nodemailer 10.0.13 → 10.0.15

package/dist/cjs/smtp-connection/index.js

@@ -614,7 +614,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      *
      * @param envelope Envelope object, {from: addr, to: [addr]}
      * @param message String, Buffer or a Stream
-     * @param callback Callback to return once sending is completed
+     * @param done Callback to return once sending is completed
      */
     send(envelope, message, done) {
         // ensure that the callback is only called once. The public callback type has a
@@ -827,6 +827,8 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * @event
      * @param err Error object
      * @param type Error name
+     * @param data Server response that triggered the error, false if there is none
+     * @param command SMTP command that was in flight
      * @internal
      */
     _onError(err, type, data, command) {
@@ -1095,6 +1097,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      *        {from:'...', to:['...']}
      *        or
      *        {from:{address:'...',name:'...'}, to:[address:'...',name:'...']}
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _setEnvelope(envelope, callback) {
@@ -1489,6 +1492,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * hosts invalidly use a longer message than VXNlcm5hbWU6
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_LOGIN_USER(str, callback) {
@@ -1510,6 +1514,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * base64 encoded again.
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_CRAM_MD5(str, callback) {
@@ -1534,6 +1539,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * the user can be considered logged in. Start waiting for a message to send
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_CRAM_MD5_PASS(str, callback) {
@@ -1555,6 +1561,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * response needs to be base64 encoded password.
      *
      * @param str Message from the server
+     * @param callback Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTH_LOGIN_PASS(str, callback) {
@@ -1574,6 +1581,8 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * the user can be considered logged in. Start waiting for a message to send
      *
      * @param str Message from the server
+     * @param isRetry True if this is a retry after a failed login, or the callback itself
+     * @param [callback] Callback to run once the authentication sequence completes
      * @internal
      */
     _actionAUTHComplete(str, isRetry, callback) {
@@ -1616,6 +1625,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a MAIL FROM: command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionMAIL(str, callback) {
@@ -1644,6 +1654,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a RCPT TO: command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionRCPT(str, callback) {
@@ -1695,6 +1706,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * Handle response for a DATA command
      *
      * @param str Message from the server
+     * @param callback Callback to run once the envelope is processed
      * @internal
      */
     _actionDATA(str, callback) {
@@ -1721,6 +1733,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * We expect a single response that defines if the sending succeeded or failed
      *
      * @param str Message from the server
+     * @param callback Callback to run with the final send result
      * @internal
      */
     _actionSMTPStream(str, callback) {
@@ -1737,6 +1750,7 @@ class SMTPConnection extends node_events_1.EventEmitter {
      * @param recipient The recipient this response applies to
      * @param final Is this the final recipient?
      * @param str Message from the server
+     * @param callback Callback to run with the final send result
      * @internal
      */
     _actionLMTPStream(recipient, final, str, callback) {

package/dist/cjs/smtp-pool/index.d.ts

@@ -110,9 +110,14 @@ declare class SMTPPool extends EventEmitter {
     /**
      * Verifies SMTP configuration
      *
-     * @param callback Callback function
+     * @returns Promise that resolves to true if the configuration is usable
      */
     verify(): Promise<true>;
+    /**
+     * Verifies SMTP configuration
+     *
+     * @param callback Callback function
+     */
     verify(callback: VerifyCallback): void;
 }
 /**

package/dist/cjs/smtp-transport/index.d.ts

@@ -125,9 +125,14 @@ declare class SMTPTransport extends EventEmitter {
     /**
      * Verifies SMTP configuration
      *
-     * @param callback Callback function
+     * @returns Promise that resolves to true if the configuration is usable
      */
     verify(): Promise<true>;
+    /**
+     * Verifies SMTP configuration
+     *
+     * @param callback Callback function
+     */
     verify(callback: VerifyCallback): void;
     /**
      * Releases resources

