@upyo/core 0.5.3 → 0.5.4

package/dist/message.cjs

@@ -22,26 +22,28 @@ const require_attachment = require('./attachment.cjs');
 *                    addresses and `File` objects for attachments.
 * @returns A new {@link Message} object with all properties normalized and
 *          validated.
-* @throws {TypeError} When any email address string cannot be parsed or when
-*                     an attachment object is invalid.
+* @throws {TypeError} When any email address string cannot be parsed, when an
+*                     address or attachment carries a carriage return or line
+*                     feed that could forge header fields, or when an
+*                     attachment object is invalid.
 */
 function createMessage(constructor) {
-	const sender = typeof constructor.from === "string" ? require_address.parseAddress(constructor.from) ?? throwTypeError(`Invalid sender address: ${JSON.stringify(constructor.from)}`) : constructor.from;
+	const sender = checkAddress("sender", constructor.from);
 	return {
 		sender,
-		recipients: ensureArray(constructor.to).map((to) => typeof to === "string" ? require_address.parseAddress(to) ?? throwTypeError(`Invalid recipient address: ${JSON.stringify(to)}`) : to),
-		ccRecipients: ensureArray(constructor.cc).map((cc) => typeof cc === "string" ? require_address.parseAddress(cc) ?? throwTypeError(`Invalid CC address: ${JSON.stringify(cc)}`) : cc),
-		bccRecipients: ensureArray(constructor.bcc).map((bcc) => typeof bcc === "string" ? require_address.parseAddress(bcc) ?? throwTypeError(`Invalid BCC address: ${JSON.stringify(bcc)}`) : bcc),
-		replyRecipients: ensureArray(constructor.replyTo).map((replyTo) => typeof replyTo === "string" ? require_address.parseAddress(replyTo) ?? throwTypeError(`Invalid reply-to address: ${JSON.stringify(replyTo)}`) : replyTo),
+		recipients: ensureArray(constructor.to).map((to) => checkAddress("recipient", to)),
+		ccRecipients: ensureArray(constructor.cc).map((cc) => checkAddress("CC", cc)),
+		bccRecipients: ensureArray(constructor.bcc).map((bcc) => checkAddress("BCC", bcc)),
+		replyRecipients: ensureArray(constructor.replyTo).map((replyTo) => checkAddress("reply-to", replyTo)),
 		attachments: ensureArray(constructor.attachments).map((attachment) => {
-			if (attachment instanceof File) return {
+			if (attachment instanceof File) return checkAttachment({
 				inline: false,
 				filename: attachment.name,
 				content: attachment.arrayBuffer().then((b) => new Uint8Array(b)),
 				contentType: attachment.type == null || attachment.type === "" ? "application/octet-stream" : attachment.type,
 				contentId: `${crypto.randomUUID()}@${sender.address.replace(/^[^@]*@/, "")}`
-			};
-			else if (require_attachment.isAttachment(attachment)) return attachment;
+			});
+			else if (require_attachment.isAttachment(attachment)) return checkAttachment(attachment);
 			else throwTypeError(`Invalid attachment: ${JSON.stringify(attachment)}`);
 		}),
 		subject: constructor.subject,
@@ -55,6 +57,45 @@ function createMessage(constructor) {
 function throwTypeError(message) {
 	throw new TypeError(message);
 }
+/**
+* Normalizes an address and rejects one that could forge header fields.
+*
+* A transport that composes a message itself writes the address into a header
+* field as given, so a carriage return or line feed in it would end that field
+* and let the rest of the value appear as further fields.  The string form has
+* always been rejected by {@link parseAddress}; the object form used to pass
+* through unchecked.
+*
+* @param label How the address is described in the error message.
+* @param address The address, either an object or a string to parse.
+* @returns The normalized address.
+* @throws {TypeError} If the string cannot be parsed, or if the resulting
+* address contains a carriage return or line feed.
+*/
+function checkAddress(label, address) {
+	const parsed = typeof address === "string" ? require_address.parseAddress(address) ?? throwTypeError(`Invalid ${label} address: ${JSON.stringify(address)}`) : address;
+	if (/[\r\n]/.test(parsed.address)) throwTypeError(`Invalid ${label} address: ${JSON.stringify(parsed.address)}`);
+	return parsed;
+}
+/**
+* Rejects an attachment whose content type or content ID could forge header
+* fields.
+*
+* A transport that composes MIME itself writes both into the part headers as
+* given, so a carriage return or line feed in either would end that field and
+* let the rest of the value appear as further fields.  An uploaded file's
+* declared content type is routinely chosen by whoever uploaded it.
+*
+* @param attachment The attachment to check.
+* @returns The attachment, unchanged.
+* @throws {TypeError} If the content type or content ID contains a carriage
+* return or line feed.
+*/
+function checkAttachment(attachment) {
+	if (/[\r\n]/.test(attachment.contentType)) throwTypeError(`Invalid attachment content type: ${JSON.stringify(attachment.contentType)}`);
+	if (/[\r\n]/.test(attachment.contentId)) throwTypeError(`Invalid attachment content ID: ${JSON.stringify(attachment.contentId)}`);
+	return attachment;
+}
 function ensureArray(value) {
 	return Array.isArray(value) ? value : value == null ? [] : [value];
 }

