net-imap 0.5.1 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf511b8683c6931cf9ec2d3aa4a55ef634a2cc0e670590a4142d9895594b9191
-  data.tar.gz: db4ca0b7230553258e0d81a8a5b5cbed4273e30245200db661145ba430af20d0
+  metadata.gz: cdbdda0ed73da899ec338f66022a16104562d3701c568b0a6d4897270a608ac5
+  data.tar.gz: b6a7ec70776b32f8eb57d01a0869503eb5d76f719ac091eb92e0206608e936e9
 SHA512:
-  metadata.gz: b61a04c6992df7d6ffcf0e5396723966c3f3a5a1c6a596caf413c63d355100c8d2c28096a2261045d52ada4d8e995bba1c4f12864bf65fe1355c331df236eb85
-  data.tar.gz: 0bc68ec15c5d53f0f437eab5318bf8cdd428dcdc650a98f66e961658ed361b125e866db2d41954e50ce66de5ec143d108e9135f554bd240ff0d7057724d16416
+  metadata.gz: 381bf2428719ed8decb5d241fda0e19f28031dd4a77980b3717bb29c37bed1c927f00e5b57862e209ecf24b2e9b38c01088d6e1a90fc4b4cc026cdd9e6611100
+  data.tar.gz: 513c6a77d46b6d2cf67aea4511023acc76c69940e3b1a0d0eae7223b53ff63bc8e6e009f51fef826b09f76f6ad1d92e84243e8457f59d3912db7e74bf69d3d1b

data/Gemfile

@@ -8,6 +8,7 @@ gem "digest"
 gem "strscan"
 gem "base64"
 
+gem "irb"
 gem "rake"
 gem "rdoc"
 gem "test-unit"

data/README.md

@@ -1,7 +1,9 @@
 # Net::IMAP
 
 Net::IMAP implements Internet Message Access Protocol (IMAP) client
-functionality.  The protocol is described in [IMAP](https://tools.ietf.org/html/rfc3501).
+functionality.  The protocol is described in
+[RFC3501](https://www.rfc-editor.org/rfc/rfc3501),
+[RFC9051](https://www.rfc-editor.org/rfc/rfc9051) and various extensions.
 
 ## Installation
 
@@ -50,12 +52,16 @@ end
 
 ```ruby
 imap.select('Mail/sent-mail')
-if not imap.list('Mail/', 'sent-apr03')
+if imap.list('Mail/', 'sent-apr03').empty?
   imap.create('Mail/sent-apr03')
 end
 imap.search(["BEFORE", "30-Apr-2003", "SINCE", "1-Apr-2003"]).each do |message_id|
-  imap.copy(message_id, "Mail/sent-apr03")
-  imap.store(message_id, "+FLAGS", [:Deleted])
+  if imap.capable?(:move) || imap.capable?(:IMAP4rev2)
+    imap.move(message_id, "Mail/sent-apr03")
+  else
+    imap.copy(message_id, "Mail/sent-apr03")
+    imap.store(message_id, "+FLAGS", [:Deleted])
+  end
 end
 imap.expunge
 ```

data/docs/styles.css

@@ -1,24 +1,85 @@
 /* this is a work in progress. :) */
 
-main .method-header {
-  background: rgba(27,31,35,0.05);
-  border: 1px solid #6C8C22;
+/***********************************************
+ * Method descriptions
+ ***********************************************/
+
+main .method-detail {
+  display: grid;
+  grid-template-columns: 1fr auto;
+  justify-content: space-between;
+}
+
+main .method-header,
+main .method-controls,
+.attribute-method-heading {
   padding: 0.5em;
-  border-radius: 4px;
-  /* padding: 0 0.5em; */
-  /* border-width: 0 1px; */
-  /* border-color: #6C8C22; */
-  /* border-style: solid; */
+  /* border: 1px solid var(--highlight-color); */
+  background: var(--table-header-background-color);
+  line-height: 1.6;
+}
+
+.attribute-method-heading .attribute-access-type {
+  float: right;
+}
+
+main .method-header {
+  border-right: none;
+  border-radius: 4px 0 0 4px;
+}
+
+main .method-heading :any-link {
+  text-decoration: none;
+}
+
+main .method-controls {
+  border-left: none;
+  border-radius: 0 4px 4px 0;
 }
 
 main .method-description, main .aliases {
+  grid-column: 1 / span 2;
   padding-left: 1em;
 }
 
-body {
-  /*
-   * The default (300) can be too low contrast.  Also, many fonts don't
-   * distinguish between 300->400, so <em>...</em> had no effect.
-   */
-  font-weight: 400;
+@media (max-width: 700px) {
+  main .method-header, main .method-controls, main .method-description {
+    grid-column: 1 / span 2;
+    margin: 0;
+  }
+  main .method-controls {
+    background: none;
+  }
+}
+
+/***********************************************
+ * Description lists
+ ***********************************************/
+
+main dt {
+  margin-bottom: 0; /* override rdoc 6.8 */
+  float: unset;     /* override rdoc 6.8 */
+  line-height: 1.5; /* matches `main p` */
+}
+
+main dl.note-list dt {
+  margin-right: 1em;
+  float: left;
+}
+
+main dl.note-list dt:has(+ dt) {
+  margin-right: 0.25em;
+}
+
+main dl.note-list dt:has(+ dt)::after {
+  content: ', ';
+  font-weight: normal;
+}
+
+main dd {
+  margin: 0 0 1em 1em;
+}
+
+main dd p:first-child {
+  margin-top: 0;
 }

data/lib/net/imap/command_data.rb

@@ -3,6 +3,7 @@
 require "date"
 
 require_relative "errors"
+require_relative "data_lite"
 
 module Net
   class IMAP < Protocol
@@ -119,80 +120,85 @@ module Net
       put_string("\\" + symbol.to_s)
     end
 
-    class RawData # :nodoc:
+    CommandData = Data.define(:data) do # :nodoc:
       def send_data(imap, tag)
-        imap.__send__(:put_string, @data)
+        raise NoMethodError, "#{self.class} must implement #{__method__}"
       end
 
       def validate
       end
-
-      private
-
-      def initialize(data)
-        @data = data
-      end
     end
 
-    class Atom # :nodoc:
+    class RawData < CommandData # :nodoc:
       def send_data(imap, tag)
-        imap.__send__(:put_string, @data)
-      end
-
-      def validate
-      end
-
-      private
-
-      def initialize(data)
-        @data = data
+        imap.__send__(:put_string, data)
       end
     end
 
-    class QuotedString # :nodoc:
+    class Atom < CommandData # :nodoc:
       def send_data(imap, tag)
-        imap.__send__(:send_quoted_string, @data)
-      end
-
-      def validate
+        imap.__send__(:put_string, data)
       end
+    end
 
-      private
-
-      def initialize(data)
-        @data = data
+    class QuotedString < CommandData # :nodoc:
+      def send_data(imap, tag)
+        imap.__send__(:send_quoted_string, data)
       end
     end
 
-    class Literal # :nodoc:
+    class Literal < CommandData # :nodoc:
       def send_data(imap, tag)
-        imap.__send__(:send_literal, @data, tag)
+        imap.__send__(:send_literal, data, tag)
       end
+    end
 
