@mavogel/awscdk-rootmail 0.1.22 → 0.1.23

package/node_modules/nodemailer/dist/cjs/mime-node/index.js

@@ -71,6 +71,13 @@ const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 // unroutable garbage into mail for a domain the sender never named. None of these
 // characters are legal in a domain, so keep them away from the mapper.
 const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+// RFC 1035 bounds a label at 63 octets and a domain at 253. An A-label is never shorter than
+// the code points it encodes, so anything past these bounds could not have become a valid
+// domain whichever way it is encoded. The bundled codec is super-linear in the length of a
+// label, a 60 KB label of distinct code points took seconds to encode, several times per
+// address, so it is only handed what could be a domain
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_LABEL_LENGTH = 63;
 // pipeline() needs a callback to not throw, the errors it sees reach the last stream anyway
 const PIPELINE_NOOP = () => false;
 // The error a node streaming into an output that was destroyed stops with
@@ -79,6 +86,27 @@ function abortedError() {
     err.code = errors.ESTREAM;
     return err;
 }
+/**
+ * Checks a domain against the DNS length limits, counted in code points per label and in
+ * total. The label separators are the ones the bundled codec splits on.
+ *
+ * @param domain Domain to check
+ * @return true if a label or the domain as a whole is too long to be a valid domain
+ */
+function exceedsDomainLimits(domain) {
+    let total = 0;
+    let label = 0;
+    for (const char of domain) {
+        total++;
+        if (char === '.' || char === '。' || char === '．' || char === '｡') {
+            label = 0;
+        }
+        else if (++label > MAX_LABEL_LENGTH) {
+            return true;
+        }
+    }
+    return total > MAX_DOMAIN_LENGTH;
+}
 /**
  * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
  * which is with UTS-46 mapping applied before the Punycode step.
@@ -110,6 +138,10 @@ function normalizeDomain(domain, toUnicode) {
             return mapped;
         }
     }
+    if (exceedsDomainLimits(domain)) {
+        // too long to be a domain whichever way it is encoded, keep it as supplied
+        return domain;
+    }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
@@ -614,6 +646,17 @@ class MimeNode {
                         /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
+                    if (this.filename) {
+                        // the name parameter is derived from the filename below, so a name that
+                        // arrived inside the content type is dropped first (a plain parameter or
+                        // rfc2231 continuation sections), otherwise the header carries two and a
+                        // receiver that reads the first sees a name the filename does not match
+                        for (const paramKey of Object.keys(structured.params)) {
+                            if (/^name(\*|$)/i.test(paramKey)) {
+                                delete structured.params[paramKey];
+                            }
+                        }
+                    }
                     value = mimeFuncs.buildHeaderValue(structured);
                     if (this.filename) {
                         // add support for non-compliant clients like QQ webmail
@@ -1223,12 +1266,12 @@ class MimeNode {
     _normalizeHeaderKey(key) {
         key = (key || '')
             .toString()
-            // no newlines in keys
-            .replace(/\r?\n|\r/g, ' ')
-            // a field name is printable ascii without the colon, so a control char or DEL
-            // can only be dropped, there is no quoting construct around a field name
-            .replace(/[\x00-\x1f\x7f]/g, '')
-            .trim()
+            // a field name is printable ascii without the colon, so a control char, DEL,
+            // whitespace or a colon can only be dropped, there is no quoting construct
+            // around a field name. A colon or a space left in place ends the name early on
+            // the wire: the key 'From: ceo@example.com (' with the value ')' was emitted as a
+            // second From header that neither setHeader() nor the Bcc filter could match
+            .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
             .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())

package/node_modules/nodemailer/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.1";
+export declare const version = "10.1.2";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.1';
+exports.version = '10.1.2';
 exports.homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/cjs/smtp-connection/index.js