package/dist/message.d.cts

@@ -239,8 +239,10 @@ interface MessageConstructor {
  *                    addresses and `File` objects for attachments.
  * @returns A new {@link Message} object with all properties normalized and
  *          validated.
- * @throws {TypeError} When any email address string cannot be parsed or when
- *                     an attachment object is invalid.
+ * @throws {TypeError} When any email address string cannot be parsed, when an
+ *                     address or attachment carries a carriage return or line
+ *                     feed that could forge header fields, or when an
+ *                     attachment object is invalid.
  */
 declare function createMessage(constructor: MessageConstructor): Message;
 //#endregion

package/dist/message.d.ts

@@ -239,8 +239,10 @@ interface MessageConstructor {
  *                    addresses and `File` objects for attachments.
  * @returns A new {@link Message} object with all properties normalized and
  *          validated.
- * @throws {TypeError} When any email address string cannot be parsed or when
- *                     an attachment object is invalid.
+ * @throws {TypeError} When any email address string cannot be parsed, when an
+ *                     address or attachment carries a carriage return or line
+ *                     feed that could forge header fields, or when an
+ *                     attachment object is invalid.
  */
 declare function createMessage(constructor: MessageConstructor): Message;
 //#endregion

package/dist/message.js

@@ -22,26 +22,28 @@ import { isAttachment } from "./attachment.js";
 *                    addresses and `File` objects for attachments.
 * @returns A new {@link Message} object with all properties normalized and
 *          validated.
-* @throws {TypeError} When any email address string cannot be parsed or when
-*                     an attachment object is invalid.
+* @throws {TypeError} When any email address string cannot be parsed, when an
+*                     address or attachment carries a carriage return or line
+*                     feed that could forge header fields, or when an
+*                     attachment object is invalid.
 */
 function createMessage(constructor) {
-	const sender = typeof constructor.from === "string" ? parseAddress(constructor.from) ?? throwTypeError(`Invalid sender address: ${JSON.stringify(constructor.from)}`) : constructor.from;
+	const sender = checkAddress("sender", constructor.from);
 	return {
 		sender,
-		recipients: ensureArray(constructor.to).map((to) => typeof to === "string" ? parseAddress(to) ?? throwTypeError(`Invalid recipient address: ${JSON.stringify(to)}`) : to),
-		ccRecipients: ensureArray(constructor.cc).map((cc) => typeof cc === "string" ? parseAddress(cc) ?? throwTypeError(`Invalid CC address: ${JSON.stringify(cc)}`) : cc),
-		bccRecipients: ensureArray(constructor.bcc).map((bcc) => typeof bcc === "string" ? parseAddress(bcc) ?? throwTypeError(`Invalid BCC address: ${JSON.stringify(bcc)}`) : bcc),
-		replyRecipients: ensureArray(constructor.replyTo).map((replyTo) => typeof replyTo === "string" ? parseAddress(replyTo) ?? throwTypeError(`Invalid reply-to address: ${JSON.stringify(replyTo)}`) : replyTo),
+		recipients: ensureArray(constructor.to).map((to) => checkAddress("recipient", to)),
+		ccRecipients: ensureArray(constructor.cc).map((cc) => checkAddress("CC", cc)),