-      def validate
+    class PartialRange < CommandData # :nodoc:
+      uint32_max = 2**32 - 1
+      POS_RANGE = 1..uint32_max
+      NEG_RANGE = -uint32_max..-1
+      Positive = ->{ (_1 in Range) and POS_RANGE.cover?(_1) }
+      Negative = ->{ (_1 in Range) and NEG_RANGE.cover?(_1) }
+
+      def initialize(data:)
+        min, max = case data
+        in Range
+          data.minmax.map { Integer _1 }
+        in ResponseParser::Patterns::PARTIAL_RANGE
+          data.split(":").map { Integer _1 }.minmax
+        else
+          raise ArgumentError, "invalid partial range input: %p" % [data]
+        end
+        data = min..max
+        unless data in Positive | Negative
+          raise ArgumentError, "invalid partial-range: %p" % [data]
+        end
+        super
+      rescue TypeError, RangeError
+        raise ArgumentError, "expected range min/max to be Integers"
       end
 
-      private
+      def formatted = "%d:%d" % data.minmax
 
-      def initialize(data)
-        @data = data
+      def send_data(imap, tag)
+        imap.__send__(:put_string, formatted)
       end
     end
 
     # *DEPRECATED*.  Replaced by SequenceSet.
-    class MessageSet # :nodoc:
+    class MessageSet < CommandData # :nodoc:
       def send_data(imap, tag)
-        imap.__send__(:put_string, format_internal(@data))
+        imap.__send__(:put_string, format_internal(data))
       end
 
       def validate
-        validate_internal(@data)
+        validate_internal(data)
       end
 
       private
 
-      def initialize(data)
-        @data = data
+      def initialize(data:)
+        super
         warn("DEPRECATED: #{MessageSet} should be replaced with #{SequenceSet}.",
              uplevel: 1, category: :deprecated)
         begin
@@ -246,22 +252,18 @@ module Net
       end
     end
 
-    class ClientID # :nodoc:
+    class ClientID < CommandData # :nodoc:
 
       def send_data(imap, tag)
-        imap.__send__(:send_data, format_internal(@data), tag)
+        imap.__send__(:send_data, format_internal(data), tag)
       end
 
       def validate
-        validate_internal(@data)
+        validate_internal(data)
       end
 
       private
 
-      def initialize(data)
-        @data = data
-      end
-
       def validate_internal(client_id)
         client_id.to_h.each do |k,v|
           unless StringFormatter.valid_string?(k)

data/lib/net/imap/config.rb

@@ -75,7 +75,7 @@ module Net
     #
     #   client = Net::IMAP.new(hostname, config: :future)
     #   client.config.sasl_ir                  # => true
-    #   client.config.responses_without_block  # => :raise
+    #   client.config.responses_without_block  # => :frozen_dup
     #
     # The versioned default configs inherit certain specific config options from
     # Config.global, for example #debug:
@@ -109,9 +109,11 @@ module Net
     # [+:future+]
     #   The _planned_ eventual config for some future +x.y+ version.
     #
-    # For example, to raise exceptions for all current deprecations:
+    # For example, to disable all currently deprecated behavior:
     #   client = Net::IMAP.new(hostname, config: :future)
-    #   client.responses  # raises an ArgumentError
+    #   client.config.response_without_args     # => :frozen_dup
+    #   client.responses.frozen?                # => true
+    #   client.responses.values.all?(&:frozen?) # => true
     #
     # == Thread Safety
     #
@@ -285,6 +287,67 @@ module Net
       #
       # Alias for responses_without_block
 
