imapflow 1.0.185 → 1.0.186

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.0.186](https://github.com/postalsys/imapflow/compare/v1.0.185...v1.0.186) (2025-04-20)
+
+
+### Bug Fixes
+
+* **parsing:** Limit the depth of nested input ([c6cd7ce](https://github.com/postalsys/imapflow/commit/c6cd7cef9f9b8a1ff137a08e8aebf2555e596a23))
+
 ## [1.0.185](https://github.com/postalsys/imapflow/compare/v1.0.184...v1.0.185) (2025-04-14)
 
 

package/lib/commands/append.js

@@ -9,6 +9,10 @@ module.exports = async (connection, destination, content, flags, idate) => {
         return;
     }
 
+    if (typeof content === 'string') {
+        content = Buffer.from(content);
+    }
+
     if (connection.capabilities.has('APPENDLIMIT')) {
         let appendLimit = connection.capabilities.get('APPENDLIMIT');
         if (typeof appendLimit === 'number' && appendLimit < content.length) {
@@ -40,9 +44,6 @@ module.exports = async (connection, destination, content, flags, idate) => {
 
     let isLiteral8 = false;
     if (connection.capabilities.has('BINARY') && !connection.disableBinary) {
-        if (typeof content === 'string') {
-            content = Buffer.from(content);
-        }
         // Value is literal8 if it contains NULL bytes. The server must support the BINARY extension
         // and if it does not then send the value as a regular literal and hope for the best
         isLiteral8 = content.indexOf(Buffer.from([0])) >= 0;

package/lib/handler/token-parser.js

@@ -15,6 +15,8 @@ const STATE_TEXT = 0x007;
 const RE_DIGITS = /^\d+$/;
 const RE_SINGLE_DIGIT = /^\d$/;
 
+const MAX_NODE_DEPTH = 25;
+
 class TokenParser {
     constructor(parent, startPos, str, options) {
         this.str = (str || '').toString();
@@ -116,6 +118,16 @@ class TokenParser {
 
         if (parentNode) {
             node.parentNode = parentNode;
+            node.depth = parentNode.depth + 1;
+        } else {
+            node.depth = 0;
+        }
+
+        if (node.depth > MAX_NODE_DEPTH) {
+            let error = new Error('Too much nesting in IMAP string');
+            error.code = 'MAX_IMAP_NESTING_REACHED';
+            error._imapStr = this.str;
+            throw error;
         }
 
         if (typeof startPos === 'number') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.0.185",
+    "version": "1.0.186",
     "description": "IMAP Client for Node",
     "main": "./lib/imap-flow.js",
     "scripts": {

package/test/bodystructure-test.js

@@ -1125,8 +1125,6 @@ module.exports['Process non-standard unicode filename property'] = test => {
 
     let bodyStruct = parseBodystructure(attribute);
 
-    console.log(JSON.stringify(bodyStruct, false, 2));
-
     test.deepEqual(bodyStruct.childNodes[1].dispositionParameters.filename, 'Trang_ghi_âm (8) (1).xlsx');
     test.done();
 };

package/test/imap-parser-test.js

@@ -981,7 +981,6 @@ module.exports['IMAP Parser, NO with a dot'] = test =>
 module.exports['IMAP Parser, no tag or response (Exchange)'] = test =>
     asyncWrapper(test, async test => {
         let parsed = await parser('Server Unavailable. 15');
-        console.log(parsed);
         test.equal(parsed.command, 'BAD');
         test.deepEqual(parsed.attributes, [{ type: 'TEXT', value: 'Server Unavailable. 15' }]);
     });
@@ -1237,3 +1236,16 @@ module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
             ]
         ]);
     });
+
+module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
+    asyncWrapper(test, async test => {
+        try {
+            let parsed = await parser('* 1 FETCH (UID 1 (((((((((((((((((((((((((');
+            test.ok(!parsed);
+        } catch (err) {
+            test.ok(err);
+            if (err.code !== 'MAX_IMAP_NESTING_REACHED') {
+                throw err;
+            }
+        }
+    });