@nocobase/plugin-workflow-mailer 2.2.17 → 2.2.18

package/dist/node_modules/nodemailer/lib/mime-funcs/index.js

@@ -5,21 +5,37 @@
 const base64 = require('../base64');
 const qp = require('../qp');
 const mimeTypes = require('./mime-types');
+const { isProtoKey } = require('../shared/objects');
 
 module.exports = {
     /**
      * Checks if a value is plaintext string (uses only printable 7bit chars)
      *
+     * When isParam is set the value is destined for a header parameter, so HT, CR and LF
+     * are not plaintext either: a header parameter has no way to carry them. HT is a valid
+     * fold point, so folding and unfolding a header would rewrite it as a space, and CR/LF
+     * cannot appear in a header value at all. DEL is neither a token character nor qtext,
+     * so it can not be carried bare or quoted. Such values have to go through the rfc2231
+     * parameter continuation encoding instead, the same way a quote already does.
+     *
      * @param {String} value String to be tested
+     * @param {Boolean} [isParam] Set to true if the value is a header parameter value
      * @returns {Boolean} true if it is a plaintext string
      */
     isPlainText(value, isParam) {
-        const re = isParam ? /[\x00-\x08\x0b\x0c\x0e-\x1f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
-        if (typeof value !== 'string' || re.test(value)) {
-            return false;
-        } else {
-            return true;
-        }
+        const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
+        return typeof value === 'string' && !re.test(value);
+    },
+
+    /**
+     * Wraps a value into a quoted-string. Inside one a quote would end the string early
+     * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
+     *
+     * @param {String} value String to be quoted
+     * @returns {String} The value as a quoted-string, quotes included
+     */
+    quoteString(value) {
+        return '"' + (value || '').toString().replace(/["\\]/g, '\\$&') + '"';
     },
 
     /**
@@ -54,7 +70,7 @@ module.exports = {
         maxLength = maxLength || 0;
 
         let encodedStr;
-        let toCharset = 'UTF-8';
+        const toCharset = 'UTF-8';
 
         if (maxLength && maxLength > 7 + toCharset.length) {
             maxLength -= 7 + toCharset.length;
@@ -63,12 +79,11 @@ module.exports = {
         if (mimeWordEncoding === 'Q') {
             // https://tools.ietf.org/html/rfc2047#section-5 rule (3)
             encodedStr = qp.encode(data).replace(/[^a-z0-9!*+\-/=]/gi, chr => {
-                let ord = chr.charCodeAt(0).toString(16).toUpperCase();
+                const ord = chr.charCodeAt(0).toString(16).toUpperCase();
                 if (chr === ' ') {
                     return '_';
-                } else {
-                    return '=' + (ord.length === 1 ? '0' + ord : ord);
                 }
+                return '=' + (ord.length === 1 ? '0' + ord : ord);
             });
         } else if (mimeWordEncoding === 'B') {
             encodedStr = typeof data === 'string' ? data : base64.encode(data);
@@ -80,13 +95,15 @@ module.exports = {
                 encodedStr = this.splitMimeEncodedString(encodedStr, maxLength).join('?= =?' + toCharset + '?' + mimeWordEncoding + '?');
             } else {
                 // RFC2047 6.3 (2) states that encoded-word must include an integral number of characters, so no chopping unicode sequences
-                let parts = [];
+                const parts = [];
                 let lpart = '';
                 for (let i = 0, len = encodedStr.length; i < len; i++) {
                     let chr = encodedStr.charAt(i);
 
-                    if (/[\ud83c\ud83d\ud83e]/.test(chr) && i < len - 1) {
-                        // composite emoji byte, so add the next byte as well
+                    if (/[\ud800-\udbff]/.test(chr) && /[\udc00-\udfff]/.test(encodedStr.charAt(i + 1))) {
+                        // leading surrogate, so add the trailing surrogate as well
+                        // an unpaired one must not swallow the next unit, that would destroy
+                        // a valid pair following it
                         chr += encodedStr.charAt(++i);
                     }
 
@@ -129,42 +146,38 @@ module.exports = {
     encodeWords(value, mimeWordEncoding, maxLength, encodeAll) {
         maxLength = maxLength || 0;
 
-        let encodedValue;
-
         // find first word with a non-printable ascii or special symbol in it
-        let firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
+        const firstMatch = value.match(/(?:^|\s)([^\s]*["\u0080-\uFFFF])/);
         if (!firstMatch) {
             return value;
         }
 
         if (encodeAll) {
             // if it is requested to encode everything or the string contains something that resebles encoded word, then encode everything
-
             return this.encodeWord(value, mimeWordEncoding, maxLength);
         }
 
