node_modules: update (#314)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/lib/shared/index.js

@@ -7,10 +7,15 @@ const util = require('util');
 const fs = require('fs');
 const nmfetch = require('../fetch');
 const errors = require('../errors');
+const objects = require('./objects');
 const dns = require('dns');
 const net = require('net');
 const os = require('os');
 
+// re-exported for the callers that already depend on this module, see ./objects
+const isProtoKey = (module.exports.isProtoKey = objects.isProtoKey);
+module.exports.copyOwnKeys = objects.copyOwnKeys;
+
 const DNS_TTL = 5 * 60 * 1000;
 const CACHE_CLEANUP_INTERVAL = 30 * 1000; // Minimum 30 seconds between cleanups
 const MAX_CACHE_SIZE = 1000; // Maximum number of entries in cache
@@ -355,7 +360,9 @@ module.exports.parseConnectionUrl = str => {
             return;
         }
 
-        if (!(lKey in obj)) {
+        // `in` already keeps "__proto__" out, but only as a side effect of it being an
+        // Object.prototype member. Say it, so the protection survives a change to the check
+        if (!isProtoKey(lKey) && !(lKey in obj)) {
             obj[lKey] = value;
         }
     });
@@ -470,7 +477,7 @@ module.exports.parseDataURI = uri => {
             // Ensure there's a key before the '='
             const key = entry.substring(0, sepPos).trim();
             const value = entry.substring(sepPos + 1).trim();
-            if (key) {
+            if (key && !isProtoKey(key)) {
                 params[key] = value;
             }
         }
@@ -561,19 +568,24 @@ function resolveContentValue(data, key, options, callback) {
                 }
                 callback(null, value);
             });
-        } else if (/^https?:\/\//i.test(content.path || content.href)) {
-            if (options.disableUrlAccess) {
-                return setImmediate(() => {
-                    const err = new Error('Url access rejected for ' + (content.path || content.href));
-                    err.code = errors.EURLACCESS;
-                    callback(err);
-                });
-            }
-            return resolveStream(nmfetch(content.path || content.href, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (/^data:/i.test(content.path || content.href)) {
             const parsedDataUri = module.exports.parseDataURI(content.path || content.href);
 
             return callback(null, parsedDataUri && parsedDataUri.data ? parsedDataUri.data : Buffer.alloc(0));
+        } else if (content.href || /^https?:\/\//i.test(content.path)) {
+            // An href is always a URL, and so is a path that looks like one. Let nmfetch
+            // decide whether it is fetchable, it validates the parsed URL. Testing the raw
+            // string here instead would let a file: href fall through to the "return as is"
+            // default below and travel on inside the resolved message.
+            const url = content.href || content.path;
+            if (options.disableUrlAccess) {
+                return setImmediate(() => {
+                    const err = new Error('Url access rejected for ' + url);
+                    err.code = errors.EURLACCESS;
+                    callback(err);
+                });
+            }
+            return resolveStream(nmfetch(url, { headers: content.httpHeaders, tls: content.tls }), callback);
         } else if (content.path) {
             if (options.disableFileAccess) {
                 return setImmediate(() => {
@@ -603,10 +615,14 @@ module.exports.assign = function (/* target, ... sources */) {
 
     args.forEach(source => {
         Object.keys(source || {}).forEach(key => {
+            if (isProtoKey(key)) {
+                return;
+            }
             if (['tls', 'auth'].includes(key) && source[key] && typeof source[key] === 'object') {
                 // tls and auth are special keys that need to be enumerated separately
-                // other objects are passed as is
-                target[key] = Object.assign(target[key] || {}, source[key]);
+                // other objects are passed as is. Enumerating is a copy of user supplied
+                // keys just like the loop above, so it gets the same treatment
+                target[key] = module.exports.copyOwnKeys(target[key] || {}, source[key]);
             } else {
                 target[key] = source[key];
             }

node_modules/nodemailer/lib/shared/objects.js

@@ -0,0 +1,42 @@
+'use strict';
+
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.js, so that every layer can reach it.
+// lib/shared/index.js requires lib/fetch, so lib/fetch can not require lib/shared back,
+// and lib/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. lib/shared/index.js re-exports both functions for the callers that already
+// depend on it.
+
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param {String} key Key to check
+ * @returns {Boolean} true if the key must not be copied
+ */
+module.exports.isProtoKey = key => key === '__proto__';
+
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param {Object} target Object to copy the keys to
+ * @param {Object} source Object to copy the keys from
+ * @param {Function} [skip] Optional predicate, return true to leave a key out
+ * @returns {Object} The target object
+ */
+module.exports.copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if (module.exports.isProtoKey(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};