HTTP Header Injection

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 6.6.1 2021-05-23
+
+-   Fixed address formatting issue where newlines in an email address, if provided via address object, were not properly removed. Reported by tmazeika (#1289)
+
 ## 6.6.0 2021-04-28
 
 -   Added new option `newline` for MailComposer

@@ -9,7 +9,9 @@ const mailOptions = {
         from: 'Daemon <deamon@kreata.ee>',
         to: 'mailer@kreata.ee, Mailer <mailer2@kreata.ee>'
     },
-    text: 'Test\n 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ö\r\nsage',
+    text: `Alice was beginning to get very tired of sitting by her sister on the bank, and of having nothing to do: once or twice she had peeped into the book her sister was reading, but it had no pictures or conversations in it, 'and what is the use of a book,' thought Alice 'without pictures or conversations?'
+
+So she was considering in her own mind (as well as she could, for the hot day made her feel very sleepy and stupid), whether the pleasure of making a daisy-chain would be worth the trouble of getting up and picking the daisies, when suddenly a White Rabbit with pink eyes ran close by her.`,
     newline: '\r\n'
 };
 

@@ -1147,9 +1147,9 @@ class MimeNode {
                 address.address = this._normalizeAddress(address.address);
 
                 if (!address.name) {
-                    values.push(address.address);
+                    values.push(address.address.indexOf(' ') >= 0 ? `<${address.address}>` : `${address.address}`);
                 } else if (address.name) {
-                    values.push(this._encodeAddressName(address.name) + ' <' + address.address + '>');
+                    values.push(`${this._encodeAddressName(address.name)} <${address.address}>`);
                 }
 
                 if (address.address) {
@@ -1158,9 +1158,8 @@ class MimeNode {
                     }
                 }
             } else if (address.group) {
-                values.push(
-                    this._encodeAddressName(address.name) + ':' + (address.group.length ? this._convertAddresses(address.group, uniqueList) : '').trim() + ';'
-                );
+                let groupListAddresses = (address.group.length ? this._convertAddresses(address.group, uniqueList) : '').trim();
+                values.push(`${this._encodeAddressName(address.name)}:${groupListAddresses};`);
             }
         });
 
@@ -1174,13 +1173,17 @@ class MimeNode {
      * @return {String} address string
      */
     _normalizeAddress(address) {
-        address = (address || '').toString().trim();
+        address = (address || '')
+            .toString()
+            .replace(/[\x00-\x1F<>]+/g, ' ') // remove unallowed characters
+            .trim();
 
         let lastAt = address.lastIndexOf('@');
         if (lastAt < 0) {
             // Bare username
             return address;
         }
+
         let user = address.substr(0, lastAt);
         let domain = address.substr(lastAt + 1);
 
@@ -1189,7 +1192,24 @@ class MimeNode {
         // 'jõgeva.ee' will be converted to 'xn--jgeva-dua.ee'
         // non-unicode domains are left as is
 
-        return user + '@' + punycode.toASCII(domain.toLowerCase());
+        let encodedDomain;
+
+        try {
+            encodedDomain = punycode.toASCII(domain.toLowerCase());
+        } catch (err) {
+            // keep as is?
+        }
+
+        if (user.indexOf(' ') >= 0) {
+            if (user.charAt(0) !== '"') {
+                user = '"' + user;
+            }
+            if (user.substr(-1) !== '"') {
+                user = user + '"';
+            }
+        }
+
+        return `${user}@${encodedDomain}`;
     }
 
     /**

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "6.6.0",
+    "version": "6.6.1",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "main": "lib/nodemailer.js",
     "scripts": {
@@ -31,7 +31,7 @@
         "libbase64": "1.2.1",
         "libmime": "5.0.0",
         "libqp": "1.1.0",
-        "mocha": "8.3.2",
+        "mocha": "8.4.0",
         "nodemailer-ntlm-auth": "1.0.1",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",

@@ -4,7 +4,7 @@ node_js:
     - 10
     - 12
     - 14
-    - 15
+    - 16
 notifications:
     email:
         - andris@kreata.ee