@mavogel/awscdk-rootmail 0.1.22 → 0.1.23

package/node_modules/libqp/lib/libqp.js

@@ -17,6 +17,18 @@ function encode(buffer) {
         buffer = Buffer.from(buffer, 'utf-8');
     }
 
+    return encodeBytes(buffer, true);
+}
+
+/**
+ * Encodes the bytes of a Buffer. The Encoder stream feeds it one chunk at a time, so it has
+ * to be told whether the first byte starts an output line, which a plain encode() call always does
+ *
+ * @param {Buffer} buffer Buffer to convert
+ * @param {Boolean} lineStart True if the first byte starts a line
+ * @returns {String} Quoted-Printable encoded string
+ */
+function encodeBytes(buffer, lineStart) {
     // usable characters that do not need encoding
     let ranges = [
         // https://tools.ietf.org/html/rfc2045#section-6.7
@@ -32,7 +44,13 @@ function encode(buffer) {
     for (let i = 0, len = buffer.length; i < len; i++) {
         ord = buffer[i];
         // if the char is in allowed range, then keep as is, unless it is a ws in the end of a line
-        if (checkRanges(ord, ranges) && !((ord === 0x20 || ord === 0x09) && (i === len - 1 || buffer[i + 1] === 0x0a || buffer[i + 1] === 0x0d))) {
+        // or a hyphen in the start of a line. A line starting with two hyphens reads as a MIME
+        // boundary delimiter, so a decoded body that gets encoded again could inject a part
+        if (
+            checkRanges(ord, ranges) &&
+            !((ord === 0x20 || ord === 0x09) && (i === len - 1 || buffer[i + 1] === 0x0a || buffer[i + 1] === 0x0d)) &&
+            !(ord === 0x2d && (i === 0 ? lineStart : buffer[i - 1] === 0x0a))
+        ) {
             result += String.fromCharCode(ord);
             continue;
         }
@@ -53,31 +71,63 @@ function decode(str) {
     // 'binary' maps every byte to one char code 0-255. A UTF-8 read would collapse raw
     // multi-byte chars into one byte below and turn raw latin1 bytes into U+FFFD
     str = (Buffer.isBuffer(str) ? str.toString('binary') : (str || '').toString())
-        // remove invalid whitespace from the end of lines
-        .replace(/[\t ]+$/gm, '')
+        // remove invalid whitespace from the end of lines. The leading group keeps this linear,
+        // a plain /[\t ]+$/gm rescans the rest of a whitespace run from every position inside it,
+        // which is quadratic. The lookahead lists the line terminators multiline $ matches before
+        .replace(/(^|[^ \t])[ \t]+(?=[\n\r\u2028\u2029]|$)/g, '$1')
         // remove soft line breaks
         .replace(/\=(?:\r?\n|$)/g, '');
 
-    let encodedBytesCount = (str.match(/\=[\da-fA-F]{2}/g) || []).length,
-        bufferLength = str.length - encodedBytesCount * 2,
-        chr,
-        hex,
-        buffer = Buffer.alloc(bufferLength),
-        bufferPos = 0;
-
-    for (let i = 0, len = str.length; i < len; i++) {
-        chr = str.charAt(i);
-        if (chr === '=' && (hex = str.substr(i + 1, 2)) && /[\da-fA-F]{2}/.test(hex)) {
-            buffer[bufferPos++] = parseInt(hex, 16);
+    // every =XX escape decodes into one byte, so count them to size the output.
+    // Counted with a loop, a match() would build an array with a string for every escape
+    let len = str.length;
+    let encodedBytesCount = 0;
+    for (let i = str.indexOf('='); i >= 0 && i < len - 2; i = str.indexOf('=', i + 1)) {
+        if (hexValue(str.charCodeAt(i + 1)) >= 0 && hexValue(str.charCodeAt(i + 2)) >= 0) {
+            encodedBytesCount++;
             i += 2;
-            continue;
         }
-        buffer[bufferPos++] = chr.charCodeAt(0);
+    }
+
+    let buffer = Buffer.alloc(len - encodedBytesCount * 2);
+    let bufferPos = 0;
+
+    for (let i = 0; i < len; i++) {
+        let code = str.charCodeAt(i);
+        if (code === 0x3d /* = */ && i < len - 2) {
+            let hi = hexValue(str.charCodeAt(i + 1));
+            let lo = hexValue(str.charCodeAt(i + 2));
+            if (hi >= 0 && lo >= 0) {
+                buffer[bufferPos++] = hi * 16 + lo;
+                i += 2;
+                continue;
+            }
+        }
+        buffer[bufferPos++] = code;
     }
 
