@nocobase/plugin-workflow-mailer 2.3.0-beta.9 → 2.4.0-alpha.10

package/dist/node_modules/nodemailer/{lib → dist/esm}/mailer/mail-message.js

@@ -1,188 +1,185 @@
-'use strict';
-
-const shared = require('../shared');
-const MimeNode = require('../mime-node');
-const mimeFuncs = require('../mime-funcs');
-
-class MailMessage {
+import * as shared from '../shared/index.js';
+import MimeNode from '../mime-node/index.js';
+import * as mimeFuncs from '../mime-funcs/index.js';
+// Only an own key counts as already set. `key in obj` also matches every member of
+// Object.prototype, which silently drops a transporter default legitimately named
+// toString or constructor.
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+export default class MailMessage {
     constructor(mailer, data) {
         this.mailer = mailer;
         this.data = {};
         this.message = null;
-
         data = data || {};
-        let options = mailer.options || {};
-        let defaults = mailer._defaults || {};
-
-        Object.keys(data).forEach(key => {
-            this.data[key] = data[key];
-        });
-
+        const options = mailer.options || {};
+        const defaults = mailer._defaults || {};
+        shared.copyOwnKeys(this.data, data);
         this.data.headers = this.data.headers || {};
-
-        // apply defaults
-        Object.keys(defaults).forEach(key => {
-            if (!(key in this.data)) {
-                this.data[key] = defaults[key];
-            } else if (key === 'headers') {
-                // headers is a special case. Allow setting individual default headers
-                Object.keys(defaults.headers).forEach(key => {
-                    if (!(key in this.data.headers)) {
-                        this.data.headers[key] = defaults.headers[key];
-                    }
-                });
-            }
-        });
-
+        // Apply defaults. `_defaults` is caller supplied too, it is the second argument of
+        // createTransport, so it needs the same treatment as `data` above
+        shared.copyOwnKeys(this.data, defaults, key => hasOwn(this.data, key));
+        // headers is a special case. Allow setting individual default headers
+        shared.copyOwnKeys(this.data.headers, defaults.headers, key => hasOwn(this.data.headers, key));
         // force specific keys from transporter options
-        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey'].forEach(key => {
+        ['disableFileAccess', 'disableUrlAccess', 'normalizeHeaderKey', 'maxRecipients'].forEach(key => {
             if (key in options) {
                 this.data[key] = options[key];
             }
         });
+        // The access flags are a sandbox rather than a message field, so `defaults` counts as
+        // transporter configuration for them. For a transporter plugin it is the only channel
+        // there is, createTransport leaves `options` undefined for one, and the defaults copy
+        // above yields to anything the message already set, which let message data switch the
+        // sandbox back off. Closing is one way here, same as in resolveContent below: either
+        // side may switch a flag on, neither can switch off what the other closed.
+        ['disableFileAccess', 'disableUrlAccess'].forEach(key => {
+            if (!(key in options) && hasOwn(defaults, key)) {
+                this.data[key] = this.data[key] || defaults[key];
+            }
+        });
     }
-
-    resolveContent(...args) {
-        return shared.resolveContent(...args);
+    resolveContent(data, key, options, callback) {
+        // Most plugins call this with the legacy (data, key, callback) signature, which carries
+        // no access policy. The policy belongs to the message, so apply it here. Explicit
+        // options may only tighten it, never reopen what the transporter closed.
