node_modules: update (#314)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/lib/dkim/index.js

@@ -10,6 +10,7 @@ const { PassThrough } = require('stream');
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { copyOwnKeys } = require('../shared/objects');
 
 const DKIM_ALGO = 'sha256';
 const MAX_MESSAGE_SIZE = 2 * 1024 * 1024; // buffer messages larger than this to disk
@@ -225,7 +226,11 @@ class DKIM {
 
         let options = this.options;
         if (extraOptions && Object.keys(extraOptions).length) {
-            options = Object.assign({}, extraOptions, this.options);
+            // extraOptions is mail.data._dkim, caller supplied message data. An own
+            // "__proto__" key there would let every option this signer reads and the
+            // transport did not set, such as skipFields, answer from the caller
+            options = copyOwnKeys({}, extraOptions);
+            copyOwnKeys(options, this.options);
         }
 
         const signer = new DKIMSigner(options, this.keys, inputStream, output);

node_modules/nodemailer/lib/dkim/sign.js

@@ -50,15 +50,20 @@ module.exports = (headers, hashAlgo, bodyHash, options) => {
 module.exports.relaxedHeaders = relaxedHeaders;
 
 function generateDKIMHeader(domainName, keySelector, fieldNames, hashAlgo, bodyHash) {
+    // the caller supplied tag values are interpolated straight into the tag list, and none of
+    // them has any way to carry a control char, DEL, or one of the delimiters that would close
+    // the value and open a tag of its own
+    const cleanTagValue = value => (value || '').toString().replace(/[\x00-\x1f\x7f;=]/g, '');
+
     const dkim = [
         'v=1',
         'a=rsa-' + hashAlgo,
         'c=relaxed/relaxed',
-        'd=' + punycode.toASCII(domainName),
+        'd=' + punycode.toASCII(cleanTagValue(domainName)),
         'q=dns/txt',
-        's=' + keySelector,
+        's=' + cleanTagValue(keySelector),
         'bh=' + bodyHash,
-        'h=' + fieldNames
+        'h=' + cleanTagValue(fieldNames)
     ].join('; ');
 
     return mimeFuncs.foldLines('DKIM-Signature: ' + dkim, 76) + ';\r\n b=';