nodemailer 9.0.4 → 9.0.6

package/lib/mime-funcs/index.js

@@ -5,6 +5,7 @@
 const base64 = require('../base64');
 const qp = require('../qp');
 const mimeTypes = require('./mime-types');
+const { isProtoKey } = require('../shared/objects');
 
 module.exports = {
     /**
@@ -13,7 +14,8 @@ module.exports = {
      * When isParam is set the value is destined for a header parameter, so HT, CR and LF
      * are not plaintext either: a header parameter has no way to carry them. HT is a valid
      * fold point, so folding and unfolding a header would rewrite it as a space, and CR/LF
-     * cannot appear in a header value at all. Such values have to go through the rfc2231
+     * cannot appear in a header value at all. DEL is neither a token character nor qtext,
+     * so it can not be carried bare or quoted. Such values have to go through the rfc2231
      * parameter continuation encoding instead, the same way a quote already does.
      *
      * @param {String} value String to be tested
@@ -21,10 +23,21 @@ module.exports = {
      * @returns {Boolean} true if it is a plaintext string
      */
     isPlainText(value, isParam) {
-        const re = isParam ? /[\x00-\x1f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
+        const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
         return typeof value === 'string' && !re.test(value);
     },
 
+    /**
+     * Wraps a value into a quoted-string. Inside one a quote would end the string early
+     * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
+     *
+     * @param {String} value String to be quoted
+     * @returns {String} The value as a quoted-string, quotes included
+     */
+    quoteString(value) {
+        return '"' + (value || '').toString().replace(/["\\]/g, '\\$&') + '"';
+    },
+
     /**
      * Checks if a multi line string containes lines longer than the selected value.
      *
@@ -177,10 +190,12 @@ module.exports = {
     buildHeaderValue(structured) {
         const paramsArray = [];
 
-        Object.keys(structured.params || {}).forEach(param => {
+        Object.keys(structured.params || {}).forEach(key => {
             // filename might include unicode characters so it is a special case
             // other values probably do not
-            const value = structured.params[param];
+            const value = structured.params[key];
+            // a parameter name is a token too and it is emitted without any quoting around it
+            const param = key.replace(/[\x00-\x1f\x7f]/g, '');
             if (!this.isPlainText(value, true) || value.length >= 75) {
                 this.buildHeaderParam(param, value, 50).forEach(encodedParam => {
                     if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
@@ -196,7 +211,11 @@ module.exports = {
             }
         });
 
-        return structured.value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
+        // the value ahead of the parameters is a token, it has no way to carry a control
+        // char or DEL and there is no quoting construct around it to escape one into
+        const value = typeof structured.value === 'string' ? structured.value.replace(/[\x00-\x1f\x7f]/g, '') : structured.value;
+
+        return value + (paramsArray.length ? '; ' + paramsArray.join('; ') : '');
     },
 
     /**
@@ -294,8 +313,11 @@ module.exports = {
                                 line,
                                 encoded
                             });
+                            // the line we start here holds an encoded char, so it has to be
+                            // flagged as one. otherwise it gets an unstarred continuation key
+                            // and a receiver reads the percent escapes as literal text
                             line = '';
-                            startPos = i - 1;
+                            encoded = true;
                         } else {
                             encoded = true;
                             i = startPos;
@@ -360,6 +382,16 @@ module.exports = {
             value: false,
             params: {}
         };
+
+        // Parameter names come from a caller supplied contentType/contentDisposition. A
+        // "__proto__" name would target the prototype chain of the params object instead of
+        // an own property of it, and read back as Object.prototype, so it is dropped.
+        const setParam = (name, value) => {
+            if (!isProtoKey(name)) {
+                response.params[name] = value;
+            }
+        };
+
         let key = false;
         let value = '';
         let type = 'value';
@@ -391,7 +423,7 @@ module.exports = {
                     if (key === false) {
                         response.value = value.trim();
                     } else {
-                        response.params[key] = value.trim();
+                        setParam(key, value.trim());
                     }
                     type = 'key';
                     value = '';
@@ -406,10 +438,10 @@ module.exports = {
             if (key === false) {
                 response.value = value.trim();
             } else {
-                response.params[key] = value.trim();
+                setParam(key, value.trim());
             }
         } else if (value.trim()) {
-            response.params[value.trim().toLowerCase()] = '';
+            setParam(value.trim().toLowerCase(), '');
         }
 
         // handle parameter value continuations
@@ -422,6 +454,14 @@ module.exports = {
                 actualKey = key.substr(0, match.index);
                 nr = Number(match[2] || match[3]) || 0;
 
