alepha 0.21.2 → 0.23.0

package/dist/email/smtp/index.js

@@ -203,12 +203,12 @@ var require_cookies = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_package = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		"name": "nodemailer",
-		"version": "8.0.7",
+		"version": "8.0.10",
 		"description": "Easy as cake e-mail sending from your Node.js applications",
 		"main": "lib/nodemailer.js",
 		"scripts": {
-			"test": "node --test --test-concurrency=1 test/**/*.test.js test/**/*-test.js",
-			"test:coverage": "c8 node --test --test-concurrency=1 test/**/*.test.js test/**/*-test.js",
+			"test": "node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",
+			"test:coverage": "c8 node --test --test-concurrency=1 $(find test \\( -name '*-test.js' -o -name '*.test.js' \\))",
 			"format": "prettier --write \"**/*.{js,json,md}\"",
 			"format:check": "prettier --check \"**/*.{js,json,md}\"",
 			"lint": "eslint .",
@@ -490,6 +490,7 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const util$1 = __require("util");
 	const fs$2 = __require("fs");
 	const nmfetch = require_fetch();
+	const errors = require_errors();
 	const dns$1 = __require("dns");
 	const net$3 = __require("net");
 	const os$1 = __require("os");
@@ -695,7 +696,16 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports._logFunc = (logger, level, defaults, data, message, ...args) => {
 		const entry = Object.assign({}, defaults || {}, data || {});
 		delete entry.level;
-		logger[level](entry, message, ...args);
+		let logLevel = level;
+		if (typeof logger[logLevel] !== "function") logLevel = [
+			"info",
+			"debug",
+			"log",
+			"trace",
+			"warn",
+			"error"
+		].find((name) => typeof logger[name] === "function");
+		if (logLevel) logger[logLevel](entry, message, ...args);
 	};
 	/**
 	* Returns a bunyan-compatible logger interface. Uses either provided logger or
@@ -802,9 +812,15 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	*
 	* @param {Object} data An object or an Array you want to resolve an element for
 	* @param {String|Number} key Property name or an Array index
+	* @param {Object} [options] Optional access policy: { disableFileAccess, disableUrlAccess }
 	* @param {Function} callback Callback function with (err, value)
 	*/
-	module.exports.resolveContent = (data, key, callback) => {
+	module.exports.resolveContent = (data, key, options, callback) => {
+		if (!callback && typeof options === "function") {
+			callback = options;
+			options = false;
+		}
+		options = options || {};
 		let promise;
 		if (!callback) promise = new Promise((resolve, reject) => {
 			callback = module.exports.callbackPromise(resolve, reject);
@@ -819,12 +835,25 @@ var require_shared = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				else data[key] = value;
 				callback(null, value);
 			});
-			else if (/^https?:\/\//i.test(content.path || content.href)) return resolveStream(nmfetch(content.path || content.href), callback);
-			else if (/^data:/i.test(content.path || content.href)) {
+			else if (/^https?:\/\//i.test(content.path || content.href)) {
+				if (options.disableUrlAccess) return setImmediate(() => {
+					const err = /* @__PURE__ */ new Error("Url access rejected for " + (content.path || content.href));
+					err.code = errors.EURLACCESS;
+					callback(err);
+				});
+				return resolveStream(nmfetch(content.path || content.href), callback);
+			} else if (/^data:/i.test(content.path || content.href)) {
 				const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
 				if (!parsedDataUri || !parsedDataUri.data) return callback(null, Buffer.from(0));
 				return callback(null, parsedDataUri.data);
-			} else if (content.path) return resolveStream(fs$2.createReadStream(content.path), callback);
+			} else if (content.path) {
+				if (options.disableFileAccess) return setImmediate(() => {
+					const err = /* @__PURE__ */ new Error("File access rejected for " + content.path);
+					err.code = errors.EFILEACCESS;
+					callback(err);
+				});
+				return resolveStream(fs$2.createReadStream(content.path), callback);
+			}
 		}
 		if (typeof data[key].content === "string" && ![
 			"utf8",
@@ -3593,8 +3622,8 @@ var require_punycode = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		let k = 0;
 		delta = firstTime ? floor(delta / damp) : delta >> 1;
 		delta += floor(delta / numPoints);
-		for (; delta > baseMinusTMin * tMax >> 1; k += base) delta = floor(delta / baseMinusTMin);
-		return floor(k + (baseMinusTMin + 1) * delta / (delta + skew));
+		for (; delta > 455; k += base) delta = floor(delta / baseMinusTMin);
+		return floor(k + 36 * delta / (delta + skew));
 	};
 	/**
 	* Converts a Punycode string of ASCII-only symbols to a string of Unicode
