@mavogel/awscdk-rootmail 0.1.24 → 0.1.25

package/node_modules/nodemailer/dist/cjs/mailer/mail-message.js

@@ -183,7 +183,10 @@ class MailMessage {
         const values = [data.html, data.text, data.watchHtml, data.amp, data.raw, data.icalEvent];
         for (const key of ['attachments', 'alternatives']) {
             if (Array.isArray(data[key])) {
-                values.push(...data[key]);
+                // one at a time, spreading a long enough list into the arguments throws
+                for (const entry of data[key]) {
+                    values.push(entry);
+                }
             }
         }
         for (const value of values) {

package/node_modules/nodemailer/dist/cjs/mime-funcs/index.js

@@ -70,6 +70,12 @@ function isPlainText(value, isParam) {
     const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
     return typeof value === 'string' && !re.test(value);
 }
+// A parameter value goes out as is only when it is plain text that does not look like an encoded
+// word. Receivers decode encoded words found in parameter values (libmime does so for unencoded
+// continuations), so as plain text it would come back as something else
+function isPlainParamValue(value) {
+    return isPlainText(value, true) && !value.includes('=?');
+}
 /**
  * Wraps a value into a quoted-string. Inside one a quote would end the string early
  * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
@@ -237,7 +243,7 @@ function buildHeaderValue(structured) {
         const value = structured.params[key];
         // a parameter name is a token too and it is emitted without any quoting around it
         const param = key.replace(/[\x00-\x1f\x7f]/g, '');
-        if (!isPlainText(value, true) || value.length >= 75) {
+        if (!isPlainParamValue(value) || value.length >= 75) {
             buildHeaderParam(param, value, 50).forEach(encodedParam => {
                 if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
                     paramsArray.push(encodedParam.key + '=' + encodedParam.value);
@@ -286,7 +292,7 @@ function buildHeaderParam(key, data, maxLength) {
     let i, len;
     maxLength = maxLength || 50;
     // process ascii only text
-    if (isPlainText(data, true)) {
+    if (isPlainParamValue(data)) {
         // check if conversion is even needed
         if (encodedStr.length <= maxLength) {
             return [

package/node_modules/nodemailer/dist/cjs/mime-node/index.js

@@ -64,6 +64,35 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // else goes into angle brackets so that the header can not be read as more addresses than
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+/**
+ * A domain literal that ends an address, see _normalizeAddress
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Removes the whitespace inside every <...> of a References value. A "<" with no ">" after
+ * it is left as it is. An index scan, the regex /<[^>]*>/g rescans the rest of the value
+ * from every such "<"
+ *
+ * @param value References header value
+ * @returns The value with the msg-ids closed up
+ */
+function stripWhitespaceInAngleBrackets(value) {
+    let result = '';
+    let pos = 0;
+    for (;;) {
+        const open = value.indexOf('<', pos);
+        if (open < 0) {
+            break;
+        }
+        const close = value.indexOf('>', open + 1);
+        if (close < 0) {
+            break;
+        }
+        result += value.slice(pos, open) + value.slice(open, close + 1).replace(/\s/g, '');
+        pos = close + 1;
+    }
+    return result + value.slice(pos);
+}
 // domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
 // mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
 // controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
@@ -1357,26 +1386,26 @@ class MimeNode {
                 }
                 return value;
             // space separated list of values enclosed in <>
-            case 'References':
-                value = [].concat
-                    .apply([], [].concat(value || '').map(elm => {
-                    elm = (elm || '')
+            case 'References': {
+                const ids = [];
+                for (const entry of [].concat(value || '')) {
+                    const elm = (entry || '')
                         .toString()
                         .replace(/\r?\n|\r/g, ' ')
                         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                         .trim();
-                    return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
-                }))
-                    .map(elm => {
-                    if (elm.charAt(0) !== '<') {
-                        elm = '<' + elm;
-                    }
-                    if (elm.charAt(elm.length - 1) !== '>') {
-                        elm = elm + '>';
+                    for (let id of stripWhitespaceInAngleBrackets(elm).split(/\s+/)) {
+                        if (id.charAt(0) !== '<') {
+                            id = '<' + id;
+                        }
+                        if (id.charAt(id.length - 1) !== '>') {
+                            id = id + '>';
+                        }
+                        ids.push(id);
                     }
-                    return elm;
-                });
-                return value.join(' ').trim();
+                }
+                return ids.join(' ').trim();
+            }
             case 'Date':
                 if (Object.prototype.toString.call(value) === '[object Date]') {
                     return value.toUTCString().replace(/GMT/, '+0000');
@@ -1455,7 +1484,10 @@ class MimeNode {
             // callers use an empty value to detect a missing address
             return address;
         }
-        const lastAt = address.lastIndexOf('@');
+        // dtext includes '@', so a domain literal is split off at the '@' in front of it and
+        // not at the last one, which delivered 'a@[x@evil.com]' to evil.com
+        const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+        const lastAt = literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
         if (lastAt < 0) {
             // Bare username, there is no domain to split off
             return this._normalizeLocalPart(address);

package/node_modules/nodemailer/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.2";
+export declare const version = "10.1.7";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.2';
+exports.version = '10.1.7';
 exports.homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/cjs/shared/url.js

@@ -58,10 +58,27 @@ const punycode = __importStar(require("../punycode/index.js"));
 // Matches a "scheme:" not followed by "//" (and with something after it), used
 // to re-insert the authority separator the legacy parser did not require.
 const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
-// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
-// looks at the input. Stripped up front so that the slash-less form is recognized in a
-// value read from a file with a trailing newline as well.
-const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+/**
+ * Drops the leading and trailing C0 controls and spaces, which the WHATWG parser strips
+ * before it looks at the input. Stripped up front so that the slash-less form is recognized
+ * in a value read from a file with a trailing newline as well. An index scan, the regex
+ * /^[\x00-\x20]+|[\x00-\x20]+$/g retried a run of spaces inside the value from every
+ * position in it
+ *
+ * @param input URL string
+ * @returns The string without the surrounding controls and spaces
+ */
+function stripSurroundingWhitespace(input) {
+    let start = 0;
+    let end = input.length;
+    while (start < end && input.charCodeAt(start) <= 0x20) {
+        start++;
+    }
+    while (end > start && input.charCodeAt(end - 1) <= 0x20) {
+        end--;
+    }
+    return input.slice(start, end);
+}
 // Leading characters legacy url.parse() skips before it reads the scheme
 const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
 // The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
@@ -156,7 +173,7 @@ function normalizeHostname(raw, href) {
     return mapped;
 }
 const parse = (input, parseQueryString) => {
-    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    input = stripSurroundingWhitespace(input || '');
     // Legacy url.parse() parses a "user:pass@host:port" authority that follows
     // the scheme even without the "//" separator, for schemes outside its
     // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG