node_modules: update (#307)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/lib/smtp-connection/http-proxy-client.js

@@ -9,6 +9,10 @@ const tls = require('tls');
 const urllib = require('../shared/url');
 const errors = require('../errors');
 
+// Cap the CONNECT response we buffer before the header terminator, so a proxy that
+// never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
+const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
+
 /**
  * Establishes proxied connection to destinationPort
  *
@@ -29,6 +33,16 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
     }
     tlsOptions = tlsOptions || {};
 
+    // Reject CRLF in the destination before it reaches the CONNECT request line
+    // and Host header. A tainted host/port could otherwise inject additional
+    // request headers into the proxy connection (HTTP request splitting).
+    destinationPort = Number(destinationPort) || 0;
+    if (!destinationPort || /[\r\n]/.test(destinationHost)) {
+        const err = new Error('Invalid proxy destination');
+        err.code = errors.EPROXY;
+        return setImmediate(() => callback(err));
+    }
+
     const proxy = urllib.parse(proxyUrl);
 
     const connectOptions = {
@@ -140,6 +154,13 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
 
                 return callback(null, socket);
             }
+
+            if (headers.length > MAX_RESPONSE_HEADER_BYTES) {
+                socket.removeListener('data', onSocketData);
+                const err = new Error('Proxy response headers too large');
+                err.code = errors.EPROXY;
+                return tempSocketErr(err);
+            }
         };
         socket.on('data', onSocketData);
     });