@mavogel/awscdk-rootmail 0.1.7 → 0.1.9

package/node_modules/nodemailer/dist/cjs/mailer/index.d.ts

@@ -4,8 +4,8 @@ import DKIM, { type DKIMOptions } from '../dkim/index.js';
 import MailMessage, { type MailDefaults, type SendMailOptions } from './mail-message.js';
 import net from 'node:net';
 import type { ConnectionOptions } from 'node:tls';
-import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders } from '../mail-composer/index.js';
-import type { NodemailerError, ResultCallback } from '../errors.js';
+import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerTextEncoding } from '../mail-composer/index.js';
+import type { Callback, NodemailerError, ResultCallback } from '../errors.js';
 import type { ParsedUrl } from '../shared/url.js';
 import type { MimeNodeAddress, MimeNodeEnvelope, MimeNodeEnvelopeInput, MimeNodeHeaders, MimeNodeOptions } from '../mime-node/index.js';
 import type { XOAuth2ProvisionCallback } from '../xoauth2/index.js';
@@ -15,9 +15,10 @@ export type { default as MailMessage } from './mail-message.js';
  * The base shape of the object a transport hands back for a sent message. Every bundled
  * transport sets the envelope and the Message-ID, the rest depends on the transport.
  *
- * The index signature keeps a transport specific field readable through this type, and it
- * is also what a result type has to inherit to stay assignable to it, so the result type
- * of a transport outside this package has to extend this interface rather than restate it
+ * The index signature keeps a transport specific field readable through this type, the way
+ * the `any` typed result of @types/nodemailer was, and it is also what a result type has
+ * to inherit to stay assignable to it, so the result type of a transport outside this
+ * package has to extend this interface rather than restate it
  */
 export interface SentMessageInfo {
     /** The envelope the message was sent with */
@@ -33,9 +34,9 @@ export interface SentMessageInfo {
     /** Last response from the server */
     response?: string | undefined;
     /** The generated message, for the transports that hand it back instead of sending it */
-    message?: unknown;
+    message?: any;
     /** Transport specific fields */
-    [key: string]: unknown;
+    [key: string]: any;
 }
 /**
  * Callback for sendMail, receives the transport result once the transport has taken the
@@ -43,9 +44,11 @@ export interface SentMessageInfo {
  */
 export type SendMailCallback<T = SentMessageInfo> = (err: NodemailerError | null, info: T) => void;
 /**
- * Callback for verify(), success is true once the transport accepted the configuration
+ * Callback for verify(), success is true once the transport accepted the configuration.
+ * Declared with a required success value, the way @types/nodemailer declared it, the
+ * error path hands over the error alone
  */
-export type VerifyCallback = (err: NodemailerError | null, success?: true) => void;
+export type VerifyCallback = Callback<true>;
 /**
  * Callback a plugin calls once it is done, an error aborts the send
  */
@@ -60,21 +63,23 @@ export type PluginFunction<T = SentMessageInfo> = (mail: MailMessage<T>, callbac
  */
 export interface GetSocketOptions {
     host?: string | undefined;
-    port?: number | string | undefined;
+    port?: number | undefined;
     [key: string]: any;
 }
 /**
- * The result of a getSocket handler, the socket to use for the connection
+ * The result of a getSocket handler, the socket to use for the connection. The object is
+ * merged into the connection options, so it may carry any of those as well
  */
 export interface SocketOptions {
     /** An established socket, the proxied connection */
     connection?: net.Socket | undefined;
+    [key: string]: any;
 }
 /**
- * Receives the socket options from a getSocket handler, or the error that prevented the
- * connection
+ * Receives the socket options from a getSocket handler, false when a new socket should be
+ * opened, or the error that prevented the connection
  */
-export type GetSocketCallback = (err: NodemailerError | null, socketOptions?: SocketOptions) => void;
+export type GetSocketCallback = (err: Error | null, socketOptions?: SocketOptions | false) => void;
 /**
  * A socket handler. Mail sets one on the transport as getSocket when a proxy is configured,
  * the SMTP transports call it to get a proxied socket instead of connecting directly
@@ -101,9 +106,12 @@ export interface MailMeta {
 /**
  * A transport as consumed by Mail: any object with a name, a version and a send method
  * works, the rest is optional. Mail forwards its close, isIdle and verify calls to the
- * methods of the same name as they are, so their arguments are up to the transport
+ * methods of the same name as they are, so their arguments are up to the transport.