+        if (!callback && typeof options === 'function') {
+            callback = options;
+            options = false;
+        }
+        options = options || {};
+        const policy = {
+            disableFileAccess: this.data.disableFileAccess || options.disableFileAccess,
+            disableUrlAccess: this.data.disableUrlAccess || options.disableUrlAccess
+        };
+        return shared.resolveContent(data, key, policy, callback);
     }
-
     resolveAll(callback) {
-        let keys = [
+        const keys = [
             [this.data, 'html'],
             [this.data, 'text'],
             [this.data, 'watchHtml'],
             [this.data, 'amp'],
             [this.data, 'icalEvent']
         ];
-
         if (this.data.alternatives && this.data.alternatives.length) {
             this.data.alternatives.forEach((alternative, i) => {
                 keys.push([this.data.alternatives, i]);
             });
         }
-
         if (this.data.attachments && this.data.attachments.length) {
             this.data.attachments.forEach((attachment, i) => {
                 if (!attachment.filename) {
-                    attachment.filename = (attachment.path || attachment.href || '').split('/').pop().split('?').shift() || 'attachment-' + (i + 1);
+                    // a backslash separates as well, so a Windows path does not put the sender's directories in the headers
+                    attachment.filename =
+                        (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() ||
+                            'attachment-' + (i + 1);
                     if (attachment.filename.indexOf('.') < 0) {
                         attachment.filename += '.' + mimeFuncs.detectExtension(attachment.contentType);
                     }
                 }
-
                 if (!attachment.contentType) {
                     attachment.contentType = mimeFuncs.detectMimeType(attachment.filename || attachment.path || attachment.href || 'bin');
                 }
-
                 keys.push([this.data.attachments, i]);
             });
         }
-
-        let mimeNode = new MimeNode();
-
-        let addressKeys = ['from', 'to', 'cc', 'bcc', 'sender', 'replyTo'];
-
+        const mimeNode = new MimeNode();
+        const addressKeys = ['from', 'to', 'cc', 'bcc', 'sender', 'replyTo'];
         addressKeys.forEach(address => {
             let value;
             if (this.message) {
                 value = [].concat(mimeNode._parseAddresses(this.message.getHeader(address === 'replyTo' ? 'reply-to' : address)) || []);
-            } else if (this.data[address]) {
+            }
+            else if (this.data[address]) {
                 value = [].concat(mimeNode._parseAddresses(this.data[address]) || []);
             }
             if (value && value.length) {
                 this.data[address] = value;
-            } else if (address in this.data) {
+            }
+            else if (address in this.data) {
                 this.data[address] = null;
             }
         });
-
-        let singleKeys = ['from', 'sender'];
+        const singleKeys = ['from', 'sender'];
         singleKeys.forEach(address => {
             if (this.data[address]) {
                 this.data[address] = this.data[address].shift();
             }
         });
-
         let pos = 0;
-        let resolveNext = () => {
+        const resolveNext = () => {
             if (pos >= keys.length) {
                 return callback(null, this.data);
             }
-            let args = keys[pos++];
+            const args = keys[pos++];
             if (!args[0] || !args[0][args[1]]) {
                 return resolveNext();
             }
-            shared.resolveContent(...args, (err, value) => {
+            shared.resolveContent(...args, { disableFileAccess: this.data.disableFileAccess, disableUrlAccess: this.data.disableUrlAccess }, (err, value) => {
                 if (err) {
                     return callback(err);
                 }
-
-                let node = {
+                const node = {
                     content: value
                 };
                 if (args[0][args[1]] && typeof args[0][args[1]] === 'object' && !Buffer.isBuffer(args[0][args[1]])) {
-                    Object.keys(args[0][args[1]]).forEach(key => {
-                        if (!(key in node) && !['content', 'path', 'href', 'raw'].includes(key)) {
-                            node[key] = args[0][args[1]][key];
-                        }
-                    });
+                    // The keys are the caller's, so copying them takes the same "__proto__"
+                    // rule as the constructor. `key in node` stays as the already-set test
+                    // here, unlike for the defaults: it also skips the Object.prototype
+                    // member names, and letting message data land a `toString` string on a
+                    // node only buys a TypeError the first time something stringifies it.