@@ -114,6 +114,21 @@ function isPartialResponse(str) {
 function isPartialLine(line) {
     return /^\d+-/.test(line);
 }
+/**
+ * The log form of a command a custom authentication handler sends. Such a command carries
+ * the credentials in whatever shape its mechanism uses, so only an AUTH verb with its
+ * mechanism name is kept, the way the built-in mechanisms hide their own secrets.
+ *
+ * @param cmd Command the handler sends
+ * @return What the transaction log gets instead
+ */
+function maskAuthCommand(cmd) {
+    const match = (cmd || '').toString().match(/^AUTH\s+[^\s]+/i);
+    if (!match) {
+        return '/* secret */';
+    }
+    return match[0].length === cmd.length ? cmd : match[0] + ' /* secret */';
+}
 /**
  * Generates a SMTP connection object
  *
@@ -601,7 +616,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
                     }
                     done(null, data);
                 });
-                setImmediate(() => this._sendCommand(cmd));
+                setImmediate(() => this._sendCommand(cmd, maskAuthCommand(cmd)));
                 return promise;
             };
             const handlerResponse = handler({

package/node_modules/nodemailer/dist/cjs/smtp-transport/index.js

@@ -43,6 +43,13 @@ const shared = __importStar(require("../shared/index.js"));
 const index_js_3 = __importDefault(require("../xoauth2/index.js"));
 const errors = __importStar(require("../errors.js"));
 const packageData = __importStar(require("../package-info.js"));
+// The keys a message's `auth` may set on top of the transport's auth settings: the ones that
+// say who logs in and with what. Everything else in the auth block (accessUrl, clientId,
+// clientSecret, customHeaders, customParams, tls, privateKey, serviceClient and the rest)
+// names the endpoint the credentials go to or is a secret of the application itself, and
+// a message that could set `auth.accessUrl` and force a refresh would have the transport's
+// client secret and refresh token posted to a URL of its choosing
+const MESSAGE_AUTH_KEYS = ['type', 'user', 'pass', 'accessToken', 'refreshToken', 'expires'];
 /**
  * Creates a SMTP transport object for Nodemailer
  *
@@ -102,7 +109,11 @@ class SMTPTransport extends node_events_1.EventEmitter {
             }
             return this.auth;
         }
-        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {}, typeof authOpts === 'object' ? authOpts : {});
+        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {});
+        if (typeof authOpts === 'object') {
+            // see MESSAGE_AUTH_KEYS
+            shared.copyOwnKeys(authData, authOpts, key => !MESSAGE_AUTH_KEYS.includes(key));
+        }
         if (Object.keys(authData).length === 0) {
             return false;
         }

package/node_modules/nodemailer/dist/cjs/well-known/services.js

@@ -363,6 +363,13 @@ exports.services = {
         "port": 587,
         "secure": false
     },
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "Postmark": {
         "description": "Postmark",
         "aliases": [

package/node_modules/nodemailer/dist/cjs/xoauth2/index.js

@@ -264,8 +264,14 @@ class XOAuth2 extends node_stream_1.Stream {
                 grant_type: 'refresh_token'
             };
         }
-        Object.assign(urlOptions, this.options.customParams);
-        Object.assign(loggedUrlOptions, this.options.customParams);
+        const customParams = this.options.customParams || {};
+        Object.assign(urlOptions, customParams);
+        // a custom param is as likely to be a client assertion or an API key as a tenant
+        // name, so the log gets the same glimpse of it that it gets of the client secret
+        for (const key of Object.keys(customParams)) {
+            const param = customParams[key];
+            loggedUrlOptions[key] = (param === undefined || param === null ? '' : String(param)).substr(0, 6) + '...';
+        }
         this.logger.debug({
             tnx: 'OAUTH2',
             user: this.options.user,

package/node_modules/nodemailer/dist/esm/dkim/index.js

@@ -128,8 +128,9 @@ class DKIMSigner {
     }
     createWriteCache() {
         this.output.usingCache = true;
-        // pipe remainings to cache file
-        this.cache = fs.createWriteStream(this.cachePath);
+        // pipe remainings to cache file. It holds the message body and cacheDir is often a
+        // shared directory such as /tmp, so nobody but the owner gets to read it
+        this.cache = fs.createWriteStream(this.cachePath, { mode: 0o600 });
         this.cache.once('error', err => {
             // drain input
             this.relaxedBody.unpipe(this.cache);

