mailparser 3.9.2 → 3.9.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.release-please-manifest.json +1 -1
- package/CHANGELOG.md +7 -0
- package/lib/mail-parser.js +5 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [3.9.3](https://github.com/nodemailer/mailparser/compare/v3.9.2...v3.9.3) (2026-01-28)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* escape URLs and link text in textToHtml to prevent XSS ([921a67d](https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08)), closes [#412](https://github.com/nodemailer/mailparser/issues/412)
|
|
9
|
+
|
|
3
10
|
## [3.9.2](https://github.com/nodemailer/mailparser/compare/v3.9.1...v3.9.2) (2026-01-28)
|
|
4
11
|
|
|
5
12
|
|
package/lib/mail-parser.js
CHANGED
|
@@ -1129,7 +1129,11 @@ class MailParser extends Transform {
|
|
|
1129
1129
|
result.push(textPart);
|
|
1130
1130
|
}
|
|
1131
1131
|
|
|
1132
|
-
|
|
1132
|
+
// Escape quotes in URL to prevent XSS
|
|
1133
|
+
let safeUrl = link.url.replace(/"/g, '"');
|
|
1134
|
+
// Escape HTML entities in link text
|
|
1135
|
+
let safeText = he.encode(link.text, { useNamedReferences: true });
|
|
1136
|
+
result.push(`<a href="${safeUrl}">${safeText}</a>`);
|
|
1133
1137
|
|
|
1134
1138
|
last = link.lastIndex;
|
|
1135
1139
|
});
|