@mavogel/awscdk-rootmail 0.1.24 → 0.1.26

package/node_modules/libmime/README.md

@@ -10,7 +10,36 @@
 
 ## Usage
 
-    var libmime = require('libmime');
+libmime is written in TypeScript and ships both an ES module and a CommonJS build, each with type declarations. Node.js 20 or newer is required.
+
+```js
+// ES modules
+import libmime from 'libmime';
+
+// CommonJS
+const libmime = require('libmime');
+```
+
+The default export is a shared `Libmime` instance. The class itself is available as `Libmime` for creating instances of your own:
+
+```js
+import { Libmime } from 'libmime';
+// or: const { Libmime } = require('libmime');
+
+const mime = new Libmime();
+```
+
+The helper modules can be loaded directly as well, for example `libmime/lib/charset` (`encode`, `decode`, `convert`, `normalizeCharset`) and `libmime/lib/mimetypes` (`list`, `extensions`).
+
+### TypeScript
+
+The bundled declarations replace `@types/libmime`, which can be removed. The type names it used keep working: `libmime.StructuredHeader` and `libmime.MimeWordEncoding` are available through the default export, next to the other public types (`ParsedHeaderValue`, `StructuredHeaderValue`, `HeaderParam`, `HeaderLine`, `HeaderObject`), which can also be imported by name:
+
+```ts
+import libmime, { type ParsedHeaderValue } from 'libmime';
+
+const parsed: ParsedHeaderValue = libmime.parseHeaderValue('text/plain; charset=utf-8');
+```
 
 ## Methods
 
@@ -22,9 +51,9 @@ Encodes a string into mime [encoded word](http://en.wikipedia.org/wiki/MIME#Enco
 
     libmime.encodeWord(str [, mimeWordEncoding[, maxLength]]) → String
 
-*   **str** - String or Buffer to be encoded
-*   **mimeWordEncoding** - Encoding for the mime word, either Q or B (default is 'Q')
-*   **maxLength** - If set, split mime words into several chunks if needed
+- **str** - String or Buffer to be encoded
+- **mimeWordEncoding** - Encoding for the mime word, either Q or B (default is 'Q')
+- **maxLength** - If set, split mime words into several chunks if needed
 
 **Example**
 
@@ -40,10 +69,10 @@ Encodes non ascii sequences in a string to mime words.
 
     libmime.encodeWords(str [, mimeWordEncoding[, maxLength[, fromCharset]]]) → String
 
-*   **str** - String or Buffer to be encoded
-*   **mimeWordEncoding** - Encoding for the mime word, either Q or B (default is 'Q')
-*   **maxLength** - If set, split mime words into several chunks if needed
-*   **fromCharset** - Source character set of `str` (defaults to `'UTF-8'`)
+- **str** - String or Buffer to be encoded
+- **mimeWordEncoding** - Encoding for the mime word, either Q or B (default is 'Q')
+- **maxLength** - If set, split mime words into several chunks if needed
+- **fromCharset** - Source character set of `str` (defaults to `'UTF-8'`)
 
 #### #decodeWords
 
@@ -51,7 +80,7 @@ Decodes a string that might include one or several mime words. If no mime words
 
     libmime.decodeWords(str) → String
 
-*   **str** - String to be decoded
+- **str** - String to be decoded
 
 ### Folding
 
@@ -61,9 +90,9 @@ Folds a long line according to the [RFC 5322](http://tools.ietf.org/html/rfc5322
 
     libmime.foldLines(str [, lineLength[, afterSpace]]) → String
 
-*   **str** - String to be folded
-*   **lineLength** - Maximum length of a line (defaults to 76)
-*   **afterSpace** - If true, leave a space in the end of a line
+- **str** - String to be folded
+- **lineLength** - Maximum length of a line (defaults to 76)
+- **afterSpace** - If true, leave a space in the end of a line
 
 **Example**
 
@@ -80,8 +109,8 @@ Adds soft line breaks to content marked with `format=flowed` options to ensure t
 
     libmime.encodeFlowed(str [, lineLength]) → String
 
-*   **str** Plaintext string that requires wrapping
-*   **lineLength** (defaults to 76) Maximum length of a line
+- **str** Plaintext string that requires wrapping
+- **lineLength** (defaults to 76) Maximum length of a line
 