+		bccRecipients: ensureArray(constructor.bcc).map((bcc) => checkAddress("BCC", bcc)),
+		replyRecipients: ensureArray(constructor.replyTo).map((replyTo) => checkAddress("reply-to", replyTo)),
 		attachments: ensureArray(constructor.attachments).map((attachment) => {
-			if (attachment instanceof File) return {
+			if (attachment instanceof File) return checkAttachment({
 				inline: false,
 				filename: attachment.name,
 				content: attachment.arrayBuffer().then((b) => new Uint8Array(b)),
 				contentType: attachment.type == null || attachment.type === "" ? "application/octet-stream" : attachment.type,
 				contentId: `${crypto.randomUUID()}@${sender.address.replace(/^[^@]*@/, "")}`
-			};
-			else if (isAttachment(attachment)) return attachment;
+			});
+			else if (isAttachment(attachment)) return checkAttachment(attachment);
 			else throwTypeError(`Invalid attachment: ${JSON.stringify(attachment)}`);
 		}),
 		subject: constructor.subject,
@@ -55,6 +57,45 @@ function createMessage(constructor) {
 function throwTypeError(message) {
 	throw new TypeError(message);
 }
+/**
+* Normalizes an address and rejects one that could forge header fields.
+*
+* A transport that composes a message itself writes the address into a header
+* field as given, so a carriage return or line feed in it would end that field
+* and let the rest of the value appear as further fields.  The string form has
+* always been rejected by {@link parseAddress}; the object form used to pass
+* through unchecked.
+*
+* @param label How the address is described in the error message.
+* @param address The address, either an object or a string to parse.
+* @returns The normalized address.
+* @throws {TypeError} If the string cannot be parsed, or if the resulting
+* address contains a carriage return or line feed.
+*/
+function checkAddress(label, address) {
+	const parsed = typeof address === "string" ? parseAddress(address) ?? throwTypeError(`Invalid ${label} address: ${JSON.stringify(address)}`) : address;
+	if (/[\r\n]/.test(parsed.address)) throwTypeError(`Invalid ${label} address: ${JSON.stringify(parsed.address)}`);
+	return parsed;
+}
+/**
+* Rejects an attachment whose content type or content ID could forge header
+* fields.
+*
+* A transport that composes MIME itself writes both into the part headers as
+* given, so a carriage return or line feed in either would end that field and
+* let the rest of the value appear as further fields.  An uploaded file's
+* declared content type is routinely chosen by whoever uploaded it.
+*
+* @param attachment The attachment to check.
+* @returns The attachment, unchanged.
+* @throws {TypeError} If the content type or content ID contains a carriage
+* return or line feed.
+*/
+function checkAttachment(attachment) {
+	if (/[\r\n]/.test(attachment.contentType)) throwTypeError(`Invalid attachment content type: ${JSON.stringify(attachment.contentType)}`);
+	if (/[\r\n]/.test(attachment.contentId)) throwTypeError(`Invalid attachment content ID: ${JSON.stringify(attachment.contentId)}`);
+	return attachment;
+}
 function ensureArray(value) {
 	return Array.isArray(value) ? value : value == null ? [] : [value];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upyo/core",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Simple email sending library for Node.js, Deno, Bun, and edge functions",
   "keywords": [
     "email",