@nocobase/plugin-workflow-mailer 2.2.17 → 2.2.18

package/dist/node_modules/nodemailer/lib/shared/objects.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.js, so that every layer can reach it.
+// lib/shared/index.js requires lib/fetch, so lib/fetch can not require lib/shared back,
+// and lib/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. lib/shared/index.js re-exports both functions for the callers that already
+// depend on it.
+
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param {String} key Key to check
+ * @returns {Boolean} true if the key must not be copied
+ */
+module.exports.isProtoKey = key => key === '__proto__';
+
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param {Object} target Object to copy the keys to
+ * @param {Object} source Object to copy the keys from
+ * @param {Function} [skip] Optional predicate, return true to leave a key out
+ * @returns {Object} The target object
+ */
+module.exports.copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if (module.exports.isProtoKey(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};

package/dist/node_modules/nodemailer/lib/shared/url.js

@@ -0,0 +1,151 @@
+'use strict';
+
+// URL parsing wrapper. Prefers the WHATWG `URL` (a global on Node 10+, and
+// available as `require('url').URL` since Node 6.13+) and only falls back to the
+// legacy, deprecation-warning-emitting `url.parse()` / `url.resolve()` on ancient
+// Node versions that predate the WHATWG implementation.
+//
+// The WHATWG `URL` exposes a different shape than the legacy parser, so results
+// are normalized back into the legacy field names the rest of the codebase reads
+// (`protocol`, `hostname`, `port`, `pathname`, `path`, `search`, `auth`, `query`,
+// `href`). This keeps every existing call site unchanged.
+//
+// Known, accepted divergences from the legacy parser:
+//  - non-special schemes (smtp:/smtps:/direct:) are not host-lowercased by
+//    WHATWG; cosmetic only, SMTP/DNS hosts are case-insensitive. (IDNA mapping
+//    and IPv6 brackets are normalized back by normalizeHostname below.)
+//  - a literal unescaped ':' inside a password is percent-encoded by WHATWG;
+//    such passwords should be percent-encoded by the caller anyway.
+
+const urllib = require('url');
+const punycode = require('../punycode');
+
+// WHATWG URL constructor if available, otherwise undefined (Node < 6.13).
+const URLImpl = (typeof URL !== 'undefined' && URL) || urllib.URL;
+
+// Matches a "scheme:" not followed by "//" (and with something after it), used
+// to re-insert the authority separator the legacy parser did not require.
+const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)(.+)$/;
+
+// decodeURIComponent that never throws. Legacy url.parse() decodes the auth
+// component but tolerates malformed percent sequences, so mirror that.
+function safeDecode(str) {
+    try {
+        return decodeURIComponent(str);
+    } catch (_err) {
+        return str;
+    }
+}
+
+// Derives the legacy-shaped bare hostname from a WHATWG URL. WHATWG keeps IPv6
+// literals bracketed ('[::1]') and, for non-special schemes (smtp:/smtps:/socks:),
+// percent-encodes a non-ASCII host instead of IDNA-mapping it. Both forms are
+// un-resolvable when handed to net/dns/http.request — which is what every call
+// site does — so map them back to what legacy url.parse() returned: the bare
+// address and the punycode form. Idempotent on plain ASCII and already-punycode
+// hosts, so special-scheme hosts (already IDNA-mapped by WHATWG) pass through.
+function normalizeHostname(raw) {
+    let hostname = raw || '';
+    if (!hostname) {
+        // Host-less URL (e.g. 'direct:'): legacy returned '' here, not null;
+        // consumers do `hostname.length` / `'.' + hostname`, so keep it a string.
+        return '';
+    }
+    if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') {
+        return hostname.slice(1, -1);
+    }
+    return punycode.toASCII(safeDecode(hostname));
+}
+
+module.exports.parse = (input, parseQueryString) => {
+    input = input || '';
+
+    if (!URLImpl) {
+        // Node < 6.13: no WHATWG URL available, use the legacy parser.
+        return urllib.parse(input, parseQueryString);
+    }
+
+    // Legacy url.parse() parses a "user:pass@host:port" authority that follows
+    // the scheme even without the "//" separator, for schemes outside its
+    // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG
+    // parser instead treats a scheme not followed by "//" as an opaque path.
+    // Re-insert the "//" so slash-less connection/proxy URLs keep resolving to
+    // an authority, as they did before. This assumes a slash-authority scheme,
+    // which every consumer here uses (http/https/smtp/smtps/socks/direct); an
+    // opaque scheme like mailto:/data:/tel: would be mis-split, but none reach
+    // this module.
+    const slashless = SLASHLESS_AUTHORITY.exec(input);
+    const normalized = slashless ? slashless[1] + '//' + slashless[2] : input;
+
+    let u;
+    try {
+        u = new URLImpl(normalized);
+    } catch (_err) {
+        // WHATWG rejects some input the legacy parser tolerated (empty/relative
+        // strings, scheme-relative '//host/path', out-of-range ports, ...). Fall
+        // back to the legacy parser so behavior — including the downstream errors
+        // callers rely on — is preserved. This is the only path that can still
+        // emit a deprecation warning; it fires for anything WHATWG cannot
+        // represent, including legitimate relative URLs, not just malformed input.
+        return urllib.parse(input, parseQueryString);
+    }
+
+    const hostname = normalizeHostname(u.hostname);
+    const port = u.port || null;
+    const pathname = u.pathname || null;
+    const search = u.search || null;
+
+    // Legacy `.auth` is the decoded "user[:pass]" string; WHATWG keeps the
+    // username/password percent-encoded, so decode to stay byte-compatible with
+    // existing consumers (parseConnectionUrl, Basic/Proxy-Authorization headers).
+    let auth = null;
+    if (u.username || u.password) {
+        // Gate on password too: legacy url.parse('smtps://:pass@host').auth was
+        // ':pass'. Dropping it would silently connect unauthenticated.
+        auth = safeDecode(u.username) + (u.password ? ':' + safeDecode(u.password) : '');
+    }
+
+    let query;
+    if (parseQueryString) {
+        // Mirror querystring.parse(): null-prototype object, repeated keys → array.
+        query = Object.create(null);
+        u.searchParams.forEach((value, key) => {
+            if (Object.prototype.hasOwnProperty.call(query, key)) {
+                if (Array.isArray(query[key])) {
+                    query[key].push(value);
+                } else {
+                    query[key] = [query[key], value];
+                }
+            } else {
+                query[key] = value;
+            }
+        });
+    } else {
+        query = search ? search.slice(1) : null;
+    }
+
+    return {
+        protocol: u.protocol || null,
+        host: u.host || null,
+        hostname,
+        port,
+        pathname,
+        search,
+        path: (pathname || '') + (search || '') || null,
+        href: u.href,
+        auth,
+        query
+    };
+};
+
+module.exports.resolve = (from, to) => {
+    if (!URLImpl) {
+        return urllib.resolve(from, to);
+    }
+    try {
+        return new URLImpl(to, from).href;
+    } catch (_err) {
+        // Malformed target — fall back to the legacy resolver.
+        return urllib.resolve(from, to);
+    }
+};