 #### #decodeFlowed
 
@@ -89,8 +118,8 @@ Unwraps a plaintext string in format=flowed wrapping.
 
     libmime.decodeFlowed(str [, delSp]) → String
 
-*   **str** Plaintext string with format=flowed to decode
-*   **delSp** If true, delete leading spaces (delsp=yes)
+- **str** Plaintext string with format=flowed to decode
+- **delSp** If true, delete leading spaces (delsp=yes)
 
 ### Headers
 
@@ -100,7 +129,7 @@ Unfolds a header line and splits it to key and value pair. The return value is i
 
     libmime.decodeHeader(headerLine) → Object
 
-*   **headerLine** - Single header line, might include linebreaks as well if folded
+- **headerLine** - Single header line, might include linebreaks as well if folded
 
 #### #decodeHeaders
 
@@ -110,7 +139,7 @@ Return value is an object of headers, where header keys are object keys and valu
 
     libmime.decodeHeaders(headers) → Object
 
-*   **headers** - Headers string
+- **headers** - Headers string
 
 #### #parseHeaderValue
 
@@ -119,7 +148,7 @@ Parses a header value with `key=value` arguments into a structured object. Usefu
 
     parseHeaderValue(valueString) → Object
 
-*   **valueString** - a header value without the key
+- **valueString** - a header value without the key
 
 **Example**
 
@@ -144,7 +173,7 @@ Joins structured header value together as 'value; param1=value1; param2=value2'
 
     buildHeaderValue(structuredHeader) → String
 
-*   **structuredHeader** - a header value formatted with `parseHeaderValue`
+- **structuredHeader** - a header value formatted with `parseHeaderValue`
 
 `filename` argument is encoded with continuation encoding if needed
 
@@ -154,10 +183,10 @@ Encodes and splits a header param value according to [RFC2231](https://tools.iet
 
     libmime.buildHeaderParam(key, str [, maxLength[, fromCharset]]) → Array
 
-*   **key** - Parameter key (eg. `filename`)
-*   **str** - String or a Buffer value to encode
-*   **maxLength** - Maximum length of the encoded string part (not line length). Defaults to 50
-*   **fromCharset** - Source character set of `str` when it is a Buffer (defaults to `'UTF-8'`)
+- **key** - Parameter key (eg. `filename`)
+- **str** - String or a Buffer value to encode
+- **maxLength** - Maximum length of the encoded string part (not line length). Defaults to 50
+- **fromCharset** - Source character set of `str` when it is a Buffer (defaults to `'UTF-8'`)
 
 The method returns an array of encoded parts with the following structure: `[{key:'...', value: '...'}]`
 
@@ -186,7 +215,7 @@ Returns file extension for a content type string. If no suitable extensions are
 
     libmime.detectExtension(mimeType) → String
 
-*   **mimeType** - Content type to be checked for
+- **mimeType** - Content type to be checked for
 
 **Example**
 
@@ -198,7 +227,7 @@ Returns content type for a file extension. If no suitable content types are foun
 
     libmime.detectMimeType(extension) → String
 
-*   **extension** Extension (or filename) to be checked for
+- **extension** Extension (or filename) to be checked for
 
 **Example**
 

package/node_modules/libmime/SECURITY.md

@@ -0,0 +1,152 @@
+# Security Policy
+
+libmime encodes and decodes MIME encoded words, headers, and header parameters,
+and converts between character sets. It is used to parse headers of untrusted
+email messages. We welcome responsible reports of vulnerabilities that present a
+credible security risk to users. Please distinguish security vulnerabilities
+from ordinary bugs, unusual edge cases, and hardening suggestions.
+
+## Supported Versions
+
+Security fixes are released only against the latest major version. We do not
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.x     | :white_check_mark: |
+| < 5.0   | :x:                |
+
+If you are on an older major, please upgrade. See [CHANGELOG.md](CHANGELOG.md)
+before updating.
+
+## What Qualifies as a Security Vulnerability
+
+A security report should identify a realistic way for an attacker to cross a
+security boundary in a supported version of libmime. Unexpected behavior, a
+failing test, or a technically correct proof of concept is not sufficient on its
+own to establish security impact.
+
+In particular, explain:
+
+- **Attacker capabilities:** Who is the attacker, and what inputs, systems, or
+  responses can they control _without_ already having the privileges or secrets
+  they are trying to gain?
+- **Attack path:** How does attacker-controlled input reach the affected code
+  through a supported public API or a realistic application integration?
+- **Prerequisites:** What configuration and user actions are required? If the
+  attack depends on unusual options or deliberately malformed input, explain why
+  those conditions could arise in a real application.
+- **Impact:** What confidentiality, integrity, or availability boundary is
+  crossed, and what can the attacker achieve as a result?
+
+A vulnerability involving an optional or less common feature can still qualify
+if these conditions are met. Conversely, the existence of a defensive check in
+the code does not, by itself, establish that every bypass of that check has a
+realistic security impact.
+
+## Reporting a Vulnerability
+
+**Do not disclose suspected exploitable vulnerabilities through public GitHub
+issues, pull requests, or discussions before coordinating with the
+maintainers.**
+
+Report privately through one of the following channels:
+
+1. **GitHub Security Advisories (preferred):**
+   <https://github.com/nodemailer/libmime/security/advisories/new>.
+2. **Email:** **andris@reinman.eu**. Encrypt sensitive details if possible (PGP
+   key fingerprint `5D952A46E1D8C931F6364E01DC6C83F4D584D364`).
+
+### Required Information
+
+Please provide enough information to evaluate both the defect and its security
+impact. Reports should include:
+
+1. The affected libmime version or commit, Node.js version, and relevant
+   configuration.
+2. A concise description of the issue and the affected public API or code path
+   (for example encoded-word decoding, header parameter (RFC 2231) parsing,
+   header folding, or charset conversion).
+3. A minimal, tested reproduction, including steps to run it, expected behavior,
+   and observed behavior.
+4. A concrete threat model: attacker control, prerequisites, trust boundary, and
+   resulting impact. Clearly distinguish what your reproduction proves from what
+   you believe might be possible.
+5. An explanation of why the issue affects real deployments beyond a
+   deliberately constructed test setup, where this is not obvious.
+
+A suggested fix is welcome but does not replace an explanation of
+exploitability. A complete real-world exploit is not always necessary, but the
+report must make a credible security impact clear.
+
+### Reports That May Be Treated as Ordinary Bugs
+
+The following generally do **not** qualify for private security handling unless
+you can demonstrate an additional, meaningful security boundary crossing:
+
+- Issues that require the attacker to control trusted application code,
+  administrator-only configuration, or the secret they supposedly extract.
+- Problems caused solely by application-level misuse, exposed credentials, or
+  insecure deployment choices outside libmime's control.
+- Contrived proof-of-concept setups where the tester controls both sides of a
+  request, without explaining how a separate attacker could trigger the issue.
+- Parser quirks, unexpected behavior, and bypasses of internal checks with no
+  demonstrated security impact.
+- Speculative findings based only on static analysis or an automated tool's
+  assessment, without a verified reproduction and credible attack scenario.
+
+These may still be valid bugs and may be considered through the normal issue
+tracker. Please coordinate before making any potentially exploitable details
+public. Classification as a bug does not guarantee a fix or a particular
+priority.
+
+### Automated and AI-Assisted Reports
+
+Automated analysis and AI tools are welcome as research aids, but the person
+submitting a report is responsible for verifying its claims. **Do not submit
+bulk, unverified, or speculative AI-generated findings.** Test each finding
+against a supported release and establish the actual security impact. Reports
+that do not meet the requirements above may be closed without further
+investigation or individual feedback; they can be resubmitted with stronger
+evidence.
+
+## Triage and Disclosure
+
+libmime is maintained by a single person, and there is **no guaranteed response
+or resolution time**. Reports are prioritized based on demonstrated impact,
+exploitability, affected usage, and available maintenance resources.
+
+A private report does not automatically become a security advisory. Confirmed
+vulnerabilities may be fixed and disclosed through GitHub Security Advisories;
+other findings may be closed, deferred, or handled as ordinary bugs. Please do
+not disclose details of an unresolved, potentially exploitable issue publicly
+without coordinating with the maintainers.
+
+## CVEs and Credit
+
+We do not request or manage CVE identifiers. A report being acknowledged, a bug
+being fixed, or a pull request being merged does **not** mean that libmime has
+confirmed a security vulnerability or endorsed a CVE assignment. We do not
+guarantee advisories, CVE identifiers, or public credit for reports. For
+confirmed vulnerabilities disclosed through an advisory, substantive reporters
+may be credited if they wish.
+
+## Scope
+
+In scope: the libmime source in this repository: encoded-word encoding and
+decoding, header parsing and folding, header parameter handling, charset
+conversion, and MIME type detection. Of particular interest are crafted headers
+that crash the process, cause catastrophic regular-expression backtracking,
+pollute prototypes, or consume resources out of proportion to their size.
+
+Out of scope:
+
+- Resource consumption that is proportional to a legitimately large input.
+- Bugs in iconv-lite or other third-party dependencies (please report those
+  upstream).
+- Vulnerabilities in your own application code, including how it renders decoded
+  header values.
+- Social-engineering reports.
+
+Thank you for helping keep libmime and its users safe.

package/node_modules/libmime/dist/cjs/charset.d.ts

@@ -0,0 +1,43 @@
+import { Buffer } from 'node:buffer';
+/**
+ * Encodes an unicode string into an Buffer object as UTF-8
+ *
+ * We force UTF-8 here, no strange encodings allowed.
+ *
+ * @param str String to be encoded
+ * @return UTF-8 encoded typed array
+ */
+export declare function encode(str: string): Buffer;
+/**
+ * Decodes a string from Buffer to an unicode string using specified encoding.
+ * An unknown charset falls back to UTF-8
+ *
+ * @param buf Binary data to be decoded
+ * @param [fromCharset='UTF-8'] Binary data is decoded into string using this charset
+ * @return Decoded string
+ */
+export declare function decode(buf: Buffer | string, fromCharset?: string): string;
+/**
+ * Convert a string from specific encoding to UTF-8 Buffer
+ *
+ * @param data String or Buffer to be encoded
+ * @param [fromCharset='UTF-8'] Source encoding for the string
+ * @return UTF-8 encoded typed array
+ */
+export declare function convert(data: string | Buffer, fromCharset?: string): Buffer;
+/**
+ * Converts well known invalid character set names to proper names.
+ * eg. win-1257 will be converted to windows-1257. Missing or non-string
+ * input defaults to UTF-8.
+ *
+ * @param charset Charset name to convert
+ * @return Canonicalized charset name
+ */
+export declare function normalizeCharset(charset?: unknown): string;
+declare const _default: {
+    encode: typeof encode;
+    decode: typeof decode;
+    convert: typeof convert;
+    normalizeCharset: typeof normalizeCharset;
+};
+export default _default;

