net-imap 0.3.9 → 0.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac3c48a5e014382d7b05eda0c632b7924829fba35358881aca99cd88e36efe05
-  data.tar.gz: 73750ad71a15a08cbab8a92ff3630ada6dbbe804af3a3981f4e65298a64e101b
+  metadata.gz: cb2a06dab230abb1358956fd53b2bdf4235a5443ab81d2e4d95df1d253fb4618
+  data.tar.gz: df7e4bf879551b5dfde3affca7c391d8fb2b2d6457247bb06567c4500e7c4a81
 SHA512:
-  metadata.gz: c1ba773bd3cc8dcd540e0c7c5ef7d63135191486660e1b5507921ed6954adb280f871a0d874838b4ef5c26d9f6d2f33d78931be7e7fd8ac8a381408a3666d1fe
-  data.tar.gz: 31c372f84bf66cb056a2933f85c2be65695f19b099ac119b5ee943e9d70d24c439d446af5b020cbe8cd4d961efd336d858e190f9b6e1a711571cf101603a0ff8
+  metadata.gz: 180b80a10c10cb1bfc5267e665d256b7c551260cc7069ecebfeaa0673f1a09b552284f506e0b25e3dbd9bbb75a0d5bf9501c8428ba3a645ff163326cf2215a82
+  data.tar.gz: b7f47f69d736ba0586d910154d2a94981d12ddcf5db9f95b4ec9d4909d463405ee09c3073dc7060825d66e028edbe269138d41697faa99a09128750b13455f6c

data/Gemfile

@@ -5,5 +5,5 @@ source "https://rubygems.org"
 gemspec
 
 gem "rake"
-gem "rdoc"
+gem "rdoc", "<7.2" # incompatible with ruby 2.6
 gem "test-unit"

data/lib/net/imap/errors.rb

@@ -81,7 +81,27 @@ module Net
     class ByeResponseError < ResponseError
     end
 
+    # Error raised when the server sends an invalid response.
+    #
+    # This is different from UnknownResponseError: the response has been
+    # rejected.  Although it may be parsable, the server is forbidden from
+    # sending it in the current context.  The client should automatically
+    # disconnect, abruptly (without logout).
+    #
+    # Note that InvalidResponseError does not inherit from ResponseError: it
+    # can be raised before the response is fully parsed.  A related
+    # ResponseParseError or ResponseError may be the #cause.
+    class InvalidResponseError < Error
+    end
+
     # Error raised upon an unknown response from the server.
+    #
+    # This is different from InvalidResponseError: the response may be a
+    # valid extension response and the server may be allowed to send it in
+    # this context, but Net::IMAP either does not know how to parse it or
+    # how to handle it.  This could result from enabling unknown or
+    # unhandled extensions.  The connection may still be usable,
+    # but—depending on context—it may be prudent to disconnect.
     class UnknownResponseError < ResponseError
     end
 

data/lib/net/imap.rb

@@ -739,7 +739,7 @@ module Net
   # * {Character sets}[https://www.iana.org/assignments/character-sets/character-sets.xhtml]
   #
   class IMAP < Protocol
-    VERSION = "0.3.9"
+    VERSION = "0.3.10"
 
     autoload :ResponseReader, File.expand_path("imap/response_reader", __dir__)
 
@@ -1014,8 +1014,11 @@ module Net
     # unsolicited untagged response immeditely _after_ #starttls completes.
     #
     def starttls(options = {}, verify = true)
-      send_command("STARTTLS") do |resp|
+      handled = false
+      error = nil
+      ok = send_command("STARTTLS") do |resp|
         if resp.kind_of?(TaggedResponse) && resp.name == "OK"
+          handled = true
           begin
             # for backward compatibility
             certs = options.to_str
@@ -1024,7 +1027,21 @@ module Net
           end
           start_tls_session(options)
         end
+      rescue Exception => error
+        raise # note that the error backtrace is in the receiver_thread
       end
+      if error
+        disconnect
+        raise error
+      end
+      unless handled
+        disconnect
+        raise InvalidResponseError,
+              "STARTTLS handler was bypassed, although server responded %p" % [
+                ok.raw_data.chomp
+              ]
+      end
+      ok
     end
 
     # :call-seq:
@@ -2294,6 +2311,7 @@ module Net
           put_string(" ")
           send_data(i, tag)
         end
+        guard_against_tagged_response_skipping_handler!(tag)
         put_string(CRLF)
         if cmd == "LOGOUT"
           @logout_command_tag = tag
@@ -2309,6 +2327,17 @@ module Net
           end
         end
       end
+    rescue InvalidResponseError
+      disconnect
+      raise
+    end
+
+    def guard_against_tagged_response_skipping_handler!(tag)
+      return unless (resp = @tagged_responses[tag])&.name&.upcase == "OK"
+      raise(InvalidResponseError,
+            "Server sent tagged 'OK' before command was finished: %p. " \
+            "This could indicate a malicious server or client-side " \
+            "command injection. Disconnecting." % [resp.raw_data.chomp])
     end
 
     def generate_tag

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-imap
 version: !ruby/object:Gem::Version
-  version: 0.3.9
+  version: 0.3.10
 platform: ruby
 authors:
 - Shugo Maeda
@@ -129,7 +129,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.8
+rubygems_version: 4.0.3
 specification_version: 4
 summary: Ruby client api for Internet Message Access Protocol
 test_files: []