@nocobase/plugin-notification-email 2.3.0-beta.12 → 2.3.0-beta.13

package/dist/node_modules/nodemailer/lib/shared/index.js

@@ -2,54 +2,62 @@
 
 'use strict';
 
-const urllib = require('url');
+const urllib = require('./url');
 const util = require('util');
 const fs = require('fs');
 const nmfetch = require('../fetch');
+const errors = require('../errors');
+const objects = require('./objects');
 const dns = require('dns');
 const net = require('net');
 const os = require('os');
 
+// re-exported for the callers that already depend on this module, see ./objects
+const isProtoKey = (module.exports.isProtoKey = objects.isProtoKey);
+module.exports.copyOwnKeys = objects.copyOwnKeys;
+
 const DNS_TTL = 5 * 60 * 1000;
+const CACHE_CLEANUP_INTERVAL = 30 * 1000; // Minimum 30 seconds between cleanups
+const MAX_CACHE_SIZE = 1000; // Maximum number of entries in cache
+
+let lastCacheCleanup = 0;
+module.exports._lastCacheCleanup = () => lastCacheCleanup;
+module.exports._resetCacheCleanup = () => {
+    lastCacheCleanup = 0;
+};
 
 let networkInterfaces;
 try {
     networkInterfaces = os.networkInterfaces();
-} catch (err) {
+} catch (_err) {
     // fails on some systems
 }
 
 module.exports.networkInterfaces = networkInterfaces;
 
 const isFamilySupported = (family, allowInternal) => {
-    let networkInterfaces = module.exports.networkInterfaces;
-    if (!networkInterfaces) {
+    const ifaces = module.exports.networkInterfaces;
+    if (!ifaces) {
         // hope for the best
         return true;
     }
 
-    const familySupported =
-        // crux that replaces Object.values(networkInterfaces) as Object.values is not supported in nodejs v6
-        Object.keys(networkInterfaces)
-            .map(key => networkInterfaces[key])
-            // crux that replaces .flat() as it is not supported in older Node versions (v10 and older)
-            .reduce((acc, val) => acc.concat(val), [])
-            .filter(i => !i.internal || allowInternal)
-            .filter(i => i.family === 'IPv' + family || i.family === family).length > 0;
-
-    return familySupported;
+    return Object.keys(ifaces)
+        .map(key => ifaces[key])
+        .reduce((acc, val) => acc.concat(val), [])
+        .filter(i => !i.internal || allowInternal)
+        .some(i => i.family === 'IPv' + family || i.family === family);
 };
 
-const resolver = (family, hostname, options, callback) => {
+const resolve = (family, hostname, options, callback) => {
     options = options || {};
-    const familySupported = isFamilySupported(family, options.allowInternalNetworkInterfaces);
 
-    if (!familySupported) {
+    if (!isFamilySupported(family, options.allowInternalNetworkInterfaces)) {
         return callback(null, []);
     }
 
-    const resolver = dns.Resolver ? new dns.Resolver(options) : dns;
-    resolver['resolve' + family](hostname, (err, addresses) => {
+    const dnsResolver = dns.Resolver ? new dns.Resolver(options) : dns;
+    dnsResolver['resolve' + family](hostname, (err, addresses) => {
         if (err) {
             switch (err.code) {
                 case dns.NODATA:
@@ -74,15 +82,17 @@ const formatDNSValue = (value, extra) => {
         return Object.assign({}, extra || {});
     }
 
+    const addresses = value.addresses || [];
+
+    // Select a random address from available addresses, or null if none
+    const host = addresses.length > 0 ? addresses[Math.floor(Math.random() * addresses.length)] : null;
+
     return Object.assign(
         {
             servername: value.servername,
-            host:
-                !value.addresses || !value.addresses.length
-                    ? null
-                    : value.addresses.length === 1
-                    ? value.addresses[0]
-                    : value.addresses[Math.floor(Math.random() * value.addresses.length)]
+            host,
+            // Include all addresses for connection fallback support
+            _addresses: addresses
         },
         extra || {}
     );
@@ -97,7 +107,7 @@ module.exports.resolveHostname = (options, callback) => {
 
     if (!options.host || net.isIP(options.host)) {
         // nothing to do here
-        let value = {
+        const value = {
             addresses: [options.host],
             servername: options.servername || false
         };
@@ -113,7 +123,27 @@ module.exports.resolveHostname = (options, callback) => {
     if (dnsCache.has(options.host)) {
         cached = dnsCache.get(options.host);
 
