nodemailer 9.0.4 → 9.0.6

package/lib/shared/index.js

@@ -7,10 +7,15 @@ const util = require('util');
 const fs = require('fs');
 const nmfetch = require('../fetch');
 const errors = require('../errors');
+const objects = require('./objects');
 const dns = require('dns');
 const net = require('net');
 const os = require('os');
 
+// re-exported for the callers that already depend on this module, see ./objects
+const isProtoKey = (module.exports.isProtoKey = objects.isProtoKey);
+module.exports.copyOwnKeys = objects.copyOwnKeys;
+
 const DNS_TTL = 5 * 60 * 1000;
 const CACHE_CLEANUP_INTERVAL = 30 * 1000; // Minimum 30 seconds between cleanups
 const MAX_CACHE_SIZE = 1000; // Maximum number of entries in cache
@@ -355,7 +360,9 @@ module.exports.parseConnectionUrl = str => {
             return;
         }
 
-        if (!(lKey in obj)) {
+        // `in` already keeps "__proto__" out, but only as a side effect of it being an
+        // Object.prototype member. Say it, so the protection survives a change to the check
+        if (!isProtoKey(lKey) && !(lKey in obj)) {
             obj[lKey] = value;
         }
     });
@@ -470,7 +477,7 @@ module.exports.parseDataURI = uri => {
             // Ensure there's a key before the '='
             const key = entry.substring(0, sepPos).trim();
             const value = entry.substring(sepPos + 1).trim();
-            if (key) {
+            if (key && !isProtoKey(key)) {
                 params[key] = value;
             }
         }
@@ -561,19 +568,24 @@ function resolveContentValue(data, key, options, callback) {
                 }
                 callback(null, value);
             });
-        } else if (/^https?:\/\//i.test(content.path || content.href)) {
+        } else if (/^data:/i.test(content.path || content.href)) {
+            const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
+
+            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+        } else if (content.href || /^https?:\/\//i.test(content.path)) {
+            // An href is always a URL, and so is a path that looks like one. Let nmfetch
+            // decide whether it is fetchable, it validates the parsed URL. Testing the raw
+            // string here instead would let a file: href fall through to the "return as is"
+            // default below and travel on inside the resolved message.
+            const url = content.href || content.path;
             if (options.disableUrlAccess) {
                 return setImmediate(() => {
-                    const err = new Error('Url access rejected for ' + (content.path || content.href));
+                    const err = new Error('Url access rejected for ' + url);
                     err.code = errors.EURLACCESS;
                     callback(err);
                 });
             }
-            return resolveStream(nmfetch(content.path || content.href, { headers: content.httpHeaders, tls: content.tls }), callback);
-        } else if (/^data:/i.test(content.path || content.href)) {
-            const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
-
-            return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+            return resolveStream(nmfetch(url, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (content.path) {
             if (options.disableFileAccess) {
                 return setImmediate(() => {
@@ -603,10 +615,14 @@ module.exports.assign = function (/* target, ... sources */) {
 
     args.forEach(source => {
         Object.keys(source || {}).forEach(key => {
+            if (isProtoKey(key)) {
+                return;
+            }
             if (['tls', 'auth'].includes(key) && source[key] && typeof source[key] === 'object') {
                 // tls and auth are special keys that need to be enumerated separately
-                // other objects are passed as is
-                target[key] = Object.assign(target[key] || {}, source[key]);
+                // other objects are passed as is. Enumerating is a copy of user supplied
+                // keys just like the loop above, so it gets the same treatment
+                target[key] = module.exports.copyOwnKeys(target[key] || {}, source[key]);
             } else {
                 target[key] = source[key];
             }

package/lib/shared/objects.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.js, so that every layer can reach it.
+// lib/shared/index.js requires lib/fetch, so lib/fetch can not require lib/shared back,
+// and lib/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. lib/shared/index.js re-exports both functions for the callers that already
+// depend on it.
+
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param {String} key Key to check
+ * @returns {Boolean} true if the key must not be copied
+ */
+module.exports.isProtoKey = key => key === '__proto__';
+
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param {Object} target Object to copy the keys to
+ * @param {Object} source Object to copy the keys from
+ * @param {Function} [skip] Optional predicate, return true to leave a key out
+ * @returns {Object} The target object
+ */
+module.exports.copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if (module.exports.isProtoKey(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};

package/lib/stream-transport/index.js

@@ -42,7 +42,7 @@ class StreamTransport {
         // We probably need this in the output
         mail.message.keepBcc = true;
 
-        const envelope = mail.data.envelope || mail.message.getEnvelope();
+        const envelope = mail.message.getEnvelope();
         const messageId = mail.message.messageId();
 
         const recipients = [].concat(envelope.to || []);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "9.0.4",
+    "version": "9.0.6",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -27,19 +27,19 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1096.0",
+        "@aws-sdk/client-sesv2": "3.1119.0",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
-        "eslint": "10.8.0",
+        "eslint": "10.9.1",
         "eslint-config-prettier": "10.1.8",
-        "globals": "17.8.0",
+        "globals": "17.11.0",
         "libbase64": "1.3.0",
-        "libmime": "5.4.1",
+        "libmime": "5.4.2",
         "libqp": "2.1.1",
         "prettier": "3.9.6",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.2"
+        "smtp-server": "3.19.3"
     },
     "engines": {
         "node": ">=6.0.0"