+      # Whether ResponseParser should use the deprecated UIDPlusData or
+      # CopyUIDData for +COPYUID+ response codes, and UIDPlusData or
+      # AppendUIDData for +APPENDUID+ response codes.
+      #
+      # UIDPlusData stores its data in arrays of numbers, which is vulnerable to
+      # a memory exhaustion denial of service attack from an untrusted or
+      # compromised server.  Set this option to +false+ to completely block this
+      # vulnerability.  Otherwise, parser_max_deprecated_uidplus_data_size
+      # mitigates this vulnerability.
+      #
+      # AppendUIDData and CopyUIDData are _mostly_ backward-compatible with
+      # UIDPlusData.  Most applications should be able to upgrade with little
+      # or no changes.
+      #
+      # <em>(Parser support for +UIDPLUS+ added in +v0.3.2+.)</em>
+      #
+      # <em>(Config option added in +v0.4.19+ and +v0.5.6+.)</em>
+      #
+      # <em>UIDPlusData will be removed in +v0.6+ and this config setting will
+      # be ignored.</em>
+      #
+      # ==== Valid options
+      #
+      # [+true+ <em>(original default)</em>]
+      #    ResponseParser only uses UIDPlusData.
+      #
+      # [+:up_to_max_size+ <em>(default since +v0.5.6+)</em>]
+      #    ResponseParser uses UIDPlusData when the +uid-set+ size is below
+      #    parser_max_deprecated_uidplus_data_size.  Above that size,
+      #    ResponseParser uses AppendUIDData or CopyUIDData.
+      #
+      # [+false+ <em>(planned default for +v0.6+)</em>]
+      #    ResponseParser _only_ uses AppendUIDData and CopyUIDData.
+      attr_accessor :parser_use_deprecated_uidplus_data, type: [
+        true, :up_to_max_size, false
+      ]
+
+      # The maximum +uid-set+ size that ResponseParser will parse into
+      # deprecated UIDPlusData.  This limit only applies when
+      # parser_use_deprecated_uidplus_data is not +false+.
+      #
+      # <em>(Parser support for +UIDPLUS+ added in +v0.3.2+.)</em>
+      #
+      # <em>Support for limiting UIDPlusData to a maximum size was added in
+      # +v0.3.8+, +v0.4.19+, and +v0.5.6+.</em>
+      #
+      # <em>UIDPlusData will be removed in +v0.6+.</em>
+      #
+      # ==== Versioned Defaults
+      #
+      # Because this limit guards against a remote server causing catastrophic
+      # memory exhaustion, the versioned default (used by #load_defaults) also
+      # applies to versions without the feature.
+      #
+      # * +0.3+ and prior: <tt>10,000</tt>
+      # * +0.4+: <tt>1,000</tt>
+      # * +0.5+: <tt>100</tt>
+      # * +0.6+: <tt>0</tt>
+      #
+      attr_accessor :parser_max_deprecated_uidplus_data_size, type: Integer
+
       # Creates a new config object and initialize its attribute with +attrs+.
       #
       # If +parent+ is not given, the global config is used by default.
@@ -365,6 +428,8 @@ module Net
         sasl_ir: true,
         enforce_logindisabled: true,
         responses_without_block: :warn,
+        parser_use_deprecated_uidplus_data: :up_to_max_size,
+        parser_max_deprecated_uidplus_data_size: 100,
       ).freeze
 
       @global = default.new
@@ -376,6 +441,8 @@ module Net
         sasl_ir: false,
         responses_without_block: :silence_deprecation_warning,
         enforce_logindisabled: false,
+        parser_use_deprecated_uidplus_data: true,
+        parser_max_deprecated_uidplus_data_size: 10_000,
       ).freeze
       version_defaults[0.0] = Config[0]
       version_defaults[0.1] = Config[0]
@@ -384,12 +451,15 @@ module Net
 
       version_defaults[0.4] = Config[0.3].dup.update(
         sasl_ir: true,
+        parser_max_deprecated_uidplus_data_size: 1000,
       ).freeze
 
       version_defaults[0.5] = Config[:current]
 
       version_defaults[0.6] = Config[0.5].dup.update(
         responses_without_block: :frozen_dup,
+        parser_use_deprecated_uidplus_data: false,
+        parser_max_deprecated_uidplus_data_size: 0,
       ).freeze
       version_defaults[:next] = Config[0.6]
       version_defaults[:future] = Config[:next]

