to base64 encoding
+ *
+ * @constructor
+ * @param options Stream options
+ * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping
+ */
+export declare class Encoder extends Transform {
+    options: EncoderOptions;
+    inputBytes: number;
+    outputBytes: number;
+    _curLine: string;
+    _remainingBytes: Buffer | false;
+    constructor(options?: EncoderOptions);
+    _transform(chunk: Buffer | string, encoding: BufferEncoding | 'buffer', done: TransformCallback): void;
+    _flush(done: TransformCallback): void;
+}

package/node_modules/nodemailer/dist/esm/base64/index.js

@@ -0,0 +1,110 @@
+import { Transform } from 'node:stream';
+/**
+ * Encodes a Buffer into a base64 encoded string
+ *
+ * @param buffer Buffer to convert
+ * @returns base64 encoded string
+ */
+export function encode(buffer) {
+    if (typeof buffer === 'string') {
+        buffer = Buffer.from(buffer, 'utf-8');
+    }
+    return buffer.toString('base64');
+}
+/**
+ * Adds soft line breaks to a base64 string
+ *
+ * @param str base64 encoded string that might need line wrapping
+ * @param [lineLength=76] Maximum allowed length for a line
+ * @returns Soft-wrapped base64 encoded string
+ */
+export function wrap(str, lineLength) {
+    str = (str || '').toString();
+    lineLength = lineLength || 76;
+    if (str.length <= lineLength) {
+        return str;
+    }
+    const result = [];
+    let pos = 0;
+    const chunkLength = lineLength * 1024;
+    const wrapRegex = new RegExp('.{' + lineLength + '}', 'g');
+    while (pos < str.length) {
+        const wrappedLines = str.substr(pos, chunkLength).replace(wrapRegex, '$&\r\n').trim();
+        result.push(wrappedLines);
+        pos += chunkLength;
+    }
+    return result.join('\r\n').trim();
+}
+/**
+ * Creates a transform stream for encoding data to base64 encoding
+ *
+ * @constructor
+ * @param options Stream options
+ * @param [options.lineLength=76] Maximum length for lines, set to false to disable wrapping
+ */
+export class Encoder extends Transform {
+    constructor(options) {
+        super();
+        this.options = options || {};
+        if (this.options.lineLength !== false) {
+            this.options.lineLength = this.options.lineLength || 76;
+        }
+        this._curLine = '';
+        this._remainingBytes = false;
+        this.inputBytes = 0;
+        this.outputBytes = 0;
+    }
+    _transform(chunk, encoding, done) {
+        let buf = encoding !== 'buffer' ? Buffer.from(chunk, encoding) : chunk;
+        if (!buf || !buf.length) {
+            setImmediate(done);
+            return;
+        }
+        this.inputBytes += buf.length;
+        if (this._remainingBytes && this._remainingBytes.length) {
+            buf = Buffer.concat([this._remainingBytes, buf], this._remainingBytes.length + buf.length);
+            this._remainingBytes = false;
+        }
+        if (buf.length % 3) {
+            this._remainingBytes = buf.slice(buf.length - (buf.length % 3));
+            buf = buf.slice(0, buf.length - (buf.length % 3));
+        }
+        else {
+            this._remainingBytes = false;
+        }
+        let b64 = this._curLine + encode(buf);
+        if (this.options.lineLength) {
+            b64 = wrap(b64, this.options.lineLength);
+            // remove last line as it is still most probably incomplete
+            const lastLF = b64.lastIndexOf('\n');
+            if (lastLF < 0) {
+                this._curLine = b64;
+                b64 = '';
+            }
+            else if (lastLF === b64.length - 1) {
+                this._curLine = '';
+            }
+            else {
+                this._curLine = b64.substring(lastLF + 1);
+                b64 = b64.substring(0, lastLF + 1);
+            }
+        }
+        if (b64) {
+            this.outputBytes += b64.length;
+            this.push(Buffer.from(b64, 'ascii'));
+        }
+        setImmediate(done);
+    }
+    _flush(done) {
+        if (this._remainingBytes && this._remainingBytes.length) {
+            this._curLine += encode(this._remainingBytes);
+        }
+        if (this._curLine) {
+            this._curLine = wrap(this._curLine, this.options.lineLength);
+            this.outputBytes += this._curLine.length;
+            this.push(Buffer.from(this._curLine, 'ascii'));
+            this._curLine = '';
+        }
+        done();
+    }
+}