package/node_modules/libmime/dist/cjs/charset.js

@@ -0,0 +1,135 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encode = encode;
+exports.decode = decode;
+exports.convert = convert;
+exports.normalizeCharset = normalizeCharset;
+const node_buffer_1 = require("node:buffer");
+const iconv_lite_1 = __importDefault(require("iconv-lite"));
+const encoding_japanese_1 = __importDefault(require("encoding-japanese"));
+const charsets_js_1 = __importDefault(require("./charsets.js"));
+/**
+ * Character set encoding and decoding functions
+ */
+// Names that are decoded as UTF-8 without going through iconv-lite
+const UTF8_COMPATIBLE = /^(?:(?:us-)?ascii|utf-8|7bit)$/i;
+// iconv-lite codecs that are not character sets a message could be written in. UTF-7 is a known
+// way to smuggle markup past filters (=?utf-7?Q?+ADw-script+AD4-?= decodes to "<script>"), base64
+// and hex are transfer encodings. A name resolving to one of them is treated like a charset
+// iconv-lite does not know. iconv-lite resolves the name itself and returns one cached codec per
+// encoding, so every alias it knows (unicode-1-1-utf-7 is utf7 too) is caught by identity
+const UNSUPPORTED_CODECS = new Set(['utf7', 'utf7imap', 'base64', 'hex'].map(name => iconv_lite_1.default.getCodec(name)));
+const isUnsupportedCodec = (name) => {
+    try {
+        return UNSUPPORTED_CODECS.has(iconv_lite_1.default.getCodec(name));
+    }
+    catch (_err) {
+        // a charset iconv-lite does not know at all
+        return false;
+    }
+};
+// Own entries only, so that a name such as '__proto__' or 'constructor' does not resolve to an
+// inherited Object.prototype member
+const CHARSET_ALIASES = new Map(Object.entries(charsets_js_1.default));
+/**
+ * Encodes an unicode string into an Buffer object as UTF-8
+ *
+ * We force UTF-8 here, no strange encodings allowed.
+ *
+ * @param str String to be encoded
+ * @return UTF-8 encoded typed array
+ */
+function encode(str) {
+    return node_buffer_1.Buffer.from(str, 'utf-8');
+}
+/**
+ * Decodes a string from Buffer to an unicode string using specified encoding.
+ * An unknown charset falls back to UTF-8
+ *
+ * @param buf Binary data to be decoded
+ * @param [fromCharset='UTF-8'] Binary data is decoded into string using this charset
+ * @return Decoded string
+ */
+function decode(buf, fromCharset) {
+    fromCharset = normalizeCharset(fromCharset || 'UTF-8');
+    if (UTF8_COMPATIBLE.test(fromCharset)) {
+        return buf.toString('utf-8');
+    }
+    if (isUnsupportedCodec(fromCharset)) {
+        // enforce utf-8, the same as for a charset iconv-lite does not know
+        return buf.toString();
+    }
+    try {
+        if (/^jis|^iso-?2022-?jp|^EUCJP/i.test(fromCharset)) {
+            if (typeof buf === 'string') {
+                buf = node_buffer_1.Buffer.from(buf);
+            }
+            try {
+                let output = encoding_japanese_1.default.convert(buf, {
+                    to: 'UNICODE',
+                    from: fromCharset,
+                    type: 'string'
+                });
+                if (typeof output === 'string') {
+                    return output;
+                }
+                // fall through to iconv-lite if convert returned something unexpected
+            }
+            catch (_err) {
+                // ignore, defaults to iconv-lite on error
+            }
+        }
+        // iconv-lite reads a string as binary, kept as it always was
+        return iconv_lite_1.default.decode(buf, fromCharset);
+    }
+    catch (_err) {
+        // enforce utf-8, data loss might occur
+        return buf.toString();
+    }
+}
+/**
+ * Convert a string from specific encoding to UTF-8 Buffer
+ *
+ * @param data String or Buffer to be encoded
+ * @param [fromCharset='UTF-8'] Source encoding for the string
+ * @return UTF-8 encoded typed array
+ */
+function convert(data, fromCharset) {
+    fromCharset = normalizeCharset(fromCharset || 'UTF-8');
+    if (typeof data !== 'string') {
+        if (UTF8_COMPATIBLE.test(fromCharset)) {
+            return data;
+        }
+        return encode(decode(data, fromCharset));
+    }
+    return encode(data);
+}
+/**
+ * Converts well known invalid character set names to proper names.
+ * eg. win-1257 will be converted to windows-1257. Missing or non-string
+ * input defaults to UTF-8.
+ *
+ * @param charset Charset name to convert
+ * @return Canonicalized charset name
+ */
+function normalizeCharset(charset) {
+    let name = (charset || 'UTF-8').toString().toLowerCase().trim();
+    // first pass
+    let canonical = CHARSET_ALIASES.get(name);
+    if (canonical) {
+        return canonical;
+    }
+    name = name
+        .replace(/^utf[-_]?(\d+)/, 'utf-$1')
+        .replace(/^(?:us[-_]?)ascii/, 'windows-1252')
+        .replace(/^win(?:dows)?[-_]?(\d+)/, 'windows-$1')
+        .replace(/^(?:latin|iso[-_]?8859)?[-_]?(\d+)/, 'iso-8859-$1')
+        .replace(/^l[-_]?(\d+)/, 'iso-8859-$1');
+    // updated pass
+    return CHARSET_ALIASES.get(name) || name.toUpperCase();
+}
+exports.default = { encode, decode, convert, normalizeCharset };
+Object.defineProperty(exports, 'default', { value: exports, enumerable: false, writable: true, configurable: true });

package/node_modules/libmime/dist/cjs/charsets.d.ts

@@ -0,0 +1,2 @@
+declare const charsets: Record<string, string>;
+export default charsets;