     return buffer;
 }
 
+/**
+ * Helper function to read the value of a hex digit
+ *
+ * @param {Number} code Char code
+ * @returns {Number} 0-15, or -1 if the char is not a hex digit
+ */
+function hexValue(code) {
+    if (code >= 0x30 && code <= 0x39) {
+        return code - 0x30; // 0-9
+    }
+    if (code >= 0x41 && code <= 0x46) {
+        return code - 0x41 + 10; // A-F
+    }
+    if (code >= 0x61 && code <= 0x66) {
+        return code - 0x61 + 10; // a-f
+    }
+    return -1;
+}
+
 /**
  * Adds soft line breaks to a Quoted-Printable string
  *
@@ -98,12 +148,27 @@ function wrap(str, lineLength) {
         match,
         code,
         line,
+        maxLength,
+        afterSoftBreak = false,
         lineMargin = Math.floor(lineLength / 3),
         result = '';
 
     // insert soft linebreaks where needed
     while (pos < len) {
-        line = str.substr(pos, lineLength);
+        maxLength = lineLength;
+
+        if (afterSoftBreak) {
+            afterSoftBreak = false;
+            // a line started by a soft break must not begin with a hyphen either, see encode().
+            // The escape takes the room of three characters off this line
+            if (str.charAt(pos) === '-') {
+                result += '=2D';
+                pos++;
+                maxLength -= 3;
+            }
+        }
+
+        line = str.substr(pos, maxLength);
         if ((match = line.match(/\r\n/))) {
             line = line.substr(0, match.index + match[0].length);
             result += line;
@@ -122,7 +187,7 @@ function wrap(str, lineLength) {
             result += line;
             pos += line.length;
             continue;
-        } else if (line.length > lineLength - lineMargin && (match = line.substr(-lineMargin).match(/[ \t\.,!\?][^ \t\.,!\?]*$/))) {
+        } else if (line.length > maxLength - lineMargin && (match = line.substr(-lineMargin).match(/[ \t\.,!\?][^ \t\.,!\?]*$/))) {
             // truncate to nearest space
             line = line.substr(0, line.length - (match[0].length - 1));
         } else if (line.match(/\=[\da-f]{0,2}$/i)) {
@@ -147,13 +212,14 @@ function wrap(str, lineLength) {
         }
 
         if (pos + line.length < len && line.substr(-1) !== '\n') {
-            if (line.length === lineLength && line.match(/\=[\da-f]{2}$/i)) {
+            if (line.length === maxLength && line.match(/\=[\da-f]{2}$/i)) {
                 line = line.substr(0, line.length - 3);
-            } else if (line.length === lineLength) {
+            } else if (line.length === maxLength) {
                 line = line.substr(0, line.length - 1);
             }
             pos += line.length;
             line += '=\r\n';
+            afterSoftBreak = true;
         } else {
             pos += line.length;
         }
@@ -205,6 +271,8 @@ class Encoder extends Transform {
         }
 
         this._curLine = '';
+        // true until a chunk that does not end with a line break has been encoded
+        this._lineStart = true;
 
         this.inputBytes = 0;
         this.outputBytes = 0;
@@ -225,8 +293,11 @@ class Encoder extends Transform {
 
         this.inputBytes += chunk.length;
 
+        let lineStart = this._lineStart;
+        this._lineStart = chunk[chunk.length - 1] === 0x0a;
+
         if (this.options.lineLength) {
-            qp = this._curLine + encode(chunk);
+            qp = this._curLine + encodeBytes(chunk, lineStart);
             qp = wrap(qp, this.options.lineLength);
             qp = qp.replace(/(^|\n)([^\n]*)$/, (match, lineBreak, lastLine) => {
                 this._curLine = lastLine;
@@ -238,7 +309,7 @@ class Encoder extends Transform {
                 this.push(qp);
             }
         } else {
-            qp = encode(chunk);
+            qp = encodeBytes(chunk, lineStart);
             this.outputBytes += qp.length;
             this.push(qp, 'ascii');
         }
@@ -286,7 +357,8 @@ class Decoder extends Transform {
             chunk = Buffer.from(chunk, encoding);
         }
 
