@nocobase/plugin-workflow-mailer 2.2.16 → 2.2.18

package/dist/node_modules/nodemailer/lib/mailer/index.js

@@ -6,14 +6,22 @@ const mimeTypes = require('../mime-funcs/mime-types');
 const MailComposer = require('../mail-composer');
 const DKIM = require('../dkim');
 const httpProxyClient = require('../smtp-connection/http-proxy-client');
+const errors = require('../errors');
 const util = require('util');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const packageData = require('../../package.json');
 const MailMessage = require('./mail-message');
 const net = require('net');
 const dns = require('dns');
 const crypto = require('crypto');
 
+/**
+ * Recipients allowed on one message unless the caller sets its own maxRecipients. A backstop
+ * against a runaway or hostile recipient list rather than a delivery policy: RFC 5321 only
+ * asks a server to accept 100, so a real send is bounded far below this.
+ */
+const DEFAULT_MAX_RECIPIENTS = 100000;
+
 /**
  * Creates an object for exposing the Mail API
  *
@@ -87,6 +95,11 @@ class Mail extends EventEmitter {
             this.transporter.on('idle', (...args) => {
                 this.emit('idle', ...args);
             });
+
+            // indicates if the sender has became idle and all connections are terminated
+            this.transporter.on('clear', (...args) => {
+                this.emit('clear', ...args);
+            });
         }
 
         /**
@@ -100,17 +113,17 @@ class Mail extends EventEmitter {
                         this.getSocket = false;
                     }
                     return this.transporter[method](...args);
-                } else {
-                    this.logger.warn(
-                        {
-                            tnx: 'transport',
-                            methodName: method
-                        },
-                        'Non existing method %s called for transport',
-                        method
-                    );
-                    return false;
                 }
+
+                this.logger.warn(
+                    {
+                        tnx: 'transport',
+                        methodName: method
+                    },
+                    'Non existing method %s called for transport',
+                    method
+                );
+                return false;
             };
         });
 
@@ -151,7 +164,7 @@ class Mail extends EventEmitter {
             this.getSocket = false;
         }
 
-        let mail = new MailMessage(this, data);
+        const mail = new MailMessage(this, data);
 
         this.logger.debug(
             {
@@ -185,6 +198,26 @@ class Mail extends EventEmitter {
             mail.setPriorityHeaders();
             mail.setListHeaders();
 
+            const maxRecipients = mail.data.maxRecipients === undefined ? DEFAULT_MAX_RECIPIENTS : mail.data.maxRecipients;
+            const recipientCount = mail.message.getEnvelope().to.length;
+
+            if (maxRecipients && recipientCount > maxRecipients) {
+                const err = new Error(
+                    `Message has ${recipientCount} recipients, which is over the ${maxRecipients} allowed by maxRecipients`
+                );
+                err.code = errors.EMAXRECIPIENTS;
+                this.logger.error(
+                    {
+                        err,
+                        tnx: 'transport',
+                        action: 'send'
+                    },
+                    'Send Error: %s',
+                    err.message
+                );
+                return callback(err);
+            }
+
             this._processPlugins('stream', mail, err => {
                 if (err) {
                     this.logger.error(
@@ -201,7 +234,7 @@ class Mail extends EventEmitter {
 
                 if (mail.data.dkim || this.dkim) {
                     mail.message.processFunc(input => {
-                        let dkim = mail.data.dkim ? new DKIM(mail.data.dkim) : this.dkim;
+                        const dkim = mail.data.dkim ? new DKIM(mail.data.dkim) : this.dkim;
                         this.logger.debug(
                             {
                                 tnx: 'DKIM',
@@ -236,7 +269,14 @@ class Mail extends EventEmitter {
     }
 
     getVersionString() {
-        return util.format('%s (%s; +%s; %s/%s)', packageData.name, packageData.version, packageData.homepage, this.transporter.name, this.transporter.version);
+        return util.format(
+            '%s (%s; +%s; %s/%s)',
+            packageData.name,
+            packageData.version,
+            packageData.homepage,
+            this.transporter.name,
+            this.transporter.version
+        );
     }
 
     _processPlugins(step, mail, callback) {
@@ -246,8 +286,8 @@ class Mail extends EventEmitter {
             return callback();
         }
 
-        let userPlugins = this._userPlugins[step] || [];
-        let defaultPlugins = this._defaultPlugins[step] || [];
+        const userPlugins = this._userPlugins[step] || [];
+        const defaultPlugins = this._defaultPlugins[step] || [];
 
         if (userPlugins.length) {
             this.logger.debug(
@@ -268,7 +308,7 @@ class Mail extends EventEmitter {
 
         let pos = 0;
         let block = 'default';
-        let processPlugins = () => {
+        const processPlugins = () => {
             let curplugins = block === 'default' ? defaultPlugins : userPlugins;
             if (pos >= curplugins.length) {
                 if (block === 'default' && userPlugins.length) {
@@ -279,7 +319,7 @@ class Mail extends EventEmitter {
                     return callback();
                 }
             }
-            let plugin = curplugins[pos++];
+            const plugin = curplugins[pos++];
             plugin(mail, err => {
                 if (err) {
                     return callback(err);
@@ -297,11 +337,11 @@ class Mail extends EventEmitter {
      * @param {String} proxyUrl Proxy configuration url
      */
     setupProxy(proxyUrl) {
-        let proxy = urllib.parse(proxyUrl);
+        const proxy = urllib.parse(proxyUrl);
 
         // setup socket handler for the mailer object
         this.getSocket = (options, callback) => {
-            let protocol = proxy.protocol.replace(/:$/, '').toLowerCase();
+            const protocol = proxy.protocol.replace(/:$/, '').toLowerCase();
 
             if (this.meta.has('proxy_handler_' + protocol)) {
                 return this.meta.get('proxy_handler_' + protocol)(proxy, options, callback);
@@ -311,7 +351,7 @@ class Mail extends EventEmitter {
                 // Connect using a HTTP CONNECT method
                 case 'http':
                 case 'https':
-                    httpProxyClient(proxy.href, options.port, options.host, (err, socket) => {
+                    httpProxyClient(proxy.href, options.port, options.host, this.options.tls || {}, (err, socket) => {
                         if (err) {
                             return callback(err);
                         }
@@ -325,13 +365,15 @@ class Mail extends EventEmitter {
                 case 'socks4':
                 case 'socks4a': {
                     if (!this.meta.has('proxy_socks_module')) {
-                        return callback(new Error('Socks module not loaded'));
+                        let err = new Error('Socks module not loaded');
+                        err.code = errors.EPROXY;
+                        return callback(err);
                     }
-                    let connect = ipaddress => {
-                        let proxyV2 = !!this.meta.get('proxy_socks_module').SocksClient;
-                        let socksClient = proxyV2 ? this.meta.get('proxy_socks_module').SocksClient : this.meta.get('proxy_socks_module');
-                        let proxyType = Number(proxy.protocol.replace(/\D/g, '')) || 5;
-                        let connectionOpts = {
+                    const connect = ipaddress => {
+                        const proxyV2 = !!this.meta.get('proxy_socks_module').SocksClient;
+                        const socksClient = proxyV2 ? this.meta.get('proxy_socks_module').SocksClient : this.meta.get('proxy_socks_module');
+                        const proxyType = Number(proxy.protocol.replace(/\D/g, '')) || 5;
+                        const connectionOpts = {
                             proxy: {
                                 ipaddress,
                                 port: Number(proxy.port),
@@ -345,8 +387,8 @@ class Mail extends EventEmitter {
                         };
 
                         if (proxy.auth) {
-                            let username = decodeURIComponent(proxy.auth.split(':').shift());
-                            let password = decodeURIComponent(proxy.auth.split(':').pop());
+                            const username = decodeURIComponent(proxy.auth.split(':').shift());
+                            const password = decodeURIComponent(proxy.auth.split(':').pop());
                             if (proxyV2) {
                                 connectionOpts.proxy.userId = username;
                                 connectionOpts.proxy.password = password;
@@ -382,7 +424,9 @@ class Mail extends EventEmitter {
                     });
                 }
             }
-            callback(new Error('Unknown proxy configuration'));
+            let err = new Error('Unknown proxy configuration');
+            err.code = errors.EPROXY;
+            callback(err);
         };
     }
 
@@ -390,31 +434,39 @@ class Mail extends EventEmitter {
         if ((!this.options.attachDataUrls && !mail.data.attachDataUrls) || !mail.data.html) {
             return callback();
         }
-        mail.resolveContent(mail.data, 'html', (err, html) => {
-            if (err) {
-                return callback(err);
+        mail.resolveContent(
+            mail.data,
+            'html',
+            { disableFileAccess: mail.data.disableFileAccess, disableUrlAccess: mail.data.disableUrlAccess },
+            (err, html) => {
+                if (err) {
+                    return callback(err);
+                }
+                let cidCounter = 0;
+                html = (html || '')
+                    .toString()
+                    .replace(
+                        /(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi,
+                        (match, prefix, dataUri, mimeType) => {
+                            const cid = crypto.randomBytes(10).toString('hex') + '@localhost';
+                            if (!mail.data.attachments) {
+                                mail.data.attachments = [];
+                            }
+                            if (!Array.isArray(mail.data.attachments)) {
+                                mail.data.attachments = [].concat(mail.data.attachments || []);
+                            }
+                            mail.data.attachments.push({
+                                path: dataUri,
+                                cid,
+                                filename: 'image-' + ++cidCounter + '.' + mimeTypes.detectExtension(mimeType)
+                            });
+                            return prefix + 'cid:' + cid;
+                        }
+                    );
+                mail.data.html = html;
+                callback();
             }
-            let cidCounter = 0;
-            html = (html || '')
-                .toString()
-                .replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
-                    let cid = crypto.randomBytes(10).toString('hex') + '@localhost';
-                    if (!mail.data.attachments) {
-                        mail.data.attachments = [];
-                    }
-                    if (!Array.isArray(mail.data.attachments)) {
-                        mail.data.attachments = [].concat(mail.data.attachments || []);
-                    }
-                    mail.data.attachments.push({
-                        path: dataUri,
-                        cid,
-                        filename: 'image-' + ++cidCounter + '.' + mimeTypes.detectExtension(mimeType)
-                    });
-                    return prefix + 'cid:' + cid;
-                });
-            mail.data.html = html;
-            callback();
-        });
+        );
     }
 
     set(key, value) {

package/dist/node_modules/nodemailer/lib/mailer/mail-message.js

@@ -4,6 +4,11 @@ const shared = require('../shared');
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
 
+// Only an own key counts as already set. `key in obj` also matches every member of
+// Object.prototype, which silently drops a transporter default legitimately named
+// toString or constructor.
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 class MailMessage {
     constructor(mailer, data) {
         this.mailer = mailer;
@@ -11,43 +16,60 @@ class MailMessage {
         this.message = null;
 
         data = data || {};
-        let options = mailer.options || {};
-        let defaults = mailer._defaults || {};
+        const options = mailer.options || {};
+        const defaults = mailer._defaults || {};
 
-        Object.keys(data).forEach(key => {
-            this.data[key] = data[key];
-        });
+        shared.copyOwnKeys(this.data, data);
 
         this.data.headers = this.data.headers || {};
 
-        // apply defaults
-        Object.keys(defaults).forEach(key => {
-            if (!(key in this.data)) {
-                this.data[key] = defaults[key];
-            } else if (key === 'headers') {
-                // headers is a special case. Allow setting individual default headers
-                Object.keys(defaults.headers).forEach(key => {
-                    if (!(key in this.data.headers)) {
-                        this.data.headers[key] = defaults.headers[key];
-                    }
-                });
-            }
-        });
+        // Apply defaults. `_defaults` is caller supplied too, it is the second argument of
+        // createTransport, so it needs the same treatment as `data` above
+        shared.copyOwnKeys(this.data, defaults, key => hasOwn(this.data, key));
+
+        // headers is a special case. Allow setting individual default headers
+        shared.copyOwnKeys(this.data.headers, defaults.headers, key => hasOwn(this.data.headers, key));
 
         // force specific keys from transporter options
-        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey'].forEach(key => {
+        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey', 'maxRecipients'].forEach(key => {
             if (key in options) {
                 this.data[key] = options[key];
             }
         });
+
+        // The access flags are a sandbox rather than a message field, so `defaults` counts as
+        // transporter configuration for them. For a transporter plugin it is the only channel
+        // there is, createTransport leaves `options` undefined for one, and the defaults copy
+        // above yields to anything the message already set, which let message data switch the
+        // sandbox back off. Closing is one way here, same as in resolveContent below: either
+        // side may switch a flag on, neither can switch off what the other closed.
+        ['disableFileAccess', 'disableUrlAccess'].forEach(key => {
+            if (!(key in options) && hasOwn(defaults, key)) {
+                this.data[key] = this.data[key] || defaults[key];
+            }
+        });
     }
 
-    resolveContent(...args) {
-        return shared.resolveContent(...args);
+    resolveContent(data, key, options, callback) {
+        // Most plugins call this with the legacy (data, key, callback) signature, which carries
+        // no access policy. The policy belongs to the message, so apply it here. Explicit
+        // options may only tighten it, never reopen what the transporter closed.
+        if (!callback && typeof options === 'function') {
+            callback = options;
+            options = false;
+        }
+        options = options || {};
+
+        const policy = {
+            disableFileAccess: this.data.disableFileAccess || options.disableFileAccess,
+            disableUrlAccess: this.data.disableUrlAccess || options.disableUrlAccess
+        };
+
+        return shared.resolveContent(data, key, policy, callback);
     }
 
     resolveAll(callback) {
-        let keys = [
+        const keys = [
             [this.data, 'html'],
             [this.data, 'text'],
             [this.data, 'watchHtml'],
@@ -64,7 +86,8 @@ class MailMessage {
         if (this.data.attachments && this.data.attachments.length) {
             this.data.attachments.forEach((attachment, i) => {
                 if (!attachment.filename) {
-                    attachment.filename = (attachment.path || attachment.href || '').split('/').pop().split('?').shift() || 'attachment-' + (i + 1);
+                    attachment.filename =
+                        (attachment.path || attachment.href || '').split('/').pop().split('?').shift() || 'attachment-' + (i + 1);
                     if (attachment.filename.indexOf('.') < 0) {
                         attachment.filename += '.' + mimeFuncs.detectExtension(attachment.contentType);
                     }
@@ -78,9 +101,9 @@ class MailMessage {
             });
         }
 
-        let mimeNode = new MimeNode();
+        const mimeNode = new MimeNode();
 
-        let addressKeys = ['from', 'to', 'cc', 'bcc', 'sender', 'replyTo'];
+        const addressKeys = ['from', 'to', 'cc', 'bcc', 'sender', 'replyTo'];
 
         addressKeys.forEach(address => {
             let value;
@@ -96,7 +119,7 @@ class MailMessage {
             }
         });
 
-        let singleKeys = ['from', 'sender'];
+        const singleKeys = ['from', 'sender'];
         singleKeys.forEach(address => {
             if (this.data[address]) {
                 this.data[address] = this.data[address].shift();
@@ -104,41 +127,46 @@ class MailMessage {
         });
 
         let pos = 0;
-        let resolveNext = () => {
+        const resolveNext = () => {
             if (pos >= keys.length) {
                 return callback(null, this.data);
             }
-            let args = keys[pos++];
+            const args = keys[pos++];
             if (!args[0] || !args[0][args[1]]) {
                 return resolveNext();
             }
-            shared.resolveContent(...args, (err, value) => {
-                if (err) {
-                    return callback(err);
-                }
+            shared.resolveContent(
+                ...args,
+                { disableFileAccess: this.data.disableFileAccess, disableUrlAccess: this.data.disableUrlAccess },
+                (err, value) => {
+                    if (err) {
+                        return callback(err);
+                    }
 
-                let node = {
-                    content: value
-                };
-                if (args[0][args[1]] && typeof args[0][args[1]] === 'object' && !Buffer.isBuffer(args[0][args[1]])) {
-                    Object.keys(args[0][args[1]]).forEach(key => {
-                        if (!(key in node) && !['content', 'path', 'href', 'raw'].includes(key)) {
-                            node[key] = args[0][args[1]][key];
-                        }
-                    });
-                }
+                    const node = {
+                        content: value
+                    };
+                    if (args[0][args[1]] && typeof args[0][args[1]] === 'object' && !Buffer.isBuffer(args[0][args[1]])) {
+                        // The keys are the caller's, so copying them takes the same "__proto__"
+                        // rule as the constructor. `key in node` stays as the already-set test
+                        // here, unlike for the defaults: it also skips the Object.prototype
+                        // member names, and letting message data land a `toString` string on a
+                        // node only buys a TypeError the first time something stringifies it.
+                        shared.copyOwnKeys(node, args[0][args[1]], key => key in node || ['content', 'path', 'href', 'raw'].includes(key));
+                    }
 