package/node_modules/nodemailer/dist/esm/fetch/index.d.ts

@@ -27,6 +27,8 @@ export interface FetchOptions {
     } | undefined;
     /** Socket inactivity timeout in milliseconds, defaults to 60000, 0 disables it */
     timeout?: number | undefined;
+    /** Time limit for the whole request in milliseconds, redirects included, defaults to 120000, 0 disables it */
+    maxTime?: number | undefined;
     /** Maximum size of the (decoded) response body in bytes, defaults to 64 MB, Infinity disables the limit */
     maxBytes?: number | undefined;
     /** Maximum number of redirects to follow (default 5) */
@@ -37,6 +39,8 @@ export interface FetchOptions {
     redirects?: number | undefined;
     /** Response stream shared across redirects, set by nmfetch itself */
     fetchRes?: FetchResponse | undefined;
+    /** Timestamp the whole request has to be done by, shared across redirects, set by nmfetch itself */
+    deadline?: number | undefined;
 }
 /**
  * The stream nmfetch returns. The response body is piped into it, the status code and
@@ -50,6 +54,7 @@ declare function nmfetch(url: string, options?: FetchOptions): FetchResponse;
 declare namespace nmfetch {
     var Cookies: typeof import("./cookies.js").default;
     var DEFAULT_TIMEOUT: number;
+    var DEFAULT_MAX_TIME: number;
 }
 type CookiesJar = Cookies;
 /**

package/node_modules/nodemailer/dist/esm/fetch/index.js

@@ -11,6 +11,10 @@ import { isProtoKey } from '../shared/objects.js';
 const MAX_REDIRECTS = 5;
 // a stalled server would otherwise hold the request, and whatever waits on it, open forever
 const DEFAULT_TIMEOUT = 60 * 1000;
+// the inactivity timeout above is reset by every byte, so a server dripping one within each
+// window could still hold the request, and the message being built from it, open for as
+// long as it liked. The whole request, redirects included, has to be done within this
+const DEFAULT_MAX_TIME = 2 * 60 * 1000;
 // the body is usually buffered in memory by the caller, so an unbounded download is refused
 const DEFAULT_MAX_BYTES = 64 * 1024 * 1024;
 // Only genuine TLS settings are taken from options.tls. That object reaches us straight
@@ -88,6 +92,12 @@ function nmfetch(url, options) {
     options.cookies = options.cookies || new Cookies();
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
+    if (!options.deadline) {
+        options.maxTime = typeof options.maxTime === 'number' && options.maxTime >= 0 ? options.maxTime : DEFAULT_MAX_TIME;
+        // the one deadline is shared with the requests the redirects lead to, every hop
+        // gets the time that is left rather than starting over
+        options.deadline = options.maxTime ? Date.now() + options.maxTime : 0;
+    }
     const fetchRes = options.fetchRes;
     const parsed = parseFetchUrl(url);
     if (!parsed) {
@@ -233,12 +243,22 @@ function nmfetch(url, options) {
         });
         return fetchRes;
     }
+    // the whole request has to be done by options.deadline, see maxTime. The timer is
+    // released on every way out of the request, so it never outlives it
+    let deadlineTimer;
+    const clearDeadline = () => {
+        if (deadlineTimer) {
+            clearTimeout(deadlineTimer);
+            deadlineTimer = undefined;
+        }
+    };
     // reports the first failure of this request on fetchRes and releases the request
     const fail = (err, sourceUrl = url) => {
         if (finished) {
             return;
         }
         finished = true;
+        clearDeadline();
         setFetchCode(err);
         err.sourceUrl = sourceUrl;
         fetchRes.emit('error', err);
@@ -248,10 +268,16 @@ function nmfetch(url, options) {
     if (timeout) {
         req.setTimeout(timeout, () => fail(new Error('Request Timeout')));
     }
+    if (options.deadline) {
+        deadlineTimer = setTimeout(() => fail(new Error('Request exceeded the allowed ' + options.maxTime + ' ms')), Math.max(options.deadline - Date.now(), 1));
+        // a pending deadline is no reason to keep the process alive
+        deadlineTimer.unref();
+    }
     req.on('error', (err) => fail(err));
     // a consumer that destroys the response stream before it ended does not want the rest of
     // the body, release the request now instead of when the timeout fires
     fetchRes.once('close', () => {
+        clearDeadline();
         if (finished || fetchRes.readableEnded) {
             return;
         }
@@ -320,6 +346,7 @@ function nmfetch(url, options) {
             // this request is done with, release it so its socket and timeout do not
             // outlive it and report a late error on the shared fetchRes
             finished = true;
+            clearDeadline();
             res.resume();
             req.abort();
             return nmfetch(redirectUrl, options);
@@ -330,6 +357,8 @@ function nmfetch(url, options) {
             return fail(new Error('Invalid status code ' + res.statusCode));
         }
         res.on('error', (err) => fail(err));
+        // the response is in, whatever is left of it is in memory and no longer on the network
+        res.once('end', () => clearDeadline());
         const maxBytes = typeof options.maxBytes === 'number' && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_BYTES;
         const source = inflate || res;
         let received = 0;
@@ -367,4 +396,5 @@ function nmfetch(url, options) {
 }
 nmfetch.Cookies = Cookies;
 nmfetch.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
+nmfetch.DEFAULT_MAX_TIME = DEFAULT_MAX_TIME;
 export default nmfetch;

