@nocobase/plugin-workflow-mailer 2.2.17 → 2.2.18

package/dist/node_modules/nodemailer/lib/mail-composer/index.js

@@ -4,7 +4,7 @@
 
 const MimeNode = require('../mime-node');
 const mimeFuncs = require('../mime-funcs');
-const parseDataURI = require('../shared').parseDataURI;
+const { parseDataURI, copyOwnKeys } = require('../shared');
 
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -32,7 +32,11 @@ class MailComposer {
 
         // Compose MIME tree
         if (this.mail.raw) {
-            this.message = new MimeNode('message/rfc822', { newline: this.mail.newline }).setRaw(this.mail.raw);
+            this.message = new MimeNode('message/rfc822', {
+                newline: this.mail.newline,
+                disableUrlAccess: this.mail.disableUrlAccess,
+                disableFileAccess: this.mail.disableFileAccess
+            }).setRaw(this.mail.raw);
         } else if (this._useMixed) {
             this.message = this._createMixed();
         } else if (this._useAlternative) {
@@ -59,7 +63,7 @@ class MailComposer {
 
         // Add headers to the root node, always overrides custom headers
         ['from', 'sender', 'to', 'cc', 'bcc', 'reply-to', 'in-reply-to', 'references', 'subject', 'message-id', 'date'].forEach(header => {
-            let key = header.replace(/-(\w)/g, (o, c) => c.toUpperCase());
+            const key = header.replace(/-(\w)/g, (o, c) => c.toUpperCase());
             if (this.mail[key]) {
                 this.message.setHeader(header, this.mail[key]);
             }
@@ -83,23 +87,36 @@ class MailComposer {
      * @returns {Object} An object of arrays (`related` and `attached`)
      */
     getAttachments(findRelated) {
-        let icalEvent, eventObject;
-        let attachments = [].concat(this.mail.attachments || []).map((attachment, i) => {
-            let data;
-            let isMessageNode = /^message\//i.test(attachment.contentType);
-
+        let eventObject;
+        const attachments = [].concat(this.mail.attachments || []).map((attachment, i) => {
             if (/^data:/i.test(attachment.path || attachment.href)) {
                 attachment = this._processDataUrl(attachment);
             }
 
-            let contentType = attachment.contentType || mimeFuncs.detectMimeType(attachment.filename || attachment.path || attachment.href || 'bin');
-            let isImage = /^image\//i.test(contentType);
-            let contentDisposition = attachment.contentDisposition || (isMessageNode || (isImage && attachment.cid) ? 'inline' : 'attachment');
+            const contentType =
+                attachment.contentType || mimeFuncs.detectMimeType(attachment.filename || attachment.path || attachment.href || 'bin');
+
+            const isImage = /^image\//i.test(contentType);
+            const isMessageNode = /^message\//i.test(contentType);
+
+            const contentDisposition =
+                attachment.contentDisposition || (isMessageNode || (isImage && attachment.cid) ? 'inline' : 'attachment');
 
-            data = {
+            let contentTransferEncoding;
+            if ('contentTransferEncoding' in attachment) {
+                // also contains `false`, to set
+                contentTransferEncoding = attachment.contentTransferEncoding;
+            } else if (isMessageNode) {
+                // the content might include non-ASCII bytes but at this point we do not know it yet
+                contentTransferEncoding = '8bit';
+            } else {
+                contentTransferEncoding = 'base64'; // the default
+            }
+
+            const data = {
                 contentType,
                 contentDisposition,
-                contentTransferEncoding: 'contentTransferEncoding' in attachment ? attachment.contentTransferEncoding : 'base64'
+                contentTransferEncoding
             };
 
             if (attachment.filename) {
@@ -129,7 +146,8 @@ class MailComposer {
             } else if (attachment.href) {
                 data.content = {
                     href: attachment.href,
-                    httpHeaders: attachment.httpHeaders
+                    httpHeaders: attachment.httpHeaders,
+                    tls: attachment.tls
                 };
             } else {
                 data.content = attachment.content || '';
@@ -147,21 +165,7 @@ class MailComposer {
         });
 
