@nocobase/plugin-workflow-mailer 2.3.0-beta.13 → 2.3.0-beta.15

package/dist/node_modules/nodemailer/{lib → dist/esm}/dkim/message-parser.js

@@ -1,7 +1,31 @@
-'use strict';
-
-const { Transform } = require('stream');
-
+import { Transform } from 'node:stream';
+/**
+ * Drops the SP and HTAB from both ends of a field name.
+ *
+ * An index scan rather than `/^[ \t]+|[ \t]+$/g`, which retries the trailing branch at
+ * every offset of a blank run that is followed by other text: the run is consumed greedily,
+ * `$` fails, and the engine gives the characters back one at a time before moving on to
+ * start the same walk one offset further in. A field name carrying a 128 KiB run of spaces
+ * between two atoms took about 6.7 seconds to trim, and the cost grows with its square.
+ *
+ * Not `.trim()`, which takes the other Unicode spaces along: an NBSP in front of a field
+ * name would come off and select the name into the signed set, where the relaxed
+ * canonicalization in sign.ts deliberately leaves everything but SP and HTAB alone.
+ *
+ * @param str Field name to trim
+ * @return The field name without the surrounding SP and HTAB
+ */
+function _trimFieldName(str) {
+    let start = 0;
+    let end = str.length;
+    while (start < end && (str.charCodeAt(start) === 0x20 || str.charCodeAt(start) === 0x09)) {
+        start++;
+    }
+    while (end > start && (str.charCodeAt(end - 1) === 0x20 || str.charCodeAt(end - 1) === 0x09)) {
+        end--;
+    }
+    return str.slice(start, end);
+}
 /**
  * MessageParser instance is a transform stream that separates message headers
  * from the rest of the body. Headers are emitted with the 'headers' event. Message
@@ -17,46 +41,42 @@ class MessageParser extends Transform {
         this.rawHeaders = false;
         this.bodySize = 0;
     }
-
     /**
      * Keeps count of the last 4 bytes in order to detect line breaks on chunk boundaries
      *
-     * @param {Buffer} data Next data chunk from the stream
+     * @param data Next data chunk from the stream
      */
     updateLastBytes(data) {
         const lblen = this.lastBytes.length;
         const nblen = Math.min(data.length, lblen);
-
         // shift existing bytes
         for (let i = 0, len = lblen - nblen; i < len; i++) {
             this.lastBytes[i] = this.lastBytes[i + nblen];
         }
-
         // add new bytes
         for (let i = 1; i <= nblen; i++) {
             this.lastBytes[lblen - i] = data[data.length - i];
         }
     }
-
     /**
      * Finds and removes message headers from the remaining body. We want to keep
      * headers separated until final delivery to be able to modify these
      *
-     * @param {Buffer} data Next chunk of data
-     * @return {Boolean} Returns true if headers are already found or false otherwise
+     * @param data Next chunk of data
+     * @return Returns true if headers are already found or false otherwise
      */
     checkHeaders(data) {
         if (this.headersParsed) {
             return true;
         }
-
         const lblen = this.lastBytes.length;
         let headerPos = 0;
         for (let i = 0, len = this.lastBytes.length + data.length; i < len; i++) {
             let chr;
             if (i < lblen) {
                 chr = this.lastBytes[i];
-            } else {
+            }
+            else {
                 chr = data[i - lblen];
             }
             if (chr === 0x0a && i) {
@@ -67,7 +87,8 @@ class MessageParser extends Transform {
                     headerPos = i - lblen + 1;
                     this.headerBytes += headerPos;
                     break;
-                } else if (pr1 === 0x0d && pr2 === 0x0a) {
+                }
+                else if (pr1 === 0x0d && pr2 === 0x0a) {
                     this.headersParsed = true;
                     headerPos = i - lblen + 1;
                     this.headerBytes += headerPos;
@@ -75,13 +96,12 @@ class MessageParser extends Transform {
                 }
             }
         }
-
         if (this.headersParsed) {
             this.headerChunks.push(data.slice(0, headerPos));
             this.rawHeaders = Buffer.concat(this.headerChunks, this.headerBytes);
             this.headerChunks = null;
             this.emit('headers', this.parseHeaders());
-            if (data.length - 1 > headerPos) {
+            if (data.length > headerPos) {
                 const chunk = data.slice(headerPos);
                 this.bodySize += chunk.length;
                 // this would be the first chunk of data sent downstream
@@ -89,66 +109,68 @@ class MessageParser extends Transform {
             }
             return false;
         }
-
         this.headerBytes += data.length;
         this.headerChunks.push(data);
-
         // store last 4 bytes to catch header break
         this.updateLastBytes(data);
-
         return false;
     }
-
+    /** @internal */
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
         }
-
         if (typeof chunk === 'string') {
             chunk = Buffer.from(chunk, encoding);
         }
-
         let headersFound;
-
         try {
             headersFound = this.checkHeaders(chunk);
-        } catch (E) {
+        }
+        catch (E) {
             return callback(E);
         }
-
         if (headersFound) {
             this.bodySize += chunk.length;
             this.push(chunk);
         }
-
         setImmediate(callback);
     }
-
+    /** @internal */
     _flush(callback) {
         if (this.headerChunks) {
-            const chunk = Buffer.concat(this.headerChunks, this.headerBytes);
-            this.bodySize += chunk.length;
-            this.push(chunk);
+            // no empty line was seen, so the message consists of headers only
+            this.rawHeaders = Buffer.concat(this.headerChunks, this.headerBytes);
             this.headerChunks = null;
+            this.emit('headers', this.parseHeaders());
         }
         callback();
     }
-
     parseHeaders() {
-        const lines = (this.rawHeaders || '').toString().split(/\r?\n/);
-        for (let i = lines.length - 1; i > 0; i--) {
-            if (/^\s/.test(lines[i])) {
-                lines[i - 1] += '\n' + lines[i];
-                lines.splice(i, 1);
+        // the header bytes are kept as they are, one character per byte, so the
+        // signature covers exactly the bytes the receiving side canonicalizes
+        // Only SP and HTAB fold a line, and only they are trimmed from the field name, the
+        // same whitespace the relaxed canonicalization in sign.ts works with
+        const rawLines = (this.rawHeaders || Buffer.alloc(0)).toString('binary').split(/\r?\n/);
+        // Unfold in a single forward pass and only ever test a freshly split line for the
+        // continuation prefix. Testing an already merged line instead would rescan a string
+        // that grows with every continuation line, so a header folded into many continuation
+        // lines (a large recipient list, for example) would take quadratic time to unfold
+        const lines = [];
+        for (const rawLine of rawLines) {
+            if (lines.length && /^[ \t]/.test(rawLine)) {
+                lines[lines.length - 1] += '\n' + rawLine;
+            }
+            else {
+                lines.push(rawLine);
             }
         }
         return lines
-            .filter(line => line.trim())
+            .filter(line => /[^ \t\r]/.test(line))
             .map(line => ({
-                key: line.substr(0, line.indexOf(':')).trim().toLowerCase(),
-                line
-            }));
+            key: _trimFieldName(line.substr(0, line.indexOf(':'))).toLowerCase(),
+            line
+        }));
     }
 }
-
-module.exports = MessageParser;
+export default MessageParser;

package/dist/node_modules/nodemailer/dist/esm/dkim/relaxed-body.d.ts

@@ -0,0 +1,36 @@
+import { Transform } from 'node:stream';
+import crypto from 'node:crypto';
+/**
+ * Options for the relaxed body hash stream
+ */
+export interface RelaxedBodyOptions {
+    /** Hash algorithm for the body hash, defaults to sha256 */
+    hashAlgo?: string | undefined;
+    /** Collect the canonicalized body and emit it with the 'hash' event */
+    debug?: boolean | undefined;
+}
+/**
+ * Passes the message body through unchanged and hashes its relaxed
+ * canonicalization (RFC 6376 section 3.4.4) on the side: whitespace at the end
+ * of a line is dropped, runs of whitespace within a line become a single space,
+ * every line ends with CRLF, empty lines at the end of the body are ignored and
+ * a non-empty body always ends with CRLF. Bytes are canonicalized as they arrive,
+ * so a line of any length costs constant memory.