+                if (isProtoKey(actualKey)) {
+                    // see setParam. Reading it back would yield Object.prototype, which is
+                    // an object, so the initializer below would be skipped and the write
+                    // that follows would throw out of a header build the caller can not catch
+                    delete response.params[key];
+                    return;
+                }
+
                 if (!response.params[actualKey] || typeof response.params[actualKey] !== 'object') {
                     response.params[actualKey] = {
                         charset: false,
@@ -548,7 +588,7 @@ module.exports = {
      */
     splitMimeEncodedString: (str, maxlen) => {
         const lines = [];
-        let curLine, match, chr, done;
+        let curLine, fallbackLine, match, chr, done;
 
         // require at least 12 symbols to fit possible 4 octet UTF-8 sequences
         maxlen = Math.max(maxlen || 0, 12);
@@ -561,8 +601,14 @@ module.exports = {
                 curLine = curLine.substr(0, match.index);
             }
 
+            // Malformed input (a run of stray UTF-8 continuation bytes) has no split point
+            // that keeps a character sequence whole, so the loop below walks back to an
+            // empty line looking for one. Keep the widest chunk that at least does not cut
+            // a "=XX" escape in half, so the part stays a decodable encoded word.
+            fallbackLine = curLine.length ? curLine : str.substr(0, maxlen);
+
             done = false;
-            while (!done) {
+            while (!done && curLine.length) {
                 done = true;
                 // check if not middle of a unicode char sequence
                 if ((match = str.substr(curLine.length).match(/^[=]([0-9A-F]{2})/i))) {
@@ -575,9 +621,11 @@ module.exports = {
                 }
             }
 
-            if (curLine.length) {
-                lines.push(curLine);
+            if (!curLine.length) {
+                curLine = fallbackLine;
             }
+
+            lines.push(curLine);
             str = str.substr(curLine.length);
         }
 

package/lib/mime-node/index.js

@@ -21,6 +21,20 @@ const LeUnix = require('./le-unix');
 
 const FORMATTED_HEADERS = ['From', 'Sender', 'To', 'Cc', 'Bcc', 'Reply-To', 'Date', 'References'];
 
+// RFC 5321 atext, plus the non-ascii bytes that SMTPUTF8 (RFC 6531) adds to it. A local part
+// built from these, with '.' as a separator, is a dot-atom and can be emitted bare
+const ATEXT = "[A-Za-z0-9!#$%&'*+\\-/=?^_`{|}~\\x80-\\uFFFF]";
+const DOT_ATOM = new RegExp('^' + ATEXT + '+(?:\\.' + ATEXT + '+)*$');
+
+// A complete quoted-string: everything between the outer quotes is either a plain char or
+// a quoted-pair. Anchored, so a value that only starts and ends with a quote does not pass
+const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
+
+// An address that carries no special anywhere can be emitted bare in a header, everything
+// else goes into angle brackets so that the header can not be read as more addresses than
+// the envelope carries
+const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+
 /**
  * Creates a new mime tree node. Assumes 'multipart/*' as the content type
  * if it is a branch, anything else counts as leaf. If rootNode is missing from
@@ -519,11 +533,10 @@ class MimeNode {
             const formattedHeaders = FORMATTED_HEADERS;
 
             if (value && typeof value === 'object' && !formattedHeaders.includes(key)) {
-                Object.keys(value).forEach(key => {
-                    if (key !== 'value') {
-                        options[key] = value[key];
-                    }
-                });
+                // the keys come from a caller supplied header object and `options.prepared`
+                // below decides whether the value is emitted raw, so an own "__proto__" key
+                // here would turn an unfolded value into header injection
+                shared.copyOwnKeys(options, value, optionKey => optionKey === 'value');
                 value = (value.value || '').toString();
                 if (!value.trim()) {
                     return;
@@ -552,6 +565,11 @@ class MimeNode {
                 case 'Content-Type':
                     structured = mimeFuncs.parseHeaderValue(value);
 
+                    // the type token decides multipart and charset below, so clean it before
+                    // those run and not just on the way out, otherwise a control char makes
+                    // the checks miss and the header ends up claiming a type it is not set up for
+                    structured.value = (structured.value || '').toString().replace(/[\x00-\x1f\x7f]/g, '');
+
                     this._handleContentType(structured);
 
                     if (
@@ -569,9 +587,9 @@ class MimeNode {
                         // we can't build the value with buildHeaderValue as the value is non standard and
                         // would be converted to parameter continuation encoding that we do not want
                         // control chars can not be quoted here: HT is a fold point that unfolding would
-                        // turn into a space and CR/LF can not appear in a header at all, so force the
-                        // mime encoded word that a non-ascii filename would get anyway
-                        param = /[\x00-\x1f]/.test(this.filename)
+                        // turn into a space, CR/LF can not appear in a header at all and DEL is not
+                        // qtext, so force the mime encoded word that a non-ascii filename would get anyway
+                        param = /[\x00-\x1f\x7f]/.test(this.filename)
                             ? mimeFuncs.encodeWord(this.filename, this._getTextEncoding(this.filename), 52)
                             : this._encodeWords(this.filename);
 
