node_modules: update (#297)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/lib/fetch/cookies.js

@@ -2,7 +2,7 @@
 
 // module to handle cookies
 
-const urllib = require('url');
+const urllib = require('../shared/url');
 
 const SESSION_TIMEOUT = 1800; // 30 min
 

node_modules/nodemailer/lib/fetch/index.js

@@ -2,7 +2,7 @@
 
 const http = require('http');
 const https = require('https');
-const urllib = require('url');
+const urllib = require('../shared/url');
 const zlib = require('zlib');
 const { PassThrough } = require('stream');
 const Cookies = require('./cookies');
@@ -123,7 +123,10 @@ function nmfetch(url, options) {
         path: parsed.path,
         port: parsed.port ? parsed.port : parsed.protocol === 'https:' ? 443 : 80,
         headers,
-        rejectUnauthorized: false,
+        // Validate TLS certificates by default. Callers that genuinely need to
+        // reach a self-signed/internal host opt out explicitly with
+        // options.tls = { rejectUnauthorized: false }.
+        rejectUnauthorized: true,
         agent: false
     };
 
@@ -212,7 +215,27 @@ function nmfetch(url, options) {
             // redirect does not include POST body
             options.method = 'GET';
             options.body = false;
-            return nmfetch(urllib.resolve(url, res.headers.location), options);
+
+            const redirectUrl = urllib.resolve(url, res.headers.location);
+            const redirectParsed = urllib.parse(redirectUrl);
+
+            // Do not forward credentials when the redirect leaves the original
+            // security context: a different host, or a downgrade from https to
+            // http (which would otherwise put them on the wire in cleartext).
+            // Strip sensitive request headers so an attacker who controls the
+            // redirect target cannot harvest them.
+            const crossHost = redirectParsed.hostname !== parsed.hostname;
+            const downgrade = parsed.protocol === 'https:' && redirectParsed.protocol === 'http:';
+            if (options.headers && (crossHost || downgrade)) {
+                const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
+                Object.keys(options.headers).forEach(key => {
+                    if (sensitive.includes(key.toLowerCase())) {
+                        delete options.headers[key];
+                    }
+                });
+            }
+
+            return nmfetch(redirectUrl, options);
         }
 
         fetchRes.statusCode = res.statusCode;