nodemailer 10.1.2 → 10.1.4

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.2';
+exports.version = '10.1.4';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/shared/url.js

@@ -58,10 +58,27 @@ const punycode = __importStar(require("../punycode/index.js"));
 // Matches a "scheme:" not followed by "//" (and with something after it), used
 // to re-insert the authority separator the legacy parser did not require.
 const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
-// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
-// looks at the input. Stripped up front so that the slash-less form is recognized in a
-// value read from a file with a trailing newline as well.
-const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+/**
+ * Drops the leading and trailing C0 controls and spaces, which the WHATWG parser strips
+ * before it looks at the input. Stripped up front so that the slash-less form is recognized
+ * in a value read from a file with a trailing newline as well. An index scan, the regex
+ * /^[\x00-\x20]+|[\x00-\x20]+$/g retried a run of spaces inside the value from every
+ * position in it
+ *
+ * @param input URL string
+ * @returns The string without the surrounding controls and spaces
+ */
+function stripSurroundingWhitespace(input) {
+    let start = 0;
+    let end = input.length;
+    while (start < end && input.charCodeAt(start) <= 0x20) {
+        start++;
+    }
+    while (end > start && input.charCodeAt(end - 1) <= 0x20) {
+        end--;
+    }
+    return input.slice(start, end);
+}
 // Leading characters legacy url.parse() skips before it reads the scheme
 const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
 // The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
@@ -156,7 +173,7 @@ function normalizeHostname(raw, href) {
     return mapped;
 }
 const parse = (input, parseQueryString) => {
-    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    input = stripSurroundingWhitespace(input || '');
     // Legacy url.parse() parses a "user:pass@host:port" authority that follows
     // the scheme even without the "//" separator, for schemes outside its
     // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG

package/dist/esm/addressparser/index.js

@@ -1,3 +1,19 @@
+/**
+ * A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
+ * in front of the literal is the one that splits the domain off, not the last one: reading
+ * 'a@[x@evil.com]' at its last '@' made it an address at evil.com.
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Offset of the '@' that splits the domain off an address, or -1 when there is none
+ *
+ * @param address Address to split
+ * @return Offset of the '@'
+ */
+function _domainAt(address) {
+    const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+    return literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
+}
 /**
  * Restores the quoting of a local part that was read out of a quoted string.
  *
@@ -16,7 +32,7 @@
  * @return Address with the local part as a quoted-string
  */
 function _quoteLocalPart(address) {
-    const lastAt = address.lastIndexOf('@');
+    const lastAt = _domainAt(address);
     if (lastAt < 0) {
         // no domain to split off, nothing can be misrouted
         return address;
@@ -42,6 +58,23 @@ const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
  * One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
  */
 const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
+/**
+ * The same with a domain literal for the domain, which may hold an '@' of its own.
+ */
+const LITERAL_ADDR_SPEC = /^[^@\s]+@\[[^[\]\\\s]*\]$/;
+/**
+ * The '@' and domain that follow a quoted local part in the same run.
+ */
+const QUOTED_LOCAL_DOMAIN = /^@(?:[^@\s"]+|\[[^[\]\\\s]*\])$/;
+/**
+ * Whether a whitespace free run reads as an addr-spec under the strict grammar
+ *
+ * @param value Run to check
+ * @return true when it does
+ */
+function _isAddrSpec(value) {
+    return ADDR_SPEC.test(value) || LITERAL_ADDR_SPEC.test(value);
+}
 /**
  * The looser reading applied once the strict one finds nothing, which tolerates the
  * further '@' that a domain should not have but malformed headers carry anyway.
@@ -108,6 +141,62 @@ function _indexOfAt(text, from, to) {
     }
     return -1;
 }
+/**
+ * A quoted-string a value opens with.
+ */
+const LEADING_QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"/;
+/**
+ * Drops the whitespace on either side of the '@' at an offset.
+ *
+ * obs-local-part and obs-domain allow CFWS around the '@' (RFC 5322 4.4), so 'user @ good.com'
+ * names user@good.com. Kept, the whitespace went into the envelope as '"user "@ good.com'.
+ * The scan is by index, a pattern such as /\s+@/ backtracks over a long whitespace run that
+ * no '@' follows.
