@nocobase/plugin-workflow-mailer 2.2.16 → 2.2.18

package/dist/node_modules/joi/lib/messages.js

@@ -37,11 +37,21 @@ exports.compile = function (messages, target) {
         if (code === 'root' ||
             Template.isTemplate(message)) {
 
+            // A flat code named __proto__ triggers the legacy accessor on plain-object assignment, and
+            // what we assign is always a Template, i.e. an object the accessor accepts, so it replaces
+            // target's own prototype instead of creating an own property. That in turn makes
+            // Template.isTemplate(target) true, so every code renders that one message
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = message;
             continue;
         }
 
         if (typeof message === 'string') {
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = new Template(message);
             continue;
         }
@@ -51,20 +61,26 @@ exports.compile = function (messages, target) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Don't reuse an inherited object, otherwise a language named __proto__ or constructor writes on the prototype
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 
@@ -143,11 +159,18 @@ exports.merge = function (base, extended) {
         if (code === 'root' ||
             Template.isTemplate(message)) {
 
+            // Same as in compile(), a flat code named __proto__ replaces target's own prototype
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = message;
             continue;
         }
 
         if (typeof message === 'string') {
+
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             target[code] = new Template(message);
             continue;
         }
@@ -157,20 +180,26 @@ exports.merge = function (base, extended) {
         Assert(typeof message === 'object' && !Array.isArray(message), 'Invalid message for', code);
 
         const language = code;
-        target[language] = target[language] || {};
+
+        // Same as in compile(), don't reuse an inherited object
+
+        const localizedTarget = Object.prototype.hasOwnProperty.call(target, language) ? target[language] : {};
+        target[language] = localizedTarget;
 
         for (code in message) {
             const localized = message[code];
 
+            Assert(code !== '__proto__', 'Cannot use __proto__ as a message code');
+
             if (code === 'root' ||
                 Template.isTemplate(localized)) {
 
-                target[language][code] = localized;
+                localizedTarget[code] = localized;
                 continue;
             }
 
             Assert(typeof localized === 'string', 'Invalid message for', code, 'in', language);
-            target[language][code] = new Template(localized);
+            localizedTarget[code] = new Template(localized);
         }
     }
 

package/dist/node_modules/joi/lib/types/keys.js

@@ -547,6 +547,7 @@ module.exports = Any.extend({
         'object.regex': '{{#label}} must be a RegExp object',
         'object.rename.multiple': '{{#label}} cannot rename {{:#from}} because multiple renames are disabled and another key was already renamed to {{:#to}}',
         'object.rename.override': '{{#label}} cannot rename {{:#from}} because override is disabled and target {{:#to}} exists',
+        'object.rename.proto': '{{#label}} cannot rename {{:#from}} because target {{:#to}} is a reserved key',
         'object.schema': '{{#label}} must be a Joi schema of {{#type}} type',
         'object.unknown': '{{#label}} is not allowed',
         'object.with': '{{:#mainWithLabel}} missing required peer {{:#peerWithLabel}}',
@@ -567,8 +568,15 @@ internals.clone = function (value, prefs) {
             return Clone(value, { shallow: true });
         }
 
-        const clone = Object.create(Object.getPrototypeOf(value));
+        const proto = Object.getPrototypeOf(value);
+        const clone = Object.create(proto);
         Object.assign(clone, value);
+
+        // Restore the prototype in case of pre-existing prototype pollution
+        if (Object.getPrototypeOf(clone) !== proto) {
+            Object.setPrototypeOf(clone, proto);
+        }
+
         return clone;
     }
 
@@ -867,6 +875,15 @@ internals.rename = function (schema, value, state, prefs, errors) {
                 }
             }
 
+            if (to === '__proto__') {
+                errors.push(schema.$_createError('object.rename.proto', value, { from, to, pattern }, state, prefs));
+                if (prefs.abortEarly) {
+                    return false;
+                }
+
+                continue;
+            }
+
             if (value[from] === undefined) {
                 delete value[to];
             }

package/dist/node_modules/joi/lib/types/link.js

@@ -29,13 +29,25 @@ module.exports = Any.extend({
         return schema.ref(ref);
     },
 
-    validate(value, { schema, state, prefs }) {
+    validate(value, { schema, state, prefs, error }) {
 
         Assert(schema.$_terms.link, 'Uninitialized link schema');
 
         const linked = internals.generate(schema, value, state, prefs);
         const ref = schema.$_terms.link[0].ref;
-        return linked.$_validate(value, state.nest(linked, `link:${ref.display}:${linked.type}`), prefs);
+
+        try {
+            return linked.$_validate(value, state.nest(linked, `link:${ref.display}:${linked.type}`), prefs);
+        }
+        catch (err) {
+            /* $lab:coverage:off$ */
+            if (!(err instanceof RangeError)) {
+                throw err;
+            }
+            /* $lab:coverage:on$ */
+
+            return { value, errors: error('link.depth') };
+        }
     },
 
     generate(schema, value, state, prefs) {
@@ -88,6 +100,10 @@ module.exports = Any.extend({
         }
     },
 
