@tryghost/nodemailer 2.3.17 → 2.3.18

package/README.md

@@ -23,6 +23,11 @@ Provides pre-configured transport options for common transport services.
 
 4. `ses` - [Send via AWS SES](https://ghost.org/docs/config/#amazon-ses).
 
+- Set `region` explicitly (preferred), or use a legacy `ServiceUrl` containing an
+  `email`, `email-smtp`, `email-fips`, or `email-smtp-fips` hostname in the form
+  `<service>.<region>.amazonaws.com`, with or without an HTTP(S) URL scheme.
+- Defaults to `us-east-1` when no region is set and `ServiceUrl` is missing or invalid.
+
 5. `direct` - Attempt to connect directly to remote SMTP servers. This is the default and requires no configuration, but is more likely to be blocked by remote mail services.
 
 6. `stub` - For testing and development. Doesn't actually send mail.

package/lib/nodemailer.js

@@ -8,6 +8,28 @@ const messages = {
     unknownTransport: `Unknown mail transport: {transport}`,
 };
 
+function regionFromServiceUrl(serviceUrl) {
+    if (typeof serviceUrl !== 'string') {
+        return;
+    }
+
+    let url;
+    try {
+        const value = serviceUrl.trim();
+        const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(value);
+        url = new URL(hasScheme ? value : `https://${value}`);
+    } catch {
+        return;
+    }
+
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        return;
+    }
+
+    const result = /^email(?:-smtp)?(?:-fips)?\.([a-z0-9-]+)\.amazonaws\.com$/.exec(url.hostname);
+    return result && result[1];
+}
+
 /**
  * @param {String} transport
  * @param {Object} options
@@ -54,13 +76,9 @@ module.exports = function (transport, options = {}) {
         case 'ses':
             const { SESv2Client, SendEmailCommand } = require('@aws-sdk/client-sesv2');
 
-            // This keeps the legacy Ghost SES ServiceUrl parser compatible with
-            // existing config shapes; explicit `region` remains the preferred path.
-            // codeql[js/incomplete-hostname-regexp]
-            const pattern = /(.*)email(.*)\.(.*).amazonaws.com/i;
-            // codeql[js/polynomial-redos]
-            const result = pattern.exec(options.ServiceUrl);
-            const region = options.region || (result && result[3]) || 'us-east-1';
+            // Parse legacy ServiceUrl config without matching arbitrary URL contents.
+            const region =
+                options.region || regionFromServiceUrl(options.ServiceUrl) || 'us-east-1';
 
             const accessKeyId = options.accessKeyId || options.AWSAccessKeyID;
             const secretAccessKey = options.secretAccessKey || options.AWSSecretKey;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryghost/nodemailer",
-  "version": "2.3.17",
+  "version": "2.3.18",
   "license": "MIT",
   "author": "Ghost Foundation",
   "repository": {
@@ -18,8 +18,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-sesv2": "^3.1122.0",
-    "@tryghost/errors": "^3.4.2",
-    "@tryghost/tpl": "^2.3.16",
+    "@tryghost/errors": "^3.4.3",
+    "@tryghost/tpl": "^2.3.17",
     "nodemailer": "^10.0.0",
     "nodemailer-mailgun-transport": "^2.1.5",
     "nodemailer-stub-transport": "^1.1.0"
@@ -29,7 +29,7 @@
   },
   "scripts": {
     "dev": "echo \"Implement me!\"",
-    "test": "NODE_ENV=testing vitest run --coverage",
+    "test": "NODE_ENV=testing vitest run --config ../../vitest.config.ts --root . --coverage",
     "lint": "oxlint -c ../../.oxlintrc.json .",
     "posttest": "pnpm run lint"
   }