+ *
+ * @param value Value holding the '@'
+ * @param at Offset of the '@', or -1
+ * @return The value with the whitespace beside that '@' removed
+ */
+function _joinAtSpacing(value, at) {
+    if (at < 0) {
+        return value;
+    }
+    let start = at;
+    while (start > 0 && _isSpaceCode(value.charCodeAt(start - 1))) {
+        start--;
+    }
+    let end = at + 1;
+    while (end < value.length && _isSpaceCode(value.charCodeAt(end))) {
+        end++;
+    }
+    return start === at && end === at + 1 ? value : value.slice(0, start) + '@' + value.slice(end);
+}
+/**
+ * Drops the whitespace beside the '@' that splits the domain off a value. That is the '@'
+ * right after a quoted local part the value opens with, or else the only '@' it holds outside
+ * any quoted string. With several it is not clear which one the whitespace belongs to, and
+ * '<x@evil.com @good.com>' is left to the addr-spec recovery to read as it always has.
+ *
+ * @param value Value to clean up
+ * @return The value with the whitespace beside that '@' removed
+ */
+function _collapseAtSpacing(value) {
+    const quoted = LEADING_QUOTED_STRING.exec(value);
+    if (quoted) {
+        let at = quoted[0].length;
+        while (at < value.length && _isSpaceCode(value.charCodeAt(at))) {
+            at++;
+        }
+        if (value.charAt(at) === '@' && value.indexOf('@', at + 1) < 0) {
+            return _joinAtSpacing(value, at);
+        }
+    }
+    const at = value.indexOf('@');
+    if (at < 0 || value.indexOf('@', at + 1) >= 0 || value.lastIndexOf('"') > at) {
+        return value;
+    }
+    return _joinAtSpacing(value, at);
+}
 /**
  * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
  *
@@ -197,6 +286,7 @@ function _looseAddressStart(text) {
  * @param data Collected address parts, mutated in place
  */
 function _recoverAddrSpec(data) {
+    data.address = _collapseAtSpacing(data.address);
     if (!HAS_WHITESPACE.test(data.address)) {
         return;
     }
@@ -223,7 +313,7 @@ function _recoverAddrSpec(data) {
             return;
         }
         const parts = data.address.split(/\s+/);
-        let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
+        let addrIndex = parts.findIndex(_isAddrSpec);
         if (addrIndex < 0) {
             addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
         }
@@ -250,6 +340,15 @@ function _recoverAddrSpec(data) {
  * A comment is folding whitespace, so it is read as a space that splits two atoms and as
  * nothing next to an '@', the same rule the token walk applies outside the brackets. Quoted
  * strings and domain literals are copied through untouched, a '(' in there is not a comment.
+ * An unexpected '<' outside them drops everything in front of it, comments included.
+ *
+ * RFC 822 also let an angle-addr name the relays to go through in front of the mailbox,
+ * '<@relay1,@relay2:user@example.com>', which RFC 5322 still parses as obs-route. The route
+ * is not part of the mailbox, and folded into the local part it made
+ * '"@relay1,@relay2:user"@example.com' a recipient that does not exist. A local part can not
+ * start with '@', so contents that do, up to the first ':' outside a domain literal and in
+ * front of any quoted string, are a route and are dropped, as long as a mailbox with an '@'
+ * of its own follows.
  *
  * @param address Contents of the angle brackets
  * @return The address with the comments removed, and the text of the comments
@@ -263,6 +362,16 @@ function _stripAddressComments(address) {
     // carried along rather than read back off the growing result, which would flatten it on
     // every comment (see lastChars in _handleAddress)
     let lastChar = '';
+    // A comment that just closed stands for a space, written once the next character shows
+    // whether one is wanted: not beside an '@', and not on top of whitespace that follows.
+    // Deciding on the spot saw only the character right after the ')', so a second comment
+    // in a row hid the '@' behind it and 'a(x)(y)@b' read as 'a @b'
+    let pendingSpace = false;
+    // first character of the result and whether a quoted string has opened since, which
+    // together tell a route from a local part
+    let firstChar = '';
+    let quoteSeen = false;
+    let routeEnd = -1;
     for (let i = 0, len = address.length; i < len; i++) {
         const chr = address.charAt(i);
         if (depth) {
@@ -276,16 +385,20 @@ function _stripAddressComments(address) {
             else if (chr === ')' && !--depth) {
                 comments.push(comment.trim());
                 comment = '';
-                if (lastChar !== '@' && address.charAt(i + 1) !== '@') {
-                    result += ' ';
-                    lastChar = ' ';
-                }
+                pendingSpace = lastChar !== '@';
             }
             else {
                 comment += chr;
             }
             continue;
         }
+        if (pendingSpace && chr !== '(') {
+            pendingSpace = false;
+            if (chr !== '@' && chr !== '<' && !_isSpaceCode(address.charCodeAt(i))) {
+                result += ' ';
+                lastChar = ' ';
+            }
+        }
         if (closer) {
             if (chr === '\\' && closer === '"' && i < len - 1) {
                 result += chr + address.charAt(++i);
@@ -298,6 +411,10 @@ function _stripAddressComments(address) {
         }
         else if (chr === '"') {
             closer = '"';
+            quoteSeen = true;
+        }
+        else if (chr === ':' && routeEnd < 0 && firstChar === '@' && !quoteSeen) {
+            routeEnd = result.length + 1;
         }
         else if (chr === '[') {
             closer = ']';
@@ -306,8 +423,27 @@ function _stripAddressComments(address) {
             depth = 1;
             continue;
         }
+        else if (chr === '<') {
+            // Apple Mail drops everything between an unexpected '<' and the address after it.
+            // Read here rather than off the raw brackets so that a '<' inside a quoted string,
+            // a comment or a domain literal stays where it is: '<"a<b"@victim.com>' cut at
+            // the first '<' left the address 'b"@victim.com'
+            result = '';
+            lastChar = '';
+            comments.length = 0;
+            firstChar = '';
+            quoteSeen = false;
+            routeEnd = -1;
+            continue;
+        }
         result += chr;
         lastChar = chr;
+        if (!firstChar && !_isSpaceCode(address.charCodeAt(i))) {
+            firstChar = chr;
+        }
+    }
+    if (routeEnd >= 0 && result.indexOf('@', routeEnd) >= 0) {
+        result = result.slice(routeEnd);
     }
     if (depth) {
         // an unterminated comment runs to the end of the address
@@ -331,9 +467,13 @@ function _handleAddress(tokens, depth) {
         comment: [],
         group: [],
         text: [],
-        textWasQuoted: []
+        textWasQuoted: [],
+        quotedLocalAt: []
     };
     let insideQuotes = false;
+    // whether the last text run holds nothing but quoted text so far, which is what a quoted
+    // local part is until the '@' after it joins the run
+    let lastTextPureQuoted = false;
     // Last character of the run each state is currently accumulating. Reading it back off
     // the accumulator with slice(-1) makes the engine flatten the whole growing string on
     // every token, which is quadratic over an address built from many comment-joined atoms
@@ -383,11 +523,6 @@ function _handleAddress(tokens, depth) {
                 !!prevToken.noBreak &&
                 prevPrevToken?.type === 'operator' &&
                 prevPrevToken.value === '"';
-            if (state === 'address') {
-                // Handle unquoted name that includes a "<".
-                // Apple Mail truncates everything between an unexpected < and an address.
-                token.value = token.value.replace(/^[^<]*<\s*/, '');
-            }
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
@@ -398,12 +533,19 @@ function _handleAddress(tokens, depth) {
                 parts.length &&
                 (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
-                data[state][data[state].length - 1] += token.value;
+                const last = data[state].length - 1;
+                if (state === 'text' && !insideQuotes) {
+                    if (lastTextPureQuoted && token.value.charAt(0) === '@') {
+                        data.quotedLocalAt[last] = data.text[last].length;
+                    }
+                    lastTextPureQuoted = false;
+                }
+                data[state][last] += token.value;
                 if (token.value) {
                     lastChars[state] = token.value.charAt(token.value.length - 1);
                 }
                 if (state === 'text' && insideQuotes) {
-                    data.textWasQuoted[data.textWasQuoted.length - 1] = true;
+                    data.textWasQuoted[last] = true;
                 }
             }
             else {
@@ -411,14 +553,21 @@ function _handleAddress(tokens, depth) {
                 lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
+                    // an empty quoted string leaves no text of its own, so the '@' opens the run
+                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && token.value.charAt(0) === '@' ? 0 : -1);
+                    lastTextPureQuoted = insideQuotes;
                 }
             }
         }
     }
-    // If there is no text but a comment, replace the two