data/lib/net/imap/data_lite.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+# Some of the code in this file was copied from the polyfill-data gem.
+#
+# MIT License
+#
+# Copyright (c) 2023 Jim Gay, Joel Drapper, Nicholas Evans
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+
+module Net
+  class IMAP
+    data_or_object = RUBY_VERSION >= "3.2.0" ? ::Data : Object
+    class DataLite < data_or_object
+      def encode_with(coder) coder.map = to_h.transform_keys(&:to_s)        end
+      def init_with(coder) initialize(**coder.map.transform_keys(&:to_sym)) end
+    end
+
+    Data = DataLite
+  end
+end
+
+# :nocov:
+# Need to skip test coverage for the rest, because it isn't loaded by ruby 3.2+.
+return if RUBY_VERSION >= "3.2.0"
+
+module Net
+  class IMAP
+    # DataLite is a temporary substitute for ruby 3.2's +Data+ class.  DataLite
+    # is aliased as Net::IMAP::Data, so that code using it won't need to be
+    # updated when it is removed.
+    #
+    # See {ruby 3.2's documentation for Data}[https://docs.ruby-lang.org/en/3.2/Data.html].
+    #
+    # [When running ruby 3.1]
+    #    This class reimplements the API for ruby 3.2's +Data+, and should be
+    #    compatible for nearly all use-cases.  This reimplementation <em>will be
+    #    removed</em> in +net-imap+ 0.6, when support for ruby 3.1 is dropped.
+    #
+    #    _NOTE:_ +net-imap+ no longer supports ruby versions prior to 3.1.
+    # [When running ruby >= 3.2]
+    #    This class inherits from +Data+ and _only_ defines the methods needed
+    #    for YAML serialization.  This will be dropped when +psych+ adds support
+    #    for +Data+.
+    #
+    # Some of the code in this class was copied or adapted from the
+    # {polyfill-data gem}[https://rubygems.org/gems/polyfill-data], by Jim Gay
+    # and Joel Drapper, under the MIT license terms.
+    class DataLite
+      singleton_class.undef_method :new
+
+      TYPE_ERROR    = "%p is not a symbol nor a string"
+      ATTRSET_ERROR = "invalid data member: %p"
+      DUP_ERROR     = "duplicate member: %p"
+      ARITY_ERROR   = "wrong number of arguments (given %d, expected %s)"
+      private_constant :TYPE_ERROR, :ATTRSET_ERROR, :DUP_ERROR, :ARITY_ERROR
+
+      # Defines a new Data class.
+      #
+      # _NOTE:_ Unlike ruby 3.2's +Data.define+, DataLite.define only supports
+      # member names which are valid local variable names.  Member names can't
+      # be keywords (e.g: +next+ or +class+) or start with capital letters, "@",
+      # etc.
+      def self.define(*args, &block)
+        members = args.each_with_object({}) do |arg, members|
+          arg = arg.to_str unless arg in Symbol | String if arg.respond_to?(:to_str)
+          arg = arg.to_sym if     arg in String
+          arg in Symbol     or  raise TypeError,     TYPE_ERROR    % [arg]
+          arg in %r{=}      and raise ArgumentError, ATTRSET_ERROR % [arg]
+          members.key?(arg) and raise ArgumentError, DUP_ERROR     % [arg]
+          members[arg] = true
+        end
+        members = members.keys.freeze
+
+        klass = ::Class.new(self)
+
+        klass.singleton_class.undef_method :define
+        klass.define_singleton_method(:members) { members }
+
+        def klass.new(*args, **kwargs, &block)
+          if kwargs.size.positive?
+            if args.size.positive?
+              raise ArgumentError, ARITY_ERROR % [args.size, 0]
+            end
+          elsif members.size < args.size
+            expected = members.size.zero? ? 0 : 0..members.size
+            raise ArgumentError, ARITY_ERROR % [args.size, expected]
+          else
+            kwargs = Hash[members.take(args.size).zip(args)]
+          end
+          allocate.tap do |instance|
+            instance.__send__(:initialize, **kwargs, &block)
+          end.freeze
+        end
+
+        klass.singleton_class.alias_method :[], :new