-        this.qpChunks.push(chunk);
+        // kept as a binary string, so joining the chunks is the only copy made before decoding
+        this.qpChunks.push(chunk.toString('binary'));
         this.inputBytes += chunk.length;
 
         done();
@@ -294,7 +366,7 @@ class Decoder extends Transform {
 
     _flush(done) {
         if (this.inputBytes) {
-            let buf = decode(Buffer.concat(this.qpChunks, this.inputBytes));
+            let buf = decode(this.qpChunks.join(''));
             this.outputBytes += buf.length;
             this.push(buf);
         }

package/node_modules/libqp/package.json

@@ -1,6 +1,6 @@
 {
     "name": "libqp",
-    "version": "2.1.2",
+    "version": "2.1.3",
     "description": "Encode and decode quoted-printable strings according to rfc2045",
     "main": "lib/libqp.js",
     "scripts": {

package/node_modules/libqp/test/libqp-test.js

@@ -256,3 +256,111 @@ test('Raw 8-bit bytes in Quoted-Printable input', async t => {
         assert.deepStrictEqual(await decodeStream([input.subarray(0, 9), input.subarray(9)]), expected);
     });
 });
+
+test('Hyphens at the start of a line', async t => {
+    const encodeStream = async (chunks, options) =>
+        await new Promise((resolve, reject) => {
+            const encoder = new libqp.Encoder(options);
+            const output = [];
+            encoder.on('data', chunk => output.push(chunk));
+            encoder.on('end', () => resolve(Buffer.concat(output).toString()));
+            encoder.on('error', reject);
+            for (const chunk of chunks) {
+                encoder.write(chunk);
+            }
+            encoder.end();
+        });
+
+    await t.test('encode() escapes a hyphen that starts a line', async () => {
+        // two hyphens at the start of a line would read as a MIME boundary delimiter
+        assert.strictEqual(libqp.encode('--boundary\r\n-x'), '=2D-boundary\r\n=2Dx');
+        assert.strictEqual(libqp.encode('\n-'), '\n=2D');
+    });
+
+    await t.test('encode() keeps a hyphen inside a line', async () => {
+        assert.strictEqual(libqp.encode('a-b --c'), 'a-b --c');
+    });
+
+    await t.test('wrap() escapes a hyphen that a soft line break would move to the start of a line', async () => {
+        const input = 'a'.repeat(75) + '-x';
+        const wrapped = libqp.wrap(libqp.encode(input));
+        assert.strictEqual(wrapped, 'a'.repeat(75) + '=\r\n=2Dx');
+        assert.strictEqual(libqp.decode(wrapped).toString(), input);
+    });
+
+    await t.test('wrap() keeps every line within the line length when escaping', async () => {
+        const input = '-'.repeat(300);
+        const wrapped = libqp.wrap(libqp.encode(input));
+        const lines = wrapped.split('\r\n');
+        assert.ok(lines.length > 3);
+        for (const line of lines) {
+            assert.ok(line.length <= 76, `line too long: ${line.length}`);
+            assert.notStrictEqual(line.charAt(0), '-');
+        }
+        assert.strictEqual(libqp.decode(wrapped).toString(), input);
+    });
+
+    await t.test('Encoder escapes a hyphen at the start of a chunk only when it starts a line', async () => {
+        for (const options of [{}, { lineLength: false }]) {
+            assert.strictEqual(await encodeStream(['-a'], options), '=2Da');
+            assert.strictEqual(await encodeStream(['ab\n', '-c'], options), 'ab\n=2Dc');
+            assert.strictEqual(await encodeStream(['ab', '-c'], options), 'ab-c');
+        }
+    });
+
+    await t.test('Encoder output never starts a line with a hyphen', async () => {
+        // a body that decodes to a boundary delimiter followed by the headers of a part
+        const input = 'text\r\n--boundary\r\nContent-Type: application/x-evil; name=evil.exe\r\n\r\n' + '-'.repeat(200) + '\r\n';
+        const chunks = [];
+        for (let i = 0; i < input.length; i += 7) {
+            chunks.push(Buffer.from(input.substring(i, i + 7)));
+        }
+        for (const options of [{}, { lineLength: false }]) {
+            const encoded = await encodeStream(chunks, options);
+            assert.ok(!/(^|\n)-/.test(encoded), `line starts with a hyphen: ${JSON.stringify(encoded)}`);
+            assert.strictEqual(libqp.decode(encoded).toString(), input);
+        }
+    });
+});
+
+test('Trailing whitespace', async t => {
+    await t.test('decode() removes whitespace from the end of lines', async () => {
+        assert.strictEqual(libqp.decode('abc  \r\ndef \t\nghi  ').toString(), 'abc\r\ndef\nghi');
+        assert.strictEqual(libqp.decode('   \n   ').toString(), '\n');
+        assert.strictEqual(libqp.decode('a  b').toString(), 'a  b');
+    });
+
+    await t.test('decode() treats a soft line break with trailing whitespace as a soft line break', async () => {
+        assert.strictEqual(libqp.decode('foo= \t\r\nbar').toString(), 'foobar');
+    });
+
+    await t.test('decode() handles a long run of whitespace in linear time', async () => {
+        // the trim used to be quadratic on a run that does not end the line, 50 KB took 2 seconds
+        for (const chr of [' ', '\t']) {
+            const input = chr.repeat(500 * 1024) + 'x';
+            const start = Date.now();
+            const decoded = libqp.decode(input).toString('binary');
+            const duration = Date.now() - start;
+            assert.strictEqual(decoded, input);
+            assert.ok(duration < 500, `decoding took ${duration} ms`);
+        }
+    });
+});
+
+test('Escape sequences', async t => {
+    await t.test('decode() decodes valid escapes and keeps invalid ones', async () => {
+        assert.strictEqual(libqp.decode('=41=42=43').toString(), 'ABC');
+        assert.strictEqual(libqp.decode('=c3=a9').toString(), 'é');
+        assert.strictEqual(libqp.decode('=4G=4').toString(), '=4G=4');
+        assert.strictEqual(libqp.decode('==41').toString(), '=A');
+        assert.strictEqual(libqp.decode('a=\r\nb=\nc=').toString(), 'abc');
+    });
+
+    await t.test('decode() sizes the output for a body made of escapes', async () => {
+        const count = 1024 * 1024;
+        const decoded = libqp.decode('=41'.repeat(count));
+        assert.strictEqual(decoded.length, count);
+        assert.strictEqual(decoded[0], 0x41);
+        assert.strictEqual(decoded[count - 1], 0x41);
+    });
+});

