Add require_tls input to prevent STARTTLS fallback to plain text (#317)

Expose nodemailer's requireTLS option so that when secure is false
(e.g. STARTTLS on port 587), the connection aborts if the server
does not support/negotiate STARTTLS, instead of silently sending
credentials in clear text.

README.md

@@ -16,8 +16,8 @@ Some features:
 - name: Send mail
   uses: dawidd6/action-send-mail@<REF>
   env:
-    # Optional http proxy:
+    # Optional proxy, NO_PROXY is honored too:
-    HTTP_PROXY: http://proxy.example.test:3128
+    SMTP_PROXY: http://proxy.example.test:3128
   with:
     # Specify connection via URL (replaces server_address, server_port, secure,
     # username and password)
@@ -37,6 +37,12 @@ Some features:
     # Optional whether this connection use TLS (default is true if server_port is 465)
     secure: true
 
+    # Optional: when secure is false (e.g. STARTTLS on port 587), abort the
+    # connection if the server does not support/negotiate STARTTLS, instead
+    # of silently falling back to a plain text connection. Recommended
+    # whenever secure is false and you authenticate with username/password.
+    require_tls: true
+
     # Optional (recommended) mail server username:
     username: ${{secrets.MAIL_USERNAME}}
 

action.yml

@@ -14,6 +14,9 @@ inputs:
     default: "25"
   secure:
     description: Whether this connection use TLS (default is true if server_port is 465)
+  require_tls:
+    description: When 'secure' is false, refuse to send if the server does not support STARTTLS (prevents credentials from ever being sent in clear text)
+    required: false
   username:
     description: Authenticate as this user to SMTP server
   password:

main.js

@@ -6,6 +6,22 @@ import fs from "node:fs";
 import showdown from "showdown";
 import path from "node:path";
 
+// smtp_proxy or smtps_proxy, exempted by no_proxy, each preferred lowercase like curl.
+function getProxy(host) {
+    const env = (name) => process.env[name] || process.env[name.toUpperCase()];
+
+    const proxy = env("smtp_proxy") || env("smtps_proxy");
+    if (!proxy) return undefined;
+
+    host = `.${host.toLowerCase()}`;
+    const excluded = (env("no_proxy") || "")
+        .split(",")
+        .map((entry) => entry.trim().replace(/^\./, "").toLowerCase())
+        .some((entry) => entry && (entry === "*" || host.endsWith(`.${entry}`)));
+
+    return excluded ? undefined : proxy;
+}
+
 function getText(textOrFile, convertMarkdown) {
     let text = textOrFile;
 
@@ -78,6 +94,7 @@ async function main() {
         let serverAddress = core.getInput("server_address");
         let serverPort = core.getInput("server_port");
         let secure = core.getInput("secure");
+        const requireTLS = core.getInput("require_tls", { required: false });
         let username = core.getInput("username");
         let password = core.getInput("password");
 
@@ -180,6 +197,7 @@ async function main() {
                     : undefined,
             port: serverPort,
             secure: secure === "true",
+            requireTLS: requireTLS === "true",
             tls:
                 ignoreCert == "true"
                     ? {
@@ -188,7 +206,7 @@ async function main() {
                     : undefined,
             logger: nodemailerdebug == "true" ? true : nodemailerlog,
             debug: nodemailerdebug,
-            proxy: process.env.HTTP_PROXY,
+            proxy: getProxy(serverAddress),
         });
 
         const messageOptions = {

package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@actions/core": "^3.0.1",
         "@actions/glob": "^0.7.0",
-        "nodemailer": "^9.1.1",
+        "nodemailer": "^10.0.0",
         "showdown": "^2.1.0"
       }
     },
@@ -103,12 +103,12 @@
       }
     },
     "node_modules/nodemailer": {
-      "version": "9.1.1",
+      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-10.0.0.tgz",
-      "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==",
+      "integrity": "sha512-wdv+hXBg0iIPIOf108FaZyTxqjQpCvQeAJt9pHHTooPy/y3vQtI9eiImM9AIVKR3e/0FeMA1oueNfBjFJcaK+Q==",
       "license": "MIT-0",
       "engines": {
-        "node": ">=6.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/showdown": {

package.json

@@ -5,7 +5,7 @@
   "dependencies": {
     "@actions/core": "^3.0.1",
     "@actions/glob": "^0.7.0",
-    "nodemailer": "^9.1.1",
+    "nodemailer": "^10.0.0",
     "showdown": "^2.1.0"
   }
 }