         if (this.mail.icalEvent) {
-            if (
-                typeof this.mail.icalEvent === 'object' &&
-                (this.mail.icalEvent.content || this.mail.icalEvent.path || this.mail.icalEvent.href || this.mail.icalEvent.raw)
-            ) {
-                icalEvent = this.mail.icalEvent;
-            } else {
-                icalEvent = {
-                    content: this.mail.icalEvent
-                };
-            }
-
-            eventObject = {};
-            Object.keys(icalEvent).forEach(key => {
-                eventObject[key] = icalEvent[key];
-            });
+            eventObject = Object.assign({}, this._getIcalEvent());
 
             eventObject.contentType = 'application/ics';
             if (!eventObject.headers) {
@@ -177,12 +181,75 @@ class MailComposer {
                 attached: attachments.concat(eventObject || []),
                 related: []
             };
-        } else {
-            return {
-                attached: attachments.filter(attachment => !attachment.cid).concat(eventObject || []),
-                related: attachments.filter(attachment => !!attachment.cid)
-            };
         }
+
+        return {
+            attached: attachments.filter(attachment => !attachment.cid).concat(eventObject || []),
+            related: attachments.filter(attachment => !!attachment.cid)
+        };
+    }
+
+    /**
+     * Returns the icalEvent value with `path`/`href`/data uri input normalized into
+     * a `content` entry, the same way as for regular attachments. The same event is
+     * included twice (as a text/calendar alternative and as an application/ics
+     * attachment), so the shared content object is marked to be resolved just once
+     * and the buffered result is reused by the second node.
+     *
+     * @returns {Object} Normalized icalEvent data
+     */
+    _getIcalEvent() {
+        if (!this._icalEvent) {
+            let icalEvent;
+            if (
+                typeof this.mail.icalEvent === 'object' &&
+                (this.mail.icalEvent.content || this.mail.icalEvent.path || this.mail.icalEvent.href || this.mail.icalEvent.raw)
+            ) {
+                // an own "__proto__" key would make the copy inherit path/href from caller
+                // data, and the mapping below then replaces the content the caller did set
+                icalEvent = copyOwnKeys({}, this.mail.icalEvent);
+            } else {
+                icalEvent = {
+                    content: this.mail.icalEvent
+                };
+            }
+
+            if (/^data:/i.test(icalEvent.path || icalEvent.href)) {
+                icalEvent = this._processDataUrl(icalEvent);
+            }
+
+            if (/^https?:\/\//i.test(icalEvent.path)) {
+                icalEvent.href = icalEvent.path;
+                icalEvent.path = undefined;
+            }
+
+            if (!icalEvent.raw) {
+                // map file path and URL values into `content`, otherwise the content
+                // nodes would render an empty body
+                if (icalEvent.path) {
+                    icalEvent.content = {
+                        path: icalEvent.path
+                    };
+                    icalEvent.path = undefined;
+                } else if (icalEvent.href) {
+                    icalEvent.content = {
+                        href: icalEvent.href,
+                        httpHeaders: icalEvent.httpHeaders
+                    };
+                    icalEvent.href = undefined;
+                }
+            }
+
+            if (icalEvent.content && typeof icalEvent.content === 'object') {
+                // we are going to have the same attachment twice, so mark this to be
+                // resolved just once
+                icalEvent.content._resolve = true;
+            }
+
+            this._icalEvent = icalEvent;
+        }
+
+        return this._icalEvent;
     }
 
     /**
@@ -191,16 +258,14 @@ class MailComposer {
      * @returns {Array} An array of alternative elements. Includes the `text` and `html` values as well
      */
     getAlternatives() {
-        let alternatives = [],
-            text,
-            html,
-            watchHtml,
-            amp,
-            icalEvent,
-            eventObject;
+        const alternatives = [];
+        let text, html, watchHtml, amp, eventObject;
 
         if (this.mail.text) {
-            if (typeof this.mail.text === 'object' && (this.mail.text.content || this.mail.text.path || this.mail.text.href || this.mail.text.raw)) {
+            if (
+                typeof this.mail.text === 'object' &&
+                (this.mail.text.content || this.mail.text.path || this.mail.text.href || this.mail.text.raw)
+            ) {
                 text = this.mail.text;
             } else {
                 text = {
@@ -225,7 +290,10 @@ class MailComposer {
         }
 
         if (this.mail.amp) {
-            if (typeof this.mail.amp === 'object' && (this.mail.amp.content || this.mail.amp.path || this.mail.amp.href || this.mail.amp.raw)) {
+            if (
+                typeof this.mail.amp === 'object' &&
+                (this.mail.amp.content || this.mail.amp.path || this.mail.amp.href || this.mail.amp.raw)
+            ) {
                 amp = this.mail.amp;
             } else {
                 amp = {
@@ -237,37 +305,21 @@ class MailComposer {
 