+ *
+ * D is the options type of the transport, the second type parameter @types/nodemailer
+ * declared on Transport, Transporter and Mail
  */
-export interface Transport<T = SentMessageInfo> {
+export interface Transport<T = SentMessageInfo, D extends TransportOptions = TransportOptions> {
     /** Transport name, used for logging */
     name: string;
     /** Transport version, used for logging */
@@ -119,7 +127,7 @@ export interface Transport<T = SentMessageInfo> {
     /** Registers an event listener, the transport may emit 'log', 'error', 'idle' and 'clear' */
     on?(event: string | symbol, listener: (...args: any[]) => void): this;
     /** The Mail object the transport belongs to, set by Mail */
-    mailer?: Mail<T> | undefined;
+    mailer?: Mail<T, D> | undefined;
     /** Socket handler for a proxied connection, set by Mail when a proxy is configured */
     getSocket?: GetSocketHandler | undefined;
 }
@@ -150,22 +158,23 @@ export interface TransportOptions {
     attachDataUrls?: boolean | undefined;
 }
 /**
- * The transporter object createTransport returns, a Mail instance wrapping a transport
+ * The transporter object createTransport returns, a Mail instance wrapping a transport. D
+ * is the options type of the transport, it types the options field of the transporter
  */
-export type Transporter<T = SentMessageInfo> = Mail<T>;
+export type Transporter<T = SentMessageInfo, D extends TransportOptions = TransportOptions> = Mail<T, D>;
 /**
  * Creates an object for exposing the Mail API
  *
  * @constructor
  * @param transporter Transport object instance to pass the mails to
  */
-declare class Mail<out T = SentMessageInfo> extends EventEmitter {
-    options: TransportOptions;
+declare class Mail<out T = SentMessageInfo, out D extends TransportOptions = TransportOptions> extends EventEmitter {
+    options: D;
     /** Message defaults given to createTransport, kept public because the DefinitelyTyped typings declared it */
     _defaults: MailDefaults;
     meta: Map<string, any>;
     dkim: DKIM | false;
-    transporter: Transport<T>;
+    transporter: Transport<T, D>;
     logger: shared.Logger;
     /** Closes the transport, the pooled SMTP transport closes its connections */
     close: () => void;
@@ -178,15 +187,21 @@ declare class Mail<out T = SentMessageInfo> extends EventEmitter {
     };
     /** Socket handler for a proxied connection, set by setupProxy and handed to the transport on the next send */
     getSocket?: GetSocketHandler | false | undefined;
-    constructor(transporter: Transport<T>, options?: TransportOptions, defaults?: MailDefaults);
+    constructor(transporter: Transport<T, D>, options?: D, defaults?: MailDefaults);
     use(step: string, plugin: PluginFunction<T>): this;
     /**
      * Sends an email using the preselected transport object
      *
      * @param data E-data description
-     * @param callback Callback to run once the sending succeeded or failed
+     * @returns Promise that resolves with the result of the send
      */
     sendMail(data: SendMailOptions): Promise<T>;
+    /**
+     * Sends an email using the preselected transport object
+     *
+     * @param data E-data description
+     * @param callback Callback to run once the sending succeeded or failed
+     */
     sendMail(data: SendMailOptions, callback: SendMailCallback<T>): void;
     getVersionString(): string;
     /**
@@ -213,7 +228,10 @@ declare namespace Mail {
     type ListHeader = MailComposerListHeaderEntry;
     type ListHeaders = MailComposerListHeaders;
     type Envelope = MimeNodeEnvelopeInput;
-    type TextEncoding = NonNullable<SendMailOptions['textEncoding']>;
+    type Connection = SocketOptions;
+    type TextEncoding = MailComposerTextEncoding;
     type PluginFunction<T = SentMessageInfo> = MailPluginFunction<T>;
 }
+/** The same aliases as module level exports, for `import * as Mail` and `import Mail = require()` */
+export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
 export default Mail;

package/node_modules/nodemailer/dist/cjs/mailer/mail-message.d.ts

@@ -3,6 +3,7 @@ import type { MailComposerOptions } from '../mail-composer/index.js';
 import type { DKIMOptions } from '../dkim/index.js';