package/dist/cjs/well-known/services.js

@@ -314,6 +314,12 @@ exports.services = {
         "host": "mailosaur.io",
         "port": 25
     },
+    "MailSenpai": {
+        "description": "MailSenpai (SMTP Senpai, EU)",
+        "host": "relay.mailsenpai.com",
+        "port": 2525,
+        "secure": false
+    },
     "Mailtrap": {
         "description": "Mailtrap",
         "host": "live.smtp.mailtrap.io",

package/dist/esm/addressparser/index.d.ts

@@ -39,7 +39,6 @@ export type Address = MailboxAddress | GroupAddress;
  *
  * @param str Address field
  * @param options Optional options object
- * @param options._depth Internal recursion depth counter (do not set manually)
  * @return An array of address objects
  */
 declare function addressparser(str: string | null | undefined, options: AddressParserOptions & {

package/dist/esm/addressparser/index.js

@@ -426,7 +426,7 @@ function _handleAddress(tokens, depth) {
         // Parse group members, but flatten any nested groups (RFC 5322 doesn't allow nesting)
         let groupMembers = [];
         if (data.group.length) {
-            const parsedGroup = addressparser(data.group.join(','), { _depth: depth + 1 });
+            const parsedGroup = _parseAddressList(data.group.join(','), depth + 1);
             parsedGroup.forEach(member => {
                 if (member.group) {
                     groupMembers = groupMembers.concat(member.group);
@@ -513,7 +513,13 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
-        if (addressFromQuotedText && data.text) {
+        if (addressFromQuotedText && data.text.indexOf('@') >= 0) {
+            // A quoted run with no '@' in it is a display name and nothing else, so it stays
+            // where it is. Moving it over anyway made a comment the mailbox was read from:
+            // '"Display Name" <(a comment)>' handed on 'Display Name' as the address with the
+            // comment as the name, and a quoted name holding a ',' or a ';' became an address
+            // that reads as two recipients once a consumer writes it back into a header.
+            //
             // The mailbox is still sitting in the text, so it moves over here and is quoted
             // before the recovery below rather than after it. Anything else the text holds
             // came along with it: a comment ends the domain but leaves the atoms behind it in
@@ -560,6 +566,7 @@ class Tokenizer {
         this.node = null;
         this.escaped = false;
         this.inDomainLiteral = false;
+        this.afterAt = false;
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -603,17 +610,23 @@ class Tokenizer {
      * Checks if a character is an operator or text and acts accordingly
      *
      * @param chr Character from the address field
+     * @param nextChr Character following chr, null at the end of the field
      */
     checkChar(chr, nextChr) {
-        // Track RFC 5322 domain-literals ("[" *dtext "]"). Operator characters such
-        // as the ":" of an IPv6 address-literal (user@[IPv6:2001:db8::1]) are dtext
-        // and must not be treated as the group delimiter while inside the brackets.
-        // Quoted strings and comments are handled separately via operatorExpecting,
-        // so only enter this state when no operator is open. The list separators ","
-        // and ";" are the exception: they always end the literal (and split the
-        // address list) so that an unclosed "[" cannot swallow later recipients.
+        // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6
+        // address-literal (user@[IPv6:2001:db8::1]) is dtext and must not be treated as
+        // the group delimiter while inside the brackets. That is the only operator the
+        // literal hides: letting it hide the others as well meant a "[" could turn the
+        // comment, quoted string or angle-addr after it into text and pick a different
+        // mailbox, '[ ( ] <a@victim.com> ) <b@evil.com>' yielded a@victim.com where
+        // RFC 5322 reads b@evil.com. A "[" also only opens a literal right after the "@"
+        // of an addr-spec, so the group delimiter of a display name holding one stays
+        // intact. Quoted strings and comments are handled separately via
+        // operatorExpecting, so only enter this state when no operator is open. The list
+        // separators "," and ";" always end the literal (and split the address list) so
+        // that an unclosed "[" cannot swallow later recipients.
         if (!this.escaped && !this.operatorExpecting) {
-            if (!this.inDomainLiteral && chr === '[') {
+            if (!this.inDomainLiteral && chr === '[' && this.afterAt) {
                 this.inDomainLiteral = true;
             }
             else if (this.inDomainLiteral && (chr === ']' || chr === ',' || chr === ';')) {
@@ -633,17 +646,24 @@ class Tokenizer {
             }
             this.list.push(this.node);
             this.node = null;
+            if (chr !== ')') {
+                // a comment is folding whitespace, it does not part the "@" from the "["
+                this.afterAt = false;
+            }
             this.operatorExpecting = '';
             this.escaped = false;
             return;
         }
-        else if (!this.operatorExpecting && !this.inDomainLiteral && chr in this.operators) {
+        else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
             this.node = {
                 type: 'operator',
                 value: chr
             };
             this.list.push(this.node);
             this.node = null;
+            if (chr !== '(') {
+                this.afterAt = false;
+            }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
             return;
@@ -667,6 +687,11 @@ class Tokenizer {
         if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
             // skip command bytes
             this.node.value += chr;
+            // text inside a quoted string or a comment is not part of an addr-spec. Tracked
+            // as it goes rather than read back off the value (see lastChars in _handleAddress)
+            if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
+                this.afterAt = chr === '@';
+            }
         }
         this.escaped = false;
     }
@@ -677,9 +702,19 @@ class Tokenizer {
  * malicious input that could cause stack overflow.
  */
 const MAX_NESTED_GROUP_DEPTH = 50;
-function addressparser(str, options) {
-    options = options || {};
-    const depth = options._depth || 0;
+/**
+ * Parses an address list, recursing into the groups it holds.
+ *
+ * The depth is threaded through the calls rather than carried in an options object, so a
+ * caller supplied one can not seed it and lift the recursion limit: `{ _depth: -1e9 }`
+ * bought a billion levels of nesting and turned the guard below into the stack overflow it
+ * is there to prevent.
+ *
+ * @param str Address field
+ * @param depth Current recursion depth for nested group protection
+ * @return An array of address objects
+ */
+function _parseAddressList(str, depth) {
     // Prevent stack overflow from deeply nested groups (DoS protection)
     if (depth > MAX_NESTED_GROUP_DEPTH) {
         return [];
@@ -688,7 +723,7 @@ function addressparser(str, options) {
     const tokens = tokenizer.tokenize();
     const addresses = [];
     let address = [];
-    let parsedAddresses = [];
+    const parsedAddresses = [];
     tokens.forEach(token => {
         if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
             if (address.length) {
@@ -729,8 +764,11 @@ function addressparser(str, options) {
         }
     }
     mergedAddresses.reverse();
-    parsedAddresses = mergedAddresses;
-    if (options.flatten) {
+    return mergedAddresses;
+}
+function addressparser(str, options) {
+    const parsedAddresses = _parseAddressList(str, 0);
+    if (options?.flatten) {
         const flatAddresses = [];
         const walkAddressList = (list) => {
             list.forEach(entry => {

