fix(mime-node): keep control chars out of header values and msg-id headers

A header field carries VCHAR and WSP only, but every C0 control character and
DEL went out raw in Subject, in any header set through the headers option, in
Message-ID, In-Reply-To, Content-Id and References, and in a List-* url. CR
and LF were already stripped, so nothing crossed a header boundary, but the
emitted header was not one an rfc5322 parser accepts.

The treatment differs by grammar. An unstructured value is forced into the
mime encoded word that a non-ascii value would get anyway, which is what the
new _encodeHeaderText does. A msg-id and a url are structured, an encoded word
inside the angle brackets would be read back as literal text, so there the
characters are dropped instead.

HT is left alone throughout. It is valid folding whitespace in a header value,
and it separates the ids of an unfolded References header, so stripping it
merged them into one unusable token.

Stripping can make a scheme match that did not before, eg ht<NUL>tps://host
now resolves to https://host. The allowlist in _formatListUrl is unchanged and
still prefixes anything outside https, http, mailto and ftp, so a caller can
not reach a scheme this way that a plain url could not already reach.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bYRfSN3MWR2St9WLuPeXA

Author: andris9

lib/mailer/mail-message.js

@@ -310,7 +310,9 @@ class MailMessage {
     }
 
     _formatListUrl(url) {
-        url = url.replace(/[\s<]+|[\s>]+/g, '');
+        // a url has no way to carry a control char or DEL, and the angle brackets around it
+        // are not a quoting construct, so anything left here lands in the header raw
+        url = url.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '').replace(/[\s<]+|[\s>]+/g, '');
         if (/^(https?|mailto|ftp):/.test(url)) {
             return '<' + url + '>';
         }

lib/mime-node/index.js

@@ -1121,7 +1121,13 @@ class MimeNode {
             case 'Message-ID':
             case 'In-Reply-To':
             case 'Content-Id':
-                value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
+                // a msg-id is structured, so an encoded word inside the angle brackets would
+                // be read as literal text. drop the characters that can not appear in a header
+                // at all, but leave HT alone, it separates the ids of a multi id value
+                value = (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
 
                 if (value.charAt(0) !== '<') {
                     value = '<' + value;
@@ -1141,6 +1147,7 @@ class MimeNode {
                             elm = (elm || '')
                                 .toString()
                                 .replace(/\r?\n|\r/g, ' ')
+                                .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                                 .trim();
                             return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
                         })
@@ -1163,7 +1170,7 @@ class MimeNode {
                 }
 
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
 
             case 'Content-Type':
             case 'Content-Disposition':
@@ -1172,8 +1179,7 @@ class MimeNode {
 
             default:
                 value = (value || '').toString().replace(/\r?\n|\r/g, ' ');
-                // encodeWords only encodes if needed, otherwise the original string is returned
-                return this._encodeWords(value);
+                return this._encodeHeaderText(value);
         }
     }
 
@@ -1278,6 +1284,21 @@ class MimeNode {
         return name;
     }
 
+    /**
+     * Encodes an unstructured header value. Such a value can only carry VCHAR and WSP, so a
+     * control char or DEL has to be forced into the mime encoded word that a non-ascii value
+     * would get anyway. HT stays as it is, it is valid folding whitespace here.
+     *
+     * @param {String} value Header value to encode
+     * @returns {String} Mime word encoded string if needed
+     */
+    _encodeHeaderText(value) {
+        return /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(value)
+            ? mimeFuncs.encodeWord(value, this._getTextEncoding(value), 52)
+            : // encodeWords only encodes if needed, otherwise the original string is returned
+              this._encodeWords(value);
+    }
+
     /**
      * If needed, mime encodes the name part
      *

test/mime-node/mime-node-test.js

@@ -657,6 +657,26 @@ describe('MimeNode Tests', { timeout: 50 * 1000 }, () => {
             });
         });
 