-                args[0][args[1]] = node;
-                resolveNext();
-            });
+                    args[0][args[1]] = node;
+                    resolveNext();
+                }
+            );
         };
 
         setImmediate(() => resolveNext());
     }
 
     normalize(callback) {
-        let envelope = this.data.envelope || this.message.getEnvelope();
-        let messageId = this.message.messageId();
+        const envelope = this.message.getEnvelope();
+        const messageId = this.message.messageId();
 
         this.resolveAll((err, data) => {
             if (err) {
@@ -183,6 +211,9 @@ class MailMessage {
 
             data.normalizedHeaders = {};
             Object.keys(data.headers || {}).forEach(key => {
+                if (shared.isProtoKey(key)) {
+                    return;
+                }
                 let value = [].concat(data.headers[key] || []).shift();
                 value = (value && value.value) || value;
                 if (value) {
@@ -194,7 +225,7 @@ class MailMessage {
             });
 
             if (data.list && typeof data.list === 'object') {
-                let listHeaders = this._getListHeaders(data.list);
+                const listHeaders = this._getListHeaders(data.list);
                 listHeaders.forEach(entry => {
                     data.normalizedHeaders[entry.key] = entry.value.map(val => (val && val.value) || val).join(', ');
                 });
@@ -244,13 +275,11 @@ class MailMessage {
             return;
         }
         // add optional List-* headers
-        if (this.data.list && typeof this.data.list === 'object') {
-            this._getListHeaders(this.data.list).forEach(listHeader => {
-                listHeader.value.forEach(value => {
-                    this.message.addHeader(listHeader.key, value);
-                });
+        this._getListHeaders(this.data.list).forEach(listHeader => {
+            listHeader.value.forEach(value => {
+                this.message.addHeader(listHeader.key, value);
             });
-        }
+        });
     }
 
     _getListHeaders(listData) {
@@ -270,23 +299,30 @@ class MailMessage {
                         }
 
                         if (value && value.url) {
+                            // strip CR/LF so a comment can't inject extra header lines. DEL is neither
+                            // qtext nor ctext, so it can not be carried literally by either construct
+                            // and has to become an encoded word like any other non-plaintext value
+                            let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
+                            const needsEncoding = !mimeFuncs.isPlainText(comment) || /\x7f/.test(comment);
+
                             if (key.toLowerCase().trim() === 'id') {
-                                // List-ID: "comment" <domain>
-                                let comment = value.comment || '';
-                                if (mimeFuncs.isPlainText(comment)) {
-                                    comment = '"' + comment + '"';
-                                } else {
-                                    comment = mimeFuncs.encodeWord(comment);
-                                }
-
-                                return (value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+\/{,2}/, '');
+                                // List-ID: "comment" <domain>, where an unescaped quote or a trailing
+                                // backslash in the comment would swallow the <domain> behind it
+                                comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
+
+                                // List-ID expects a bare domain-like identifier, so strip the
+                                // scheme prefix that _formatListUrl adds or passes through
+                                return (
+                                    (value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<')
+                                );
                             }
 
                             // List-*: <http://domain> (comment)
-                            let comment = value.comment || '';
-                            if (!mimeFuncs.isPlainText(comment)) {
-                                comment = mimeFuncs.encodeWord(comment);
-                            }
+                            // the ctext specials go out as quoted-pairs, otherwise a ")" closes the
+                            // comment early and leaves the rest as junk, an unpaired "(" opens a
+                            // nested comment that never closes, and a trailing backslash escapes
+                            // the closing ")" so the comment swallows whatever follows it
+                            comment = needsEncoding ? mimeFuncs.encodeWord(comment) : comment.replace(/[()\\]/g, '\\$&');
 
                             return this._formatListUrl(value.url) + (value.comment ? ' (' + comment + ')' : '');
                         }
@@ -300,7 +336,9 @@ class MailMessage {
     }
 
     _formatListUrl(url) {
-        url = url.replace(/[\s<]+|[\s>]+/g, '');
+        // a url has no way to carry a control char or DEL, and the angle brackets around it
+        // are not a quoting construct, so anything left here lands in the header raw
+        url = url.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[\s<]+|[\s>]+/g, '');
         if (/^(https?|mailto|ftp):/.test(url)) {
             return '<' + url + '>';
         }