         // find the last word with a non-printable ascii in it
-        let lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
+        const lastMatch = value.match(/(["\u0080-\uFFFF][^\s]*)[^"\u0080-\uFFFF]*$/);
         if (!lastMatch) {
             // should not happen
             return value;
         }
 
-        let startIndex =
+        const startIndex =
             firstMatch.index +
             (
                 firstMatch[0].match(/[^\s]/) || {
                     index: 0
                 }
             ).index;
-        let endIndex = lastMatch.index + (lastMatch[1] || '').length;
+        const endIndex = lastMatch.index + (lastMatch[1] || '').length;
 
-        encodedValue =
+        return (
             (startIndex ? value.substr(0, startIndex) : '') +
             this.encodeWord(value.substring(startIndex, endIndex), mimeWordEncoding || 'Q', maxLength) +
-            (endIndex < value.length ? value.substr(endIndex) : '');
-
-        return encodedValue;
+            (endIndex < value.length ? value.substr(endIndex) : '')
+        );
     },
 
     /**
@@ -175,12 +188,14 @@ module.exports = {
      * @return {String} joined header value
      */
     buildHeaderValue(structured) {
-        let paramsArray = [];
+        const paramsArray = [];
 
-        Object.keys(structured.params || {}).forEach(param => {
+        Object.keys(structured.params || {}).forEach(key => {
             // filename might include unicode characters so it is a special case
             // other values probably do not
-            let value = structured.params[param];
+            const value = structured.params[key];
+            // a parameter name is a token too and it is emitted without any quoting around it
+            const param = key.replace(/[\x00-\x1f\x7f]/g, '');
             if (!this.isPlainText(value, true) || value.length >= 75) {
                 this.buildHeaderParam(param, value, 50).forEach(encodedParam => {
                     if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
@@ -196,7 +211,11 @@ module.exports = {
             }
         });
 
-        return structured.value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
+        // the value ahead of the parameters is a token, it has no way to carry a control
+        // char or DEL and there is no quoting construct around it to escape one into
+        const value = typeof structured.value === 'string' ? structured.value.replace(/[\x00-\x1f\x7f]/g, '') : structured.value;
+
+        return value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
     },
 
     /**
@@ -215,10 +234,9 @@ module.exports = {
      * @return {Array} A list of encoded keys and headers
      */
     buildHeaderParam(key, data, maxLength) {
-        let list = [];
+        const list = [];
         let encodedStr = typeof data === 'string' ? data : (data || '').toString();
-        let encodedStrArr;
-        let chr, ord;
+        let chr;
         let line;
         let startPos = 0;
         let i, len;
@@ -252,11 +270,12 @@ module.exports = {
         } else {
             if (/[\uD800-\uDBFF]/.test(encodedStr)) {
                 // string containts surrogate pairs, so normalize it to an array of bytes
-                encodedStrArr = [];
+                const encodedStrArr = [];
                 for (i = 0, len = encodedStr.length; i < len; i++) {
                     chr = encodedStr.charAt(i);
-                    ord = chr.charCodeAt(0);
-                    if (ord >= 0xd800 && ord <= 0xdbff && i < len - 1) {
+                    if (/[\ud800-\udbff]/.test(chr) && /[\udc00-\udfff]/.test(encodedStr.charAt(i + 1))) {
+                        // an unpaired leading surrogate must not consume the next unit, that
+                        // would tear apart a valid pair following it
                         chr += encodedStr.charAt(i + 1);
                         encodedStrArr.push(chr);
                         i++;
@@ -269,7 +288,7 @@ module.exports = {
 
             // first line includes the charset and language info and needs to be encoded
             // even if it does not contain any unicode characters
-            line = 'utf-8\x27\x27';
+            line = "utf-8''";
             let encoded = true;
             startPos = 0;
 
@@ -294,8 +313,11 @@ module.exports = {
                                 line,
                                 encoded
                             });
+                            // the line we start here holds an encoded char, so it has to be
+                            // flagged as one. otherwise it gets an unstarred continuation key
+                            // and a receiver reads the percent escapes as literal text
                             line = '';
-                            startPos = i - 1;
+                            encoded = true;
                         } else {
                             encoded = true;
                             i = startPos;
@@ -356,10 +378,20 @@ module.exports = {
      * @return {Object} Header value as a parsed structure
      */
     parseHeaderValue(str) {
-        let response = {
+        const response = {
             value: false,
             params: {}
         };
+
+        // Parameter names come from a caller supplied contentType/contentDisposition. A
+        // "__proto__" name would target the prototype chain of the params object instead of
+        // an own property of it, and read back as Object.prototype, so it is dropped.
+        const setParam = (name, value) => {
+            if (!isProtoKey(name)) {
+                response.params[name] = value;
+            }
+        };
+
         let key = false;
         let value = '';
         let type = 'value';
@@ -391,7 +423,7 @@ module.exports = {
                     if (key === false) {
                         response.value = value.trim();
                     } else {
-                        response.params[key] = value.trim();
+                        setParam(key, value.trim());
                     }
                     type = 'key';
                     value = '';
@@ -406,10 +438,10 @@ module.exports = {
             if (key === false) {
                 response.value = value.trim();
             } else {
-                response.params[key] = value.trim();
+                setParam(key, value.trim());
             }
         } else if (value.trim()) {
-            response.params[value.trim().toLowerCase()] = '';
+            setParam(value.trim().toLowerCase(), '');
         }
 
