@mavogel/awscdk-rootmail 0.1.24 → 0.1.25

package/node_modules/nodemailer/dist/esm/mailer/mail-message.js

@@ -145,7 +145,10 @@ export default class MailMessage {
         const values = [data.html, data.text, data.watchHtml, data.amp, data.raw, data.icalEvent];
         for (const key of ['attachments', 'alternatives']) {
             if (Array.isArray(data[key])) {
-                values.push(...data[key]);
+                // one at a time, spreading a long enough list into the arguments throws
+                for (const entry of data[key]) {
+                    values.push(entry);
+                }
             }
         }
         for (const value of values) {

package/node_modules/nodemailer/dist/esm/mime-funcs/index.js

@@ -21,6 +21,12 @@ export function isPlainText(value, isParam) {
     const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
     return typeof value === 'string' && !re.test(value);
 }
+// A parameter value goes out as is only when it is plain text that does not look like an encoded
+// word. Receivers decode encoded words found in parameter values (libmime does so for unencoded
+// continuations), so as plain text it would come back as something else
+function isPlainParamValue(value) {
+    return isPlainText(value, true) && !value.includes('=?');
+}
 /**
  * Wraps a value into a quoted-string. Inside one a quote would end the string early
  * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
@@ -188,7 +194,7 @@ export function buildHeaderValue(structured) {
         const value = structured.params[key];
         // a parameter name is a token too and it is emitted without any quoting around it
         const param = key.replace(/[\x00-\x1f\x7f]/g, '');
-        if (!isPlainText(value, true) || value.length >= 75) {
+        if (!isPlainParamValue(value) || value.length >= 75) {
             buildHeaderParam(param, value, 50).forEach(encodedParam => {
                 if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
                     paramsArray.push(encodedParam.key + '=' + encodedParam.value);
@@ -237,7 +243,7 @@ export function buildHeaderParam(key, data, maxLength) {
     let i, len;
     maxLength = maxLength || 50;
     // process ascii only text
-    if (isPlainText(data, true)) {
+    if (isPlainParamValue(data)) {
         // check if conversion is even needed
         if (encodedStr.length <= maxLength) {
             return [

package/node_modules/nodemailer/dist/esm/mime-node/index.js

@@ -26,6 +26,35 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // else goes into angle brackets so that the header can not be read as more addresses than
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+/**
+ * A domain literal that ends an address, see _normalizeAddress
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Removes the whitespace inside every <...> of a References value. A "<" with no ">" after
+ * it is left as it is. An index scan, the regex /<[^>]*>/g rescans the rest of the value
+ * from every such "<"
+ *
+ * @param value References header value
+ * @returns The value with the msg-ids closed up
+ */
+function stripWhitespaceInAngleBrackets(value) {
+    let result = '';
+    let pos = 0;
+    for (;;) {
+        const open = value.indexOf('<', pos);
+        if (open < 0) {
+            break;
+        }
+        const close = value.indexOf('>', open + 1);
+        if (close < 0) {
+            break;
+        }
+        result += value.slice(pos, open) + value.slice(open, close + 1).replace(/\s/g, '');
+        pos = close + 1;
+    }
+    return result + value.slice(pos);
+}
 // domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
 // mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
 // controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
@@ -1319,26 +1348,26 @@ class MimeNode {
                 }
                 return value;
             // space separated list of values enclosed in <>
-            case 'References':
-                value = [].concat
-                    .apply([], [].concat(value || '').map(elm => {
-                    elm = (elm || '')
+            case 'References': {
+                const ids = [];
+                for (const entry of [].concat(value || '')) {
+                    const elm = (entry || '')
                         .toString()
                         .replace(/\r?\n|\r/g, ' ')
                         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                         .trim();
-                    return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
-                }))
-                    .map(elm => {
-                    if (elm.charAt(0) !== '<') {
-                        elm = '<' + elm;
-                    }
-                    if (elm.charAt(elm.length - 1) !== '>') {
-                        elm = elm + '>';
+                    for (let id of stripWhitespaceInAngleBrackets(elm).split(/\s+/)) {
+                        if (id.charAt(0) !== '<') {
+                            id = '<' + id;
+                        }
+                        if (id.charAt(id.length - 1) !== '>') {
+                            id = id + '>';
+                        }
+                        ids.push(id);
                     }
-                    return elm;
-                });
-                return value.join(' ').trim();
+                }
+                return ids.join(' ').trim();
+            }
             case 'Date':
                 if (Object.prototype.toString.call(value) === '[object Date]') {
                     return value.toUTCString().replace(/GMT/, '+0000');
@@ -1417,7 +1446,10 @@ class MimeNode {
             // callers use an empty value to detect a missing address
             return address;
         }
-        const lastAt = address.lastIndexOf('@');
+        // dtext includes '@', so a domain literal is split off at the '@' in front of it and
+        // not at the last one, which delivered 'a@[x@evil.com]' to evil.com
+        const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+        const lastAt = literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
         if (lastAt < 0) {
             // Bare username, there is no domain to split off
             return this._normalizeLocalPart(address);

