`verification/e2e-proof.json`

58 lines
{
  "intent": "Remediate GHSA-p6gq-j5cr-w38f without changing George's send-with-attachment MIME behavior",
  "risk_tier": "R1",
  "environment": "local dependency and streamTransport only; no George process, Gmail API, draft/send, PM2, deploy, production write, or remote push",
  "baseline_commit": "9cfb00ae972c9d65dfa67644031a77eec0ccf641",
  "timestamp": "2026-08-28T21:29:08-07:00",
  "ticket": "TK-10946-remediate-nodemailer-ghsa-p6gq-j5cr-w38f",
  "commands": [
    "npm test",
    "node --check server.js",
    "node --check lib/attachment-mime.js",
    "node --check test/nodemailer-security.test.js",
    "npm audit --omit=dev --audit-level=high",
    "git diff --check"
  ],
  "assertions": [
    {
      "boundary": "dependency advisory",
      "verdict": "PASS",
      "evidence": "package and lockfile resolve exact nodemailer 9.0.6; fresh npm audit reports 0 vulnerabilities"
    },
    {
      "boundary": "production usage",
      "verdict": "PASS",
      "evidence": "send-with-attachment continues to map caller content_base64 into in-memory Buffer attachments; production now calls the tested buildAttachmentMime helper with disableFileAccess and disableUrlAccess forced true"
    },
    {
      "boundary": "MIME compatibility",
      "verdict": "PASS",
      "evidence": "hermetic production-helper test generated multipart/mixed MIME with UTF-8 subject, expected addressing, filename, content type, and exact base64 attachment bytes"
    },
    {
      "boundary": "file and URL access controls",
      "verdict": "PASS",
      "evidence": "the production helper rejected html.path and raw.path with EFILEACCESS, and html.href and raw.href with EURLACCESS; loopback URL targets were never contacted"
    },
    {
      "boundary": "existing compliance behavior",
      "verdict": "PASS",
      "evidence": "the complete existing send-preflight suite still passes"
    },
    {
      "boundary": "side effects",
      "verdict": "PASS",
      "evidence": "tests used streamTransport buffers only; no Gmail client, live service, account, network URL, or persistent message state was touched"
    }
  ],
  "negative_checks": [
    "filesystem-backed HTML body",
    "URL-backed HTML body targeting loopback",
    "message-level raw filesystem input from the advisory",
    "message-level raw URL input from the advisory"
  ],
  "cleanup": "No server or external fixture was started; generated MIME remained in process memory and exited with the test process",
  "residual_risk": "Nodemailer remains a direct security-sensitive dependency; keep the exact patched pin and re-run npm audit during future upgrades",
  "verdict": "PASS"
}