haraka / email-message / 23762987265

push

github

release 1.3.1 (#20)

Fixes
- header: prevent prototype pollution
  - belt: use Object.create instead of {}
  - suspenders: add guards for **proto**, constructor, and prototype
- header: switch from recursion to iteration in parser
  - prevents stack exhaustion vulnerabilities
- body: added max_mime_depth, default 100
- body: disallow empty boundaries

Changes
- dep(message-stream): update to v2
- test: added vulnerability test suite
- test: added additional test coverage
- test: ES2024, table driven

226 of 253 branches covered (89.33%)

Branch coverage included in aggregate %.

49 of 55 new or added lines in 2 files covered. (89.09%)

766 of 830 relevant lines covered (92.29%)

520.03 hits per line