         // NB! when including attachments with a calendar alternative you might end up in a blank screen on some clients
         if (this.mail.icalEvent) {
-            if (
-                typeof this.mail.icalEvent === 'object' &&
-                (this.mail.icalEvent.content || this.mail.icalEvent.path || this.mail.icalEvent.href || this.mail.icalEvent.raw)
-            ) {
-                icalEvent = this.mail.icalEvent;
-            } else {
-                icalEvent = {
-                    content: this.mail.icalEvent
-                };
-            }
-
-            eventObject = {};
-            Object.keys(icalEvent).forEach(key => {
-                eventObject[key] = icalEvent[key];
-            });
-
-            if (eventObject.content && typeof eventObject.content === 'object') {
-                // we are going to have the same attachment twice, so mark this to be
-                // resolved just once
-                eventObject.content._resolve = true;
-            }
+            eventObject = Object.assign({}, this._getIcalEvent());
 
             eventObject.filename = false;
-            eventObject.contentType = 'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
+            eventObject.contentType =
+                'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
             if (!eventObject.headers) {
                 eventObject.headers = {};
             }
         }
 
         if (this.mail.html) {
-            if (typeof this.mail.html === 'object' && (this.mail.html.content || this.mail.html.path || this.mail.html.href || this.mail.html.raw)) {
+            if (
+                typeof this.mail.html === 'object' &&
+                (this.mail.html.content || this.mail.html.path || this.mail.html.href || this.mail.html.raw)
+            ) {
                 html = this.mail.html;
             } else {
                 html = {
@@ -285,14 +337,14 @@ class MailComposer {
             .concat(eventObject || [])
             .concat(this.mail.alternatives || [])
             .forEach(alternative => {
-                let data;
-
                 if (/^data:/i.test(alternative.path || alternative.href)) {
                     alternative = this._processDataUrl(alternative);
                 }
 
-                data = {
-                    contentType: alternative.contentType || mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
+                const data = {
+                    contentType:
+                        alternative.contentType ||
+                        mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
                     contentTransferEncoding: alternative.contentTransferEncoding
                 };
 
@@ -341,26 +393,22 @@ class MailComposer {
      * @returns {Object} MimeNode node element
      */
     _createMixed(parentNode) {
-        let node;
-
-        if (!parentNode) {
-            node = new MimeNode('multipart/mixed', {
-                baseBoundary: this.mail.baseBoundary,
-                textEncoding: this.mail.textEncoding,
-                boundaryPrefix: this.mail.boundaryPrefix,
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        } else {
-            node = parentNode.createChild('multipart/mixed', {
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        }
+        const node = parentNode
+            ? parentNode.createChild('multipart/mixed', {
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              })
+            : new MimeNode('multipart/mixed', {
+                  baseBoundary: this.mail.baseBoundary,
+                  textEncoding: this.mail.textEncoding,
+                  boundaryPrefix: this.mail.boundaryPrefix,
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              });
 
         if (this._useAlternative) {
             this._createAlternative(node);
@@ -389,26 +437,22 @@ class MailComposer {
      * @returns {Object} MimeNode node element
      */
     _createAlternative(parentNode) {
-        let node;
-
-        if (!parentNode) {
-            node = new MimeNode('multipart/alternative', {
-                baseBoundary: this.mail.baseBoundary,
-                textEncoding: this.mail.textEncoding,
-                boundaryPrefix: this.mail.boundaryPrefix,
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        } else {
-            node = parentNode.createChild('multipart/alternative', {
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        }
+        const node = parentNode
+            ? parentNode.createChild('multipart/alternative', {
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              })
+            : new MimeNode('multipart/alternative', {
+                  baseBoundary: this.mail.baseBoundary,
+                  textEncoding: this.mail.textEncoding,
+                  boundaryPrefix: this.mail.boundaryPrefix,
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              });
 