+        klass.attr_reader(*members)
+
+        # Dynamically defined initializer methods are in an included module,
+        # rather than directly on DataLite (like in ruby 3.2+):
+        # * simpler to handle required kwarg ArgumentErrors
+        # * easier to ensure consistent ivar assignment order (object shape)
+        # * faster than instance_variable_set
+        klass.include(Module.new do
+          if members.any?
+            kwargs = members.map{"#{_1.name}:"}.join(", ")
+            params = members.map(&:name).join(", ")
+            ivars  = members.map{"@#{_1.name}"}.join(", ")
+            attrs  = members.map{"attrs[:#{_1.name}]"}.join(", ")
+            module_eval <<~RUBY, __FILE__, __LINE__ + 1
+              protected
+              def initialize(#{kwargs}) #{ivars} = #{params}; freeze end
+              def marshal_load(attrs)   #{ivars} = #{attrs};  freeze end
+            RUBY
+          end
+        end)
+
+        klass.module_eval do _1.module_eval(&block) end if block_given?
+
+        klass
+      end
+
+      ##
+      # singleton-method: new
+      # call-seq:
+      #   new(*args) -> instance
+      #   new(**kwargs) -> instance
+      #
+      # Constuctor for classes defined with ::define.
+      #
+      # Aliased as ::[].
+
+      ##
+      # singleton-method: []
+      # call-seq:
+      #   ::[](*args) -> instance
+      #   ::[](**kwargs) -> instance
+      #
+      # Constuctor for classes defined with ::define.
+      #
+      # Alias for ::new
+
+      ##
+      def members;     self.class.members                              end
+      def to_h(&block) block ? __to_h__.to_h(&block) : __to_h__        end
+      def hash;        [self.class, __to_h__].hash                     end
+      def ==(other)    self.class == other.class && to_h == other.to_h end
+      def eql?(other)  self.class == other.class && hash == other.hash end
+      def deconstruct; __to_h__.values                                 end
+
+      def deconstruct_keys(keys)
+        raise TypeError unless keys.is_a?(Array) || keys.nil?
+        return __to_h__ if keys&.first.nil?
+        __to_h__.slice(*keys)
+      end
+
+      def with(**kwargs)
+        return self if kwargs.empty?
+        self.class.new(**__to_h__.merge(kwargs))
+      end
+
+      def inspect
+        __inspect_guard__(self) do |seen|
+          return "#<data #{self.class}:...>" if seen
+          attrs = __to_h__.map {|kv| "%s=%p" % kv }.join(", ")
+          display = ["data", self.class.name, attrs].compact.join(" ")
+          "#<#{display}>"
+        end
+      end
+      alias_method :to_s, :inspect
+
+      private
+
+      def initialize_copy(source) super.freeze end
+      def marshal_dump; __to_h__ end
+
+      def __to_h__; Hash[members.map {|m| [m, send(m)] }] end
+
+      # Yields +true+ if +obj+ has been seen already, +false+ if it hasn't.
+      # Marks +obj+ as seen inside the block, so circuler references don't
+      # recursively trigger a SystemStackError (stack level too deep).
+      #
+      # Making circular references inside a Data object _should_ be very
+      # uncommon, but we'll support them for the sake of completeness.
+      def __inspect_guard__(obj)
+        preexisting = Thread.current[:__net_imap_data__inspect__]
+        Thread.current[:__net_imap_data__inspect__] ||= {}.compare_by_identity
+        inspect_guard = Thread.current[:__net_imap_data__inspect__]
+        if inspect_guard.include?(obj)
+          yield true
+        else
+          begin
+            inspect_guard[obj] = true
+            yield false
+          ensure
+            inspect_guard.delete(obj)
+          end
+        end
+      ensure
+        unless preexisting.equal?(inspect_guard)
+          Thread.current[:__net_imap_data__inspect__] = preexisting
+        end
+      end
+
+    end
+
+  end
+end
+# :nocov: