nodemailer 6.6.2 → 6.7.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # CHANGELOG
 
+## 6.7.0 2021-10-11
+
+-   Updated DNS resolving logic. If there are multiple responses for a A/AAAA record, then loop these randomly instead of only caching the first one
+
+## 6.6.5 2021-09-23
+
+-   Replaced Object.values() and Array.flat() with polyfills to allow using Nodemailer in Node v6+
+
+## 6.6.4 2021-09-22
+
+-   Better compatibility with IPv6-only SMTP hosts (oxzi)
+-   Fix ses verify for sdk v3 (hannesvdvreken)
+-   Added SECURITY.txt for contact info
+
+## 6.6.3 2021-07-14
+
+-   Do not show passwords in SMTP transaction logs. All passwords used in logging are replaced by `"/* secret */"`
+
 ## 6.6.1 2021-05-23
 
 -   Fixed address formatting issue where newlines in an email address, if provided via address object, were not properly removed. Reported by tmazeika (#1289)

package/README.md

@@ -10,6 +10,8 @@ See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
 ## Having an issue?
 
+> Nodemailer supports all Node.js versions starting from Node.js@v6.0.0. Existing test suite does not support such old Node.js versions so all features are not actually tested. From time to time some regression bugs might occur because of this.
+
 #### First review the docs
 
 Documentation for Nodemailer can be found at [nodemailer.com](https://nodemailer.com/about/).

package/SECURITY.txt

@@ -0,0 +1,22 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+Contact: mailto:andris@reinman.eu
+Encryption: https://keys.openpgp.org/vks/v1/by-fingerprint/5D952A46E1D8C931F6364E01DC6C83F4D584D364
+Preferred-Languages: en, et
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAEBCAAdFiEEXZUqRuHYyTH2Nk4B3GyD9NWE02QFAmFDnUgACgkQ3GyD9NWE
+02RqUA/+MM3afmRYq874C7wp+uN6dTMCvUX5g5zqBZ2yKpFr46L+PYvM7o8TMm5h
+hmLT2I1zZmi+xezOL3zHFizaw0tKkZIz9cWl3Jrgs0FLp0zOsSz1xucp9Q2tYM/Q
+vbiP6ys0gbim4tkDGRmZOEiO23s0BuRnmHt7vZg210O+D105Yd8/Ohzbj6PSLBO5
+W1tA7Xw5t0FQ14NNH5+MKyDIKoCX12n0FmrC6qLTXeojf291UgKhCUPda3LIGTmx
+mTXz0y68149Mw+JikRCYP8HfGRY9eA4XZrYXF7Bl2T9OJpKD3JAH+69P3xBw19Gn
+Csaw3twu8P1bxoVGjY4KRrBOp68W8TwZYjWVWbqY6oV8hb/JfrMxa+kaSxRuloFs
+oL6+phrDSPTWdOj2LlEDBJbPOMeDFzIlsBBcJ/JHCEHTvlHl7LoWr3YuWce9PUwl
+4r3JUovvaeuJxLgC0vu3WCB3Jeocsl3SreqNkrVc1IjvkSomn3YGm5nCNAd/2F0V
+exCGRk/8wbkSjAY38GwQ8K/VuFsefWN3L9sVwIMAMu88KFCAN+GzVFiwvyIXehF5
+eogP9mIXzdQ5YReQjUjApOzGz54XnDyv9RJ3sdvMHosLP+IOg+0q5t9agWv6aqSR
+2HzCpiQnH/gmM5NS0AU4Koq/L7IBeLu1B8+61/+BiHgZJJmPdgU=
+=BUZr
+-----END PGP SIGNATURE-----

package/lib/ses-transport/index.js

@@ -321,7 +321,7 @@ class SESTransport extends EventEmitter {
             Destinations: ['invalid@invalid']
         };
         const cb = err => {
-            if (err && err.code !== 'InvalidParameterValue') {
+            if (err && (err.code || err.Code) !== 'InvalidParameterValue') {
                 return callback(err);
             }
             return callback(null, true);
@@ -335,6 +335,7 @@ class SESTransport extends EventEmitter {
 
