Unleash / unleash / 34299312815

87%

master: 91%

push

github

chore(deps): update dependency nodemailer to v9.1.1 [security] (#12630)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [nodemailer](https://nodemailer.com/)
([source](https://redirect.github.com/nodemailer/nodemailer)) | [`9.0.6`
→ `9.1.1`](https://renovatebot.com/diffs/npm/nodemailer/9.0.6/9.1.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/nodemailer/9.1.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nodemailer/9.0.6/9.1.1?slim=true)
|

---

### Nodemailer: resolveContent() on a MailMessage bypasses
disableFileAccess/disableUrlAccess when called with the legacy signature

[GHSA-8m3c-c648-2xjj](https://redirect.github.com/advisories/GHSA-8m3c-c648-2xjj)

<details>
<summary>More information</summary>

#### Details
##### Summary

Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a
security sandbox that lets an application forbid untrusted message
content (`html`/`text`/attachment `path`/`href`) from reading local
files or making outbound HTTP(S) requests. The fix for
GHSA-wqvq-jvpq-h66f (commit `5f69497`) threaded these flags through the
library's internal resolution paths (`MailMessage.resolveAll()` and
`_convertDataImages()`), but the public plugin API
`MailMessage.resolveContent(...args)`
(`lib/mailer/mail-message.js:41-43`) remains a raw passthrough to
`shared.resolveContent()`.

When called with the documented legacy signature
`mail.resolveContent(data, key, callback)`, `shared.resolveContent`
normalizes the missing options argument to an empty object (`options =
options || {}`, `lib/shared/index.js:530`). The message-level flags that
the `MailMessage` constructor already copied into `mail.data`
(`lib/mailer/mail-message.js:34-38`) are silently discarded, so
`resolveContentValue` skips both access-control guards and reaches
`nmfetc... (continued)

3966 of 5171 branches covered (76.7%)

16179 of 18520 relevant lines covered (87.36%)

834.73 hits per line