-        if (!cached.expires || cached.expires >= Date.now()) {
+        // Lazy cleanup with time throttling
+        const now = Date.now();
+        if (now - lastCacheCleanup > CACHE_CLEANUP_INTERVAL) {
+            lastCacheCleanup = now;
+
+            // Clean up expired entries
+            for (const [host, entry] of dnsCache.entries()) {
+                if (entry.expires && entry.expires < now) {
+                    dnsCache.delete(host);
+                }
+            }
+
+            // If cache is still too large, remove oldest entries
+            if (dnsCache.size > MAX_CACHE_SIZE) {
+                const toDelete = Math.floor(MAX_CACHE_SIZE * 0.1); // Remove 10% of entries
+                const keys = Array.from(dnsCache.keys()).slice(0, toDelete);
+                keys.forEach(key => dnsCache.delete(key));
+            }
+        }
+
+        if (!cached.expires || cached.expires >= now) {
             return callback(
                 null,
                 formatDNSValue(cached.value, {
@@ -123,58 +153,32 @@ module.exports.resolveHostname = (options, callback) => {
         }
     }
 
-    resolver(4, options.host, options, (err, addresses) => {
-        if (err) {
-            if (cached) {
-                // ignore error, use expired value
-                return callback(
-                    null,
-                    formatDNSValue(cached.value, {
-                        cached: true,
-                        error: err
-                    })
-                );
-            }
-            return callback(err);
-        }
-
-        if (addresses && addresses.length) {
-            let value = {
-                addresses,
-                servername: options.servername || options.host
-            };
+    // Resolve both IPv4 and IPv6 addresses for fallback support
+    let ipv4Addresses = [];
+    let ipv6Addresses = [];
+    let ipv4Error = null;
+    let ipv6Error = null;
 
-            dnsCache.set(options.host, {
-                value,
-                expires: Date.now() + (options.dnsTtl || DNS_TTL)
-            });
-
-            return callback(
-                null,
-                formatDNSValue(value, {
-                    cached: false
-                })
-            );
+    resolve(4, options.host, options, (err, addresses) => {
+        if (err) {
+            ipv4Error = err;
+        } else {
+            ipv4Addresses = addresses || [];
         }
 
-        resolver(6, options.host, options, (err, addresses) => {
+        resolve(6, options.host, options, (err, addresses) => {
             if (err) {
-                if (cached) {
-                    // ignore error, use expired value
-                    return callback(
-                        null,
-                        formatDNSValue(cached.value, {
-                            cached: true,
-                            error: err
-                        })
-                    );
-                }
-                return callback(err);
+                ipv6Error = err;
+            } else {
+                ipv6Addresses = addresses || [];
             }
 
-            if (addresses && addresses.length) {
-                let value = {
-                    addresses,
+            // Combine addresses: IPv4 first, then IPv6
+            const allAddresses = ipv4Addresses.concat(ipv6Addresses);
+
+            if (allAddresses.length) {
+                const value = {
+                    addresses: allAddresses,
                     servername: options.servername || options.host
                 };
 
@@ -191,11 +195,34 @@ module.exports.resolveHostname = (options, callback) => {
                 );
             }
 
+            // No addresses from resolve4/resolve6, try dns.lookup as fallback
+            if (ipv4Error && ipv6Error) {
+                // Both resolvers had errors
+                if (cached) {
+                    dnsCache.set(options.host, {
+                        value: cached.value,
+                        expires: Date.now() + (options.dnsTtl || DNS_TTL)
+                    });
+
+                    return callback(
+                        null,
+                        formatDNSValue(cached.value, {
+                            cached: true,
+                            error: ipv4Error
+                        })
+                    );
+                }
+            }
+
             try {
                 dns.lookup(options.host, { all: true }, (err, addresses) => {
                     if (err) {
                         if (cached) {
-                            // ignore error, use expired value
+                            dnsCache.set(options.host, {
+                                value: cached.value,
+                                expires: Date.now() + (options.dnsTtl || DNS_TTL)
+                            });
+
                             return callback(
                                 null,
                                 formatDNSValue(cached.value, {
@@ -207,19 +234,17 @@ module.exports.resolveHostname = (options, callback) => {
                         return callback(err);
                     }
 