@@ -4041,7 +4070,6 @@ var require_mime_funcs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			mimeWordEncoding = (mimeWordEncoding || "Q").toString().toUpperCase().trim().charAt(0);
 			maxLength = maxLength || 0;
 			let encodedStr;
-			const toCharset = "UTF-8";
 			if (maxLength && maxLength > 12) maxLength -= 12;
 			if (mimeWordEncoding === "Q") encodedStr = qp.encode(data).replace(/[^a-z0-9!*+\-/=]/gi, (chr) => {
 				const ord = chr.charCodeAt(0).toString(16).toUpperCase();
@@ -4052,7 +4080,7 @@ var require_mime_funcs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				encodedStr = typeof data === "string" ? data : base64.encode(data);
 				maxLength = maxLength ? Math.max(3, (maxLength - maxLength % 4) / 4 * 3) : 0;
 			}
-			if (maxLength && (mimeWordEncoding !== "B" ? encodedStr : base64.encode(data)).length > maxLength) if (mimeWordEncoding === "Q") encodedStr = this.splitMimeEncodedString(encodedStr, maxLength).join("?= =?" + toCharset + "?" + mimeWordEncoding + "?");
+			if (maxLength && (mimeWordEncoding !== "B" ? encodedStr : base64.encode(data)).length > maxLength) if (mimeWordEncoding === "Q") encodedStr = this.splitMimeEncodedString(encodedStr, maxLength).join("?= =?UTF-8?" + mimeWordEncoding + "?");
 			else {
 				const parts = [];
 				let lpart = "";
@@ -4066,11 +4094,11 @@ var require_mime_funcs = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					}
 				}
 				if (lpart) parts.push(base64.encode(lpart));
-				if (parts.length > 1) encodedStr = parts.join("?= =?" + toCharset + "?" + mimeWordEncoding + "?");
+				if (parts.length > 1) encodedStr = parts.join("?= =?UTF-8?" + mimeWordEncoding + "?");
 				else encodedStr = parts.join("");
 			}
 			else if (mimeWordEncoding === "B") encodedStr = base64.encode(data);
-			return "=?" + toCharset + "?" + mimeWordEncoding + "?" + encodedStr + (encodedStr.substr(-2) === "?=" ? "" : "?=");
+			return "=?UTF-8?" + mimeWordEncoding + "?" + encodedStr + (encodedStr.substr(-2) === "?=" ? "" : "?=");
 		},
 		/**
 		* Finds word sequences with non ascii text and converts these to mime words
@@ -6636,7 +6664,10 @@ var require_mail_message = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				if (pos >= keys.length) return callback(null, this.data);
 				const args = keys[pos++];
 				if (!args[0] || !args[0][args[1]]) return resolveNext();
-				shared.resolveContent(...args, (err, value) => {
+				shared.resolveContent(...args, {
+					disableFileAccess: this.data.disableFileAccess,
+					disableUrlAccess: this.data.disableUrlAccess
+				}, (err, value) => {
 					if (err) return callback(err);
 					const node = { content: value };
 					if (args[0][args[1]] && typeof args[0][args[1]] === "object" && !Buffer.isBuffer(args[0][args[1]])) Object.keys(args[0][args[1]]).forEach((key) => {
@@ -6747,12 +6778,12 @@ var require_mail_message = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 						if (typeof value === "string") value = { url: value };
 						if (value && value.url) {
 							if (key.toLowerCase().trim() === "id") {
-								let comment = value.comment || "";
+								let comment = (value.comment || "").toString().replace(/\r?\n|\r/g, " ");
 								if (mimeFuncs.isPlainText(comment)) comment = "\"" + comment + "\"";
 								else comment = mimeFuncs.encodeWord(comment);
 								return (value.comment ? comment + " " : "") + this._formatListUrl(value.url).replace(/^<[^:]+\/{,2}/, "");
 							}
-							let comment = value.comment || "";
+							let comment = (value.comment || "").toString().replace(/\r?\n|\r/g, " ");
 							if (!mimeFuncs.isPlainText(comment)) comment = mimeFuncs.encodeWord(comment);
 							return this._formatListUrl(value.url) + (value.comment ? " (" + comment + ")" : "");
 						}
@@ -7031,7 +7062,10 @@ var require_mailer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		_convertDataImages(mail, callback) {
 			if (!this.options.attachDataUrls && !mail.data.attachDataUrls || !mail.data.html) return callback();
-			mail.resolveContent(mail.data, "html", (err, html) => {
+			mail.resolveContent(mail.data, "html", {
+				disableFileAccess: mail.data.disableFileAccess,
+				disableUrlAccess: mail.data.disableUrlAccess
+			}, (err, html) => {
 				if (err) return callback(err);
 				let cidCounter = 0;
 				html = (html || "").toString().replace(/(<img\b[^<>]{0,1024} src\s{0,20}=[\s"']{0,20})(data:([^;]+);[^"'>\s]+)/gi, (match, prefix, dataUri, mimeType) => {
@@ -7308,6 +7342,12 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 			*/
 			this._closing = false;
 			/**
+			* Message DATA stream currently piped to the socket, if any. Tracked so
+			* close() can unpipe it before tearing the socket down.