         if (typeof ses.send === 'function' && aws.SendRawEmailCommand) {
             // v3 API
+            sesMessage.RawMessage.Data = Buffer.from(sesMessage.RawMessage.Data);
             ses.send(new aws.SendRawEmailCommand(sesMessage), cb);
         } else {
             // v2 API

package/lib/shared/index.js

@@ -8,10 +8,26 @@ const fs = require('fs');
 const fetch = require('../fetch');
 const dns = require('dns');
 const net = require('net');
+const os = require('os');
 
 const DNS_TTL = 5 * 60 * 1000;
 
+const networkInterfaces = (module.exports.networkInterfaces = os.networkInterfaces());
+
 const resolver = (family, hostname, callback) => {
+    const familySupported =
+        // crux that replaces Object.values(networkInterfaces) as Object.values is not supported in nodejs v6
+        Object.keys(networkInterfaces)
+            .map(key => networkInterfaces[key])
+            // crux that replaces .flat() as it is not supported in older Node versions (v10 and older)
+            .reduce((acc, val) => acc.concat(val), [])
+            .filter(i => !i.internal)
+            .filter(i => i.family === 'IPv' + family).length > 0;
+
+    if (!familySupported) {
+        return callback(null, []);
+    }
+
     dns['resolve' + family](hostname, (err, addresses) => {
         if (err) {
             switch (err.code) {
@@ -30,16 +46,45 @@ const resolver = (family, hostname, callback) => {
 };
 
 const dnsCache = (module.exports.dnsCache = new Map());
+
+const formatDNSValue = (value, extra) => {
+    if (!value) {
+        return Object.assign({}, extra || {});
+    }
+
+    return Object.assign(
+        {
+            servername: value.servername,
+            host:
+                !value.addresses || !value.addresses.length
+                    ? null
+                    : value.addresses.length === 1
+                    ? value.addresses[0]
+                    : value.addresses[Math.floor(Math.random() * value.addresses.length)]
+        },
+        extra || {}
+    );
+};
+
 module.exports.resolveHostname = (options, callback) => {
     options = options || {};
 
+    if (!options.host && options.servername) {
+        options.host = options.servername;
+    }
+
     if (!options.host || net.isIP(options.host)) {
         // nothing to do here
         let value = {
-            host: options.host,
+            addresses: [options.host],
             servername: options.servername || false
         };
-        return callback(null, value);
+        return callback(
+            null,
+            formatDNSValue(value, {
+                cached: false
+            })
+        );
     }
 
     let cached;
@@ -47,11 +92,12 @@ module.exports.resolveHostname = (options, callback) => {
     if (dnsCache.has(options.host)) {
         cached = dnsCache.get(options.host);
         if (!cached.expires || cached.expires >= Date.now()) {
-            return callback(null, {
-                host: cached.value.host,
-                servername: cached.value.servername,
-                _cached: true
-            });
+            return callback(
+                null,
+                formatDNSValue(cached.value, {
+                    cached: true
+                })
+            );
         }
     }
 
@@ -59,40 +105,68 @@ module.exports.resolveHostname = (options, callback) => {
         if (err) {
             if (cached) {
                 // ignore error, use expired value
-                return callback(null, cached.value);
+                return callback(
+                    null,
+                    formatDNSValue(cached.value, {
+                        cached: true,
+                        error: err
+                    })
+                );
             }
             return callback(err);
         }
+
         if (addresses && addresses.length) {
             let value = {
-                host: addresses[0] || options.host,
+                addresses,
                 servername: options.servername || options.host
             };
+
             dnsCache.set(options.host, {
                 value,
                 expires: Date.now() + DNS_TTL
             });
-            return callback(null, value);
+
+            return callback(
+                null,
+                formatDNSValue(value, {
+                    cached: false
+                })
+            );
         }
 