-                    let address = addresses
-                        ? addresses
-                              .filter(addr => isFamilySupported(addr.family))
-                              .map(addr => addr.address)
-                              .shift()
-                        : false;
+                    // Get all supported addresses from dns.lookup
+                    const supportedAddresses = addresses
+                        ? addresses.filter(addr => isFamilySupported(addr.family)).map(addr => addr.address)
+                        : [];
 
-                    if (addresses && addresses.length && !address) {
+                    if (addresses && addresses.length && !supportedAddresses.length) {
                         // there are addresses but none can be used
                         console.warn(`Failed to resolve IPv${addresses[0].family} addresses with current network`);
                     }
 
-                    if (!address && cached) {
+                    if (!supportedAddresses.length && cached) {
                         // nothing was found, fallback to cached value
                         return callback(
                             null,
@@ -229,8 +254,8 @@ module.exports.resolveHostname = (options, callback) => {
                         );
                     }
 
-                    let value = {
-                        addresses: address ? [address] : [options.host],
+                    const value = {
+                        addresses: supportedAddresses.length ? supportedAddresses : [options.host],
                         servername: options.servername || options.host
                     };
 
@@ -246,18 +271,22 @@ module.exports.resolveHostname = (options, callback) => {
                         })
                     );
                 });
-            } catch (err) {
+            } catch (lookupErr) {
                 if (cached) {
-                    // ignore error, use expired value
+                    dnsCache.set(options.host, {
+                        value: cached.value,
+                        expires: Date.now() + (options.dnsTtl || DNS_TTL)
+                    });
+
                     return callback(
                         null,
                         formatDNSValue(cached.value, {
                             cached: true,
-                            error: err
+                            error: lookupErr
                         })
                     );
                 }
-                return callback(err);
+                return callback(ipv4Error || ipv6Error || lookupErr);
             }
         });
     });
@@ -270,97 +299,91 @@ module.exports.resolveHostname = (options, callback) => {
  */
 module.exports.parseConnectionUrl = str => {
     str = str || '';
-    let options = {};
-
-    [urllib.parse(str, true)].forEach(url => {
-        let auth;
-
-        switch (url.protocol) {
-            case 'smtp:':
-                options.secure = false;
-                break;
-            case 'smtps:':
-                options.secure = true;
-                break;
-            case 'direct:':
-                options.direct = true;
-                break;
-        }
+    const options = {};
+    const url = urllib.parse(str, true);
+
+    switch (url.protocol) {
+        case 'smtp:':
+            options.secure = false;
+            break;
+        case 'smtps:':
+            options.secure = true;
+            break;
+        case 'direct:':
+            options.direct = true;
+            break;
+    }
 
-        if (!isNaN(url.port) && Number(url.port)) {
-            options.port = Number(url.port);
-        }
+    if (!isNaN(url.port) && Number(url.port)) {
+        options.port = Number(url.port);
+    }
 
-        if (url.hostname) {
-            options.host = url.hostname;
-        }
+    if (url.hostname) {
+        options.host = url.hostname;
+    }
 
-        if (url.auth) {
-            auth = url.auth.split(':');
+    if (url.auth) {
+        const auth = url.auth.split(':');
+        options.auth = {
+            user: auth.shift(),
+            pass: auth.join(':')
+        };
+    }
 
-            if (!options.auth) {
-                options.auth = {};
-            }
+    Object.keys(url.query || {}).forEach(key => {
+        let obj = options;
+        let lKey = key;
+        let value = url.query[key];
 
-            options.auth.user = auth.shift();
-            options.auth.pass = auth.join(':');
+        if (!isNaN(value)) {
+            value = Number(value);
         }
 