+        it('should not leave a control char anywhere in the headers', (t, done) => {
+            // a header carries VCHAR and WSP only. every field below used to pass these through
+            let mb = new MimeNode('text/plain')
+                .setHeader({
+                    subject: 'in\x01voice',
+                    'x-custom': 'a\x7fb',
+                    'message-id': '<a\x01b@example.test>',
+                    'in-reply-to': '<c\x1bd@example.test>',
+                    references: '<e\x00f@example.test>'
+                })
+                .setContent('x');
+
+            mb.build((err, msg) => {
+                assert.ok(!err);
+                const headers = msg.toString().split('\r\n\r\n')[0];
+                assert.strictEqual(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(headers), false);
+                done();
+            });
+        });
+
         it('should encode filename with a tab', (t, done) => {
             let mb = new MimeNode('application/pdf', {
                 filename: 'in\tvoice.pdf'
@@ -1376,17 +1396,50 @@ describe('MimeNode Tests', { timeout: 50 * 1000 }, () => {
             assert.strictEqual(mb._encodeHeaderValue('x-my', 'test jõgeva value'), '=?UTF-8?Q?test_j=C3=B5geva_value?=');
         });
 
+        it('should encode a control char', () => {
+            // a header value can only carry VCHAR and WSP, so these have to become an encoded word
+            let mb = new MimeNode();
+            assert.strictEqual(mb._encodeHeaderValue('x-my', 'in\x01voice'), '=?UTF-8?Q?in=01voice?=');
+            assert.strictEqual(mb._encodeHeaderValue('x-my', 'a\x7fb'), '=?UTF-8?Q?a=7Fb?=');
+        });
+
+        it('should keep a tab in a header value', () => {
+            // HT is valid folding whitespace here, unlike in a header parameter
+            let mb = new MimeNode();
+            assert.strictEqual(mb._encodeHeaderValue('x-my', 'a\tb'), 'a\tb');
+        });
+
         it('should format references', () => {
             let mb = new MimeNode();
             assert.strictEqual(mb._encodeHeaderValue('references', 'abc def'), '<abc> <def>');
             assert.strictEqual(mb._encodeHeaderValue('references', ['abc', 'def']), '<abc> <def>');
         });
 
+        it('should strip control chars from references', () => {
+            // a msg-id is structured, an encoded word inside the brackets would be literal text
+            let mb = new MimeNode();
+            assert.strictEqual(mb._encodeHeaderValue('references', 'a\x00b c\x7fd'), '<ab> <cd>');
+        });
+
+        it('should keep tab separated references apart', () => {
+            // HT separates the ids of an unfolded References header, so stripping it would
+            // merge them into a single unusable token
+            let mb = new MimeNode();
+            assert.strictEqual(mb._encodeHeaderValue('references', '<a@x.test>\t<b@x.test>'), '<a@x.test> <b@x.test>');
+            assert.strictEqual(mb._encodeHeaderValue('in-reply-to', '<a@x.test>\t<b@x.test>'), '<a@x.test>\t<b@x.test>');
+        });
+
         it('should format message-id', () => {
             let mb = new MimeNode();
             assert.strictEqual(mb._encodeHeaderValue('message-id', 'abc'), '<abc>');
         });
 
+        it('should strip control chars from message-id', () => {
+            let mb = new MimeNode();
+            assert.strictEqual(mb._encodeHeaderValue('message-id', 'a\x01b'), '<ab>');
+            assert.strictEqual(mb._encodeHeaderValue('in-reply-to', 'c\x1bd'), '<cd>');
+        });
+
         it('should format addresses', () => {
             let mb = new MimeNode();
             assert.strictEqual(

test/nodemailer/list-headers-test.js

@@ -172,6 +172,21 @@ describe('List-* header comment CRLF injection', () => {
             assert.strictEqual(await listIdValue('a\x7fb'), 'List-ID: =?UTF-8?Q?a=7Fb?= <mylist.example.test>');
             assert.strictEqual(await listUrlValue('a\x7fb'), 'List-Unsubscribe: <https://example.test/u> (=?UTF-8?Q?a=7Fb?=)');
         });
+
+        it('should strip control chars from a List-* url', async () => {
+            // the angle brackets around a url are not a quoting construct and a url has no
+            // way to carry these, so anything left here would land in the header raw
+            const raw = await send({
+                from: 'sender@example.test',
+                to: 'recipient@example.test',
+                subject: 'list unsubscribe',
+                list: { unsubscribe: { url: 'https://example.test/u\x01n\x7fsub' } },
+                text: 'body'
+            });
+
+            const line = raw.split('\r\n').find(l => /^List-Unsubscribe:/i.test(l));
+            assert.strictEqual(line, 'List-Unsubscribe: <https://example.test/unsub>');
+        });
     });
 
     it('should keep a benign comment intact in the List-* header', async () => {