package/node_modules/mailparser/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.39"
+    ".": "3.9.40"
 }

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [3.9.40](https://github.com/nodemailer/mailparser/compare/v3.9.39...v3.9.40) (2026-10-16)
+
+
+### Bug Fixes
+
+* bump @zone-eu/mailsplit to 5.4.23 ([32adf4f](https://github.com/nodemailer/mailparser/commit/32adf4f9b7d10a95f98359de7476ebb7fe526cf0))
+* bump libmime to 5.4.9 and nodemailer to 10.1.2 ([a928892](https://github.com/nodemailer/mailparser/commit/a92889221c11eb81b06472f911672b71c288c4ef))
+* keep the message when its HTML can not be converted to text, and never turn a decoded display name into an address ([0d234fd](https://github.com/nodemailer/mailparser/commit/0d234fd3ab1207a617e3682b27c72f4902d76936))
+
 ## [3.9.39](https://github.com/nodemailer/mailparser/compare/v3.9.38...v3.9.39) (2026-10-14)
 
 

package/node_modules/mailparser/README.md

@@ -28,7 +28,8 @@ See [mailparser homepage](https://nodemailer.com/extras/mailparser/) for documen
 ### Limits
 
 - `simpleParser` replaces `cid:` image references in the HTML with `data:` URLs. The total length of the URLs written into the HTML is capped by the `maxInlinedImagesSize` option (default 20 MB, counted in characters of the inserted URLs). References past the cap stay as `cid:` links. The same cap applies to URLs returned from a custom `updateImageLinks()` callback.
-- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error (for example HTML longer than `maxHtmlLengthToParse`), that error is what the caller receives. `MailParser` itself still emits the `'error'` event and then finishes parsing.
+- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error and then finishes parsing, that error is what the caller receives.
+- HTML that can not be converted to text (longer than `maxHtmlLengthToParse`, nested deeper than 1000 levels, or rejected by html-to-text) does not fail the message. `text` is empty, `html` is kept, and the reason is set as `textConversionError` on the result (and on the `text` object `MailParser` emits).
 
 ### License