package/node_modules/nodemailer/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.2";
+export declare const version = "10.1.7";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.2';
+export const version = '10.1.7';
 export const homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/esm/shared/url.js

@@ -19,10 +19,27 @@ import * as punycode from '../punycode/index.js';
 // Matches a "scheme:" not followed by "//" (and with something after it), used
 // to re-insert the authority separator the legacy parser did not require.
 const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
-// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
-// looks at the input. Stripped up front so that the slash-less form is recognized in a
-// value read from a file with a trailing newline as well.
-const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+/**
+ * Drops the leading and trailing C0 controls and spaces, which the WHATWG parser strips
+ * before it looks at the input. Stripped up front so that the slash-less form is recognized
+ * in a value read from a file with a trailing newline as well. An index scan, the regex
+ * /^[\x00-\x20]+|[\x00-\x20]+$/g retried a run of spaces inside the value from every
+ * position in it
+ *
+ * @param input URL string
+ * @returns The string without the surrounding controls and spaces
+ */
+function stripSurroundingWhitespace(input) {
+    let start = 0;
+    let end = input.length;
+    while (start < end && input.charCodeAt(start) <= 0x20) {
+        start++;
+    }
+    while (end > start && input.charCodeAt(end - 1) <= 0x20) {
+        end--;
+    }
+    return input.slice(start, end);
+}
 // Leading characters legacy url.parse() skips before it reads the scheme
 const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
 // The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
@@ -117,7 +134,7 @@ function normalizeHostname(raw, href) {
     return mapped;
 }
 export const parse = (input, parseQueryString) => {
-    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    input = stripSurroundingWhitespace(input || '');
     // Legacy url.parse() parses a "user:pass@host:port" authority that follows
     // the scheme even without the "//" separator, for schemes outside its
     // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG

package/node_modules/nodemailer/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.2",
+    "version": "10.1.7",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",

package/package.json

@@ -87,7 +87,7 @@
     "@mavogel/mvc-projen": "^0.0.61",
     "cdk-nag": "^3.0.1",
     "constructs": "^10.5.1",
-    "mailparser": "^3.9.40",
+    "mailparser": "^3.9.46",
     "uuid": "^14.0.3"
   },
   "bundledDependencies": [
@@ -122,7 +122,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.24",
+  "version": "0.1.25",
   "jest": {
     "coverageProvider": "v8",
     "transformIgnorePatterns": [

package/node_modules/libbase64/.eslintrc

@@ -1,11 +0,0 @@
-{
-    "rules": {
-        "indent": 0,
-        "global-require": 0,
-        "no-await-in-loop": 0
-    },
-    "extends": ["nodemailer", "prettier"],
-    "parserOptions": {
-        "ecmaVersion": 2017
-    }
-}

package/node_modules/libbase64/.github/FUNDING.yml

@@ -1,4 +0,0 @@
-# These are supported funding model platforms
-
-github: [andris9] # enable once enrolled
-custom: ['https://www.paypal.me/nodemailer']

