actions/send-mail
1
0
Fork 0
mirror of https://github.com/dawidd6/action-send-mail.git synced 2026-09-09 05:56:37 +07:00
Code Issues Packages Projects Releases Wiki Activity

node_modules: update (#314)

Browse Source 
Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>
This commit is contained in:
Dawid Dziurla
2026-09-07 07:05:39 +02:00
committed by GitHub
parent 40eba5cee7
commit d35571df19
23 changed files with 938 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files
node_modules/nodemailer/lib/addressparser/index.js
Generated Vendored
+166 -8
View File
@@ -1,5 +1,134 @@
'use strict';
/**
* Restores the quoting of a local part that was read out of a quoted string.
*
* RFC 5321 allows '@' inside a quoted local part, so handing '"user@evil.com"@good.com'
* on as the bare 'user@evil.com@good.com' leaves it to the consumer which '@' splits the
* domain off. Getting that wrong is a misrouting vector, so the quotes go back on. The
* same holds for the other specials: a ',' or a ';' that loses its quotes reads as a
* recipient separator once the consumer puts the address back into a header.
*
* This module has no dependencies so that it can ship on its own, which is why the two
* grammar tests below are spelled out here instead of shared with lib/mime-node. Keeping
* only what is ambiguous quoted is deliberate, mime-node applies the stricter RFC 5321
* dot-atom rule on top of this when it emits an address.
*
* @param {String} address Address with an unquoted local part
* @return {String} Address with the local part as a quoted-string
*/
function _quoteLocalPart(address) {
const lastAt = address.lastIndexOf('@');
if (lastAt < 0) {
// no domain to split off, nothing can be misrouted
return address;
}
const user = address.substr(0, lastAt);
if (/^[^\s"(),:;<>@[\\\]]+$/.test(user) || /^"(?:[^"\\]|\\[\s\S])*"$/.test(user)) {
// a local part that carries no special reads the same with or without the quotes,
// and one that is already a complete quoted-string needs nothing either
return address;
}
return '"' + user.replace(/["\\]/g, '\\$&') + '"@' + address.substr(lastAt + 1);
}
/**
* Reached for every parsed address, so it is built once rather than per call.
*/
const HAS_WHITESPACE = /\s/;
/**
* An addr-spec that carries its whitespace legally, inside a quoted local part. The
* optional tail is the malformed shape: a real mailbox with wreckage trailing it.
*/
const QUOTED_LOCAL_ADDR = /^("(?:[^"\\]|\\[\s\S])*"@\S+)(?:\s+([\s\S]+))?$/;
/**
* One run holding a single '@' and no whitespace, the shape an addr-spec has to have.
*/
const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
/**
* The looser reading applied once the strict one finds nothing, which tolerates the
* further '@' that a domain should not have but malformed headers carry anyway.
*/
const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
/**
* Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
*
* A malformed header can put more than a mailbox between the angle brackets, most often
* because the generator wrote the recipient twice: '<user@example.com user@example.com>'
* or '<example.com user@example.com>'. Whitespace is not addr-spec, so the whole run can
* never be a mailbox anyone could deliver to, and passing it on as the address loses the
* recipient that is sitting right there in the header.
*
* The run that still reads as an addr-spec is kept and whatever is left over becomes
* display text rather than being dropped. Candidates are read strictly first and then
* under the looser grammar, the same two tiers the unquoted-text branch below applies to
* the same problem, so that '<a@b@c.com junk>' and a bare 'a@b@c.com junk' agree on the
* recipient. When several runs qualify the first wins, which is what that branch's looser
* tier does within a token.
*
* A quoted local part is left alone: RFC 5321 allows whitespace inside it, so
* '<"user name"@example.com>' is well formed and means exactly what it says.