         resolver(6, options.host, (err, addresses) => {
             if (err) {
                 if (cached) {
                     // ignore error, use expired value
-                    return callback(null, cached.value);
+                    return callback(
+                        null,
+                        formatDNSValue(cached.value, {
+                            cached: true,
+                            error: err
+                        })
+                    );
                 }
                 return callback(err);
             }
+
             if (addresses && addresses.length) {
                 let value = {
-                    host: addresses[0] || options.host,
+                    addresses,
                     servername: options.servername || options.host
                 };
+
                 dnsCache.set(options.host, {
                     value,
                     expires: Date.now() + DNS_TTL
                 });
-                return callback(null, value);
+
+                return callback(
+                    null,
+                    formatDNSValue(value, {
+                        cached: false
+                    })
+                );
             }
 
             try {
@@ -100,30 +174,54 @@ module.exports.resolveHostname = (options, callback) => {
                     if (err) {
                         if (cached) {
                             // ignore error, use expired value
-                            return callback(null, cached.value);
+                            return callback(
+                                null,
+                                formatDNSValue(cached.value, {
+                                    cached: true,
+                                    error: err
+                                })
+                            );
                         }
                         return callback(err);
                     }
 
                     if (!address && cached) {
                         // nothing was found, fallback to cached value
-                        return callback(null, cached.value);
+                        return callback(
+                            null,
+                            formatDNSValue(cached.value, {
+                                cached: true
+                            })
+                        );
                     }
 
                     let value = {
-                        host: address || options.host,
+                        addresses: address ? [address] : [options.host],
                         servername: options.servername || options.host
                     };
+
                     dnsCache.set(options.host, {
                         value,
                         expires: Date.now() + DNS_TTL
                     });
-                    return callback(null, value);
+
+                    return callback(
+                        null,
+                        formatDNSValue(value, {
+                            cached: false
+                        })
+                    );
                 });
             } catch (err) {
                 if (cached) {
                     // ignore error, use expired value
-                    return callback(null, cached.value);
+                    return callback(
+                        null,
+                        formatDNSValue(cached.value, {
+                            cached: true,
+                            error: err
+                        })
+                    );
                 }
                 return callback(err);
             }

package/lib/smtp-connection/index.js

@@ -261,12 +261,12 @@ class SMTPConnection extends EventEmitter {
                         tnx: 'dns',
                         source: opts.host,
                         resolved: resolved.host,
-                        cached: !!resolved._cached
+                        cached: !!resolved.cached
                     },
                     'Resolved %s as %s [cache %s]',
                     opts.host,
                     resolved.host,
-                    resolved._cached ? 'hit' : 'miss'
+                    resolved.cached ? 'hit' : 'miss'
                 );
                 Object.keys(resolved).forEach(key => {
                     if (key.charAt(0) !== '_' && resolved[key]) {
@@ -299,12 +299,12 @@ class SMTPConnection extends EventEmitter {
                         tnx: 'dns',
                         source: opts.host,
                         resolved: resolved.host,
-                        cached: !!resolved._cached
+                        cached: !!resolved.cached
                     },
                     'Resolved %s as %s [cache %s]',
                     opts.host,
                     resolved.host,
-                    resolved._cached ? 'hit' : 'miss'
+                    resolved.cached ? 'hit' : 'miss'
                 );
                 Object.keys(resolved).forEach(key => {
                     if (key.charAt(0) !== '_' && resolved[key]) {
@@ -332,12 +332,12 @@ class SMTPConnection extends EventEmitter {
                         tnx: 'dns',
                         source: opts.host,
                         resolved: resolved.host,
-                        cached: !!resolved._cached
+                        cached: !!resolved.cached
                     },
                     'Resolved %s as %s [cache %s]',
                     opts.host,
                     resolved.host,
-                    resolved._cached ? 'hit' : 'miss'
+                    resolved.cached ? 'hit' : 'miss'
                 );
                 Object.keys(resolved).forEach(key => {
                     if (key.charAt(0) !== '_' && resolved[key]) {
@@ -548,6 +548,16 @@ class SMTPConnection extends EventEmitter {
                                 '\u0000' +
                                 this._auth.credentials.pass,
                             'utf-8'
+                        ).toString('base64'),
+                    // log entry without passwords
+                    'AUTH PLAIN ' +
+                        Buffer.from(
+                            //this._auth.user+'\u0000'+
+                            '\u0000' + // skip authorization identity as it causes problems with some servers
+                                this._auth.credentials.user +
+                                '\u0000' +
+                                '/* secret */',
+                            'utf-8'
                         ).toString('base64')
                 );
                 return;
@@ -945,8 +955,9 @@ class SMTPConnection extends EventEmitter {
      * Send a command to the server, append \r\n
      *
      * @param {String} str String to be sent to the server
+     * @param {String} logStr Optional string to be used for logging instead of the actual string
      */
-    _sendCommand(str) {
+    _sendCommand(str, logStr) {
         if (this._destroyed) {
             // Connection already closed, can't send any more data
             return;
@@ -961,7 +972,7 @@ class SMTPConnection extends EventEmitter {
                 {
                     tnx: 'client'
                 },
-                (str || '').toString().replace(/\r?\n$/, '')
+                (logStr || str || '').toString().replace(/\r?\n$/, '')
             );
         }
 