+			* @private
+			*/
+			this._currentDataStream = false;
+			/**
 			* Callbacks for socket's listeners
 			*/
 			this._onSocketData = (chunk) => this._onData(chunk);
@@ -7480,6 +7520,12 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 			const closeMethod = this.stage === "init" ? "destroy" : "end";
 			this.logger.debug({ tnx: "smtp" }, "Closing connection to the server using \"%s\"", closeMethod);
 			const socket = this._socket && this._socket.socket || this._socket;
+			if (this._currentDataStream) {
+				try {
+					this._currentDataStream.unpipe(this._socket);
+				} catch (_E) {}
+				this._currentDataStream = false;
+			}
 			if (socket && !socket.destroyed) try {
 				socket.setTimeout(0);
 				socket.removeListener("data", this._onSocketData);
@@ -7776,7 +7822,7 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 		* @event
 		*/
 		_onEnd() {
-			if (this._socket && !this._socket.destroyed) this._socket.destroy();
+			if (this._socket && !this._socket.destroyed) this._socket.end();
 		}
 		/**
 		* 'timeout' listener for the socket
@@ -7809,18 +7855,22 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 				host: this.host
 			}, this.options.tls || {});
 			if (this.servername && !opts.servername) opts.servername = this.servername;
+			const removePlainSocketListeners = () => {
+				socketPlain.removeListener("close", this._onSocketClose);
+				socketPlain.removeListener("end", this._onSocketEnd);
+				socketPlain.removeListener("error", this._onSocketError);
+			};
 			this.upgrading = true;
 			try {
 				this._socket = tls.connect(opts, () => {
 					this.secure = true;
 					this.upgrading = false;
 					this._socket.on("data", this._onSocketData);
-					socketPlain.removeListener("close", this._onSocketClose);
-					socketPlain.removeListener("end", this._onSocketEnd);
-					socketPlain.removeListener("error", this._onSocketError);
+					removePlainSocketListeners();
 					return callback(null, true);
 				});
 			} catch (err) {
+				removePlainSocketListeners();
 				return callback(err);
 			}
 			this._socket.on("error", this._onSocketError);
@@ -7971,6 +8021,7 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 			else this._responseActions.push((str) => {
 				this._actionSMTPStream(str, callback);
 			});
+			this._currentDataStream = dataStream;
 			dataStream.pipe(this._socket, { end: false });
 			if (this.options.debug) {
 				const logStream = new PassThrough();
@@ -7981,6 +8032,7 @@ var require_smtp_connection = /* @__PURE__ */ __commonJSMin(((exports, module) =
 				dataStream.pipe(logStream);
 			}
 			dataStream.once("end", () => {
+				if (this._currentDataStream === dataStream) this._currentDataStream = false;
 				this.logger.info({
 					tnx: "message",
 					inByteCount: dataStream.inByteCount,
@@ -8403,6 +8455,7 @@ var require_xoauth2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @param {Number} options.expires Optional Access Token expire time in ms
 	* @param {Number} options.timeout Optional TTL for Access Token in seconds
 	* @param {Function} options.provisionCallback Function to run when a new access token is required
+	* @param {Object} options.tls Optional TLS options forwarded to the HTTPS token request. Defaults to strict cert validation; supply { rejectUnauthorized: false } only for self-hosted OAuth providers on private CAs.