package/dist/esm/dkim/message-parser.js

@@ -1,4 +1,31 @@
 import { Transform } from 'node:stream';
+/**
+ * Drops the SP and HTAB from both ends of a field name.
+ *
+ * An index scan rather than `/^[ \t]+|[ \t]+$/g`, which retries the trailing branch at
+ * every offset of a blank run that is followed by other text: the run is consumed greedily,
+ * `$` fails, and the engine gives the characters back one at a time before moving on to
+ * start the same walk one offset further in. A field name carrying a 128 KiB run of spaces
+ * between two atoms took about 6.7 seconds to trim, and the cost grows with its square.
+ *
+ * Not `.trim()`, which takes the other Unicode spaces along: an NBSP in front of a field
+ * name would come off and select the name into the signed set, where the relaxed
+ * canonicalization in sign.ts deliberately leaves everything but SP and HTAB alone.
+ *
+ * @param str Field name to trim
+ * @return The field name without the surrounding SP and HTAB
+ */
+function _trimFieldName(str) {
+    let start = 0;
+    let end = str.length;
+    while (start < end && (str.charCodeAt(start) === 0x20 || str.charCodeAt(start) === 0x09)) {
+        start++;
+    }
+    while (end > start && (str.charCodeAt(end - 1) === 0x20 || str.charCodeAt(end - 1) === 0x09)) {
+        end--;
+    }
+    return str.slice(start, end);
+}
 /**
  * MessageParser instance is a transform stream that separates message headers
  * from the rest of the body. Headers are emitted with the 'headers' event. Message
@@ -141,10 +168,7 @@ class MessageParser extends Transform {
         return lines
             .filter(line => /[^ \t\r]/.test(line))
             .map(line => ({
-            key: line
-                .substr(0, line.indexOf(':'))
-                .replace(/^[ \t]+|[ \t]+$/g, '')
-                .toLowerCase(),
+            key: _trimFieldName(line.substr(0, line.indexOf(':'))).toLowerCase(),
             line
         }));
     }