@@ -1420,18 +1431,21 @@ class SMTPConnection extends EventEmitter {
 
         // Decode from base64
         let base64decoded = Buffer.from(challengeString, 'base64').toString('ascii'),
-            hmac_md5 = crypto.createHmac('md5', this._auth.credentials.pass);
+            hmacMD5 = crypto.createHmac('md5', this._auth.credentials.pass);
 
-        hmac_md5.update(base64decoded);
+        hmacMD5.update(base64decoded);
 
-        let hex_hmac = hmac_md5.digest('hex');
-        let prepended = this._auth.credentials.user + ' ' + hex_hmac;
+        let prepended = this._auth.credentials.user + ' ' + hmacMD5.digest('hex');
 
         this._responseActions.push(str => {
             this._actionAUTH_CRAM_MD5_PASS(str, callback);
         });
 
-        this._sendCommand(Buffer.from(prepended).toString('base64'));
+        this._sendCommand(
+            Buffer.from(prepended).toString('base64'),
+            // hidden hash for logs
+            Buffer.from(this._auth.credentials.user + ' /* secret */').toString('base64')
+        );
     }
 
     /**
@@ -1476,7 +1490,11 @@ class SMTPConnection extends EventEmitter {
             this._actionAUTHComplete(str, callback);
         });
 
-        this._sendCommand(Buffer.from(this._auth.credentials.pass + '', 'utf-8').toString('base64'));
+        this._sendCommand(
+            Buffer.from((this._auth.credentials.pass || '').toString(), 'utf-8').toString('base64'),
+            // Hidden pass for logs
+            Buffer.from('/* secret */', 'utf-8').toString('base64')
+        );
     }
 
     /**
@@ -1706,7 +1724,11 @@ class SMTPConnection extends EventEmitter {
             this._responseActions.push(str => {
                 this._actionAUTHComplete(str, isRetry, callback);
             });
-            this._sendCommand('AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken));
+            this._sendCommand(
+                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token(accessToken),
+                //  Hidden for logs
+                'AUTH XOAUTH2 ' + this._auth.oauth2.buildXOAuth2Token('/* secret */')
+            );
         });
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "6.6.2",
+    "version": "6.7.0",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -20,6 +20,8 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
+        "@aws-sdk/client-ses": "3.36.0",
+        "aws-sdk": "2.1004.0",
         "bunyan": "1.8.15",
         "chai": "4.3.4",
         "eslint-config-nodemailer": "1.2.0",
@@ -31,11 +33,11 @@
         "libbase64": "1.2.1",
         "libmime": "5.0.0",
         "libqp": "1.1.0",
-        "mocha": "9.0.0",
+        "mocha": "9.1.2",
         "nodemailer-ntlm-auth": "1.0.1",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "sinon": "11.1.1",
+        "sinon": "11.1.2",
         "smtp-server": "3.9.0"
     },
     "engines": {