@@ -602,8 +620,12 @@ class MimeNode {
 
             if (typeof this.normalizeHeaderKey === 'function') {
                 const normalized = this.normalizeHeaderKey(key, value);
-                if (normalized && typeof normalized === 'string' && normalized.length) {
-                    key = normalized;
+                // the result replaces the key on the way into the header, so it gets the same
+                // treatment the key it replaces already had. a line break here would end the
+                // header and start one of the caller's own
+                const cleaned = typeof normalized === 'string' ? normalized.replace(/[\x00-\x1f\x7f]/g, '') : '';
+                if (cleaned) {
+                    key = cleaned;
                 }
             }
 
@@ -844,7 +866,7 @@ class MimeNode {
 
         if (envelope.from) {
             list = [];
-            this._convertAddresses(this._parseAddresses(envelope.from), list);
+            this._convertAddresses(this._parseEnvelopeAddresses(envelope.from), list);
             list = list.filter(address => address && address.address);
             if (list.length && list[0]) {
                 this._envelope.from = list[0].address;
@@ -852,18 +874,14 @@ class MimeNode {
         }
         ['to', 'cc', 'bcc'].forEach(key => {
             if (envelope[key]) {
-                this._convertAddresses(this._parseAddresses(envelope[key]), this._envelope.to);
+                this._convertAddresses(this._parseEnvelopeAddresses(envelope[key]), this._envelope.to);
             }
         });
 
         this._envelope.to = this._envelope.to.map(to => to.address).filter(address => address);
 
         const standardFields = ['to', 'cc', 'bcc', 'from'];
-        Object.keys(envelope).forEach(key => {
-            if (!standardFields.includes(key)) {
-                this._envelope[key] = envelope[key];
-            }
-        });
+        shared.copyOwnKeys(this._envelope, envelope, key => standardFields.includes(key));
 
         return this;
     }
@@ -1012,7 +1030,9 @@ class MimeNode {
                 });
                 return contentStream;
             }
-            // fetch URL
+            // fetch URL. nmfetch refuses any scheme that is not http(s), and it decides
+            // that on the parsed URL. Testing the raw string here instead would reject
+            // forms the parser accepts, such as a leading space or a slash-less authority
             return nmfetch(content.href, { headers: content.httpHeaders, tls: content.tls });
         }
 
@@ -1041,15 +1061,69 @@ class MimeNode {
             [],
             [].concat(addresses).map(address => {
                 if (address && address.address) {
-                    address.address = this._normalizeAddress(address.address);
-                    address.name = address.name || '';
-                    return [address];
+                    const normalized = this._normalizeAddress(address.address);
+                    if (normalized === address.address && typeof address.name === 'string') {
+                        // there is nothing to rewrite, so there is nothing to keep off the original
+                        return [address];
+                    }
+
+                    // rewriting would land on the object the caller passed in and might
+                    // still hold a reference to, so rewrite a copy of it instead. An own
+                    // "__proto__" key would make the copy inherit from caller data, and
+                    // _convertAddresses reads `group` off it straight into the envelope
+                    const copy = shared.copyOwnKeys({}, address);
+                    copy.address = normalized;
+                    copy.name = address.name || '';
+                    return [copy];
                 }
-                return addressparser(address);
+                return this._normalizeParsedAddresses(addressparser(address));
             })
         );
     }
 