 	*/
 	var XOAuth2 = class extends Stream {
 		constructor(options, logger) {
@@ -8647,12 +8700,14 @@ var require_xoauth2 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			let returned = false;
 			const chunks = [];
 			let chunklen = 0;
-			const req = nmfetch(url, {
+			const fetchOptions = {
 				method: "post",
 				headers: params.customHeaders,
 				body: payload,
 				allowErrorResponse: true
-			});
+			};
+			if (/^https:/i.test(url)) fetchOptions.tls = Object.assign({ rejectUnauthorized: true }, params.tls || {});
+			const req = nmfetch(url, fetchOptions);
 			req.on("readable", () => {
 				let chunk;
 				while ((chunk = req.read()) !== null) {
@@ -9960,9 +10015,15 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 					options = Object.assign(shared.assign(false, options), socketOptions);
 				}
 				const connection = new SMTPConnection(options);
+				let perCallAuth;
+				const cleanupPerCallAuth = () => {
+					if (perCallAuth && perCallAuth !== this.auth && perCallAuth.oauth2) perCallAuth.oauth2.removeAllListeners();
+					perCallAuth = null;
+				};
 				connection.once("error", (err) => {
 					if (returned) return;
 					returned = true;
+					cleanupPerCallAuth();
 					connection.close();
 					return callback(err);
 				});
@@ -9971,6 +10032,7 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 					const timer = setTimeout(() => {
 						if (returned) return;
 						returned = true;
+						cleanupPerCallAuth();
 						const err = /* @__PURE__ */ new Error("Unexpected socket close");
 						if (connection && connection._socket && connection._socket.upgrading) err.code = errors.ETLS;
 						callback(err);
@@ -9992,6 +10054,7 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 					}, "Sending message %s to <%s>", messageId, recipients.join(", "));
 					connection.send(envelope, mail.message.createReadStream(), (err, info) => {
 						returned = true;
+						cleanupPerCallAuth();
 						connection.close();
 						if (err) {
 							this.logger.error({
@@ -10017,9 +10080,9 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 				};
 				connection.connect(() => {
 					if (returned) return;
-					const auth = this.getAuth(mail.data.auth);
-					if (auth && (connection.allowsAuth || options.forceAuth)) connection.login(auth, (err) => {
-						if (auth && auth !== this.auth && auth.oauth2) auth.oauth2.removeAllListeners();
+					perCallAuth = this.getAuth(mail.data.auth);
+					if (perCallAuth && (connection.allowsAuth || options.forceAuth)) connection.login(perCallAuth, (err) => {
+						cleanupPerCallAuth();
 						if (returned) return;
 						if (err) {
 							returned = true;
@@ -10058,27 +10121,36 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 				}
 				const connection = new SMTPConnection(options);
 				let returned = false;
+				let perCallAuth;
+				const cleanupPerCallAuth = () => {
+					if (perCallAuth && perCallAuth !== this.auth && perCallAuth.oauth2) perCallAuth.oauth2.removeAllListeners();
+					perCallAuth = null;
+				};
 				connection.once("error", (err) => {
 					if (returned) return;
 					returned = true;
+					cleanupPerCallAuth();
 					connection.close();
 					return callback(err);
 				});
 				connection.once("end", () => {
 					if (returned) return;
 					returned = true;
+					cleanupPerCallAuth();
 					return callback(/* @__PURE__ */ new Error("Connection closed"));
 				});
 				const finalize = () => {
 					if (returned) return;
 					returned = true;
+					cleanupPerCallAuth();
 					connection.quit();
 					return callback(null, true);
 				};
 				connection.connect(() => {
 					if (returned) return;
-					const authData = this.getAuth({});
-					if (authData && (connection.allowsAuth || options.forceAuth)) connection.login(authData, (err) => {
+					perCallAuth = this.getAuth({});
+					if (perCallAuth && (connection.allowsAuth || options.forceAuth)) connection.login(perCallAuth, (err) => {
+						cleanupPerCallAuth();
 						if (returned) return;
 						if (err) {
 							returned = true;
@@ -10087,10 +10159,11 @@ var require_smtp_transport = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 						}
 						finalize();
 					});
-					else if (!authData && connection.allowsAuth && options.forceAuth) {
+					else if (!perCallAuth && connection.allowsAuth && options.forceAuth) {
 						const err = /* @__PURE__ */ new Error("Authentication info was not provided");
 						err.code = errors.ENOAUTH;
 						returned = true;
+						cleanupPerCallAuth();
 						connection.close();
 						return callback(err);
 					} else finalize();
@@ -10596,12 +10669,14 @@ var import_nodemailer = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin((
 			version: packageData.version
 		};
 		if (ETHEREAL_API_KEY) requestHeaders.Authorization = "Bearer " + ETHEREAL_API_KEY;
-		const req = nmfetch(apiUrl + "/user", {
+		const fetchOptions = {
 			contentType: "application/json",
 			method: "POST",
 			headers: requestHeaders,
 			body: Buffer.from(JSON.stringify(requestBody))
-		});
+		};
+		if (/^https:/i.test(apiUrl)) fetchOptions.tls = { rejectUnauthorized: true };
+		const req = nmfetch(apiUrl + "/user", fetchOptions);
 		req.on("readable", () => {
 			let chunk;
 			while ((chunk = req.read()) !== null) {