-        Object.keys(url.query || {}).forEach(key => {
-            let obj = options;
-            let lKey = key;
-            let value = url.query[key];
-
-            if (!isNaN(value)) {
-                value = Number(value);
-            }
-
-            switch (value) {
-                case 'true':
-                    value = true;
-                    break;
-                case 'false':
-                    value = false;
-                    break;
-            }
+        switch (value) {
+            case 'true':
+                value = true;
+                break;
+            case 'false':
+                value = false;
+                break;
+        }
 
-            // tls is nested object
-            if (key.indexOf('tls.') === 0) {
-                lKey = key.substr(4);
-                if (!options.tls) {
-                    options.tls = {};
-                }
-                obj = options.tls;
-            } else if (key.indexOf('.') >= 0) {
-                // ignore nested properties besides tls
-                return;
+        // tls is nested object
+        if (key.indexOf('tls.') === 0) {
+            lKey = key.substr(4);
+            if (!options.tls) {
+                options.tls = {};
             }
+            obj = options.tls;
+        } else if (key.indexOf('.') >= 0) {
+            // ignore nested properties besides tls
+            return;
+        }
 
-            if (!(lKey in obj)) {
-                obj[lKey] = value;
-            }
-        });
+        // `in` already keeps "__proto__" out, but only as a side effect of it being an
+        // Object.prototype member. Say it, so the protection survives a change to the check
+        if (!isProtoKey(lKey) && !(lKey in obj)) {
+            obj[lKey] = value;
+        }
     });
 
     return options;
 };
 
 module.exports._logFunc = (logger, level, defaults, data, message, ...args) => {
-    let entry = {};
-
-    Object.keys(defaults || {}).forEach(key => {
-        if (key !== 'level') {
-            entry[key] = defaults[key];
-        }
-    });
-
-    Object.keys(data || {}).forEach(key => {
-        if (key !== 'level') {
-            entry[key] = data[key];
-        }
-    });
+    const entry = Object.assign({}, defaults || {}, data || {});
+    delete entry.level;
+
+    let logLevel = level;
+    if (typeof logger[logLevel] !== 'function') {
+        // Provided logger does not implement this level. Fall back to a
+        // lower-severity handler instead of throwing.
+        logLevel = ['info', 'debug', 'log', 'trace', 'warn', 'error'].find(name => typeof logger[name] === 'function');
+    }
 
-    logger[level](entry, message, ...args);
+    if (logLevel) {
+        logger[logLevel](entry, message, ...args);
+    }
 };
 
 /**
@@ -373,8 +396,8 @@ module.exports._logFunc = (logger, level, defaults, data, message, ...args) => {
 module.exports.getLogger = (options, defaults) => {
     options = options || {};
 
-    let response = {};
-    let levels = ['trace', 'debug', 'info', 'warn', 'error', 'fatal'];
+    const response = {};
+    const levels = ['trace', 'debug', 'info', 'warn', 'error', 'fatal'];
 
     if (!options.logger) {
         // use vanity logger
@@ -384,12 +407,7 @@ module.exports.getLogger = (options, defaults) => {
         return response;
     }
 
-    let logger = options.logger;
-
-    if (options.logger === true) {
-        // create console logger
-        logger = createDefaultLogger(levels);
-    }
+    const logger = options.logger === true ? createDefaultLogger(levels) : options.logger;
 
     levels.forEach(level => {
         response[level] = (data, message, ...args) => {
@@ -409,8 +427,8 @@ module.exports.getLogger = (options, defaults) => {
  */
 module.exports.callbackPromise = (resolve, reject) =>
     function () {
-        let args = Array.from(arguments);
-        let err = args.shift();
+        const args = Array.from(arguments);
+        const err = args.shift();
         if (err) {
             reject(err);
         } else {
@@ -418,6 +436,77 @@ module.exports.callbackPromise = (resolve, reject) =>
         }
     };
 