+    /**
+     * Normalizes the addresses of a freshly parsed address list, groups included.
+     *
+     * Everything this method returns carries a normalized address, whether it arrived as an
+     * object or was parsed out of a header value. Without this the two shapes disagree, and
+     * a consumer reading the parsed form back is handed the ambiguous
+     * 'user@evil.com@good.com' that the header and the envelope no longer carry.
+     *
+     * @param {Array} parsed An array of address objects, as returned by addressparser
+     * @return {Array} The same array, with every address normalized
+     */
+    _normalizeParsedAddresses(parsed) {
+        // addressparser builds these objects, so no caller holds a reference to rewrite around
+        parsed.forEach(entry => {
+            if (entry.address) {
+                entry.address = this._normalizeAddress(entry.address);
+            } else if (entry.group) {
+                this._normalizeParsedAddresses(entry.group);
+            }
+        });
+
+        return parsed;
+    }
+
+    /**
+     * Parses the addresses of an explicitly set envelope.
+     *
+     * An envelope value is an addr-spec and never a display name, so a bare local username
+     * such as 'root' is the address here. Header parsing has to read the same value as a
+     * display name, as a value with no '@' in it can not be an addr-spec in a header.
+     *
+     * @param {Mixed} addresses Addresses to be parsed
+     * @return {Array} An array of address objects
+     */
+    _parseEnvelopeAddresses(addresses) {
+        return this._parseAddresses(addresses).map(entry => {
+            if (entry.address || entry.group || !entry.name || /[\s@]/.test(entry.name)) {
+                return entry;
+            }
+            return { address: this._normalizeAddress(entry.name), name: '' };
+        });
+    }
+
     /**
      * Normalizes a header key, uses Camel-Case form, except for uppercase MIME-
      *
@@ -1061,6 +1135,9 @@ class MimeNode {
             .toString()
             // no newlines in keys
             .replace(/\r?\n|\r/g, ' ')
+            // a field name is printable ascii without the colon, so a control char or DEL
+            // can only be dropped, there is no quoting construct around a field name
+            .replace(/[\x00-\x1f\x7f]/g, '')
             .trim()
             .toLowerCase()
             // use uppercase words, except MIME
@@ -1121,7 +1198,13 @@ class MimeNode {
             case 'Message-ID':
             case 'In-Reply-To':
             case 'Content-Id':
-                value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
+                // a msg-id is structured, so an encoded word inside the angle brackets would
+                // be read as literal text. drop the characters that can not appear in a header
+                // at all, but leave HT alone, it separates the ids of a multi id value
+                value = (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
 
                 if (value.charAt(0) !== '<') {
                     value = '<' + value;
@@ -1141,6 +1224,7 @@ class MimeNode {
                             elm = (elm || '')
                                 .toString()
                                 .replace(/\r?\n|\r/g, ' ')
+                                .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                                 .trim();
                             return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
                         })
@@ -1163,7 +1247,7 @@ class MimeNode {
                 }
 
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
 
             case 'Content-Type':
             case 'Content-Disposition':
@@ -1172,8 +1256,7 @@ class MimeNode {
 
             default:
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                // encodeWords only encodes if needed, otherwise the original string is returned
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
         }
     }
 
@@ -1194,7 +1277,11 @@ class MimeNode {
                 address.address = this._normalizeAddress(address.address);
 
                 if (!address.name) {
-                    values.push(address.address.indexOf(' ') >= 0 ? `<${address.address}>` : `${address.address}`);
+                    // an address that carries a special, be it a quoted local part or a domain
+                    // that could not be normalized, is only unambiguous inside angle brackets.
+                    // Without them a ',' or a ';' anywhere in it reads as a recipient separator
+                    // and the header would list more recipients than the envelope carries
+                    values.push(PLAIN_ADDRESS.test(address.address) ? address.address : `<${address.address}>`);
                 } else {
                     values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
@@ -1220,19 +1307,26 @@ class MimeNode {
     _normalizeAddress(address) {
         address = (address || '')
             .toString()
-            .replace(/[\x00-\x1F<>]+/g, ' ') // remove unallowed characters
+            .replace(/[\x00-\x1F\x7F<>]+/g, ' ') // remove unallowed characters
             .trim();
 
+        if (!address) {
+            // callers use an empty value to detect a missing address
+            return address;
+        }
+
         const lastAt = address.lastIndexOf('@');
         if (lastAt < 0) {
-            // Bare username
-            return address;
+            // Bare username, there is no domain to split off
+            return this._normalizeLocalPart(address);
         }
 
-        let user = address.substr(0, lastAt);
+        const user = address.substr(0, lastAt);
         const domain = address.substr(lastAt + 1);
 
-        // Usernames are not touched and are kept as is even if these include unicode.
+        // Unicode in the local part is kept as is, see _normalizeLocalPart for the rest of it.
+        // A domain has no quoting construct to fall back on, so whatever is not a valid domain
+        // is kept as supplied and it is _convertAddresses that keeps such an address unambiguous.
         // Domains are punycoded when the local part is ASCII ('safe@jõgeva.ee' -> 'safe@xn--jgeva-dua.ee').
         // When the local part contains non-ASCII bytes the address already requires SMTPUTF8,
         // so the domain is kept (or decoded back) as UTF-8 for symmetry on both sides of '@'.
@@ -1249,16 +1343,27 @@ class MimeNode {
             // keep domain as supplied
         }
 
