@nocobase/plugin-workflow-mailer 2.2.16 → 2.2.18

package/dist/node_modules/nodemailer/lib/fetch/index.js

@@ -2,15 +2,74 @@
 
 const http = require('http');
 const https = require('https');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const zlib = require('zlib');
-const PassThrough = require('stream').PassThrough;
+const { PassThrough } = require('stream');
 const Cookies = require('./cookies');
 const packageData = require('../../package.json');
 const net = require('net');
+const errors = require('../errors');
+const { isProtoKey } = require('../shared/objects');
 
 const MAX_REDIRECTS = 5;
 
+// Only genuine TLS settings are taken from options.tls. That object reaches us straight
+// from a user supplied attachment (content.tls), so keys like host, port, path, socketPath
+// or lookup would otherwise repoint the request at a destination that never went through
+// the URL checks below.
+//
+// The source of truth is the tls.connect() option list in the Node docs. A key missing
+// here is dropped silently, so extend this list rather than working around it.
+const TLS_OPTION_KEYS = [
+    'ALPNProtocols',
+    'ca',
+    'cert',
+    'checkServerIdentity',
+    'ciphers',
+    'crl',
+    'dhparam',
+    'ecdhCurve',
+    'honorCipherOrder',
+    'key',
+    'maxVersion',
+    'minVersion',
+    'passphrase',
+    'pfx',
+    'rejectUnauthorized',
+    'secureContext',
+    'secureOptions',
+    'secureProtocol',
+    'servername',
+    'sessionIdContext',
+    'sigalgs'
+];
+
+/**
+ * Resolves a URL only if it is one this module is willing to request.
+ *
+ * urllib.parse throws for a host that contains forbidden bytes, and it is called for
+ * every URL that reaches nmfetch, including ones that arrive from a message attachment
+ * or from a redirect Location header. An uncaught throw here takes the process down,
+ * so a URL that does not parse is reported the same way as one with a scheme we refuse.
+ *
+ * @param {String} url URL to parse
+ * @returns {Object|Boolean} Parsed URL, or false if it is not a usable http(s) URL
+ */
+function parseFetchUrl(url) {
+    let parsed;
+    try {
+        parsed = urllib.parse(url);
+    } catch (_err) {
+        return false;
+    }
+
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return false;
+    }
+
+    return parsed;
+}
+
 module.exports = function (url, options) {
     return nmfetch(url, options);
 };
@@ -25,6 +84,30 @@ function nmfetch(url, options) {
     options.redirects = options.redirects || 0;
     options.maxRedirects = isNaN(options.maxRedirects) ? MAX_REDIRECTS : options.maxRedirects;
 
+    const fetchRes = options.fetchRes;
+    const parsed = parseFetchUrl(url);
+
+    if (!parsed) {
+        // Only http(s) URLs can be fetched. Any other scheme (file:, gopher:, a
+        // protocol-relative redirect target etc.) would otherwise be silently served over
+        // plain HTTP, possibly against an unintended host. Bail out before the cookie jar
+        // is touched so a refused URL can not seed it, and release a caller supplied body:
+        // this is the one exit that runs before the error handler below is attached to it,
+        // so an error on that stream would have nowhere to go and the fd or socket behind
+        // it would never be released.
+        if (options.body && typeof options.body.destroy === 'function') {
+            options.body.on('error', () => false);
+            options.body.destroy();
+        }
+        setImmediate(() => {
+            const err = new Error('Unsupported protocol for URL ' + url);
+            err.code = errors.EFETCH;
+            err.sourceUrl = url;
+            fetchRes.emit('error', err);
+        });
+        return fetchRes;
+    }
+
     if (options.cookie) {
         [].concat(options.cookie || []).forEach(cookie => {
             options.cookies.set(cookie, url);
@@ -32,21 +115,23 @@ function nmfetch(url, options) {
         options.cookie = false;
     }
 
-    let fetchRes = options.fetchRes;
-    let parsed = urllib.parse(url);
     let method = (options.method || '').toString().trim().toUpperCase() || 'GET';
     let finished = false;
     let cookies;
     let body;
 
-    let handler = parsed.protocol === 'https:' ? https : http;
+    const handler = parsed.protocol === 'https:' ? https : http;
 