         // handle parameter value continuations
@@ -422,6 +454,14 @@ module.exports = {
                 actualKey = key.substr(0, match.index);
                 nr = Number(match[2] || match[3]) || 0;
 
+                if (isProtoKey(actualKey)) {
+                    // see setParam. Reading it back would yield Object.prototype, which is
+                    // an object, so the initializer below would be skipped and the write
+                    // that follows would throw out of a header build the caller can not catch
+                    delete response.params[key];
+                    return;
+                }
+
                 if (!response.params[actualKey] || typeof response.params[actualKey] !== 'object') {
                     response.params[actualKey] = {
                         charset: false,
@@ -458,12 +498,11 @@ module.exports = {
                         value
                             // fix invalidly encoded chars
                             .replace(/[=?_\s]/g, s => {
-                                let c = s.charCodeAt(0).toString(16);
+                                const c = s.charCodeAt(0).toString(16);
                                 if (s === ' ') {
                                     return '_';
-                                } else {
-                                    return '%' + (c.length < 2 ? '0' : '') + c;
                                 }
+                                return '%' + (c.length < 2 ? '0' : '') + c;
                             })
                             // change from urlencoding to percent encoding
                             .replace(/%/g, '=') +
@@ -508,11 +547,10 @@ module.exports = {
         str = (str || '').toString();
         lineLength = lineLength || 76;
 
-        let pos = 0,
-            len = str.length,
-            result = '',
-            line,
-            match;
+        let pos = 0;
+        const len = str.length;
+        let result = '';
+        let line, match;
 
         while (pos < len) {
             line = str.substr(pos, lineLength);
@@ -549,11 +587,8 @@ module.exports = {
      * @return {Array} Split string
      */
     splitMimeEncodedString: (str, maxlen) => {
-        let curLine,
-            match,
-            chr,
-            done,
-            lines = [];
+        const lines = [];
+        let curLine, fallbackLine, match, chr, done;
 
         // require at least 12 symbols to fit possible 4 octet UTF-8 sequences
         maxlen = Math.max(maxlen || 0, 12);
@@ -566,8 +601,14 @@ module.exports = {
                 curLine = curLine.substr(0, match.index);
             }
 
+            // Malformed input (a run of stray UTF-8 continuation bytes) has no split point
+            // that keeps a character sequence whole, so the loop below walks back to an
+            // empty line looking for one. Keep the widest chunk that at least does not cut
+            // a "=XX" escape in half, so the part stays a decodable encoded word.
+            fallbackLine = curLine.length ? curLine : str.substr(0, maxlen);
+
             done = false;
-            while (!done) {
+            while (!done && curLine.length) {
                 done = true;
                 // check if not middle of a unicode char sequence
                 if ((match = str.substr(curLine.length).match(/^[=]([0-9A-F]{2})/i))) {
@@ -580,9 +621,11 @@ module.exports = {
                 }
             }
 
-            if (curLine.length) {
-                lines.push(curLine);
+            if (!curLine.length) {
+                curLine = fallbackLine;
             }
+
+            lines.push(curLine);
             str = str.substr(curLine.length);
         }
 
@@ -614,9 +657,12 @@ module.exports = {
         try {
             // might throw if we try to encode invalid sequences, eg. partial emoji
             str = encodeURIComponent(str);
-        } catch (E) {
-            // should never run
-            return str.replace(/[^\x00-\x1F *'()<>@,;:\\"[\]?=\u007F-\uFFFF]+/g, '');
+        } catch (_E) {
+            // an unpaired surrogate has no utf-8 representation, so run the value through a
+            // utf-8 roundtrip to get the same U+FFFD every other encoder here produces and
+            // retry. the value must never come back unencoded, it goes into a header parameter
+            // where a bare quote or semicolon would break it out into a parameter of its own
+            str = encodeURIComponent(Buffer.from(str, 'utf-8').toString('utf-8'));
         }
 