+ */
+declare class RelaxedBody extends Transform {
+    bodyHash: crypto.Hash;
+    /** Bytes of the original body seen so far */
+    byteLength: number;
+    debug: boolean | undefined;
+    constructor(options?: RelaxedBodyOptions);
+    updateHash(chunk: Buffer, final?: boolean): void;
+}
+/**
+ * Type aliases in the layout of @types/nodemailer, so `RelaxedBody.Options` style references keep working
+ */
+declare namespace RelaxedBody {
+    type Options = RelaxedBodyOptions;
+}
+/** The same alias as a module level export, for `import * as RelaxedBody` and `import RelaxedBody = require()` */
+export type { RelaxedBodyOptions as Options };
+export default RelaxedBody;

package/dist/node_modules/nodemailer/dist/esm/dkim/relaxed-body.js

@@ -0,0 +1,141 @@
+// streams through a message body and calculates relaxed body hash
+import { Transform } from 'node:stream';
+import crypto from 'node:crypto';
+const CHAR_CR = 0x0d;
+const CHAR_LF = 0x0a;
+const CHAR_SPACE = 0x20;
+const CHAR_TAB = 0x09;
+const CRLF = Buffer.from('\r\n');
+// a run of empty lines is hashed from this buffer in slices
+const EMPTY_LINES = Buffer.alloc(4096, CRLF);
+/**
+ * Passes the message body through unchanged and hashes its relaxed
+ * canonicalization (RFC 6376 section 3.4.4) on the side: whitespace at the end
+ * of a line is dropped, runs of whitespace within a line become a single space,
+ * every line ends with CRLF, empty lines at the end of the body are ignored and
+ * a non-empty body always ends with CRLF. Bytes are canonicalized as they arrive,
+ * so a line of any length costs constant memory.
+ */
+class RelaxedBody extends Transform {
+    constructor(options) {
+        super();
+        options = options || {};
+        this.bodyHash = crypto.createHash(options.hashAlgo || 'sha256');
+        this.byteLength = 0;
+        this.debug = options.debug;
+        this._debugBody = options.debug ? [] : false;
+        this._lineHasContent = false;
+        this._pendingWsp = false;
+        this._pendingCr = false;
+        this._pendingEmptyLines = 0;
+    }
+    /** @internal */
+    _hashCanonical(data) {
+        if (!data.length) {
+            return;
+        }
+        this.bodyHash.update(data);
+        if (this._debugBody) {
+            this._debugBody.push(Buffer.from(data));
+        }
+    }
+    /** @internal */
+    _hashEmptyLines() {
+        while (this._pendingEmptyLines > 0) {
+            const count = Math.min(this._pendingEmptyLines, EMPTY_LINES.length / 2);
+            this._hashCanonical(EMPTY_LINES.subarray(0, count * 2));
+            this._pendingEmptyLines -= count;
+        }
+    }
+    /**
+     * Writes a content byte, with the space a pending run of whitespace collapses to,
+     * into the output buffer and returns the new write position. Kept a method rather
+     * than a closure so the write position stays a plain local in the byte loop
+     * @internal
+     */
+    _emitContent(out, outPos, c) {
+        if (!this._lineHasContent) {
+            if (this._pendingEmptyLines) {
+                // the first content byte of a line is where the empty lines before it
+                // become part of the body, so hash what is in the buffer before them
+                this._hashCanonical(out.subarray(0, outPos));
+                outPos = 0;
+                this._hashEmptyLines();
+            }
+            this._lineHasContent = true;
+        }
+        if (this._pendingWsp) {
+            out[outPos++] = CHAR_SPACE;
+            this._pendingWsp = false;
+        }
+        out[outPos++] = c;
+        return outPos;
+    }
+    updateHash(chunk, final) {
+        // every byte contributes itself at most once, plus a CR for a bare LF