package/node_modules/nodemailer/dist/esm/mailer/index.js

@@ -360,9 +360,12 @@ class Mail extends EventEmitter {
                 return callback(err);
             }
             let cidCounter = 0;
+            // the media type is a bounded token: a quote, whitespace, '>' or '<' ends the
+            // attribute value and with it the type, so one img tag never scans ahead to a
+            // ';' that belongs to a later tag, which was quadratic
             html = (html || '')
                 .toString()
-                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
+                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;"'<>\s]{1,255});[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
                 const cid = crypto.randomBytes(10).toString('hex') + '@localhost';
                 if (!mail.data.attachments) {
                     mail.data.attachments = [];

package/node_modules/nodemailer/dist/esm/mailer/mail-message.d.ts

@@ -23,7 +23,11 @@ export interface SendMailOptions extends MailComposerOptions {
     dsn?: SMTPEnvelopeDsn | undefined;
     /** SMTP transports: RFC 8689, send the REQUIRETLS parameter with MAIL FROM */
     requireTLSExtensionEnabled?: boolean | undefined;
-    /** SMTP transports: per-message authentication settings, used instead of the transport level auth */
+    /**
+     * SMTP transports: per-message authentication settings, used instead of the transport level auth.
+     * Only the credential fields are taken from it (type, user, pass, accessToken, refreshToken, expires),
+     * the token endpoint and client settings stay those of the transport
+     */
     auth?: SMTPTransportAuthOptions | undefined;
     /** SES transport: extra SendEmailCommand parameters merged into the API call */
     ses?: SESSendEmailRequest | undefined;

package/node_modules/nodemailer/dist/esm/mime-funcs/index.js

@@ -137,26 +137,38 @@ export function encodeWord(data, mimeWordEncoding, maxLength) {
  */
 export function encodeWords(value, mimeWordEncoding, maxLength, encodeAll) {
     maxLength = maxLength || 0;
-    // find first word with a non-printable ascii or special symbol in it
-    const firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
-    if (!firstMatch) {
+    // find the first and the last character that needs encoding, a quote or anything outside
+    // printable ascii. A scan rather than a regex: matching the last such word with a
+    // backtracking pattern took quadratic time on a long word of non-ascii characters
+    let firstSpecial = -1;
+    let lastSpecial = -1;
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code === 0x22 || code >= 0x80) {
+            if (firstSpecial < 0) {
+                firstSpecial = i;
+            }
+            lastSpecial = i;
+        }
+    }
+    if (firstSpecial < 0) {
         return value;
     }
     if (encodeAll) {
         // if it is requested to encode everything or the string contains something that resebles encoded word, then encode everything
         return encodeWord(value, mimeWordEncoding, maxLength);
     }
-    // find the last word with a non-printable ascii in it
-    const lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
-    if (!lastMatch) {
-        // should not happen
-        return value;
+    // encode from the start of the word holding the first such character to the end of the
+    // word holding the last one, so the encoded words stay separated from the plain text by
+    // the whitespace that was already there
+    let startIndex = firstSpecial;
+    while (startIndex > 0 && !/\s/.test(value.charAt(startIndex - 1))) {
+        startIndex--;
+    }
+    let endIndex = lastSpecial + 1;
+    while (endIndex < value.length && !/\s/.test(value.charAt(endIndex))) {
+        endIndex++;
     }
-    const startIndex = firstMatch.index +
-        (firstMatch[0].match(/[^\s]/) || {
-            index: 0
-        }).index;
-    const endIndex = lastMatch.index + (lastMatch[1] || '').length;
     return ((startIndex ? value.substr(0, startIndex) : '') +
         encodeWord(value.substring(startIndex, endIndex), mimeWordEncoding || 'Q', maxLength) +
         (endIndex < value.length ? value.substr(endIndex) : ''));