package/node_modules/libbase64/.github/VULNERABILITY_REPORT.yml

@@ -1,75 +0,0 @@
-name: "libbase64 security vulnerability report"
-description: "Report an exploitable security vulnerability in libbase64"
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Before reporting, read our
-        [Security Policy](https://github.com/nodemailer/libbase64/security/policy).
-
-        Reports must demonstrate a credible security impact.
-        Technically valid bugs without a realistic attack
-        scenario belong in the regular issue tracker.
-
-  - type: textarea
-    id: summary
-    attributes:
-      label: Vulnerability summary
-      description: Describe the vulnerability and affected versions.
-    validations:
-      required: true
-
-  - type: textarea
-    id: attacker
-    attributes:
-      label: Attacker capabilities
-      description: |
-        What can an attacker control without already having
-        privileged access to the application or its configuration?
-    validations:
-      required: true
-      min_length: 100
-
-  - type: textarea
-    id: exploit
-    attributes:
-      label: Realistic exploitation scenario
-      description: |
-        Describe how this can be exploited in a real application.
-        Explain the prerequisites and security boundary crossed.
-    validations:
-      required: true
-      min_length: 150
-
-  - type: textarea
-    id: poc
-    attributes:
-      label: Proof of concept
-      description: Provide reproducible steps or working code.
-    validations:
-      required: true
-
-  - type: textarea
-    id: impact
-    attributes:
-      label: Security impact
-      description: |
-        What can the attacker achieve? Who is affected?
-        Explain why this is a security vulnerability rather
-        than an ordinary bug.
-    validations:
-      required: true
-      min_length: 100
-
-  - type: checkboxes
-    id: confirmation
-    attributes:
-      label: Reporting requirements
-      options:
-        - label: I have read the Security Policy.
-          required: true
-        - label: I have verified the finding against a supported version.
-          required: true
-        - label: I have described a credible attacker-controlled scenario.
-          required: true

package/node_modules/libbase64/.github/workflows/release.yaml

@@ -1,39 +0,0 @@
-on:
-    push:
-        branches:
-            - master
-    # Manual run: publish the version currently on master (used when a release was cut
-    # but the publish step failed)
-    workflow_dispatch:
-
-permissions:
-    contents: write
-    pull-requests: write
-    id-token: write
-
-name: release
-jobs:
-    release-please:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: google-github-actions/release-please-action@v3
-              id: release
-              if: ${{ github.event_name == 'push' }}
-              with:
-                  release-type: node
-                  package-name: ${{vars.NPM_MODULE_NAME}}
-                  pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
-            # The logic below handles the npm publication through npm trusted publishing
-            # (OIDC, no token secret): it runs when a new release is created, or on a
-            # manual dispatch.
-            - uses: actions/checkout@v4
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 24
-                  registry-url: 'https://registry.npmjs.org'
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - run: npm ci
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - run: npm publish --provenance --access public
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}

package/node_modules/libbase64/.github/workflows/test.yml

@@ -1,21 +0,0 @@
-name: Run tests
-
-on:
-    push:
-    pull_request:
-
-jobs:
-    test:
-        strategy:
-            matrix:
-                node: [16.x, 18.x, 20.x, 21.x]
-                os: [ubuntu-latest]
-        runs-on: ${{ matrix.os }}
-        steps:
-            - uses: actions/checkout@v2
-            - name: Use Node.js ${{ matrix.node }}
-              uses: actions/setup-node@v4
-              with:
-                  node-version: ${{ matrix.node }}
-            - run: npm install
-            - run: npm test

package/node_modules/libbase64/.ncurc.js

@@ -1,13 +0,0 @@
-module.exports = {
-    upgrade: true,
-    reject: [
-        // 12 is esm only ("type": "module"), and grunt-mocha-test require()s it as a
-        // constructor - "Mocha is not a constructor". Node 24 hides this through
-        // require(esm); CI on Node 22 does not. Lift it when the runner drops grunt.
-        'mocha',
-        // 5x is esm only
-        'chai',
-        // api changes in newer eslint
-        'grunt-eslint'
-    ]
-};

package/node_modules/libbase64/.prettierrc.js

@@ -1,8 +0,0 @@
-module.exports = {
-    printWidth: 160,
-    tabWidth: 4,
-    singleQuote: true,
-    endOfLine: 'lf',
-    trailingComma: 'none',
-    arrowParens: 'avoid'
-};