-    let headers = {
+    const headers = {
         'accept-encoding': 'gzip,deflate',
         'user-agent': 'nodemailer/' + packageData.version
     };
 
     Object.keys(options.headers || {}).forEach(key => {
+        // options.headers is the caller's httpHeaders, straight off an attachment
+        if (isProtoKey(key.toLowerCase().trim())) {
+            return;
+        }
         headers[key.toLowerCase().trim()] = options.headers[key];
     });
 
@@ -76,7 +161,7 @@ function nmfetch(url, options) {
                     return;
                 }
                 finished = true;
-                err.type = 'FETCH';
+                err.code = errors.EFETCH;
                 err.sourceUrl = url;
                 fetchRes.emit('error', err);
             });
@@ -89,7 +174,7 @@ function nmfetch(url, options) {
                     body = Buffer.from(
                         Object.keys(options.body)
                             .map(key => {
-                                let value = options.body[key].toString().trim();
+                                const value = options.body[key].toString().trim();
                                 return encodeURIComponent(key) + '=' + encodeURIComponent(value);
                             })
                             .join('&')
@@ -99,7 +184,7 @@ function nmfetch(url, options) {
                         return;
                     }
                     finished = true;
-                    E.type = 'FETCH';
+                    E.code = errors.EFETCH;
                     E.sourceUrl = url;
                     fetchRes.emit('error', E);
                     return;
@@ -116,23 +201,35 @@ function nmfetch(url, options) {
     }
 
     let req;
-    let reqOptions = {
+    const reqOptions = {
         method,
         host: parsed.hostname,
         path: parsed.path,
         port: parsed.port ? parsed.port : parsed.protocol === 'https:' ? 443 : 80,
         headers,
-        rejectUnauthorized: false,
+        // Validate TLS certificates by default. Callers that genuinely need to
+        // reach a self-signed/internal host opt out explicitly with
+        // options.tls = { rejectUnauthorized: false }.
+        rejectUnauthorized: true,
         agent: false
     };
 
     if (options.tls) {
+        // see TLS_OPTION_KEYS
         Object.keys(options.tls).forEach(key => {
-            reqOptions[key] = options.tls[key];
+            if (TLS_OPTION_KEYS.includes(key)) {
+                reqOptions[key] = options.tls[key];
+            }
         });
     }
 
-    if (parsed.protocol === 'https:' && parsed.hostname && parsed.hostname !== reqOptions.host && !net.isIP(parsed.hostname) && !reqOptions.servername) {
+    if (
+        parsed.protocol === 'https:' &&
+        parsed.hostname &&
+        parsed.hostname !== reqOptions.host &&
+        !net.isIP(parsed.hostname) &&
+        !reqOptions.servername
+    ) {
         reqOptions.servername = parsed.hostname;
     }
 