+                    shared.copyOwnKeys(node, args[0][args[1]], key => key in node || ['content', 'path', 'href', 'raw'].includes(key));
                 }
-
                 args[0][args[1]] = node;
                 resolveNext();
             });
         };
-
         setImmediate(() => resolveNext());
     }
-
     normalize(callback) {
-        let envelope = this.data.envelope || this.message.getEnvelope();
-        let messageId = this.message.messageId();
-
+        const envelope = this.message.getEnvelope();
+        const messageId = this.message.messageId();
         this.resolveAll((err, data) => {
             if (err) {
                 return callback(err);
             }
-
             data.envelope = envelope;
             data.messageId = messageId;
-
             ['html', 'text', 'watchHtml', 'amp'].forEach(key => {
                 if (data[key] && data[key].content) {
                     if (typeof data[key].content === 'string') {
                         data[key] = data[key].content;
-                    } else if (Buffer.isBuffer(data[key].content)) {
+                    }
+                    else if (Buffer.isBuffer(data[key].content)) {
                         data[key] = data[key].content.toString();
                     }
                 }
             });
-
             if (data.icalEvent && Buffer.isBuffer(data.icalEvent.content)) {
                 data.icalEvent.content = data.icalEvent.content.toString('base64');
                 data.icalEvent.encoding = 'base64';
             }
-
             if (data.alternatives && data.alternatives.length) {
-                data.alternatives.forEach(alternative => {
+                data.alternatives.forEach((alternative) => {
                     if (alternative && alternative.content && Buffer.isBuffer(alternative.content)) {
                         alternative.content = alternative.content.toString('base64');
                         alternative.encoding = 'base64';
                     }
                 });
             }
-
             if (data.attachments && data.attachments.length) {
-                data.attachments.forEach(attachment => {
+                data.attachments.forEach((attachment) => {
                     if (attachment && attachment.content && Buffer.isBuffer(attachment.content)) {
                         attachment.content = attachment.content.toString('base64');
                         attachment.encoding = 'base64';
                     }
                 });
             }
-
             data.normalizedHeaders = {};
             Object.keys(data.headers || {}).forEach(key => {
+                if (shared.isProtoKey(key)) {
+                    return;
+                }
                 let value = [].concat(data.headers[key] || []).shift();
                 value = (value && value.value) || value;
                 if (value) {
@@ -192,33 +189,27 @@ class MailMessage {
                     data.normalizedHeaders[key] = value;
                 }
             });
-
             if (data.list && typeof data.list === 'object') {
-                let listHeaders = this._getListHeaders(data.list);
+                const listHeaders = this._getListHeaders(data.list);
                 listHeaders.forEach(entry => {
                     data.normalizedHeaders[entry.key] = entry.value.map(val => (val && val.value) || val).join(', ');
                 });
             }
-
             if (data.references) {
                 data.normalizedHeaders.references = this.message._encodeHeaderValue('references', data.references);
             }
-
             if (data.inReplyTo) {
                 data.normalizedHeaders['in-reply-to'] = this.message._encodeHeaderValue('in-reply-to', data.inReplyTo);
             }
-
             return callback(null, data);
         });
     }
-
     setMailerHeader() {
         if (!this.message || !this.data.xMailer) {
             return;
         }
         this.message.setHeader('X-Mailer', this.data.xMailer);
     }
-
     setPriorityHeaders() {
         if (!this.message || !this.data.priority) {
             return;
@@ -238,21 +229,18 @@ class MailMessage {
             // do not add anything, since all messages are 'Normal' by default
         }
     }
-
     setListHeaders() {
         if (!this.message || !this.data.list || typeof this.data.list !== 'object') {
             return;
         }
         // add optional List-* headers
-        if (this.data.list && typeof this.data.list === 'object') {
-            this._getListHeaders(this.data.list).forEach(listHeader => {
-                listHeader.value.forEach(value => {
-                    this.message.addHeader(listHeader.key, value);
-                });
+        this._getListHeaders(this.data.list).forEach(listHeader => {
+            listHeader.value.forEach(value => {
+                this.message.addHeader(listHeader.key, value);
             });
-        }
+        });
     }
-
+    /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
         return Object.keys(listData).map(key => ({
@@ -263,53 +251,51 @@ class MailMessage {
                 value: []
                     .concat(value || [])
                     .map(value => {
-                        if (typeof value === 'string') {
-                            value = {
-                                url: value
-                            };
-                        }
-
-                        if (value && value.url) {
-                            if (key.toLowerCase().trim() === 'id') {
-                                // List-ID: "comment" <domain>
-                                let comment = value.comment || '';
-                                if (mimeFuncs.isPlainText(comment)) {
-                                    comment = '"' + comment + '"';
-                                } else {
-                                    comment = mimeFuncs.encodeWord(comment);
-                                }
-