 import type { SMTPEnvelopeDsn } from '../smtp-connection/index.js';
 import type { SMTPTransportAuthOptions } from '../smtp-transport/index.js';
+import type { SESSendEmailRequest } from '../ses-transport/index.js';
 import type { NodemailerError } from '../errors.js';
 import type { ResolveContentOptions } from '../shared/index.js';
 import type Mail from './index.js';
@@ -14,6 +15,8 @@ import type { SentMessageInfo } from './index.js';
 export interface SendMailOptions extends MailComposerOptions {
     /** DKIM signing options for this message, used instead of the ones of the transporter */
     dkim?: DKIMOptions | undefined;
+    /** Extra DKIM options for this message, merged over the options of the signer. The SES transport sets skipFields here, the option is not meant for callers */
+    _dkim?: DKIMOptions | undefined;
     /** Recipients allowed on this message, 0 disables the limit, defaults to 100000 */
     maxRecipients?: number | undefined;
     /** SMTP transports: DSN parameters for the envelope, sent when the server supports the DSN extension */
@@ -23,9 +26,7 @@ export interface SendMailOptions extends MailComposerOptions {
     /** SMTP transports: per-message authentication settings, used instead of the transport level auth */
     auth?: SMTPTransportAuthOptions | undefined;
     /** SES transport: extra SendEmailCommand parameters merged into the API call */
-    ses?: {
-        [key: string]: unknown;
-    } | undefined;
+    ses?: SESSendEmailRequest | undefined;
 }
 /**
  * Default message fields, the third argument of createTransport. Applied to every message
@@ -71,7 +72,13 @@ export interface MailMessageListHeader {
 export default class MailMessage<T = SentMessageInfo> {
     mailer: Mail<T>;
     data: MailMessageData;
-    message: MimeNode | null;
+    /**
+     * The compiled MIME tree. Set once the compile step is done, so it is null while the
+     * 'compile' plugins run and set by the time the 'stream' plugins and the transport see
+     * the message. Declared as always set, the way @types/nodemailer declared it, since the
+     * plugins that read it are the ones that run after it is set
+     */
+    message: MimeNode;
     constructor(mailer: Mail<T>, data?: SendMailOptions);
     resolveContent(data: {
         [key: string]: any;

package/node_modules/nodemailer/dist/cjs/mime-funcs/index.d.ts

@@ -2,8 +2,8 @@
  * A header value split into the value token and its parameters, the result of parseHeaderValue
  */
 export interface ParsedHeaderValue {
-    /** The value ahead of the parameters, for example the content type */
-    value: string | false;
+    /** The value ahead of the parameters, for example the content type, an empty string when there is none */
+    value: string;
     /** Parameter values keyed by lowercase parameter name */
     params: Record<string, string>;
 }
@@ -25,6 +25,9 @@ export interface EncodedHeaderParam {
     /** Parameter value of this part */
     value: string;
 }
+/** The names @types/nodemailer used for the two types above */
+export type HeaderValue = StructuredHeaderValue;
+export type ParsedHeaderParam = EncodedHeaderParam;
 /**
  * Checks if a value is plaintext string (uses only printable 7bit chars)
  *
@@ -56,6 +59,7 @@ export declare function quoteString(value?: string): string;
  * no need to encode the values in any way. If the value is plaintext but has
  * longer lines then allowed, then use format=flowed
  *
+ * @param str Multi line string to check
  * @param lineLength Max line length to check for
  * @returns Returns true if there is at least one line longer than lineLength chars
  */
@@ -97,9 +101,9 @@ export declare function buildHeaderValue(structured: StructuredHeaderValue): str
  *     title*0*=utf-8''unicode
  *     title*1*=%20string
  *
+ * @param key Parameter name the generated keys are built from, for example title
  * @param data String to be encoded
  * @param [maxLength=50] Max length for generated chunks
- * @param [fromCharset='UTF-8'] Source sharacter set
  * @return A list of encoded keys and headers
  */
 export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];

package/node_modules/nodemailer/dist/cjs/mime-funcs/index.js

@@ -88,6 +88,7 @@ function quoteString(value) {