         this._alternatives.forEach(alternative => {
             if (this._useRelated && this._htmlNode === alternative) {
@@ -428,26 +472,22 @@ class MailComposer {
      * @returns {Object} MimeNode node element
      */
     _createRelated(parentNode) {
-        let node;
-
-        if (!parentNode) {
-            node = new MimeNode('multipart/related; type="text/html"', {
-                baseBoundary: this.mail.baseBoundary,
-                textEncoding: this.mail.textEncoding,
-                boundaryPrefix: this.mail.boundaryPrefix,
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        } else {
-            node = parentNode.createChild('multipart/related; type="text/html"', {
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        }
+        const node = parentNode
+            ? parentNode.createChild('multipart/related; type="text/html"', {
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              })
+            : new MimeNode('multipart/related; type="text/html"', {
+                  baseBoundary: this.mail.baseBoundary,
+                  textEncoding: this.mail.textEncoding,
+                  boundaryPrefix: this.mail.boundaryPrefix,
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              });
 
         this._createContentNode(node, this._htmlNode);
 
@@ -467,33 +507,30 @@ class MailComposer {
         element = element || {};
         element.content = element.content || '';
 
-        let node;
-        let encoding = (element.encoding || 'utf8')
+        const encoding = (element.encoding || 'utf8')
             .toString()
             .toLowerCase()
             .replace(/[-_\s]/g, '');
 
-        if (!parentNode) {
-            node = new MimeNode(element.contentType, {
-                filename: element.filename,
-                baseBoundary: this.mail.baseBoundary,
-                textEncoding: this.mail.textEncoding,
-                boundaryPrefix: this.mail.boundaryPrefix,
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        } else {
-            node = parentNode.createChild(element.contentType, {
-                filename: element.filename,
-                textEncoding: this.mail.textEncoding,
-                disableUrlAccess: this.mail.disableUrlAccess,
-                disableFileAccess: this.mail.disableFileAccess,
-                normalizeHeaderKey: this.mail.normalizeHeaderKey,
-                newline: this.mail.newline
-            });
-        }
+        const node = parentNode
+            ? parentNode.createChild(element.contentType, {
+                  filename: element.filename,
+                  textEncoding: this.mail.textEncoding,
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              })
+            : new MimeNode(element.contentType, {
+                  filename: element.filename,
+                  baseBoundary: this.mail.baseBoundary,
+                  textEncoding: this.mail.textEncoding,
+                  boundaryPrefix: this.mail.boundaryPrefix,
+                  disableUrlAccess: this.mail.disableUrlAccess,
+                  disableFileAccess: this.mail.disableFileAccess,
+                  normalizeHeaderKey: this.mail.normalizeHeaderKey,
+                  newline: this.mail.newline
+              });
 
         // add custom headers
         if (element.headers) {
@@ -538,9 +575,46 @@ class MailComposer {
      * @return {Object} Parsed element
      */
     _processDataUrl(element) {
+        const dataUrl = element.path || element.href;
+
+        // Early validation to prevent ReDoS
+        if (!dataUrl || typeof dataUrl !== 'string') {
+            return element;
+        }
+
+        if (!dataUrl.startsWith('data:')) {
+            return element;
+        }
+
+        if (dataUrl.length > 52428800) {
+            // 52428800 chars = 50MB limit for data URL string (~37.5MB decoded image)
+            // Extract content type before rejecting to preserve MIME type
+            let detectedType = 'application/octet-stream';
+            const commaPos = dataUrl.indexOf(',');
+
+            if (commaPos > 0 && commaPos < 200) {
+                // Parse header safely with size limit
+                const header = dataUrl.substring(5, commaPos); // skip 'data:'
+                const parts = header.split(';');
+                if (parts[0] && parts[0].includes('/')) {
+                    detectedType = parts[0].trim();
+                }
+            }
+
+            // Return empty content for excessively long data URLs
+            return Object.assign(copyOwnKeys({}, element), {
+                path: false,
+                href: false,
+                content: Buffer.alloc(0),
+                contentType: element.contentType || detectedType
+            });
+        }
+
         let parsedDataUri;
-        if ((element.path || element.href).match(/^data:/)) {
-            parsedDataUri = parseDataURI(element.path || element.href);
+        try {
+            parsedDataUri = parseDataURI(dataUrl);
+        } catch (_err) {
+            return element;
         }
 
         if (!parsedDataUri) {