+    // If there is no text but a comment, replace the two. A comment is never part of a
+    // mailbox, so text that came out of one only ever names it: reading an address out of it
+    // made '(a@evil.com)' a recipient where no conformant reading has a mailbox at all
+    let textFromComment = false;
     if (!data.text.length && data.comment.length) {
         data.text = data.comment;
         data.comment = [];
+        textFromComment = true;
     }
     if (isGroup) {
         // http://tools.ietf.org/html/rfc2822#appendix-A.1.3
@@ -447,10 +596,6 @@ function _handleAddress(tokens, depth) {
         const addressComments = [];
         const addressParts = [];
         for (const part of data.address) {
-            if (part.indexOf('(') < 0) {
-                addressParts.push(part);
-                continue;
-            }
             const stripped = _stripAddressComments(part);
             for (const comment of stripped.comments) {
                 addressComments.push(comment);
@@ -461,25 +606,42 @@ function _handleAddress(tokens, depth) {
         }
         data.address = addressParts;
         // If no address was found, try to detect one from regular text
-        if (!data.address.length && data.text.length) {
-            for (let i = data.text.length - 1; i >= 0; i--) {
+        if (!data.address.length && data.text.length && !textFromComment) {
+            // Whitespace beside the '@' is CFWS, so 'user @ good.com' is read as one run. Both
+            // tiers read the collapsed runs, and only a run an address comes out of is replaced
+            // by its collapsed form, the display text keeps its spacing
+            const candidates = data.text.map((part) => _collapseAtSpacing(part));
+            // The first addr-spec in the text is the mailbox, as it is for a conformant parser
+            // reading as far as it can. Taking the last one let a comment part two of them and
+            // pick the second, 'user@good.com (x) evil@evil.com' went to evil.com, while the
+            // same two without the comment, one run, went to good.com
+            for (let i = 0; i < data.text.length; i++) {
                 // Security: Do not extract email addresses from quoted strings.
                 // RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
                 // Extracting emails from quoted text leads to misrouting vulnerabilities.
-                if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
-                    data.address = data.text.splice(i, 1);
+                // A run that is a quoted local part with its '@' and domain is an addr-spec of
+                // its own, with the quoting put back on, and takes its turn like any other
+                const local = data.quotedLocalAt[i];
+                const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
+                    ? _quoteLocalPart(data.text[i])
+                    : '';
+                if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
+                    data.address = [quotedLocal || candidates[i]];
+                    data.text.splice(i, 1);
                     data.textWasQuoted.splice(i, 1);
+                    data.quotedLocalAt.splice(i, 1);
                     break;
                 }
             }
             // Try a looser regex match if strict match found nothing
             if (!data.address.length) {
                 let extracted = false;
-                for (let i = data.text.length - 1; i >= 0; i--) {
+                for (let i = 0; i < data.text.length; i++) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        const part = data.text[i];
-                        let remainder = part;
+                        // the strict tier found nothing, so it spliced nothing and the indexes still line up
+                        const part = candidates[i];
+                        let remainder = data.text[i];
                         const at = _looseAddressStart(part);
                         if (at >= 0) {
                             LOOSE_TEXT_ADDR.lastIndex = at;
@@ -528,16 +690,19 @@ function _handleAddress(tokens, depth) {
             // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
             // back first is what lets the recovery tell the whitespace an addr-spec may carry
             // from the wreckage trailing one, as only a quoted local part may hold whitespace
-            data.address = _quoteLocalPart(data.text);
+            // The quotes are gone at this point, so the '@' the domain splits off at is the
+            // last one, not the single one _collapseAtSpacing insists on
+            data.address = _quoteLocalPart(_joinAtSpacing(data.text, _domainAt(data.text)));
             data.text = '';
         }
         _recoverAddrSpec(data);
         // a comment names the mailbox only when nothing else does, as one outside the brackets
         if (!data.text && addressComments.length) {
             data.text = addressComments.join(' ');
+            textFromComment = true;
         }
         const address = {
-            address: data.address || data.text || '',
+            address: data.address || (textFromComment ? '' : data.text) || '',
             name: data.text || data.address || ''
         };
         if (address.address === address.name) {
@@ -567,6 +732,10 @@ class Tokenizer {
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
         this.list = [];
         /**
          * Operator tokens and which tokens are expected to end the sequence
@@ -633,10 +802,32 @@ class Tokenizer {
                 this.inDomainLiteral = false;
             }
         }