+        // and, once per chunk, a pending space and CR carried over from before
+        const out = Buffer.allocUnsafe(chunk.length * 2 + 2);
+        let outPos = 0;
+        for (let i = 0; i < chunk.length; i++) {
+            const c = chunk[i];
+            if (c === CHAR_LF) {
+                // end of line, a CR right before it and any trailing whitespace are dropped
+                if (this._lineHasContent) {
+                    out[outPos++] = CHAR_CR;
+                    out[outPos++] = CHAR_LF;
+                    this._lineHasContent = false;
+                }
+                else {
+                    this._pendingEmptyLines++;
+                }
+                this._pendingWsp = false;
+                this._pendingCr = false;
+                continue;
+            }
+            if (this._pendingCr) {
+                // not followed by LF, so the CR is content
+                outPos = this._emitContent(out, outPos, CHAR_CR);
+                this._pendingCr = false;
+            }
+            if (c === CHAR_CR) {
+                this._pendingCr = true;
+            }
+            else if (c === CHAR_SPACE || c === CHAR_TAB) {
+                this._pendingWsp = true;
+            }
+            else {
+                outPos = this._emitContent(out, outPos, c);
+            }
+        }
+        if (final && this._pendingCr) {
+            // a CR at the very end of the body is content
+            outPos = this._emitContent(out, outPos, CHAR_CR);
+            this._pendingCr = false;
+        }
+        this._hashCanonical(out.subarray(0, outPos));
+    }
+    /** @internal */
+    _transform(chunk, encoding, callback) {
+        if (!chunk || !chunk.length) {
+            return callback();
+        }
+        if (typeof chunk === 'string') {
+            chunk = Buffer.from(chunk, encoding);
+        }
+        this.updateHash(chunk);
+        this.byteLength += chunk.length;
+        this.push(chunk);
+        callback();
+    }
+    /** @internal */
+    _flush(callback) {
+        this.updateHash(Buffer.alloc(0), true);
+        if (this._lineHasContent) {
+            // the body does not end with a line break, add one
+            this._hashCanonical(CRLF);
+        }
+        this.emit('hash', this.bodyHash.digest('base64'), this.debug ? Buffer.concat(this._debugBody) : false);
+        callback();
+    }
+}
+export default RelaxedBody;

package/dist/node_modules/nodemailer/dist/esm/dkim/sign.d.ts

@@ -0,0 +1,52 @@
+import crypto from 'node:crypto';
+import type { NodemailerError } from '../errors.js';
+import type { MessageParserHeaderLine } from './message-parser.js';
+/**
+ * Private key accepted by crypto.Sign#sign: a PEM string, a Buffer, a KeyObject or an
+ * object with the key and its passphrase
+ */
+export type DKIMPrivateKey = crypto.KeyLike | crypto.SignKeyObjectInput | crypto.SignPrivateKeyInput;
+/**
+ * Options for the DKIM signature header generator
+ */
+export interface DKIMKey {
+    /** Domain name to be signed for */
+    domainName?: string | undefined;
+    /** DKIM key selector to use */
+    keySelector?: string | undefined;
+    /** DKIM private key to use */
+    privateKey?: DKIMPrivateKey | undefined;
+}
+export interface DKIMSignOptions extends DKIMKey {
+    /** Colon separated list of header field names to sign, defaults to the RFC4871 list */
+    headerFieldNames?: string | undefined;
+    /** Colon separated list of header field names to leave out of the signature */
+    skipFields?: string | undefined;
+}
+/**
+ * Canonicalized headers and the list of field names that went into them
+ */
+export interface DKIMRelaxedHeaders {