@@ -141,7 +238,7 @@ function nmfetch(url, options) {
     } catch (E) {
         finished = true;
         setImmediate(() => {
-            E.type = 'FETCH';
+            E.code = errors.EFETCH;
             E.sourceUrl = url;
             fetchRes.emit('error', E);
         });
@@ -155,8 +252,8 @@ function nmfetch(url, options) {
             }
             finished = true;
             req.abort();
-            let err = new Error('Request Timeout');
-            err.type = 'FETCH';
+            const err = new Error('Request Timeout');
+            err.code = errors.EFETCH;
             err.sourceUrl = url;
             fetchRes.emit('error', err);
         });
@@ -167,7 +264,7 @@ function nmfetch(url, options) {
             return;
         }
         finished = true;
-        err.type = 'FETCH';
+        err.code = errors.EFETCH;
         err.sourceUrl = url;
         fetchRes.emit('error', err);
     });
@@ -197,8 +294,8 @@ function nmfetch(url, options) {
             options.redirects++;
             if (options.redirects > options.maxRedirects) {
                 finished = true;
-                let err = new Error('Maximum redirect count exceeded');
-                err.type = 'FETCH';
+                const err = new Error('Maximum redirect count exceeded');
+                err.code = errors.EFETCH;
                 err.sourceUrl = url;
                 fetchRes.emit('error', err);
                 req.abort();
@@ -207,7 +304,48 @@ function nmfetch(url, options) {
             // redirect does not include POST body
             options.method = 'GET';
             options.body = false;
-            return nmfetch(urllib.resolve(url, res.headers.location), options);
+
+            let redirectUrl;
+            try {
+                redirectUrl = urllib.resolve(url, res.headers.location);
+            } catch (_err) {
+                // the legacy resolver throws on a Location the WHATWG parser also refused,
+                // so fall through to the check below with what the server actually sent
+                redirectUrl = res.headers.location;
+            }
+            const redirectParsed = parseFetchUrl(redirectUrl);
+
+            if (!redirectParsed) {
+                // Refuse the redirect target here rather than leaving it to the recursive
+                // call: that call gets its own `finished` flag and no handle on this
+                // request, so this one would stay open and could emit a second error on
+                // the shared fetchRes once it times out. Callers listen with req.once().
+                finished = true;
+                const err = new Error('Unsupported protocol for URL ' + redirectUrl);
+                err.code = errors.EFETCH;
+                err.sourceUrl = redirectUrl;
+                fetchRes.emit('error', err);
+                req.abort();
+                return;
+            }
+
+            // Do not forward credentials when the redirect leaves the original
+            // security context: a different host, or a downgrade from https to
+            // http (which would otherwise put them on the wire in cleartext).
+            // Strip sensitive request headers so an attacker who controls the
+            // redirect target cannot harvest them.
+            const crossHost = redirectParsed.hostname !== parsed.hostname;
+            const downgrade = parsed.protocol === 'https:' && redirectParsed.protocol === 'http:';
+            if (options.headers && (crossHost || downgrade)) {
+                const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
+                Object.keys(options.headers).forEach(key => {
+                    if (sensitive.includes(key.toLowerCase())) {
+                        delete options.headers[key];
+                    }
+                });
+            }
+
+            return nmfetch(redirectUrl, options);
         }
 
         fetchRes.statusCode = res.statusCode;
@@ -215,8 +353,8 @@ function nmfetch(url, options) {
 
         if (res.statusCode >= 300 && !options.allowErrorResponse) {
             finished = true;
-            let err = new Error('Invalid status code ' + res.statusCode);
-            err.type = 'FETCH';
+            const err = new Error('Invalid status code ' + res.statusCode);
+            err.code = errors.EFETCH;
             err.sourceUrl = url;
             fetchRes.emit('error', err);
             req.abort();
@@ -228,7 +366,7 @@ function nmfetch(url, options) {
                 return;
             }
             finished = true;
-            err.type = 'FETCH';
+            err.code = errors.EFETCH;
             err.sourceUrl = url;
             fetchRes.emit('error', err);
             req.abort();
@@ -241,7 +379,7 @@ function nmfetch(url, options) {
                     return;
                 }
                 finished = true;
-                err.type = 'FETCH';
+                err.code = errors.EFETCH;
                 err.sourceUrl = url;
                 fetchRes.emit('error', err);
                 req.abort();
@@ -256,12 +394,11 @@ function nmfetch(url, options) {
             try {
                 if (typeof body.pipe === 'function') {
                     return body.pipe(req);
-                } else {
-                    req.write(body);
                 }
+                req.write(body);
             } catch (err) {
                 finished = true;
-                err.type = 'FETCH';
+                err.code = errors.EFETCH;
                 err.sourceUrl = url;
                 fetchRes.emit('error', err);
                 return;

package/dist/node_modules/nodemailer/lib/json-transport/index.js

@@ -13,7 +13,7 @@ class JSONTransport {
     constructor(options) {
         options = options || {};
 
-        this.options = options || {};
+        this.options = options;
 
         this.name = 'JSONTransport';
         this.version = packageData.version;
@@ -33,10 +33,10 @@ class JSONTransport {
         // Sendmail strips this header line by itself
         mail.message.keepBcc = true;
 
-        let envelope = mail.data.envelope || mail.message.getEnvelope();
-        let messageId = mail.message.messageId();
+        const envelope = mail.message.getEnvelope();
+        const messageId = mail.message.messageId();
 
-        let recipients = [].concat(envelope.to || []);
+        const recipients = [].concat(envelope.to || []);
         if (recipients.length > 3) {
             recipients.push('...and ' + recipients.splice(2).length + ' more');
         }