+        // The closer of an angle-addr or a group is only read outside the quoted strings,
+        // comments and domain literals it holds. Looking for nothing but the closer let a '>'
+        // inside a quoted local part end the angle-addr, '<"a@evil.com>"@good.com>' was read
+        // as an address at evil.com, and a ';' inside a quoted display name or a comment end
+        // the group and release the rest of that text as recipients. The characters are still
+        // collected as they are, the angle-addr and the group content are read again later
+        let nested = false;
+        if (this.operatorExpecting === '>' || this.operatorExpecting === ';') {
+            nested = this._trackInner(chr);
+        }
+        else if (this.operatorExpecting === ')' && !this.escaped) {
+            // Comments nest (RFC 5322 3.2.2). Ending one at the first ')' let the ')' of a
+            // nested comment close the outer one and released the rest of it, an address
+            // included, into the header
+            if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')' && this.innerComment) {
+                this.innerComment--;
+                nested = true;
+            }
+        }
         if (this.escaped) {
             // ignore next condition blocks
         }
-        else if (chr === this.operatorExpecting) {
+        else if (chr === this.operatorExpecting && !nested) {
             this.node = {
                 type: 'operator',
                 value: chr
@@ -652,6 +843,7 @@ class Tokenizer {
             }
             this.operatorExpecting = '';
             this.escaped = false;
+            this._resetInner();
             return;
         }
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
@@ -666,6 +858,7 @@ class Tokenizer {
             }
             this.operatorExpecting = this.operators[chr];
             this.escaped = false;
+            this._resetInner();
             return;
         }
         else if (['"', "'", ')'].includes(this.operatorExpecting) && chr === '\\') {
@@ -699,13 +892,86 @@ class Tokenizer {
         }
         this.escaped = false;
     }
+    /**
+     * Tracks the quoted strings, comments and domain literals inside an angle-addr or a
+     * group, which the closer of either must not be read from. A backslash escapes the next
+     * character inside a quoted string and a comment. A domain literal is only tracked in an
+     * angle-addr, where it opens right after an "@" and ends at the "]". dtext holds the list
+     * separators as well, and inside the brackets they never split the list anyway. In a group
+     * they do, so a literal is not tracked there and an unclosed "[" can not swallow the
+     * recipients after it.
+     *
+     * @param chr Character from the address field
+     * @return true while the character sits inside one of them, the one that closes it included
+     */
+    _trackInner(chr) {
+        if (this.innerEscaped) {
+            this.innerEscaped = false;
+            return true;
+        }
+        if (this.innerQuoted) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '"') {
+                this.innerQuoted = false;
+            }
+            return true;
+        }
+        if (this.innerComment) {
+            if (chr === '\\') {
+                this.innerEscaped = true;
+            }
+            else if (chr === '(') {
+                this.innerComment++;
+            }
+            else if (chr === ')') {
+                this.innerComment--;
+            }
+            return true;
+        }
+        if (this.innerLiteral) {
+            if (chr === ']') {
+                this.innerLiteral = false;
+            }
+            return true;
+        }
+        if (chr === '"') {
+            this.innerQuoted = true;
+            return true;
+        }
+        if (chr === '(') {
+            this.innerComment = 1;
+            return true;
+        }
+        if (chr === '[' && this.afterAt && this.operatorExpecting === '>') {
+            this.innerLiteral = true;
+            return true;
+        }
+        // afterAt is otherwise only kept outside the operators and is cleared when one opens
+        // or ends, so inside an angle-addr it serves the literal tracked here
+        if (!_isSpaceCode(chr.charCodeAt(0))) {
+            this.afterAt = chr === '@';
+        }
+        return false;
+    }
+    /**
+     * Forgets the nesting collected for the operator that just opened or ended
+     */
+    _resetInner() {
+        this.innerQuoted = false;
+        this.innerComment = 0;
+        this.innerLiteral = false;
+        this.innerEscaped = false;
+    }
 }
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
- * malicious input that could cause stack overflow.
+ * malicious input that could cause stack overflow. Every level parses what is left of the
+ * value once more, so the limit is also the factor a crafted header multiplies the parse by.
  */
-const MAX_NESTED_GROUP_DEPTH = 50;
+const MAX_NESTED_GROUP_DEPTH = 10;
 /**
  * Parses an address list, recursing into the groups it holds.
  *

package/dist/esm/mailer/mail-message.js

@@ -145,7 +145,10 @@ export default class MailMessage {
         const values = [data.html, data.text, data.watchHtml, data.amp, data.raw, data.icalEvent];
         for (const key of ['attachments', 'alternatives']) {
             if (Array.isArray(data[key])) {
-                values.push(...data[key]);
+                // one at a time, spreading a long enough list into the arguments throws
+                for (const entry of data[key]) {
+                    values.push(entry);
+                }
             }
         }
         for (const value of values) {