+module.exports.parseDataURI = uri => {
+    if (typeof uri !== 'string') {
+        return null;
+    }
+
+    // Early return for non-data URIs to avoid unnecessary processing
+    if (!uri.startsWith('data:')) {
+        return null;
+    }
+
+    // Find the first comma safely - this prevents ReDoS
+    const commaPos = uri.indexOf(',');
+    if (commaPos === -1) {
+        return null;
+    }
+
+    const data = uri.substring(commaPos + 1);
+    const metaStr = uri.substring('data:'.length, commaPos);
+
+    let encoding;
+    const metaEntries = metaStr.split(';');
+
+    if (metaEntries.length > 0) {
+        const lastEntry = metaEntries[metaEntries.length - 1].toLowerCase().trim();
+        // Only recognize valid encoding types to prevent manipulation
+        if (['base64', 'utf8', 'utf-8'].includes(lastEntry) && lastEntry.indexOf('=') === -1) {
+            encoding = lastEntry;
+            metaEntries.pop();
+        }
+    }
+
+    const contentType = metaEntries.length > 0 ? metaEntries.shift() : 'application/octet-stream';
+    const params = {};
+
+    for (let i = 0; i < metaEntries.length; i++) {
+        const entry = metaEntries[i];
+        const sepPos = entry.indexOf('=');
+        if (sepPos > 0) {
+            // Ensure there's a key before the '='
+            const key = entry.substring(0, sepPos).trim();
+            const value = entry.substring(sepPos + 1).trim();
+            if (key && !isProtoKey(key)) {
+                params[key] = value;
+            }
+        }
+    }
+
+    // Decode data based on encoding with proper error handling
+    let bufferData;
+    try {
+        if (encoding === 'base64') {
+            bufferData = Buffer.from(data, 'base64');
+        } else {
+            try {
+                bufferData = Buffer.from(decodeURIComponent(data));
+            } catch (_decodeError) {
+                bufferData = Buffer.from(data);
+            }
+        }
+    } catch (_bufferError) {
+        bufferData = Buffer.alloc(0);
+    }
+
+    return {
+        data: bufferData,
+        encoding: encoding || null,
+        contentType: contentType || 'application/octet-stream',
+        params
+    };
+};
+
 /**
  * Resolves a String or a Buffer value for content value. Useful if the value
  * is a Stream or a file or an URL. If the value is a Stream, overwrites
@@ -429,9 +518,17 @@ module.exports.callbackPromise = (resolve, reject) =>
  *
  * @param {Object} data An object or an Array you want to resolve an element for
  * @param {String|Number} key Property name or an Array index
+ * @param {Object} [options] Optional access policy: { disableFileAccess, disableUrlAccess }
  * @param {Function} callback Callback function with (err, value)
  */
-module.exports.resolveContent = (data, key, callback) => {
+module.exports.resolveContent = (data, key, options, callback) => {
+    // options is optional; support the legacy resolveContent(data, key, callback) signature
+    if (!callback && typeof options === 'function') {
+        callback = options;
+        options = false;
+    }
+    options = options || {};
+
     let promise;
 
     if (!callback) {
@@ -440,9 +537,14 @@ module.exports.resolveContent = (data, key, callback) => {
         });
     }
 
+    resolveContentValue(data, key, options, callback);
+
+    return promise;
+};
+
+function resolveContentValue(data, key, options, callback) {
     let content = (data && data[key] && data[key].content) || data[key];
-    let contentStream;
-    let encoding = ((typeof data[key] === 'object' && data[key].encoding) || 'utf8')
+    const encoding = ((typeof data[key] === 'object' && data[key].encoding) || 'utf8')
         .toString()
         .toLowerCase()
         .replace(/[-_\s]/g, '');
@@ -466,16 +568,32 @@ module.exports.resolveContent = (data, key, callback) => {
                 }
                 callback(null, value);
             });
-        } else if (/^https?:\/\//i.test(content.path || content.href)) {
-            contentStream = nmfetch(content.path || content.href);
-            return resolveStream(contentStream, callback);
         } else if (/^data:/i.test(content.path || content.href)) {
-            let parts = (content.path || content.href).match(/^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/i);
-            if (!parts) {
-                return callback(null, Buffer.from(0));
+            const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
+
+            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+        } else if (content.href || /^https?:\/\//i.test(content.path)) {
+            // An href is always a URL, and so is a path that looks like one. Let nmfetch
+            // decide whether it is fetchable, it validates the parsed URL. Testing the raw
+            // string here instead would let a file: href fall through to the "return as is"
+            // default below and travel on inside the resolved message.
+            const url = content.href || content.path;
+            if (options.disableUrlAccess) {
+                return setImmediate(() => {
+                    const err = new Error('Url access rejected for ' + url);
+                    err.code = errors.EURLACCESS;
+                    callback(err);
+                });
             }
-            return callback(null, /\bbase64$/i.test(parts[1]) ? Buffer.from(parts[2], 'base64') : Buffer.from(decodeURIComponent(parts[2])));
+            return resolveStream(nmfetch(url, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (content.path) {
+            if (options.disableFileAccess) {
+                return setImmediate(() => {
+                    const err = new Error('File access rejected for ' + content.path);
+                    err.code = errors.EFILEACCESS;
+                    callback(err);
+                });
+            }
             return resolveStream(fs.createReadStream(content.path), callback);
         }
     }
@@ -486,29 +604,25 @@ module.exports.resolveContent = (data, key, callback) => {
 