package/dist/node_modules/nodemailer/lib/smtp-connection/data-stream.js

@@ -1,7 +1,6 @@
 'use strict';
 
-const stream = require('stream');
-const Transform = stream.Transform;
+const { Transform } = require('stream');
 
 /**
  * Escapes dots in the beginning of lines. Ends the stream with <CR><LF>.<CR><LF>
@@ -12,9 +11,7 @@ const Transform = stream.Transform;
 class DataStream extends Transform {
     constructor(options) {
         super(options);
-        // init Transform
         this.options = options || {};
-        this._curLine = '';
 
         this.inByteCount = 0;
         this.outByteCount = 0;
@@ -25,7 +22,7 @@ class DataStream extends Transform {
      * Escapes dots
      */
     _transform(chunk, encoding, done) {
-        let chunks = [];
+        const chunks = [];
         let chunklen = 0;
         let i,
             len,
@@ -53,7 +50,7 @@ class DataStream extends Transform {
                     lastPos = i + 1;
                 }
             } else if (chunk[i] === 0x0a) {
-                // .
+                // \n
                 if ((i && chunk[i - 1] !== 0x0d) || (!i && this.lastByte !== 0x0d)) {
                     if (i > lastPos) {
                         buf = chunk.slice(lastPos, i);

package/dist/node_modules/nodemailer/lib/smtp-connection/http-proxy-client.js

@@ -6,7 +6,12 @@
 
 const net = require('net');
 const tls = require('tls');
-const urllib = require('url');
+const urllib = require('../shared/url');
+const errors = require('../errors');
+
+// Cap the CONNECT response we buffer before the header terminator, so a proxy that
+// never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
+const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
 