package/node_modules/nodemailer/dist/esm/mime-node/index.js

@@ -33,6 +33,13 @@ const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
 // unroutable garbage into mail for a domain the sender never named. None of these
 // characters are legal in a domain, so keep them away from the mapper.
 const URL_PARSER_UNSAFE = /[/\\?#%\x00-\x20\x7F]/;
+// RFC 1035 bounds a label at 63 octets and a domain at 253. An A-label is never shorter than
+// the code points it encodes, so anything past these bounds could not have become a valid
+// domain whichever way it is encoded. The bundled codec is super-linear in the length of a
+// label, a 60 KB label of distinct code points took seconds to encode, several times per
+// address, so it is only handed what could be a domain
+const MAX_DOMAIN_LENGTH = 253;
+const MAX_LABEL_LENGTH = 63;
 // pipeline() needs a callback to not throw, the errors it sees reach the last stream anyway
 const PIPELINE_NOOP = () => false;
 // The error a node streaming into an output that was destroyed stops with
@@ -41,6 +48,27 @@ function abortedError() {
     err.code = errors.ESTREAM;
     return err;
 }
+/**
+ * Checks a domain against the DNS length limits, counted in code points per label and in
+ * total. The label separators are the ones the bundled codec splits on.
+ *
+ * @param domain Domain to check
+ * @return true if a label or the domain as a whole is too long to be a valid domain
+ */
+function exceedsDomainLimits(domain) {
+    let total = 0;
+    let label = 0;
+    for (const char of domain) {
+        total++;
+        if (char === '.' || char === '。' || char === '．' || char === '｡') {
+            label = 0;
+        }
+        else if (++label > MAX_LABEL_LENGTH) {
+            return true;
+        }
+    }
+    return total > MAX_DOMAIN_LENGTH;
+}
 /**
  * Encodes a domain the way browsers, the WHATWG URL Standard and DNS facing resolvers do,
  * which is with UTS-46 mapping applied before the Punycode step.
@@ -72,6 +100,10 @@ function normalizeDomain(domain, toUnicode) {
             return mapped;
         }
     }
+    if (exceedsDomainLimits(domain)) {
+        // too long to be a domain whichever way it is encoded, keep it as supplied
+        return domain;
+    }
     return toUnicode ? punycode.toUnicode(domain) : punycode.toASCII(domain);
 }
 /**
@@ -576,6 +608,17 @@ class MimeNode {
                         /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
+                    if (this.filename) {
+                        // the name parameter is derived from the filename below, so a name that
+                        // arrived inside the content type is dropped first (a plain parameter or
+                        // rfc2231 continuation sections), otherwise the header carries two and a
+                        // receiver that reads the first sees a name the filename does not match
+                        for (const paramKey of Object.keys(structured.params)) {
+                            if (/^name(\*|$)/i.test(paramKey)) {
+                                delete structured.params[paramKey];
+                            }
+                        }
+                    }
                     value = mimeFuncs.buildHeaderValue(structured);
                     if (this.filename) {
                         // add support for non-compliant clients like QQ webmail
@@ -1185,12 +1228,12 @@ class MimeNode {
     _normalizeHeaderKey(key) {
         key = (key || '')
             .toString()
-            // no newlines in keys
-            .replace(/\r?\n|\r/g, ' ')
-            // a field name is printable ascii without the colon, so a control char or DEL
-            // can only be dropped, there is no quoting construct around a field name
-            .replace(/[\x00-\x1f\x7f]/g, '')
-            .trim()
+            // a field name is printable ascii without the colon, so a control char, DEL,
+            // whitespace or a colon can only be dropped, there is no quoting construct
+            // around a field name. A colon or a space left in place ends the name early on
+            // the wire: the key 'From: ceo@example.com (' with the value ')' was emitted as a
+            // second From header that neither setHeader() nor the Bcc filter could match
+            .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
             .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())

package/node_modules/nodemailer/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.1";
+export declare const version = "10.1.2";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.1';
+export const version = '10.1.2';
 export const homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/esm/smtp-connection/index.js

