imapflow 1.0.185 → 1.0.187

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.0.187](https://github.com/postalsys/imapflow/compare/v1.0.186...v1.0.187) (2025-05-20)
+
+
+### Bug Fixes
+
+* Bumped deps ([6efb9f6](https://github.com/postalsys/imapflow/commit/6efb9f6952ff1f17d80054edb3d46aa43d540756))
+
+## [1.0.186](https://github.com/postalsys/imapflow/compare/v1.0.185...v1.0.186) (2025-04-20)
+
+
+### Bug Fixes
+
+* **parsing:** Limit the depth of nested input ([c6cd7ce](https://github.com/postalsys/imapflow/commit/c6cd7cef9f9b8a1ff137a08e8aebf2555e596a23))
+
 ## [1.0.185](https://github.com/postalsys/imapflow/compare/v1.0.184...v1.0.185) (2025-04-14)
 
 

package/lib/commands/append.js

@@ -9,6 +9,10 @@ module.exports = async (connection, destination, content, flags, idate) => {
         return;
     }
 
+    if (typeof content === 'string') {
+        content = Buffer.from(content);
+    }
+
     if (connection.capabilities.has('APPENDLIMIT')) {
         let appendLimit = connection.capabilities.get('APPENDLIMIT');
         if (typeof appendLimit === 'number' && appendLimit < content.length) {
@@ -40,9 +44,6 @@ module.exports = async (connection, destination, content, flags, idate) => {
 
     let isLiteral8 = false;
     if (connection.capabilities.has('BINARY') && !connection.disableBinary) {
-        if (typeof content === 'string') {
-            content = Buffer.from(content);
-        }
         // Value is literal8 if it contains NULL bytes. The server must support the BINARY extension
         // and if it does not then send the value as a regular literal and hope for the best
         isLiteral8 = content.indexOf(Buffer.from([0])) >= 0;

package/lib/handler/token-parser.js

@@ -15,6 +15,8 @@ const STATE_TEXT = 0x007;
 const RE_DIGITS = /^\d+$/;
 const RE_SINGLE_DIGIT = /^\d$/;
 
+const MAX_NODE_DEPTH = 25;
+
 class TokenParser {
     constructor(parent, startPos, str, options) {
         this.str = (str || '').toString();
@@ -116,6 +118,16 @@ class TokenParser {
 
         if (parentNode) {
             node.parentNode = parentNode;
+            node.depth = parentNode.depth + 1;
+        } else {
+            node.depth = 0;
+        }
+
+        if (node.depth > MAX_NODE_DEPTH) {
+            let error = new Error('Too much nesting in IMAP string');
+            error.code = 'MAX_IMAP_NESTING_REACHED';
+            error._imapStr = this.str;
+            throw error;
         }
 
         if (typeof startPos === 'number') {

package/lib/imap-flow.js

@@ -1993,7 +1993,7 @@ class ImapFlow extends EventEmitter {
      * @property {String} [unKeyword] Matches messages that do not have the custom flag set
      * @property {Object.<string, Boolean|String>} [header] Matches messages with header key set if value is `true` (**NB!** not supported by all servers) or messages where header partially matches a string value
      * @property {SearchObject} [not] A {@link SearchObject} object. It must not match.
-     * @property {SearchObject[]} [or] An array of 2 or more {@link SearchObject} objects. At least on of these must match
+     * @property {SearchObject[]} [or] An array of 2 or more {@link SearchObject} objects. At least one of these must match
      */
 
     /**

package/lib/types.d.ts

@@ -905,7 +905,7 @@ declare type SequenceString = string;
  * @property [unKeyword] - Matches messages that do not have the custom flag set
  * @property [header] - Matches messages with header key set if value is `true` (**NB!** not supported by all servers) or messages where header partially matches a string value
  * @property [not] - A {@link SearchObject} object. It must not match.
- * @property [or] - An array of 2 or more {@link SearchObject} objects. At least on of these must match
+ * @property [or] - An array of 2 or more {@link SearchObject} objects. At least one of these must match
  */
 declare type SearchObject = {
     seq?: SequenceString;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.0.185",
+    "version": "1.0.187",
     "description": "IMAP Client for Node",
     "main": "./lib/imap-flow.js",
     "scripts": {
@@ -28,11 +28,11 @@
     },
     "homepage": "https://imapflow.com/",
     "devDependencies": {
-        "@babel/eslint-parser": "7.26.8",
-        "@babel/eslint-plugin": "7.25.9",
+        "@babel/eslint-parser": "7.27.1",
+        "@babel/eslint-plugin": "7.27.1",
         "@babel/plugin-syntax-class-properties": "7.12.13",
-        "@babel/preset-env": "7.26.9",
-        "@types/node": "22.13.10",
+        "@babel/preset-env": "7.27.2",
+        "@types/node": "22.15.19",
         "eslint": "8.57.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "9.1.0",
@@ -52,8 +52,8 @@
         "libmime": "5.3.6",
         "libqp": "2.1.1",
         "mailsplit": "5.4.3",
-        "nodemailer": "6.10.0",
-        "pino": "9.6.0",
+        "nodemailer": "7.0.3",
+        "pino": "9.7.0",
         "socks": "2.8.4"
     }
 }

package/test/bodystructure-test.js

@@ -1125,8 +1125,6 @@ module.exports['Process non-standard unicode filename property'] = test => {
 
     let bodyStruct = parseBodystructure(attribute);
 
-    console.log(JSON.stringify(bodyStruct, false, 2));
-
     test.deepEqual(bodyStruct.childNodes[1].dispositionParameters.filename, 'Trang_ghi_âm (8) (1).xlsx');
     test.done();
 };

package/test/imap-parser-test.js

@@ -981,7 +981,6 @@ module.exports['IMAP Parser, NO with a dot'] = test =>
 module.exports['IMAP Parser, no tag or response (Exchange)'] = test =>
     asyncWrapper(test, async test => {
         let parsed = await parser('Server Unavailable. 15');
-        console.log(parsed);
         test.equal(parsed.command, 'BAD');
         test.deepEqual(parsed.attributes, [{ type: 'TEXT', value: 'Server Unavailable. 15' }]);
     });
@@ -1237,3 +1236,16 @@ module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
             ]
         ]);
     });
+
+module.exports['IMAP Parser, FETCH with BODYSTRUCTURE'] = test =>
+    asyncWrapper(test, async test => {
+        try {
+            let parsed = await parser('* 1 FETCH (UID 1 (((((((((((((((((((((((((');
+            test.ok(!parsed);
+        } catch (err) {
+            test.ok(err);
+            if (err.code !== 'MAX_IMAP_NESTING_REACHED') {
+                throw err;
+            }
+        }
+    });