+    /** Relaxed header lines, each terminated with CRLF, one character per byte ('binary' encoding) */
+    headers: string;
+    /** Colon separated list of the field names that were included */
+    fieldNames: string;
+}
+/**
+ * Returns DKIM signature header line
+ *
+ * @param headers Parsed headers object from MessageParser
+ * @param hashAlgo Hash algorithm the body hash was calculated with, for example "sha256"
+ * @param bodyHash Base64 encoded hash of the message
+ * @param options DKIM options
+ * @param options.domainName Domain name to be signed for
+ * @param options.keySelector DKIM key selector to use
+ * @param options.privateKey DKIM private key to use
+ * @return Complete header line
+ */
+declare function sign(headers: MessageParserHeaderLine[], hashAlgo: string, bodyHash: string, options?: DKIMSignOptions): string | false;
+declare namespace sign {
+    var relaxedHeaders: (headers: MessageParserHeaderLine[], fieldNames?: string, skipFields?: string) => DKIMRelaxedHeaders;
+    var unsupportedHashAlgoError: (hashAlgo: string) => NodemailerError;
+}
+export default sign;

package/dist/node_modules/nodemailer/{lib → dist/esm}/dkim/sign.js

@@ -1,60 +1,66 @@
-'use strict';
-
-const punycode = require('../punycode');
-const mimeFuncs = require('../mime-funcs');
-const crypto = require('crypto');
-
+import * as punycode from '../punycode/index.js';
+import * as mimeFuncs from '../mime-funcs/index.js';
+import crypto from 'node:crypto';
+import * as errors from '../errors.js';
+/**
+ * Error for a hashAlgo value the crypto module does not know
+ */
+function unsupportedHashAlgoError(hashAlgo) {
+    const err = new Error('Unsupported DKIM hash algorithm "' + hashAlgo + '"');
+    err.code = errors.ECONFIG;
+    return err;
+}
 /**
  * Returns DKIM signature header line
  *
- * @param {Object} headers Parsed headers object from MessageParser
- * @param {String} bodyHash Base64 encoded hash of the message
- * @param {Object} options DKIM options
- * @param {String} options.domainName Domain name to be signed for
- * @param {String} options.keySelector DKIM key selector to use
- * @param {String} options.privateKey DKIM private key to use
- * @return {String} Complete header line
+ * @param headers Parsed headers object from MessageParser
+ * @param hashAlgo Hash algorithm the body hash was calculated with, for example "sha256"
+ * @param bodyHash Base64 encoded hash of the message
+ * @param options DKIM options
+ * @param options.domainName Domain name to be signed for
+ * @param options.keySelector DKIM key selector to use
+ * @param options.privateKey DKIM private key to use
+ * @return Complete header line
  */
-
-module.exports = (headers, hashAlgo, bodyHash, options) => {
+function sign(headers, hashAlgo, bodyHash, options) {
     options = options || {};
-
     // all listed fields from RFC4871 #5.5
-    const defaultFieldNames =
-        'From:Sender:Reply-To:Subject:Date:Message-ID:To:' +
+    const defaultFieldNames = 'From:Sender:Reply-To:Subject:Date:Message-ID:To:' +
         'Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Content-ID:' +
         'Content-Description:Resent-Date:Resent-From:Resent-Sender:' +
         'Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:' +
         'List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:' +
         'List-Owner:List-Archive';
-
     const fieldNames = options.headerFieldNames || defaultFieldNames;
-
     const canonicalizedHeaderData = relaxedHeaders(headers, fieldNames, options.skipFields);
     const dkimHeader = generateDKIMHeader(options.domainName, options.keySelector, canonicalizedHeaderData.fieldNames, hashAlgo, bodyHash);
-
     canonicalizedHeaderData.headers += 'dkim-signature:' + relaxedHeaderLine(dkimHeader);