         // ensure chars that are not handled by encodeURICompent are converted as well

package/dist/node_modules/nodemailer/lib/mime-funcs/mime-types.js

@@ -44,6 +44,7 @@ const mimeTypes = new Map([
     ['application/fractals', 'fif'],
     ['application/freeloader', 'frl'],
     ['application/futuresplash', 'spl'],
+    ['application/geo+json', 'geojson'],
     ['application/gnutar', 'tgz'],
     ['application/groupwise', 'vew'],
     ['application/hlp', 'hlp'],
@@ -1101,7 +1102,10 @@ const extensions = new Map([
     ['bdm', 'application/vnd.syncml.dm+wbxml'],
     ['bed', 'application/vnd.realvnc.bed'],
     ['bh2', 'application/vnd.fujitsu.oasysprs'],
-    ['bin', ['application/octet-stream', 'application/mac-binary', 'application/macbinary', 'application/x-macbinary', 'application/x-binary']],
+    [
+        'bin',
+        ['application/octet-stream', 'application/mac-binary', 'application/macbinary', 'application/x-macbinary', 'application/x-binary']
+    ],
     ['bm', 'image/bmp'],
     ['bmi', 'application/vnd.bmi'],
     ['bmp', ['image/bmp', 'image/x-windows-bmp']],
@@ -1146,7 +1150,10 @@ const extensions = new Map([
     ['cii', 'application/vnd.anser-web-certificate-issue-initiation'],
     ['cil', 'application/vnd.ms-artgalry'],
     ['cla', 'application/vnd.claymore'],
-    ['class', ['application/octet-stream', 'application/java', 'application/java-byte-code', 'application/java-vm', 'application/x-java-class']],
+    [
+        'class',
+        ['application/octet-stream', 'application/java', 'application/java-byte-code', 'application/java-vm', 'application/x-java-class']
+    ],
     ['clkk', 'application/vnd.crick.clicker.keyboard'],
     ['clkp', 'application/vnd.crick.clicker.palette'],
     ['clkt', 'application/vnd.crick.clicker.template'],
@@ -1287,6 +1294,7 @@ const extensions = new Map([
     ['gac', 'application/vnd.groove-account'],
     ['gdl', 'model/vnd.gdl'],
     ['geo', 'application/vnd.dynageo'],
+    ['geojson', 'application/geo+json'],
     ['gex', 'application/vnd.geometry-explorer'],
     ['ggb', 'application/vnd.geogebra.file'],
     ['ggt', 'application/vnd.geogebra.tool'],
@@ -1750,7 +1758,10 @@ const extensions = new Map([
     ['sbml', 'application/sbml+xml'],
     ['sc', 'application/vnd.ibm.secure-container'],
     ['scd', 'application/x-msschedule'],
-    ['scm', ['application/vnd.lotus-screencam', 'video/x-scm', 'text/x-script.guile', 'application/x-lotusscreencam', 'text/x-script.scheme']],
+    [
+        'scm',
+        ['application/vnd.lotus-screencam', 'video/x-scm', 'text/x-script.guile', 'application/x-lotusscreencam', 'text/x-script.scheme']
+    ],
     ['scq', 'application/scvp-cv-request'],
     ['scs', 'application/scvp-cv-response'],
     ['sct', 'text/scriptlet'],
@@ -2062,13 +2073,9 @@ module.exports = {
             return defaultMimeType;
         }
 
-        let parsed = path.parse(filename);
-        let extension = (parsed.ext.substr(1) || parsed.name || '').split('?').shift().trim().toLowerCase();
-        let value = defaultMimeType;
-
-        if (extensions.has(extension)) {
-            value = extensions.get(extension);
-        }
+        const parsed = path.parse(filename);
+        const extension = (parsed.ext.substr(1) || parsed.name || '').split('?').shift().trim().toLowerCase();
+        const value = extensions.has(extension) ? extensions.get(extension) : defaultMimeType;
 
         if (Array.isArray(value)) {
             return value[0];
@@ -2080,12 +2087,12 @@ module.exports = {
         if (!mimeType) {
             return defaultExtension;
         }
-        let parts = (mimeType || '').toLowerCase().trim().split('/');
-        let rootType = parts.shift().trim();
-        let subType = parts.join('/').trim();
+        const parts = mimeType.toLowerCase().trim().split('/');
+        const rootType = parts.shift().trim();
+        const subType = parts.join('/').trim();
 
         if (mimeTypes.has(rootType + '/' + subType)) {
-            let value = mimeTypes.get(rootType + '/' + subType);
+            const value = mimeTypes.get(rootType + '/' + subType);
             if (Array.isArray(value)) {
                 return value[0];
             }