package/dist/esm/dkim/sign.d.ts

@@ -36,6 +36,7 @@ export interface DKIMRelaxedHeaders {
  * Returns DKIM signature header line
  *
  * @param headers Parsed headers object from MessageParser
+ * @param hashAlgo Hash algorithm the body hash was calculated with, for example "sha256"
  * @param bodyHash Base64 encoded hash of the message
  * @param options DKIM options
  * @param options.domainName Domain name to be signed for

package/dist/esm/dkim/sign.js

@@ -14,6 +14,7 @@ function unsupportedHashAlgoError(hashAlgo) {
  * Returns DKIM signature header line
  *
  * @param headers Parsed headers object from MessageParser
+ * @param hashAlgo Hash algorithm the body hash was calculated with, for example "sha256"
  * @param bodyHash Base64 encoded hash of the message
  * @param options DKIM options
  * @param options.domainName Domain name to be signed for

package/dist/esm/errors.d.ts

@@ -65,11 +65,11 @@ export declare const EFETCH = "EFETCH";
  * An Error together with the properties Nodemailer attaches to the errors it
  * hands to callers. Every property is optional, the set that is present
  * depends on where the error originated. Socket level errors keep the errno
- * and syscall fields Node.js sets on them.
+ * and syscall fields Node.js sets on them. `code` (see ERROR_CODES) is
+ * inherited from ErrnoException, not redeclared, so it follows the
+ * consumer's @types/node.
  */
 export interface NodemailerError extends NodeJS.ErrnoException {
-    /** Nodemailer error code, see ERROR_CODES */
-    code?: string | undefined;
     /** SMTP command that was in flight when the server replied with an error */
     command?: string | undefined;
     /** Raw SMTP server response */

package/dist/esm/mailer/index.d.ts

@@ -193,9 +193,15 @@ declare class Mail<out T = SentMessageInfo, out D extends TransportOptions = Tra
      * Sends an email using the preselected transport object
      *
      * @param data E-data description
-     * @param callback Callback to run once the sending succeeded or failed
+     * @returns Promise that resolves with the result of the send
      */
     sendMail(data: SendMailOptions): Promise<T>;
+    /**
+     * Sends an email using the preselected transport object
+     *
+     * @param data E-data description
+     * @param callback Callback to run once the sending succeeded or failed
+     */
     sendMail(data: SendMailOptions, callback: SendMailCallback<T>): void;
     getVersionString(): string;
     /**

package/dist/esm/mime-funcs/index.d.ts

@@ -59,6 +59,7 @@ export declare function quoteString(value?: string): string;
  * no need to encode the values in any way. If the value is plaintext but has
  * longer lines then allowed, then use format=flowed
  *
+ * @param str Multi line string to check
  * @param lineLength Max line length to check for
  * @returns Returns true if there is at least one line longer than lineLength chars
  */
@@ -100,9 +101,9 @@ export declare function buildHeaderValue(structured: StructuredHeaderValue): str
  *     title*0*=utf-8''unicode
  *     title*1*=%20string
  *
+ * @param key Parameter name the generated keys are built from, for example title
  * @param data String to be encoded
  * @param [maxLength=50] Max length for generated chunks
- * @param [fromCharset='UTF-8'] Source sharacter set
  * @return A list of encoded keys and headers
  */
 export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];