nodemailer 10.0.2 → 10.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,12 @@
|
|
|
1
1
|
# CHANGELOG
|
|
2
2
|
|
|
3
|
+
## [10.0.3](https://github.com/nodemailer/nodemailer/compare/v10.0.2...v10.0.3) (2026-09-10)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Bug Fixes
|
|
7
|
+
|
|
8
|
+
* **fetch:** honor the cookie Domain attribute without accepting public suffixes ([1608391](https://github.com/nodemailer/nodemailer/commit/1608391ff4ccd5422a88e4cf760b26068aad6d39)), closes [#1856](https://github.com/nodemailer/nodemailer/issues/1856)
|
|
9
|
+
|
|
3
10
|
## [10.0.2](https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2) (2026-09-09)
|
|
4
11
|
|
|
5
12
|
|
|
@@ -33,7 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
|
|
|
33
33
|
return result;
|
|
34
34
|
};
|
|
35
35
|
})();
|
|
36
|
+
var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
37
|
+
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
38
|
+
};
|
|
36
39
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
40
|
+
const node_net_1 = __importDefault(require("node:net"));
|
|
37
41
|
const urllib = __importStar(require("../shared/url.js"));
|
|
38
42
|
const SESSION_TIMEOUT = 1800; // 30 min
|
|
39
43
|
/**
|
|
@@ -59,12 +63,19 @@ class Cookies {
|
|
|
59
63
|
let domain;
|
|
60
64
|
if (cookie.domain) {
|
|
61
65
|
domain = cookie.domain.replace(/^\./, '');
|
|
62
|
-
// do not allow cross origin cookies
|
|
66
|
+
// do not allow cross origin cookies. There is no public suffix list here, so a
|
|
67
|
+
// multi-label suffix like 'co.uk' can not be told apart from a registrable domain
|
|
63
68
|
if (
|
|
64
69
|
// can't be valid if the requested domain is shorter than current hostname
|
|
65
70
|
urlparts.hostname.length < domain.length ||
|
|
71
|
+
// a top level domain is not a valid scope, 'Domain=com' would otherwise be
|
|
72
|
+
// sent to every .com host. A trailing dot does not make 'com.' any better
|
|
73
|
+
domain.indexOf('.') < 0 ||
|
|
74
|
+
domain.endsWith('.') ||
|
|
75
|
+
// an IP address has no subdomains, so cookies set on it stay host-only
|
|
76
|
+
node_net_1.default.isIP(urlparts.hostname) ||
|
|
66
77
|
// prefix domains with dot to be sure that partial matches are not used
|
|
67
|
-
('.' + urlparts.hostname).
|
|
78
|
+
!('.' + urlparts.hostname).endsWith('.' + domain)) {
|
|
68
79
|
cookie.domain = urlparts.hostname;
|
|
69
80
|
}
|
|
70
81
|
}
|
package/dist/cjs/package-info.js
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
// module to handle cookies
|
|
2
|
+
import net from 'node:net';
|
|
2
3
|
import * as urllib from '../shared/url.js';
|
|
3
4
|
const SESSION_TIMEOUT = 1800; // 30 min
|
|
4
5
|
/**
|
|
@@ -24,12 +25,19 @@ export default class Cookies {
|
|
|
24
25
|
let domain;
|
|
25
26
|
if (cookie.domain) {
|
|
26
27
|
domain = cookie.domain.replace(/^\./, '');
|
|
27
|
-
// do not allow cross origin cookies
|
|
28
|
+
// do not allow cross origin cookies. There is no public suffix list here, so a
|
|
29
|
+
// multi-label suffix like 'co.uk' can not be told apart from a registrable domain
|
|
28
30
|
if (
|
|
29
31
|
// can't be valid if the requested domain is shorter than current hostname
|
|
30
32
|
urlparts.hostname.length < domain.length ||
|
|
33
|
+
// a top level domain is not a valid scope, 'Domain=com' would otherwise be
|
|
34
|
+
// sent to every .com host. A trailing dot does not make 'com.' any better
|
|
35
|
+
domain.indexOf('.') < 0 ||
|
|
36
|
+
domain.endsWith('.') ||
|
|
37
|
+
// an IP address has no subdomains, so cookies set on it stay host-only
|
|
38
|
+
net.isIP(urlparts.hostname) ||
|
|
31
39
|
// prefix domains with dot to be sure that partial matches are not used
|
|
32
|
-
('.' + urlparts.hostname).
|
|
40
|
+
!('.' + urlparts.hostname).endsWith('.' + domain)) {
|
|
33
41
|
cookie.domain = urlparts.hostname;
|
|
34
42
|
}
|
|
35
43
|
}
|
package/dist/esm/package-info.js
CHANGED