package/node_modules/libmime/lib/charset.js

@@ -1,131 +0,0 @@
-'use strict';
-
-const { Buffer } = require('node:buffer');
-const iconv = require('iconv-lite');
-const encodingJapanese = require('encoding-japanese');
-const charsets = require('./charsets');
-
-// iconv-lite codecs that are not character sets a message could be written in. UTF-7 is a known
-// way to smuggle markup past filters (=?utf-7?Q?+ADw-script+AD4-?= decodes to "<script>"), base64
-// and hex are transfer encodings. A name resolving to one of them is treated like a charset
-// iconv-lite does not know. Compared in the canonical form iconv-lite itself resolves names in
-const UNSUPPORTED_CODECS = new Set(['utf7', 'utf7imap', 'base64', 'hex']);
-const isUnsupportedCodec = name => UNSUPPORTED_CODECS.has(name.toLowerCase().replace(/:\d{4}$|[^0-9a-z]/g, ''));
-
-/**
- * Character set encoding and decoding functions
- */
-const charset = (module.exports = {
-    /**
-     * Encodes an unicode string into an Buffer object as UTF-8
-     *
-     * We force UTF-8 here, no strange encodings allowed.
-     *
-     * @param {String} str String to be encoded
-     * @return {Buffer} UTF-8 encoded typed array
-     */
-    encode(str) {
-        return Buffer.from(str, 'utf-8');
-    },
-
-    /**
-     * Decodes a string from Buffer to an unicode string using specified encoding
-     * NB! Throws if unknown charset is used
-     *
-     * @param {Buffer} buf Binary data to be decoded
-     * @param {String} [fromCharset='UTF-8'] Binary data is decoded into string using this charset
-     * @return {String} Decoded string
-     */
-    decode(buf, fromCharset) {
-        fromCharset = charset.normalizeCharset(fromCharset || 'UTF-8');
-
-        if (/^(?:(?:us-)?ascii|utf-8|7bit)$/i.test(fromCharset)) {
-            return buf.toString('utf-8');
-        }
-
-        if (isUnsupportedCodec(fromCharset)) {
-            // enforce utf-8, the same as for a charset iconv-lite does not know
-            return buf.toString();
-        }
-
-        try {
-            if (/^jis|^iso-?2022-?jp|^EUCJP/i.test(fromCharset)) {
-                if (typeof buf === 'string') {
-                    buf = Buffer.from(buf);
-                }
-                try {
-                    let output = encodingJapanese.convert(buf, {
-                        to: 'UNICODE',
-                        from: fromCharset,
-                        type: 'string'
-                    });
-                    if (typeof output === 'string') {
-                        return output;
-                    }
-                    // fall through to iconv-lite if convert returned something unexpected
-                } catch (err) {
-                    // ignore, defaults to iconv-lite on error
-                }
-            }
-
-            return iconv.decode(buf, fromCharset);
-        } catch (err) {
-            // enforce utf-8, data loss might occur
-            return buf.toString();
-        }
-    },
-
-    /**
-     * Convert a string from specific encoding to UTF-8 Buffer
-     *
-     * @param {String|Buffer} data String or Buffer to be encoded
-     * @param {String} [fromCharset='UTF-8'] Source encoding for the string
-     * @return {Buffer} UTF-8 encoded typed array
-     */
-    convert(data, fromCharset) {
-        fromCharset = charset.normalizeCharset(fromCharset || 'UTF-8');
-
-        let bufString;
-
-        if (typeof data !== 'string') {
-            if (/^(?:(?:us-)?ascii|utf-8|7bit)$/i.test(fromCharset)) {
-                return data;
-            }
-
-            bufString = charset.decode(data, fromCharset);
-            return charset.encode(bufString);
-        }
-        return charset.encode(data);
-    },
-
-    /**
-     * Converts well known invalid character set names to proper names.
-     * eg. win-1257 will be converted to windows-1257. Missing or non-string
-     * input defaults to UTF-8.
-     *
-     * @param {String} charset Charset name to convert
-     * @return {String} Canonicalized charset name
-     */
-    normalizeCharset(charset) {
-        charset = (charset || 'UTF-8').toString().toLowerCase().trim();
-
-        // first pass
-        if (charsets.hasOwnProperty(charset) && charsets[charset]) {
-            return charsets[charset];
-        }
-
-        charset = charset
-            .replace(/^utf[-_]?(\d+)/, 'utf-$1')
-            .replace(/^(?:us[-_]?)ascii/, 'windows-1252')
-            .replace(/^win(?:dows)?[-_]?(\d+)/, 'windows-$1')
-            .replace(/^(?:latin|iso[-_]?8859)?[-_]?(\d+)/, 'iso-8859-$1')
-            .replace(/^l[-_]?(\d+)/, 'iso-8859-$1');
-
-        // updated pass
-        if (charsets.hasOwnProperty(charset) && charsets[charset]) {
-            return charsets[charset];
-        }
-
-        return charset.toUpperCase();
-    }
-});