+    messages: {
+        'link.depth': '{{#label}} exceeds maximum recursion depth supported by the runtime'
+    },
+
     manifest: {
 
         build(obj, desc) {

package/dist/node_modules/joi/lib/types/string.js

@@ -829,8 +829,8 @@ internals.isoDate = function (value) {
         return null;
     }
 
-    if (/.*T.*[+-]\d\d$/.test(value)) {             // Add missing trailing zeros to timeshift
-        value += '00';
+    if (/T.*[+-]\d\d$/.test(value)) {                // Add missing separator and trailing zeros to timeshift
+        value += ':00';
     }
 
     const date = new Date(value);

package/dist/node_modules/joi/package.json

@@ -1 +1 @@
-{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-09-21T01:35:20.327Z"}
+{"name":"joi","description":"Object schema validation","version":"17.13.8","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-09-25T14:54:18.030Z"}

package/dist/node_modules/nodemailer/.ncurc.js

@@ -1,3 +1,5 @@
+'use strict';
+
 module.exports = {
     upgrade: true,
     reject: [

package/dist/node_modules/nodemailer/.prettierignore

@@ -0,0 +1,8 @@
+node_modules
+coverage
+*.min.js
+dist
+build
+.nyc_output
+package-lock.json
+CHANGELOG.md

package/dist/node_modules/nodemailer/.prettierrc

@@ -0,0 +1,12 @@
+{
+    "printWidth": 140,
+    "tabWidth": 4,
+    "useTabs": false,
+    "semi": true,
+    "singleQuote": true,
+    "quoteProps": "as-needed",
+    "trailingComma": "none",
+    "bracketSpacing": true,
+    "arrowParens": "avoid",
+    "endOfLine": "lf"
+}

package/dist/node_modules/nodemailer/.prettierrc.js

@@ -1,3 +1,5 @@
+'use strict';
+
 module.exports = {
     printWidth: 160,
     tabWidth: 4,

package/dist/node_modules/nodemailer/.release-please-config.json

@@ -0,0 +1,9 @@
+{
+    "packages": {
+        ".": {
+            "release-type": "node",
+            "package-name": "nodemailer",
+            "pull-request-title-pattern": "chore${scope}: release ${version} [skip-ci]"
+        }
+    }
+}

package/dist/node_modules/nodemailer/eslint.config.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const globals = require('globals');
+
+module.exports = [
+    {
+        ignores: ['node_modules/**', 'coverage/**', 'dist/**', 'build/**', '.nyc_output/**']
+    },
+    {
+        files: ['**/*.js'],
+        languageOptions: {
+            ecmaVersion: 2017,
+            sourceType: 'script',
+            globals: Object.assign({}, globals.node, globals.es2017, {
+                it: true,
+                describe: true,
+                beforeEach: true,
+                afterEach: true
+            })
+        },
+        rules: {
+            // Error detection
+            'for-direction': 'error',
+            'no-await-in-loop': 'error',
+            'no-div-regex': 'error',
+            eqeqeq: 'error',
+            'dot-notation': 'error',
+            curly: 'error',
+            'no-fallthrough': 'error',
+            'no-unused-expressions': [
+                'error',
+                {
+                    allowShortCircuit: true
+                }
+            ],
+            'no-unused-vars': [
+                'error',
+                {
+                    varsIgnorePattern: '^_',
+                    argsIgnorePattern: '^_',
+                    caughtErrorsIgnorePattern: '^_'
+                }
+            ],
+            'handle-callback-err': 'error',
+            'no-new': 'error',
+            'new-cap': 'error',
+            'no-eval': 'error',
+            'no-invalid-this': 'error',
+            radix: ['error', 'always'],
+            'no-use-before-define': ['error', 'nofunc'],
+            'callback-return': ['error', ['callback', 'cb', 'done']],
+            'no-regex-spaces': 'error',
+            'no-empty': 'error',
+            'no-duplicate-case': 'error',
+            'no-empty-character-class': 'error',
+            'no-redeclare': 'off', // Disabled per project preference
+            'block-scoped-var': 'error',
+            'no-sequences': 'error',
+            'no-throw-literal': 'error',
+            'no-useless-call': 'error',
+            'no-useless-concat': 'error',
+            'no-void': 'error',
+            yoda: 'error',
+            'no-undef': 'error',
+            'global-require': 'error',
+            'no-var': 'error',
+            'no-bitwise': 'error',
+            'no-lonely-if': 'error',
+            'no-mixed-spaces-and-tabs': 'error',
+            'arrow-body-style': ['error', 'as-needed'],
+            'arrow-parens': ['error', 'as-needed'],
+            'prefer-arrow-callback': 'error',
+            'object-shorthand': 'error',
+            'prefer-spread': 'error',
+            'no-prototype-builtins': 'off', // Disabled per project preference
+            strict: ['error', 'global'],
+
+            // Disable all formatting rules (handled by Prettier)
+            indent: 'off',
+            quotes: 'off',
+            'linebreak-style': 'off',
+            semi: 'off',
+            'quote-props': 'off',
+            'comma-dangle': 'off',
+            'comma-style': 'off'
+        }
+    }
+];