  * no need to encode the values in any way. If the value is plaintext but has
  * longer lines then allowed, then use format=flowed
  *
+ * @param str Multi line string to check
  * @param lineLength Max line length to check for
  * @returns Returns true if there is at least one line longer than lineLength chars
  */
@@ -234,7 +235,10 @@ function buildHeaderValue(structured) {
                 }
             });
         }
-        else if (/[\s'"\\;:/=(),<>@[\]?]|^-/.test(value)) {
+        else if (!value.length || /[\s'"\\;:/=(),<>@[\]?]|^-/.test(value)) {
+            // a parameter value is a token or a quoted-string and a token is never empty, so
+            // a valueless parameter such as the 'flag' of 'multipart/mixed; flag; boundary=b'
+            // goes out as 'flag=""' rather than as the 'flag=' that parses as neither
             paramsArray.push(param + '=' + JSON.stringify(value));
         }
         else {
@@ -256,9 +260,9 @@ function buildHeaderValue(structured) {
  *     title*0*=utf-8''unicode
  *     title*1*=%20string
  *
+ * @param key Parameter name the generated keys are built from, for example title
  * @param data String to be encoded
  * @param [maxLength=50] Max length for generated chunks
- * @param [fromCharset='UTF-8'] Source sharacter set
  * @return A list of encoded keys and headers
  */
 function buildHeaderParam(key, data, maxLength) {
@@ -385,6 +389,26 @@ function buildHeaderParam(key, data, maxLength) {
         value: item.line
     }));
 }
+/**
+ * An RFC 2045 token: printable ASCII without SPACE, the control characters, DEL and the
+ * tspecials. A charset name is one, and the name a continuation carries is written into
+ * the encoded word the parameter value becomes, so it is checked against this before it
+ * goes in. Whitespace used to come off it only because the value was trimmed first.
+ */
+const TOKEN = /^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;
+/**
+ * Whether a string can be a header parameter name.
+ *
+ * A parameter name is a token, so it is never empty. A "__proto__" name would target the
+ * prototype chain of the params object instead of an own property of it and read back as
+ * Object.prototype, so it is no name either.
+ *
+ * @param name Candidate parameter name, already lowercased
+ * @return true when the name can be used
+ */
+function _isParamName(name) {
+    return !!name && !(0, objects_js_1.isProtoKey)(name);
+}
 /**
  * Parses a header value with key=value arguments into a structured
  * object.
@@ -402,137 +426,227 @@ function buildHeaderParam(key, data, maxLength) {
  */
 function parseHeaderValue(str) {
     const response = {
-        value: false,
+        value: '',
         params: {}
     };
-    // Parameter names come from a caller supplied contentType/contentDisposition. A
-    // "__proto__" name would target the prototype chain of the params object instead of
-    // an own property of it, and read back as Object.prototype, so it is dropped.
+    // A duplicated parameter resolves to its first occurrence, the way a duplicated header
+    // does. Letting the last one win disagrees with the receivers that take the first, and
+    // the two readings of 'boundary="b"; boundary="c"' name different delimiters. The
+    // continuation join below is the only writer of the name it builds, so it tests the
+    // name with _isParamName directly rather than taking that rule along from here.
     const setParam = (name, value) => {
-        if (!(0, objects_js_1.isProtoKey)(name)) {
+        name = name.toLowerCase();
+        if (_isParamName(name) && !Object.prototype.hasOwnProperty.call(response.params, name)) {
             response.params[name] = value;
         }
     };
     let key = false;
     let value = '';
-    let type = 'value';
+    let stage = 'value';
     let quote = false;
     let escaped = false;
     let chr;
+    // Whitespace seen outside a quoted string is held back until a significant character
+    // follows it, so the whitespace around a value is dropped without trimming spaces the
+    // sender quoted on purpose. Trimming the stored value instead loses the trailing space
+    // of 'filename*0="Annual Report "', which the next continuation section is appended to.
