nodemailer 6.6.2 → 6.6.3

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 6.6.3 2021-07-14
+
+-   Do not show passwords in SMTP transaction logs. All passwords used in logging are replaced by `"/* secret */"`
+
 ## 6.6.1 2021-05-23
 
 -   Fixed address formatting issue where newlines in an email address, if provided via address object, were not properly removed. Reported by tmazeika (#1289)

package/lib/smtp-connection/index.js

@@ -548,6 +548,16 @@ class SMTPConnection extends EventEmitter {
                                 '\u0000' +
                                 this._auth.credentials.pass,
                             'utf-8'
+                        ).toString('base64'),
+                    // log entry without passwords
+                    'AUTH PLAIN ' +
+                        Buffer.from(
+                            //this._auth.user+'\u0000'+
+                            '\u0000' + // skip authorization identity as it causes problems with some servers
+                                this._auth.credentials.user +
+                                '\u0000' +
+                                '/* secret */',
+                            'utf-8'
                         ).toString('base64')
                 );
                 return;
@@ -945,8 +955,9 @@ class SMTPConnection extends EventEmitter {
      * Send a command to the server, append \r\n
      *
      * @param {String} str String to be sent to the server
+     * @param {String} logStr Optional string to be used for logging instead of the actual string
      */
-    _sendCommand(str) {
+    _sendCommand(str, logStr) {
         if (this._destroyed) {
             // Connection already closed, can't send any more data
             return;
@@ -961,7 +972,7 @@ class SMTPConnection extends EventEmitter {
                 {
                     tnx: 'client'
                 },
-                (str || '').toString().replace(/\r?\n$/, '')
+                (logStr || str || '').toString().replace(/\r?\n$/, '')
             );
         }
 
@@ -1420,18 +1431,21 @@ class SMTPConnection extends EventEmitter {
 
         // Decode from base64
         let base64decoded = Buffer.from(challengeString, 'base64').toString('ascii'),
-            hmac_md5 = crypto.createHmac('md5', this._auth.credentials.pass);
+            hmacMD5 = crypto.createHmac('md5', this._auth.credentials.pass);
 
-        hmac_md5.update(base64decoded);
+        hmacMD5.update(base64decoded);
 
-        let hex_hmac = hmac_md5.digest('hex');
-        let prepended = this._auth.credentials.user + ' ' + hex_hmac;
+        let prepended = this._auth.credentials.user + ' ' + hmacMD5.digest('hex');
 
         this._responseActions.push(str => {
             this._actionAUTH_CRAM_MD5_PASS(str, callback);
         });
 
-        this._sendCommand(Buffer.from(prepended).toString('base64'));
+        this._sendCommand(
+            Buffer.from(prepended).toString('base64'),
+            // hidden hash for logs
+            Buffer.from(this._auth.credentials.user + ' /* secret */').toString('base64')
+        );
     }
 
     /**
@@ -1476,7 +1490,11 @@ class SMTPConnection extends EventEmitter {
             this._actionAUTHComplete(str, callback);
         });
 
-        this._sendCommand(Buffer.from(this._auth.credentials.pass + '', 'utf-8').toString('base64'));
+        this._sendCommand(
+            Buffer.from((this._auth.credentials.pass || '').toString(), 'utf-8').toString('base64'),
+            // Hidden pass for logs
+            Buffer.from('/* secret */', 'utf-8').toString('base64')
+        );
     }
 
     /**
@@ -1706,7 +1724,11 @@ class SMTPConnection extends EventEmitter {
             this._responseActions.push(str => {
                 this._actionAUTHComplete(str, isRetry, callback);
             });
-            this._sendCommand('AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken));
+            this._sendCommand(
+                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken),
+                //  Hidden for logs
+                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token('/* secret */')
+            );
         });
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "6.6.2",
+    "version": "6.6.3",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -20,6 +20,8 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
+        "@aws-sdk/client-ses": "3.21.0",
+        "aws-sdk": "2.945.0",
         "bunyan": "1.8.15",
         "chai": "4.3.4",
         "eslint-config-nodemailer": "1.2.0",
@@ -31,7 +33,7 @@
         "libbase64": "1.2.1",
         "libmime": "5.0.0",
         "libqp": "1.1.0",
-        "mocha": "9.0.0",
+        "mocha": "9.0.2",
         "nodemailer-ntlm-auth": "1.0.1",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",