-                                return (value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+\/{,2}/, '');
-                            }
-
-                            // List-*: <http://domain> (comment)
-                            let comment = value.comment || '';
-                            if (!mimeFuncs.isPlainText(comment)) {
-                                comment = mimeFuncs.encodeWord(comment);
-                            }
-
-                            return this._formatListUrl(value.url) + (value.comment ? ' (' + comment + ')' : '');
+                    if (typeof value === 'string') {
+                        value = {
+                            url: value
+                        };
+                    }
+                    if (value && value.url) {
+                        // strip CR/LF so a comment can't inject extra header lines. DEL is neither
+                        // qtext nor ctext, so it can not be carried literally by either construct
+                        // and has to become an encoded word like any other non-plaintext value
+                        let comment = (value.comment || '').toString().replace(/\r?\n|\r/g, ' ');
+                        const needsEncoding = !mimeFuncs.isPlainText(comment) || /\x7f/.test(comment);
+                        if (key.toLowerCase().trim() === 'id') {
+                            // List-ID: "comment" <domain>, where an unescaped quote or a trailing
+                            // backslash in the comment would swallow the <domain> behind it
+                            comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
+                            // List-ID expects a bare domain-like identifier, so strip the
+                            // scheme prefix that _formatListUrl adds or passes through
+                            return ((value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<'));
                         }
-
-                        return '';
-                    })
+                        // List-*: <http://domain> (comment)
+                        // the ctext specials go out as quoted-pairs, otherwise a ")" closes the
+                        // comment early and leaves the rest as junk, an unpaired "(" opens a
+                        // nested comment that never closes, and a trailing backslash escapes
+                        // the closing ")" so the comment swallows whatever follows it
+                        comment = needsEncoding ? mimeFuncs.encodeWord(comment) : comment.replace(/[()\\]/g, '\\$&');
+                        return this._formatListUrl(value.url) + (value.comment ? ' (' + comment + ')' : '');
+                    }
+                    return '';
+                })
                     .filter(value => value)
                     .join(', ')
             }))
         }));
     }
-
+    /** @internal */
     _formatListUrl(url) {
-        url = url.replace(/[\s<]+|[\s>]+/g, '');
+        // a url has no way to carry a control char or DEL, and the angle brackets around it
+        // are not a quoting construct, so anything left here lands in the header raw
+        url = url.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[\s<]+|[\s>]+/g, '');
         if (/^(https?|mailto|ftp):/.test(url)) {
             return '<' + url + '>';
         }
         if (/^[^@]+@[^@]+$/.test(url)) {
             return '<mailto:' + url + '>';
         }
-
         return '<http://' + url + '>';
     }
 }
-
-module.exports = MailMessage;

package/dist/node_modules/nodemailer/dist/esm/mime-funcs/index.d.ts

@@ -0,0 +1,161 @@
+/**
+ * A header value split into the value token and its parameters, the result of parseHeaderValue
+ */
+export interface ParsedHeaderValue {
+    /** The value ahead of the parameters, for example the content type, an empty string when there is none */
+    value: string;
+    /** Parameter values keyed by lowercase parameter name */
+    params: Record<string, string>;
+}
+/**
+ * Header value structure accepted by buildHeaderValue
+ */
+export interface StructuredHeaderValue {
+    /** The value ahead of the parameters, for example the content type */
+    value: string | false;
+    /** Parameter values keyed by parameter name */
+    params?: Record<string, string> | undefined;
+}
+/**
+ * A single key=value pair of an rfc2231 encoded header parameter
+ */
+export interface EncodedHeaderParam {
+    /** Parameter name with the continuation suffix, for example title*0* */
+    key: string;
+    /** Parameter value of this part */
+    value: string;
+}
+/** The names @types/nodemailer used for the two types above */
+export type HeaderValue = StructuredHeaderValue;
+export type ParsedHeaderParam = EncodedHeaderParam;
+/**
+ * Checks if a value is plaintext string (uses only printable 7bit chars)
+ *
+ * When isParam is set the value is destined for a header parameter, so HT, CR and LF
+ * are not plaintext either: a header parameter has no way to carry them. HT is a valid
+ * fold point, so folding and unfolding a header would rewrite it as a space, and CR/LF
+ * cannot appear in a header value at all. DEL is neither a token character nor qtext,
+ * so it can not be carried bare or quoted. Such values have to go through the rfc2231
+ * parameter continuation encoding instead, the same way a quote already does.
+ *
+ * @param value String to be tested
+ * @param [isParam] Set to true if the value is a header parameter value
+ * @returns true if it is a plaintext string
+ */
+export declare function isPlainText(value: unknown, isParam?: boolean): boolean;
+/**
+ * Wraps a value into a quoted-string. Inside one a quote would end the string early
+ * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
+ *
+ * @param value String to be quoted
+ * @returns The value as a quoted-string, quotes included
+ */
+export declare function quoteString(value?: string): string;
+/**
+ * Checks if a multi line string containes lines longer than the selected value.