+    let pendingSpace = '';
+    let quoteClosed = false;
+    // Whitespace ahead of the first character of a value is padding and is dropped, the
+    // whitespace between two characters of it is content
+    const flushSpace = () => {
+        if (value.length) {
+            value += pendingSpace;
+        }
+        pendingSpace = '';
+    };
+    const addChr = (c) => {
+        flushSpace();
+        value += c;
+    };
+    const takeValue = () => {
+        const taken = value;
+        value = '';
+        pendingSpace = '';
+        quoteClosed = false;
+        return taken;
+    };
+    const storeValue = () => {
+        const taken = takeValue();
+        if (key === false) {
+            response.value = taken;
+        }
+        else {
+            setParam(key, taken);
+        }
+    };
+    // A parameter name with no '=' is a valueless parameter, not the start of the next one.
+    // Without this the name keeps growing across the ';' and swallows whatever follows, which
+    // is how 'multipart/mixed; flag; boundary="AAA"' lost its boundary to a parameter named
+    // 'flag; boundary' and left the node declaring the generated boundary beside the asked
+    // for one, so a receiver reading the first of the two found no delimiter it matched.
+    const storeEmptyKey = () => {
+        setParam(takeValue().trim(), '');
+    };
     for (let i = 0, len = str.length; i < len; i++) {
         chr = str.charAt(i);
-        if (type === 'key') {
+        if (stage === 'key') {
             if (chr === '=') {
-                key = value.trim().toLowerCase();
-                type = 'value';
-                value = '';
+                key = takeValue().trim();
+                stage = 'value';
+                continue;
+            }
+            if (chr === ';') {
+                storeEmptyKey();
                 continue;
             }
             value += chr;
         }
         else {
+            if (quoteClosed && chr !== ';') {
+                // Nothing behind a closed quoted string reaches the value. RFC 2045 says a
+                // parameter value is a token or a quoted string and not both, so what follows
+                // one is junk and only the ';' that ends the parameter still counts. Tested
+                // ahead of the branches rather than beside the append at the foot of them,
+                // where each branch above was a way around it: a second '"' reopened quoting
+                // and swallowed the rest of the header, so 'boundary="AAA" "; boundary=BBB"'
+                // read as a single boundary of 'AAA ', and the junk of
+                // 'boundary="AAA" (unterminated comment' still joined the declared boundary
+                // through the escape branch. quoteClosed is only ever set while no quote is
+                // open, and this is what keeps one from being opened afterwards.
+                escaped = false;
+                continue;
+            }
             if (escaped) {
-                value += chr;
+                addChr(chr);
             }
-            else if (chr === '\\') {
+            else if (quote && chr === '\\') {
+                // a backslash only escapes inside a quoted string, everywhere else it is an
+                // ordinary character. Treating it as an escape turns the parameter value
+                // 'C:\Users\me\report.txt' into 'C:Usersmereport.txt'
                 escaped = true;
                 continue;
             }
             else if (quote && chr === quote) {
                 quote = false;
+                quoteClosed = true;
             }
             else if (!quote && chr === '"') {
                 quote = chr;
+                flushSpace();
             }
             else if (!quote && chr === ';') {
-                if (key === false) {
-                    response.value = value.trim();
-                }
-                else {
-                    setParam(key, value.trim());
-                }
-                type = 'key';
-                value = '';
+                storeValue();
+                stage = 'key';
+            }
+            else if (!quote && (chr === ' ' || chr === '\t')) {
+                pendingSpace += chr;
             }
             else {
-                value += chr;
+                addChr(chr);
             }
             escaped = false;
         }
     }
-    if (type === 'value') {
-        if (key === false) {
-            response.value = value.trim();
-        }
-        else {
-            setParam(key, value.trim());
-        }
+    if (stage === 'value') {
+        storeValue();
     }
-    else if (value.trim()) {
-        setParam(value.trim().toLowerCase(), '');
+    else {
+        // a key with no value, as in 'Header-Key: somevalue; key=value; emptykey'
+        storeEmptyKey();
     }
     // handle parameter value continuations
     // https://tools.ietf.org/html/rfc2231#section-3
-    // preprocess values
+    // Sections are collected in a list and ordered below rather than written into an array
+    // at their own section number. An index write makes the array as long as the number the
+    // header asked for, and the join that follows walks all of it, so the 55 byte value
+    // "attachment; filename*0*=utf-8''a; filename*4000000000=b" held a core for over two
+    // minutes.