-        if (user.indexOf(' ') >= 0) {
-            if (user.charAt(0) !== '"') {
-                user = '"' + user;
-            }
-            if (user.substr(-1) !== '"') {
-                user = user + '"';
-            }
+        return `${this._normalizeLocalPart(user)}@${encodedDomain}`;
+    }
+
+    /**
+     * Normalizes the local part of an address into a form that can be emitted as is.
+     *
+     * A local part is either a dot-atom or a quoted-string, anything else is not a valid
+     * addr-spec. The quotes of a quoted local part get lost along the way, and a bare
+     * 'user@evil.com@good.com' leaves it to the receiver which '@' splits the domain off,
+     * while the split here is always at the last one. So whatever is not already one of
+     * the two valid forms goes back out as a quoted-string.
+     *
+     * @param {String} user Local part of an address
+     * @return {String} Local part as a dot-atom or as a quoted-string
+     */
+    _normalizeLocalPart(user) {
+        if (DOT_ATOM.test(user) || QUOTED_STRING.test(user)) {
+            return user;
         }
 
-        return `${user}@${encodedDomain}`;
+        return mimeFuncs.quoteString(user);
     }
 
     /**
@@ -1270,7 +1375,7 @@ class MimeNode {
     _encodeAddressName(name) {
         if (!/^[\w ]*$/.test(name)) {
             if (/^[\x20-\x7e]*$/.test(name)) {
-                return '"' + name.replace(/([\\"])/g, '\\$1') + '"';
+                return mimeFuncs.quoteString(name);
             } else {
                 return mimeFuncs.encodeWord(name, this._getTextEncoding(name), 52);
             }
@@ -1278,6 +1383,21 @@ class MimeNode {
         return name;
     }
 
+    /**
+     * Encodes an unstructured header value. Such a value can only carry VCHAR and WSP, so a
+     * control char or DEL has to be forced into the mime encoded word that a non-ascii value
+     * would get anyway. HT stays as it is, it is valid folding whitespace here.
+     *
+     * @param {String} value Header value to encode
+     * @returns {String} Mime word encoded string if needed
+     */
+    _encodeHeaderText(value) {
+        return /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)
+            ? mimeFuncs.encodeWord(value, this._getTextEncoding(value), 52)
+            : // encodeWords only encodes if needed, otherwise the original string is returned
+              this._encodeWords(value);
+    }
+
     /**
      * If needed, mime encodes the name part
      *

package/lib/punycode/index.js

@@ -250,7 +250,7 @@ const decode = function (input) {
     // Main decoding loop: start just after the last delimiter if any basic code
     // points were copied; start at the beginning otherwise.
 
-    for (let index = basic > 0 ? basic + 1 : 0; index < inputLength /* no final expression */; ) {
+    for (let index = basic > 0 ? basic + 1 : 0; index < inputLength /* no final expression */;) {
         // `index` is the index of the next character to be consumed.
         // Decode a generalized variable-length integer into `delta`,
         // which gets added to `i`. The overflow checking is easier

package/lib/sendmail-transport/index.js

@@ -62,14 +62,17 @@ class SendmailTransport {
         // Sendmail strips this header line by itself
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
         let returned;
 
         const hasInvalidAddresses = []
             .concat(envelope.from || [])
             .concat(envelope.to || [])
-            .some(addr => /^-/.test(addr));
+            // a local part is either a dot-atom or a quoted-string, so a leading dash sits at
+            // offset 0 or, behind the opening quote, at offset 1. Only the first shape is read
+            // as an option by sendmail, but both are the address this guard keeps out of argv
+            .some(addr => /^"?-/.test(addr));
         if (hasInvalidAddresses) {
             const err = new Error('Can not send mail. Invalid envelope addresses.');
             err.code = errors.ESENDMAIL;

package/lib/ses-transport/index.js

@@ -66,7 +66,7 @@ class SESTransport extends EventEmitter {
             fromHeader = mimeNode._convertAddresses(mimeNode._parseAddresses(fromHeader.value));
         }
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);
@@ -130,7 +130,8 @@ class SESTransport extends EventEmitter {
                     return callback(err);
                 }
 
-                const sesMessage = Object.assign(
+                // mail.data.ses is caller supplied message data, so copy its own keys only
+                const sesMessage = shared.copyOwnKeys(
                     {
                         Content: {
                             Raw: {
@@ -143,7 +144,7 @@ class SESTransport extends EventEmitter {
                             ToAddresses: envelope.to
                         }
                     },
-                    mail.data.ses || {}
+                    mail.data.ses
                 );
 
                 this.getRegion((err, region) => {