-
-    const signer = crypto.createSign(('rsa-' + hashAlgo).toUpperCase());
-    signer.update(canonicalizedHeaderData.headers);
+    let signer;
+    try {
+        signer = crypto.createSign(('rsa-' + hashAlgo).toUpperCase());
+    }
+    catch (_E) {
+        throw unsupportedHashAlgoError(hashAlgo);
+    }
+    // the header lines are 'binary' strings, so this reproduces the original header bytes
+    signer.update(canonicalizedHeaderData.headers, 'latin1');
     let signature;
     try {
         signature = signer.sign(options.privateKey, 'base64');
-    } catch (_E) {
+    }
+    catch (_E) {
         return false;
     }
-
     return dkimHeader + signature.replace(/(^.{73}|.{75}(?!\r?\n|\r))/g, '$&\r\n ').trim();
-};
-
-module.exports.relaxedHeaders = relaxedHeaders;
-
+}
+sign.relaxedHeaders = relaxedHeaders;
+sign.unsupportedHashAlgoError = unsupportedHashAlgoError;
+export default sign;
 function generateDKIMHeader(domainName, keySelector, fieldNames, hashAlgo, bodyHash) {
     // the caller supplied tag values are interpolated straight into the tag list, and none of
     // them has any way to carry a control char, DEL, or one of the delimiters that would close
     // the value and open a tag of its own
-    const cleanTagValue = value => (value || '').toString().replace(/[\x00-\x1f\x7f;=]/g, '');
-
+    const cleanTagValue = (value) => (value || '').toString().replace(/[\x00-\x1f\x7f;=]/g, '');
     const dkim = [
         'v=1',
         'a=rsa-' + hashAlgo,
@@ -65,30 +71,25 @@ function generateDKIMHeader(domainName, keySelector, fieldNames, hashAlgo, bodyH
         'bh=' + bodyHash,
         'h=' + cleanTagValue(fieldNames)
     ].join('; ');
-
     return mimeFuncs.foldLines('DKIM-Signature: ' + dkim, 76) + ';\r\n b=';
 }
-
 function relaxedHeaders(headers, fieldNames, skipFields) {
     const includedFields = new Set();
     const skip = new Set();
     const headerFields = new Map();
-
     (skipFields || '')
         .toLowerCase()
         .split(':')
         .forEach(field => {
-            skip.add(field.trim());
-        });
-
+        skip.add(field.trim());
+    });
     (fieldNames || '')
         .toLowerCase()
         .split(':')
         .filter(field => !skip.has(field.trim()))
         .forEach(field => {
-            includedFields.add(field.trim());
-        });
-
+        includedFields.add(field.trim());
+    });
     for (let i = headers.length - 1; i >= 0; i--) {
         const line = headers[i];
         // only include the first value from bottom to top
@@ -96,7 +97,6 @@ function relaxedHeaders(headers, fieldNames, skipFields) {
             headerFields.set(line.key, relaxedHeaderLine(line.line));
         }
     }
-
     const headersList = [];
     const fields = [];
     includedFields.forEach(field => {
@@ -105,17 +105,21 @@ function relaxedHeaders(headers, fieldNames, skipFields) {
             headersList.push(field + ':' + headerFields.get(field));
         }
     });
-
     return {
         headers: headersList.join('\r\n') + '\r\n',
         fieldNames: fields.join(':')
     };
 }
-
+/**
+ * Relaxed canonicalization of a header field value (RFC 6376 section 3.4.2): unfold, turn
+ * every run of SP and HTAB into a single SP and drop the whitespace next to the colon and
+ * at the end. Only SP and HTAB count as whitespace, so bytes that decode to other space
+ * characters, such as a non-breaking space in a UTF-8 header, stay as they are
+ */
 function relaxedHeaderLine(line) {
     return line
         .substr(line.indexOf(':') + 1)
         .replace(/\r?\n/g, '')
-        .replace(/\s+/g, ' ')
-        .trim();
+        .replace(/[ \t]+/g, ' ')
+        .replace(/^ | $/g, '');
 }