+    const continuations = new Map();
     Object.keys(response.params).forEach(key => {
-        let actualKey, nr, match, value;
-        if ((match = key.match(/(\*(\d+)|\*(\d+)\*|\*)$/))) {
-            actualKey = key.substr(0, match.index);
-            nr = Number(match[2] || match[3]) || 0;
-            if ((0, objects_js_1.isProtoKey)(actualKey)) {
-                // see setParam. Reading it back would yield Object.prototype, which is
-                // an object, so the initializer below would be skipped and the write
-                // that follows would throw out of a header build the caller can not catch
-                delete response.params[key];
-                return;
-            }
-            if (!response.params[actualKey] || typeof response.params[actualKey] !== 'object') {
-                response.params[actualKey] = {
-                    charset: false,
-                    values: []
-                };
-            }
-            value = response.params[key];
-            if (nr === 0 && match[0].substr(-1) === '*' && (match = value.match(/^([^']*)'[^']*'(.*)$/))) {
-                response.params[actualKey].charset = match[1] || 'iso-8859-1';
-                value = match[2];
-            }
-            response.params[actualKey].values[nr] = value;
-            // remove the old reference
-            delete response.params[key];
+        const match = key.match(/(\*(\d+)|\*(\d+)\*|\*)$/);
+        if (!match) {
+            // not a continuation parameter, there is nothing to join
+            return;
+        }
+        const actualKey = key.substr(0, match.index);
+        const nr = Number(match[2] || match[3]) || 0;
+        // RFC 2231 section 4.1: only a section whose name ends in '*' is percent encoded
+        const encoded = match[0].substr(-1) === '*';
+        // remove the old reference
+        let value = response.params[key];
+        delete response.params[key];
+        if (!_isParamName(actualKey)) {
+            // the joined value can not be written back under this name. It is empty when the
+            // continuation suffix was all there was of it, as in the bare '*' of 'text/plain; a;*'
+            return;
+        }
+        let continuation = continuations.get(actualKey);
+        if (!continuation) {
+            continuation = { charset: false, sections: [] };
+            continuations.set(actualKey, continuation);
+        }
+        const charsetMatch = nr === 0 && encoded ? value.match(/^([^']*)'[^']*'(.*)$/) : null;
+        if (charsetMatch) {
+            // the charset is a token, and anything else named as one is no charset a consumer
+            // could resolve, so it reads as the unnamed case rather than being carried into
+            // the encoded word below. A "\r\n" of a prefix would otherwise reach a consumer
+            // of the parsed value as the charset of a word that no decoder can act on
+            continuation.charset = TOKEN.test(charsetMatch[1]) ? charsetMatch[1] : 'iso-8859-1';
+            value = charsetMatch[2];
         }
+        continuation.sections.push({ nr, value, encoded });
     });
     // concatenate split rfc2231 strings and convert encoded strings to mime encoded words
-    Object.keys(response.params).forEach(key => {
-        let value;
-        if (response.params[key] && Array.isArray(response.params[key].values)) {
-            value = response.params[key].values.map((val) => val || '').join('');
-            if (response.params[key].charset) {
-                // convert "%AB" to "=?charset?Q?=AB?="
-                response.params[key] =
-                    '=?' +
-                        response.params[key].charset +
-                        '?Q?' +
-                        value
-                            // fix invalidly encoded chars
-                            .replace(/[=?_\s]/g, s => {
-                            const c = s.charCodeAt(0).toString(16);
-                            if (s === ' ') {
-                                return '_';
-                            }