+ *
+ * Useful when detecting if a mail message needs any processing at all:
+ * if only plaintext characters are used and lines are short, then there is
+ * no need to encode the values in any way. If the value is plaintext but has
+ * longer lines then allowed, then use format=flowed
+ *
+ * @param str Multi line string to check
+ * @param lineLength Max line length to check for
+ * @returns Returns true if there is at least one line longer than lineLength chars
+ */
+export declare function hasLongerLines(str: string, lineLength: number): boolean;
+/**
+ * Encodes a string or an Buffer to an UTF-8 MIME Word (rfc2047)
+ *
+ * @param data String to be encoded
+ * @param mimeWordEncoding='Q' Encoding for the mime word, either Q or B
+ * @param [maxLength=0] If set, split mime words into several chunks if needed
+ * @return Single or several mime words joined together
+ */
+export declare function encodeWord(data: string | Buffer, mimeWordEncoding?: string, maxLength?: number): string;
+/**
+ * Finds word sequences with non ascii text and converts these to mime words
+ *
+ * @param value String to be encoded
+ * @param mimeWordEncoding='Q' Encoding for the mime word, either Q or B
+ * @param [maxLength=0] If set, split mime words into several chunks if needed
+ * @param [encodeAll=false] If true and the value needs encoding then encodes entire string, not just the smallest match
+ * @return String with possible mime words
+ */
+export declare function encodeWords(value: string, mimeWordEncoding?: string, maxLength?: number, encodeAll?: boolean): string;
+/**
+ * Joins parsed header value together as 'value; param1=value1; param2=value2'
+ * PS: We are following RFC 822 for the list of special characters that we need to keep in quotes.
+ *      Refer: https://www.w3.org/Protocols/rfc1341/4_Content-Type.html
+ * @param structured Parsed header value
+ * @return joined header value
+ */
+export declare function buildHeaderValue(structured: StructuredHeaderValue): string;
+/**
+ * Encodes a string or an Buffer to an UTF-8 Parameter Value Continuation encoding (rfc2231)
+ * Useful for splitting long parameter values.
+ *
+ * For example
+ *      title="unicode string"
+ * becomes
+ *     title*0*=utf-8''unicode
+ *     title*1*=%20string
+ *
+ * @param key Parameter name the generated keys are built from, for example title
+ * @param data String to be encoded
+ * @param [maxLength=50] Max length for generated chunks
+ * @return A list of encoded keys and headers
+ */
+export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];
+/**
+ * Parses a header value with key=value arguments into a structured
+ * object.
+ *
+ *   parseHeaderValue('content-type: text/plain; CHARSET='UTF-8'') ->
+ *   {
+ *     'value': 'text/plain',
+ *     'params': {
+ *       'charset': 'UTF-8'
+ *     }
+ *   }
+ *
+ * @param str Header value
+ * @return Header value as a parsed structure
+ */
+export declare function parseHeaderValue(str: string): ParsedHeaderValue;
+/**
+ * Returns file extension for a content type string. If no suitable extensions
+ * are found, 'bin' is used as the default extension
+ *
+ * @param mimeType Content type to be checked for
+ * @return File extension
+ */
+export declare function detectExtension(mimeType?: string | false): string;
+/**
+ * Returns content type for a file extension. If no suitable content types
+ * are found, 'application/octet-stream' is used as the default content type
+ *
+ * @param extension Extension to be checked for
+ * @return File extension
+ */
+export declare function detectMimeType(extension?: string | false): string;
+/**
+ * Folds long lines, useful for folding header lines (afterSpace=false) and
+ * flowed text (afterSpace=true)
+ *
+ * @param str String to be folded
+ * @param [lineLength=76] Maximum length of a line
+ * @param afterSpace If true, leave a space in th end of a line
+ * @return String with folded lines
+ */
+export declare function foldLines(str: string, lineLength?: number, afterSpace?: boolean): string;
+/**
+ * Splits a mime encoded string. Needed for dividing mime words into smaller chunks
+ *
+ * @param str Mime encoded string to be split up
+ * @param maxlen Maximum length of characters for one part (minimum 12)
+ * @return Split string
+ */
+export declare function splitMimeEncodedString(str: string, maxlen?: number): string[];
+export declare function encodeURICharComponent(chr: string): string;
+export declare function safeEncodeURIComponent(str: string): string;