*
* @param {Object} data Collected address parts, mutated in place
*/
function _recoverAddrSpec(data) {
if (!HAS_WHITESPACE.test(data.address)) {
return;
}
let address;
let rest;
const quoted = data.address.match(QUOTED_LOCAL_ADDR);
if (quoted) {
if (!quoted[2]) {
// the whitespace sits inside the quoted local part, this is a well formed mailbox
return;
}
// a real mailbox with wreckage trailing it, so peel the addr-spec off whole rather
// than splitting into the quotes
address = quoted[1];
rest = [quoted[2]];
} else {
if (data.address.indexOf('"') >= 0) {
// Splitting on whitespace loses track of where the quoted string starts and ends,
// and this module does not take addresses out of quoted strings: the run picked out
// of '<junk "user@evil.com b"@good.com>' would be an address from the domain the
// quotes were hiding. Every well formed shape was already handled above, so what is
// left is wreckage either way and the original is the honest answer
return;
}
const parts = data.address.split(/\s+/);
let addrIndex = parts.findIndex(part => ADDR_SPEC.test(part));
if (addrIndex < 0) {
addrIndex = parts.findIndex(part => LOOSE_ADDR_SPEC.test(part));
}
if (addrIndex < 0) {
// nothing in there reads as an address, there is no better answer than the original
return;
}
address = parts.splice(addrIndex, 1)[0];
rest = parts;
}
data.address = address;
data.text = [data.text]
.concat(rest)
.filter(part => part)
.join(' ');
}
/**
* Converts tokens for a single address into an address object
*
@@ -55,7 +184,18 @@ function _handleAddress(tokens, depth) {
token.value = token.value.replace(/^[^<]*<\s*/, '');
}
if (prevToken && prevToken.noBreak && data[state].length) {
// A comment is folding whitespace. It may sit inside an addr-spec, on either side
// of the '@', but it cannot join two atoms into one: gluing across it would read
// 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
// deliver to a domain the sender never named.
const parts = data[state];
const joins =
prevToken &&
prevToken.noBreak &&
parts.length &&
(prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
if (joins) {
data[state][data[state].length - 1] += token.value;
if (state === 'text' && insideQuotes) {
data.textWasQuoted[data.textWasQuoted.length - 1] = true;
@@ -103,7 +243,7 @@ function _handleAddress(tokens, depth) {
// Security: Do not extract email addresses from quoted strings.
// RFC 5321 allows @ inside quoted local-parts like "user@domain"@example.com.
// Extracting emails from quoted text leads to misrouting vulnerabilities.
if (!data.textWasQuoted[i] && /^[^@\s]+@[^@\s]+$/.test(data.text[i])) {
if (!data.textWasQuoted[i] && ADDR_SPEC.test(data.text[i])) {
data.address = data.text.splice(i, 1);
data.textWasQuoted.splice(i, 1);
break;
@@ -145,10 +285,16 @@ function _handleAddress(tokens, depth) {
data.text = data.text.concat(data.address.splice(1));
}
// An address is only taken from unquoted text, so anything left in the text at this
// point that still has to serve as the address carries its quoting in this flag
const addressFromQuotedText = !data.address.length && data.textWasQuoted.some(wasQuoted => wasQuoted);
// Join values with spaces
data.text = data.text.join(' ');
data.address = data.address.join(' ');
_recoverAddrSpec(data);
const address = {
address: data.address || data.text || '',
name: data.text || data.address || ''
@@ -162,6 +308,10 @@ function _handleAddress(tokens, depth) {
}
}
if (addressFromQuotedText && address.address) {
address.address = _quoteLocalPart(address.address);
}
addresses.push(address);
}
@@ -360,8 +510,10 @@ function addressparser(str, options) {
addresses.forEach(addr => {
const handled = _handleAddress(addr, depth);
if (handled.length) {
parsedAddresses = parsedAddresses.concat(handled);
// Appended in place. Rebuilding the accumulator with concat() would copy every
// entry collected so far on each address, making a flat list cost O(n^2).
for (let i = 0; i < handled.length; i++) {
parsedAddresses.push(handled[i]);
}
});
@@ -369,14 +521,20 @@ function addressparser(str, options) {
// "Joe Foo, PhD <joe@example.com>" is split on the comma into
// [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].
// Recombine: a name-only entry followed by an entry with both name and address.
for (let i = parsedAddresses.length - 2; i >= 0; i--) {
// Walked back to front so that a run of fragments folds into one entry in a single
// pass. Splicing each fragment out of the list instead would cost O(n^2).
const mergedAddresses = [];
for (let i = parsedAddresses.length - 1; i >= 0; i--) {
const current = parsedAddresses[i];
const next = parsedAddresses[i + 1];
if (current.address === '' && current.name && !current.group && next.address && next.name) {
const next = mergedAddresses.length ? mergedAddresses[mergedAddresses.length - 1] : null;
if (next && current.address === '' && current.name && !current.group && next.address && next.name) {
next.name = current.name + ', ' + next.name;
parsedAddresses.splice(i, 1);
} else {
mergedAddresses.push(current);
}
}
mergedAddresses.reverse();
parsedAddresses = mergedAddresses;
if (options.flatten) {
const flatAddresses = [];