@@ -76,6 +76,21 @@ function isPartialResponse(str) {
 function isPartialLine(line) {
     return /^\d+-/.test(line);
 }
+/**
+ * The log form of a command a custom authentication handler sends. Such a command carries
+ * the credentials in whatever shape its mechanism uses, so only an AUTH verb with its
+ * mechanism name is kept, the way the built-in mechanisms hide their own secrets.
+ *
+ * @param cmd Command the handler sends
+ * @return What the transaction log gets instead
+ */
+function maskAuthCommand(cmd) {
+    const match = (cmd || '').toString().match(/^AUTH\s+[^\s]+/i);
+    if (!match) {
+        return '/* secret */';
+    }
+    return match[0].length === cmd.length ? cmd : match[0] + ' /* secret */';
+}
 /**
  * Generates a SMTP connection object
  *
@@ -563,7 +578,7 @@ class SMTPConnection extends EventEmitter {
                     }
                     done(null, data);
                 });
-                setImmediate(() => this._sendCommand(cmd));
+                setImmediate(() => this._sendCommand(cmd, maskAuthCommand(cmd)));
                 return promise;
             };
             const handlerResponse = handler({

package/node_modules/nodemailer/dist/esm/smtp-transport/index.js

@@ -5,6 +5,13 @@ import * as shared from '../shared/index.js';
 import XOAuth2 from '../xoauth2/index.js';
 import * as errors from '../errors.js';
 import * as packageData from '../package-info.js';
+// The keys a message's `auth` may set on top of the transport's auth settings: the ones that
+// say who logs in and with what. Everything else in the auth block (accessUrl, clientId,
+// clientSecret, customHeaders, customParams, tls, privateKey, serviceClient and the rest)
+// names the endpoint the credentials go to or is a secret of the application itself, and
+// a message that could set `auth.accessUrl` and force a refresh would have the transport's
+// client secret and refresh token posted to a URL of its choosing
+const MESSAGE_AUTH_KEYS = ['type', 'user', 'pass', 'accessToken', 'refreshToken', 'expires'];
 /**
  * Creates a SMTP transport object for Nodemailer
  *
@@ -64,7 +71,11 @@ class SMTPTransport extends EventEmitter {
             }
             return this.auth;
         }
-        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {}, typeof authOpts === 'object' ? authOpts : {});
+        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {});
+        if (typeof authOpts === 'object') {
+            // see MESSAGE_AUTH_KEYS
+            shared.copyOwnKeys(authData, authOpts, key => !MESSAGE_AUTH_KEYS.includes(key));
+        }
         if (Object.keys(authData).length === 0) {
             return false;
         }

package/node_modules/nodemailer/dist/esm/well-known/services.js

@@ -360,6 +360,13 @@ export const services = {
         "port": 587,
         "secure": false
     },
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "Postmark": {
         "description": "Postmark",
         "aliases": [

package/node_modules/nodemailer/dist/esm/xoauth2/index.js

@@ -226,8 +226,14 @@ class XOAuth2 extends Stream {
                 grant_type: 'refresh_token'
             };
         }
-        Object.assign(urlOptions, this.options.customParams);
-        Object.assign(loggedUrlOptions, this.options.customParams);
+        const customParams = this.options.customParams || {};
+        Object.assign(urlOptions, customParams);
+        // a custom param is as likely to be a client assertion or an API key as a tenant
+        // name, so the log gets the same glimpse of it that it gets of the client secret
+        for (const key of Object.keys(customParams)) {
+            const param = customParams[key];
+            loggedUrlOptions[key] = (param === undefined || param === null ? '' : String(param)).substr(0, 6) + '...';
+        }
         this.logger.debug({
             tnx: 'OAUTH2',
             user: this.options.user,

package/node_modules/nodemailer/dist/well-known/services.json

@@ -333,6 +333,14 @@
         "secure": false
     },
 
+    "Oveyon": {
+        "description": "Oveyon",
+        "host": "smtp.oveyon.com",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
+
     "Postmark": {
         "description": "Postmark",
         "aliases": ["PostmarkApp"],

package/node_modules/nodemailer/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.1",
+    "version": "10.1.2",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",

package/package.json

@@ -87,7 +87,7 @@
     "@mavogel/mvc-projen": "^0.0.60",
     "cdk-nag": "^3.0.1",
     "constructs": "^10.5.1",
-    "mailparser": "^3.9.39",
+    "mailparser": "^3.9.40",
     "uuid": "^14.0.3"
   },
   "bundledDependencies": [
@@ -122,7 +122,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.22",
+  "version": "0.1.23",
   "jest": {
     "coverageProvider": "v8",
     "transformIgnorePatterns": [