 /**
  * Establishes proxied connection to destinationPort
@@ -18,57 +23,74 @@ const urllib = require('url');
  * @param {String} proxyUrl proxy configuration, etg "http://proxy.host:3128/"
  * @param {Number} destinationPort Port to open in destination host
  * @param {String} destinationHost Destination hostname
+ * @param {Object} [tlsOptions] Optional TLS options for an HTTPS proxy (e.g. { rejectUnauthorized: false })
  * @param {Function} callback Callback to run with the rocket object once connection is established
  */
-function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
-    let proxy = urllib.parse(proxyUrl);
+function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
+    if (typeof tlsOptions === 'function') {
+        callback = tlsOptions;
+        tlsOptions = {};
+    }
+    tlsOptions = tlsOptions || {};
+
+    // Reject CRLF in the destination before it reaches the CONNECT request line
+    // and Host header. A tainted host/port could otherwise inject additional
+    // request headers into the proxy connection (HTTP request splitting).
+    destinationPort = Number(destinationPort) || 0;
+    if (!destinationPort || /[\r\n]/.test(destinationHost)) {
+        const err = new Error('Invalid proxy destination');
+        err.code = errors.EPROXY;
+        return setImmediate(() => callback(err));
+    }
 
-    // create a socket connection to the proxy server
-    let options;
-    let connect;
-    let socket;
+    const proxy = urllib.parse(proxyUrl);
 
-    options = {
+    const connectOptions = {
         host: proxy.hostname,
         port: Number(proxy.port) ? Number(proxy.port) : proxy.protocol === 'https:' ? 443 : 80
     };
 
+    let connect;
     if (proxy.protocol === 'https:') {
-        // we can use untrusted proxies as long as we verify actual SMTP certificates
-        options.rejectUnauthorized = false;
+        // Validate the proxy's TLS certificate by default. A caller that uses a
+        // self-signed proxy (e.g. integration tests) opts out explicitly with
+        // tls.rejectUnauthorized === false.
+        connectOptions.rejectUnauthorized = tlsOptions.rejectUnauthorized !== false;
         connect = tls.connect.bind(tls);
     } else {
         connect = net.connect.bind(net);
     }
 
+    let socket;
+
     // Error harness for initial connection. Once connection is established, the responsibility
     // to handle errors is passed to whoever uses this socket
     let finished = false;
-    let tempSocketErr = err => {
+    const tempSocketErr = err => {
         if (finished) {
             return;
         }
         finished = true;
         try {
             socket.destroy();
-        } catch (E) {
+        } catch (_E) {
             // ignore
         }
         callback(err);
     };
 
-    let timeoutErr = () => {
-        let err = new Error('Proxy socket timed out');
+    const timeoutErr = () => {
+        const err = new Error('Proxy socket timed out');
         err.code = 'ETIMEDOUT';
         tempSocketErr(err);
     };
 
-    socket = connect(options, () => {
+    socket = connect(connectOptions, () => {
         if (finished) {
             return;
         }
 
-        let reqHeaders = {
+        const reqHeaders = {
             Host: destinationHost + ':' + destinationPort,
             Connection: 'close'
         };
@@ -92,7 +114,7 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
         );
 
         let headers = '';
-        let onSocketData = chunk => {
+        const onSocketData = chunk => {
             let match;
             let remainder;
 
@@ -118,10 +140,12 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
                 if (!match || (match[1] || '').charAt(0) !== '2') {
                     try {
                         socket.destroy();
-                    } catch (E) {
+                    } catch (_E) {
                         // ignore
                     }
-                    return callback(new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || '')));
+                    const err = new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || ''));
+                    err.code = errors.EPROXY;
+                    return callback(err);
                 }
 
                 socket.removeListener('error', tempSocketErr);
@@ -130,6 +154,13 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, callback) {
 
                 return callback(null, socket);
             }
+
+            if (headers.length > MAX_RESPONSE_HEADER_BYTES) {
+                socket.removeListener('data', onSocketData);
+                const err = new Error('Proxy response headers too large');
+                err.code = errors.EPROXY;
+                return tempSocketErr(err);
+            }
         };
         socket.on('data', onSocketData);
     });