     // default action, return as is
     setImmediate(() => callback(null, content));
-
-    return promise;
-};
+}
 
 /**
  * Copies properties from source objects to target objects
  */
 module.exports.assign = function (/* target, ... sources */) {
-    let args = Array.from(arguments);
-    let target = args.shift() || {};
+    const args = Array.from(arguments);
+    const target = args.shift() || {};
 
     args.forEach(source => {
         Object.keys(source || {}).forEach(key => {
+            if (isProtoKey(key)) {
+                return;
+            }
             if (['tls', 'auth'].includes(key) && source[key] && typeof source[key] === 'object') {
                 // tls and auth are special keys that need to be enumerated separately
-                // other objects are passed as is
-                if (!target[key]) {
-                    // ensure that target has this key
-                    target[key] = {};
-                }
-                Object.keys(source[key]).forEach(subKey => {
-                    target[key][subKey] = source[key][subKey];
-                });
+                // other objects are passed as is. Enumerating is a copy of user supplied
+                // keys just like the loop above, so it gets the same treatment
+                target[key] = module.exports.copyOwnKeys(target[key] || {}, source[key]);
             } else {
                 target[key] = source[key];
             }
@@ -525,10 +639,10 @@ module.exports.encodeXText = str => {
     if (!/[^\x21-\x2A\x2C-\x3C\x3E-\x7E]/.test(str)) {
         return str;
     }
-    let buf = Buffer.from(str);
+    const buf = Buffer.from(str);
     let result = '';
     for (let i = 0, len = buf.length; i < len; i++) {
-        let c = buf[i];
+        const c = buf[i];
         if (c < 0x21 || c > 0x7e || c === 0x2b || c === 0x3d) {
             result += '+' + (c < 0x10 ? '0' : '') + c.toString(16).toUpperCase();
         } else {
@@ -546,7 +660,7 @@ module.exports.encodeXText = str => {
  */
 function resolveStream(stream, callback) {
     let responded = false;
-    let chunks = [];
+    const chunks = [];
     let chunklen = 0;
 
     stream.on('error', err => {
@@ -589,13 +703,8 @@ function resolveStream(stream, callback) {
  * @returns {Object} Bunyan logger instance
  */
 function createDefaultLogger(levels) {
-    let levelMaxLen = 0;
-    let levelNames = new Map();
-    levels.forEach(level => {
-        if (level.length > levelMaxLen) {
-            levelMaxLen = level.length;
-        }
-    });
+    const levelMaxLen = levels.reduce((max, level) => Math.max(max, level.length), 0);
+    const levelNames = new Map();
 
     levels.forEach(level => {
         let levelName = level.toUpperCase();
@@ -605,7 +714,7 @@ function createDefaultLogger(levels) {
         levelNames.set(level, levelName);
     });
 
-    let print = (level, entry, message, ...args) => {
+    const print = (level, entry, message, ...args) => {
         let prefix = '';
         if (entry) {
             if (entry.tnx === 'server') {
@@ -629,7 +738,7 @@ function createDefaultLogger(levels) {
         });
     };
 
-    let logger = {};
+    const logger = {};
     levels.forEach(level => {
         logger[level] = print.bind(null, level);
     });