-                            return '%' + (c.length < 2 ? '0' : '') + c;
-                        })
-                            // change from urlencoding to percent encoding
-                            .replace(/%/g, '=') +
-                        '?=';
-            }
-            else {
-                response.params[key] = value;
-            }
+    continuations.forEach((continuation, key) => {
+        if (Object.prototype.hasOwnProperty.call(response.params, key)) {
+            // The same name was also given as a plain parameter, which the starred keys were
+            // just deleted from around, so this write would be the only one in the function
+            // to override a name already taken. 'filename=plain.txt; filename*0=evil.txt'
+            // resolves to the plain parameter either way round, so the reading does not come
+            // down to which of the two spellings the sender put first
+            return;
+        }
+        continuation.sections.sort((a, b) => a.nr - b.nr);
+        if (!continuation.charset) {
+            // nothing said which charset the percent escapes of an encoded section are in,
+            // so every section is passed on as the text it already is
+            response.params[key] = continuation.sections.map(section => section.value).join('');
+            return;
         }
+        // convert "%AB" to "=?charset?Q?=AB?="
+        response.params[key] = '=?' + continuation.charset + '?Q?' + continuation.sections.map(_encodeContinuationSection).join('') + '?=';
     });
     return response;
 }
+/**
+ * Renders one parameter value continuation section as the payload of a Q encoded word.
+ *
+ * A section whose name ends in '*' is percent encoded and its escapes carry the bytes of
+ * the value, so they only have to be rewritten into the "=AB" spelling a Q encoded word
+ * uses. A section without the '*' is literal text (RFC 2231 section 4.1), so its '%' is a
+ * '%' and is escaped along with the characters a Q encoded word can not carry bare.
+ * Decoding a literal section invents bytes that never appeared on the wire: it is how the
+ * value 'filename*0*=utf-8''safe; filename*1=%2F..%2F..%2Fetc%2Fpasswd' was emitted as a
+ * filename every receiving client reads back as 'safe/../../etc/passwd'.
+ *
+ * @param section One collected continuation section
+ * @return The section as Q encoded word payload
+ */
+function _encodeContinuationSection(section) {
+    const specials = section.encoded ? /[=?_\s]/g : /[=?_\s%]/g;
+    return (section.value
+        // fix invalidly encoded chars
+        .replace(specials, s => {
+        const c = s.charCodeAt(0).toString(16);
+        if (s === ' ') {
+            return '_';
+        }
+        return '%' + (c.length < 2 ? '0' : '') + c;
+    })
+        // change from urlencoding to percent encoding
+        .replace(/%/g, '='));
+}
 /**
  * Returns file extension for a content type string. If no suitable extensions
  * are found, 'bin' is used as the default extension

package/node_modules/nodemailer/dist/cjs/mime-node/index.d.ts

@@ -108,10 +108,11 @@ export interface MimeNodeEnvelope {
 }
 /**
  * Envelope as accepted by setEnvelope. Recipients are collected from to, cc and bcc, any
- * other field is copied to the envelope as is
+ * other field is copied to the envelope as is. A `from` of false is the null sender of a
+ * bounce message, it is sent as MAIL FROM:<>
  */
 export interface MimeNodeEnvelopeInput {
-    from?: MimeNodeAddressInput | undefined;
+    from?: MimeNodeAddressInput | false | undefined;
     to?: MimeNodeAddressInput | undefined;
     cc?: MimeNodeAddressInput | undefined;
     bcc?: MimeNodeAddressInput | undefined;
@@ -327,4 +328,6 @@ declare namespace MimeNode {
     type Addresses = MimeNodeAddresses;
     type Envelope = MimeNodeEnvelope;
 }
+/** The same aliases as module level exports, for `import * as MimeNode` and `import MimeNode = require()` */
+export type { MimeNodeOptions as Options, MimeNodeAddresses as Addresses, MimeNodeEnvelope as Envelope };
 export default MimeNode;